Outils pour utilisateurs
technique:chd-tls1
Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentes Révision précédente Prochaine révision | Révision précédente | ||
|
technique:chd-tls1 [2016/02/22 17:28] admin [Certificat SSL LetsEncrypt] |
— (Version actuelle) | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| - | ====== Serveur chd-tls1 ====== | ||
| - | |||
| - | ===== Caractéristiques ===== | ||
| - | |||
| - | * Machine virtuelle (KVM amd64) | ||
| - | * Debian 8 | ||
| - | |||
| - | ===== Roles ===== | ||
| - | |||
| - | * Outils collaboratif de l'asso | ||
| - | * Appli de gestion des adhérents | ||
| - | * Surveillance (monitoring) des équipements en Comminges | ||
| - | * Tests de débit des liens vers Saint-Gaudens | ||
| - | |||
| - | ===== Notes d'installation ===== | ||
| - | |||
| - | ==== Système / Réseau ==== | ||
| - | |||
| - | <code bash> | ||
| - | # Parti d'un template Debian 8 préinstallé sur un disque de 8 giga | ||
| - | editor /etc/hosts /etc/hostname /etc/network/interfaces /etc/resolv.conf | ||
| - | ifup eth0 | ||
| - | ping 185.61.116.254 | ||
| - | ping 8.8.8.8 | ||
| - | ping google.fr | ||
| - | passwd root | ||
| - | reboot | ||
| - | hostname --fqdn | ||
| - | apt-get update | ||
| - | apt-get install openssh-server | ||
| - | deluser temp | ||
| - | editor ~root/.ssh/authorized_keys | ||
| - | editor ~/.bashrc | ||
| - | passwd -dl root | ||
| - | apt-get autoremove --purge rpcbind nfs-common | ||
| - | apt-get install sudo arping ethtool fail2ban iftop iperf lldpd molly-guard nmap ntp powertop procps rdiff-backup rsync screen sshpass strace sysstat tcpdump vim w3m unzip | ||
| - | apt-get install apache2 libapache2-mod-php5 mysql-server automysqlbackup phpmyadmin munin munin-node pdns-recursor | ||
| - | rm /etc/munin/plugins/ntp_kernel_* | ||
| - | rm /etc/munin/plugins/nfs* | ||
| - | service munin-node reload | ||
| - | </code> | ||
| - | |||
| - | ==== Services web ==== | ||
| - | |||
| - | <code bash> | ||
| - | apt-get install dokuwiki owncloud | ||
| - | zless /usr/share/doc/owncloud/README.Debian.gz | ||
| - | a2disconf dokuwiki | ||
| - | a2disconf munin | ||
| - | a2disconf owncloud | ||
| - | a2disconf phpmyadmin | ||
| - | a2disconf serve-cgi-bin | ||
| - | editor /etc/apache2/sites-available/000-default.conf | ||
| - | editor /etc/apache2/sites-available/default-ssl.conf | ||
| - | editor /etc/apache2/sites-available/redirect.conf | ||
| - | editor /etc/apache2/sites-available/www.conf | ||
| - | editor /etc/apache2/conf-available/dokuwiki.conf | ||
| - | editor /etc/apache2/conf-available/phpmyadmin.conf | ||
| - | editor /etc/apache2/conf-available/munin.conf | ||
| - | editor /etc/apache2/conf-available/security.conf | ||
| - | a2ensite default-ssl | ||
| - | a2ensite redirect | ||
| - | a2ensite www | ||
| - | a2enmod rewrite | ||
| - | a2enmod ssl | ||
| - | htpasswd -Bc /etc/apache2/priv.htpasswd admin | ||
| - | chgrp www-data /etc/apache2/priv.htpasswd | ||
| - | chmod 640 /etc/apache2/priv.htpasswd | ||
| - | service apache2 restart | ||
| - | mkdir /var/www/priv | ||
| - | editor /var/www/html/index.html | ||
| - | editor /var/www/priv/index.html | ||
| - | editor /usr/local/bin/tailapache | ||
| - | chmod 755 /usr/local/bin/tailapache | ||
| - | editor /etc/dokuwiki/dokuwiki.php | ||
| - | editor /etc/dokuwiki/mime.php # Ajouter eps (même mimetype que ps) | ||
| - | rm /etc/dokuwiki/local.php | ||
| - | chown www-data /var/lib/dokuwiki/lib/plugins/ | ||
| - | |||
| - | mysql --defaults-file=/etc/mysql/debian.cnf | ||
| - | </code> | ||
| - | |||
| - | <code sql> | ||
| - | CREATE DATABASE owncloud; | ||
| - | CREATE USER owncloud@localhost IDENTIFIED BY 'monsupermotdepasse'; | ||
| - | GRANT ALL PRIVILEGES ON owncloud.* TO owncloud@localhost; | ||
| - | FLUSH privileges; | ||
| - | quit | ||
| - | </code> | ||
| - | |||
| - | * le config.php se remplit à partir de [[http://priