View | Details | Raw Unified | Return to bug 15540
Collapse All | Expand All

(-)a/debian/docs/koha-create.xml (+8 lines)
Lines 41-46 Link Here
41
      <arg><option>--sru-port</option> port</arg>
41
      <arg><option>--sru-port</option> port</arg>
42
      <arg><option>--upload-path</option> directory</arg>
42
      <arg><option>--upload-path</option> directory</arg>
43
      <arg><option>--letsencrypt</option></arg>
43
      <arg><option>--letsencrypt</option></arg>
44
      <arg><option>--tor</option></arg>
44
      <arg><option>--help</option>|<option>-h</option></arg>
45
      <arg><option>--help</option>|<option>-h</option></arg>
45
46
46
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
47
      <arg choice="req" rep="norepeat"><replaceable>instancename</replaceable></arg>
Lines 192-197 Link Here
192
    </varlistentry>
193
    </varlistentry>
193
194
194
    <varlistentry>
195
    <varlistentry>
196
      <term><option>--tor</option></term>
197
      <listitem>
198
        <para>Enable a Tor hidden service (.onion address) for the created instance.</para>
199
      </listitem>
200
    </varlistentry>
201
202
    <varlistentry>
195
      <term><option>--help</option>,<option>-h</option></term>
203
      <term><option>--help</option>,<option>-h</option></term>
196
      <listitem>
204
      <listitem>
197
        <para>Print usage information.</para>
205
        <para>Print usage information.</para>
(-)a/debian/scripts/koha-create (-2 / +173 lines)
Lines 72-77 Options: Link Here
72
  --upload-path dir         Set a user defined upload_path. It defaults to
72
  --upload-path dir         Set a user defined upload_path. It defaults to
73
                            /var/lib/koha/<instance>/uploads
73
                            /var/lib/koha/<instance>/uploads
74
  --letsencrypt             Set up a https-only site with letsencrypt certificates
74
  --letsencrypt             Set up a https-only site with letsencrypt certificates
75
  --tor                     Automatically set up a Tor hidden service for the OPAC
75
  --help,-h                 Show this help.
76
  --help,-h                 Show this help.
76
77
77
Note: the instance name cannot be longer that 11 chars.
78
Note: the instance name cannot be longer that 11 chars.
Lines 377-382 letsencrypt_instance() Link Here
377
    echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled
378
    echo -e "opacdomain=\"$opacdomain\"\nintradomain=\"$intradomain\"" > /var/lib/koha/$name/letsencrypt.enabled
378
    # restart apache with working certs
379
    # restart apache with working certs
379
    service apache2 restart
380
    service apache2 restart
381
382
tor_check_install()
383
{
384
    # Check if Tor is installed
385
386
    # Check if Tor is installed, otherwise do it now
387
    # Repeat for every instance. Do at the beginning so we can stop the installation if necessary.
388
    if [ $(dpkg-query -W -f='${Status}' tor 2>/dev/null | grep -c "ok installed") -eq 0 ]; then
389
        debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')"
390
        # Check if Tor repository for this version of GNU/Linux exists
391
        if [ $(curl -sI "http://deb.torproject.org/torproject.org/dists/$debrelease/" | grep -c "200 OK") -eq 0 ]; then
392
            die "Cannot find a Tor release for $debrelease in the official repository. Please install the 'tor' package manually to use the option --tor"
393
        else
394
            # Prompt before adding the official Tor repo and installing Tor
395
            read -r -p "Tor is not installed. Do you want Koha to automatically set up the Tor repository and install Tor? [y/N] " response
396
            if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
397
            then
398
                TORINSTALLATION="yes"
399
            else
400
                die "You need to install Tor to use the --tor option. Either accept or run koha-create without the --tor option."
401
            fi
402
        fi
403
    else
404
        if [ -e "/etc/tor/torrc-koha" ]; then
405
            TORINSTALLATION="previous"
406
        else
407
            TORINSTALLATION="manual"
408
            # Prompt to overwrite previous Tor config, otherwise stop installation
409
            read -r -p "Tor seems to be installed manually. Previous configuration file /etc/tor/torrc will be deleted! Continue? [y/N] " response
410
            if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]
411
            then
412
                rm -f /etc/tor/torrc
413
            else
414
                die "Please move your old configuration file /etc/tor/torrc and run koha-create again."
415
            fi
416
        fi
417
    fi
418
419
    # Is a key already present in the folder?
420
    if [ $(tor_check_instance $name) -eq 1 ]; then
421
        # Prompt to re-use previous key
422
        toroldonion="$(tor_get_onion $name)"
423
        read -r -p "There is a previous .onion key in the hidden service folder for instance $name. Do you want to overwrite it? Choose no to re-use the address $toroldonion. [y/N] " response
424
        if [[ $response =~ ^([yY][eE][sS]|[yY])$ ]]; then
425
            rm -Rf /var/lib/tor/koha/$name/
426
            toruseoldconfig="no"
427
        else
428
            toruseoldconfig="yes"
429
        fi
430
431
    fi
432
}
433
434
tor_check_instance()
435
{
436
    # Check if previous Tor hidden service folder exists and promt for re-use or deletion
437
    # Takes a Koha instance name as an argument
438
    if [ -e "/var/lib/tor/koha/$1/hidden_service/private_key" ]; then
439
        echo "1";
440
    else
441
        echo "0"
442
    fi
443
}
444
445
tor_install()
446
{
447
    # Install Tor from the official repository.
448
    # Only done once… I guess.
449
450
    echo "Installing Tor…"
451
    debrelease="$(lsb_release -c | sed 's|.*\W\(.*\)|\1|')"
452
    # Check if Tor repository is already in /etc/apt/sources.list.*
453
    if [ $(grep -rl "^deb http://deb.torproject.org/torproject.org" "/etc/apt/sources.list" "/etc/apt/sources.list.d/") != "" ]; then
454
        echo "deb http://deb.torproject.org/torproject.org $debrelease main" | tee -a /etc/apt/sources.list.d/tor.list
455
        gpg --keyserver keys.gnupg.net --recv 886DDD89
456
        gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -
457
        apt-get update
458
    fi
459
    apt-get install -y tor deb.torproject.org-keyring
460
    service tor stop
461
    # next: tor_config
462
}
463
464
tor_config()
465
{
466
    # Create Koha-specific Tor config, make backup of last config.
467
    # Called for every new instance
468
469
    # Check if /etc/tor/torrc-koha exists, if not create it now
470
    if [ ! -e "/etc/tor/torrc-koha" ]; then
471
        generate_config_file torrc.in \
472
            "/etc/tor/torrc-koha"
473
        rm -f /etc/tor/torrc # just in case
474
        ln -s /etc/tor/torrc-koha /etc/tor/torrc
475
        chown -R debian-tor:debian-tor /etc/tor/
476
    fi
477
    tor_instance
478
}
479
480
tor_instance() # FIXME there needs to be tor_remove in koha-remove to undo all this
481
{
482
    # Add config to Tor configuration file
483
    # Repeat for every instance.
484
    # FIXME should go to koha-tor or koha-functions?
485
486
    torconfig=`cat <<EOF
487
488
# begin instance koha-$name
489
HiddenServiceDir /var/lib/tor/koha/$name/hidden_service/
490
HiddenServicePort 80 127.0.0.1:80
491
# end instance koha-$name
492
493
EOF`
494
    echo "$torconfig" >> /etc/tor/torrc-koha
495
    # Create instance-specific Tor folder.
496
    # We put this in /var/lib/tor/koha/ to keep it out of Koha backups and safe from koha-remove.
497
    # FIXME Would it be better to have it in the backups?
498
    #
499
    # Re-use old .onion if desired
500
    if [ "$toruseoldconfig" != "yes" ]; then
501
        mkdir -p /var/lib/tor/koha/$name
502
    fi
503
    chown -R debian-tor:debian-tor /var/lib/tor/koha/
504
    # Start Tor with new settings
505
    service tor restart           # needs to be done after apache for this instance is started, or hostname won't be created
506
    # Get .onion address          # FIXME does this work instantly or should we wait a few seconds?
507
    onion="$(tor_get_onion $name)"
508
    torinfo=`cat <<EOF
509
Your .onion address is $onion.
510
If you already have another .onion address that you would like to re-use,
511
stop the tor service, copy the key to /var/lib/tor/koha/$name/hidden_service/private_key,
512
change the ServerAlias in /etc/apache2/sites/sites-available/$name.conf to your
513
old .onion address, restart Apache and restart Tor.
514
EOF` # FIXME Should this be done at the first check so we don't do all the installation?
515
    echo "$torinfo"
516
    # Write ServerAlias $onion to apache config and restart apache
517
    sed -i "s/__OPACTORHIDDENSERVICE__/$onion/g" "/etc/apache2/sites-available/$name.conf"
518
    sed -i "s:^\s*#\(.*\)#onion$: \1:" "/etc/apache2/sites-available/$name.conf"
519
    service apache2 reload
520
}
521
522
tor_get_onion()
523
{
524
    # Get .onion address of an instance
525
    # Repeat on demand.
526
    # FIXME should go to koha-tor or koha-functions?
527
528
    # This is useful for 'public' 'hidden' Koha OPACS. For security reasons, other
529
    # hidden services a library might run SHOULD NOT BE in /var/lib/tor/koha/
530
    local myonion="$(cat /var/lib/tor/koha/$1/hidden_service/hostname)"
531
    echo $myonion
380
}
532
}
381
533
382
# Set defaults and read config file, if it exists.
534
# Set defaults and read config file, if it exists.
Lines 425-430 END_AUTHORITIES_RETRIEVAL_INFO="" Link Here
425
577
426
APACHE_CONFIGFILE=""
578
APACHE_CONFIGFILE=""
427
579
580
# Tor settings
581
ENABLE_TOR_HIDDEN_SERVICE="no"
582
TOR_INSTALLATION="no"
583
428
if [ -e /etc/koha/koha-sites.conf ]
584
if [ -e /etc/koha/koha-sites.conf ]
429
then
585
then
430
    . /etc/koha/koha-sites.conf
586
    . /etc/koha/koha-sites.conf
Lines 432-438 fi Link Here
432
588
433
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
589
[ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" )
434
590
435
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt, \
591
TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,letsencrypt,tor, \
436
     -n "$0" -- "$@"`
592
     -n "$0" -- "$@"`
437
593
438
# Note the quotes around `$TEMP': they are essential!
594
# Note the quotes around `$TEMP': they are essential!
Lines 492-497 while true ; do Link Here
492
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
648
            CLO_UPLOAD_PATH="$2" ; shift 2 ;;
493
        --letsencrypt)
649
        --letsencrypt)
494
            CLO_LETSENCRYPT="yes" ; shift ;;
650
            CLO_LETSENCRYPT="yes" ; shift ;;
651
        --tor)
652
            ENABLE_TOR_HIDDEN_SERVICE="yes" ; shift ;;
495
        -h|--help)
653
        -h|--help)
496
            usage ; exit 0 ;;
654
            usage ; exit 0 ;;
497
        --)
655
        --)
Lines 581-586 then Link Here
581
    die "This script must be run with root privileges."
739
    die "This script must be run with root privileges."
582
fi
740
fi
583
741
742
# If --tor is used, but package 'tor' not installed, prompt for installation
743
# If refused, we can stop cleanly here
744
if [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then
745
    enable_tor_hidden_service
746
fi
747
584
# Check everything is ok with Apache, die otherwise
748
# Check everything is ok with Apache, die otherwise
585
check_apache_config
749
check_apache_config
586
750
Lines 799-810 then Link Here
799
    fi
963
    fi
800
fi
964
fi
801
965
802
803
if [ "$op" = request ]
966
if [ "$op" = request ]
804
then
967
then
805
    koha-disable "$name"
968
    koha-disable "$name"
806
fi
969
fi
807
970
971
if [ "$op" = create ] && [ "$TORINSTALLATION" = "yes" ]; then
972
    tor_install
973
fi
974
975
if [ "$op" = create ] && [ "$ENABLE_TOR_HIDDEN_SERVICE" = "yes" ]; then
976
    tor_config
977
fi
978
808
echo <<eoh
979
echo <<eoh
809
980
810
Email for this instance is disabled. When you're ready to enable it, use:
981
Email for this instance is disabled. When you're ready to enable it, use:
(-)a/debian/scripts/koha-remove (+5 lines)
Lines 128-133 eof Link Here
128
    getent passwd "$name-koha" > /dev/null && deluser --quiet "$name-koha"
128
    getent passwd "$name-koha" > /dev/null && deluser --quiet "$name-koha"
129
    # in case the site has already been disabled, we don't want to break the loop now.
129
    # in case the site has already been disabled, we don't want to break the loop now.
130
    a2dissite "$name" > /dev/null 2>&1 || a2dissite "${name}.conf" > /dev/null 2>&1 || /bin/true
130
    a2dissite "$name" > /dev/null 2>&1 || a2dissite "${name}.conf" > /dev/null 2>&1 || /bin/true
131
    # Remove Tor hidden service info from torrrc if present and restart Tor
132
    if [ $(grep -c "# Start instance koha-$name" "/etc/tor/torrc") -eq 1 ]; then
133
        sed -i '/# begin instance koha-$name/, +4 d' "/etc/tor/torrc"
134
        service tor restart
135
    fi
131
done
136
done
132
137
133
service apache2 restart
138
service apache2 restart
(-)a/debian/templates/apache-site-tor.conf.in (+21 lines)
Line 0 Link Here
1
# Koha instance __KOHASITE__ Apache config for Tor hidden service.
2
3
# OPAC
4
<VirtualHost 127.0.0.1:8080>
5
  <IfVersion >= 2.4>
6
   Define instance "__KOHASITE__"
7
  </IfVersion>
8
   Include /etc/koha/apache-shared.conf
9
#  Include /etc/koha/apache-shared-disable.conf
10
#  Include /etc/koha/apache-shared-opac-plack.conf
11
   Include /etc/koha/apache-shared-opac.conf
12
13
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
14
#   SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__"
15
#   SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__"
16
   AssignUserID __UNIXUSER__ __UNIXGROUP__
17
18
   ErrorLog    /var/log/koha/__KOHASITE__/opac-error.log
19
#  TransferLog /var/log/koha/__KOHASITE__/opac-access.log
20
#  RewriteLog  /var/log/koha/__KOHASITE__/opac-rewrite.log
21
</VirtualHost>
(-)a/debian/templates/apache-site.conf.in (+1 lines)
Lines 11-16 Link Here
11
   Include /etc/koha/apache-shared-opac.conf
11
   Include /etc/koha/apache-shared-opac.conf
12
12
13
   ServerName __OPACSERVER__
13
   ServerName __OPACSERVER__
14
#  ServerAlias __OPACTORHIDDENSERVICE__ #onion
14
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
15
   SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml"
15
   AssignUserID __UNIXUSER__ __UNIXGROUP__
16
   AssignUserID __UNIXUSER__ __UNIXGROUP__
16
17
(-)a/debian/templates/torrc.in (-1 / +31 lines)
Line 0 Link Here
0
- 
1
# Tor minimal config for Koha bundle
2
# For a list of options check the default file at /etc/tor/torrc-old
3
4
5
# General section.
6
7
SocksPort 0
8
SocksPolicy reject *
9
DataDirectory /var/lib/tor
10
11
12
# Relay section
13
# You should read the Tor manual before you set up a Tor relay!
14
15
#ORPort 9001                  # use a port that is not used by anything else
16
#Address                      # ip or domain, or tor will guess
17
#Nickname Koha ILS Tor Server # public name of the Tor server, use whatever you like
18
#RelayBandwidthRate 100 KB    # Throttle traffic to 100KB/s (800Kbps)
19
#RelayBandwidthBurst 200 KB   # But allow bursts up to 200KB/s (1600Kbps)
20
#ExitPolicy reject *:*        # no exits allowed
21
22
23
# General hidden service section
24
# If you want to a run Tor hidden service other than the Koha OPAC, put it here.
25
# DO NOT USE the /var/lib/tor/koha FOLDER FOR CUSTOM HIDDEN SERVICES!
26
27
28
29
# !!! DO NOT EDIT ANYTHING BELOW THIS LINE !!!
30
31
# Koha hidden service section. This is generated automatically. Do not touch!

Return to bug 15540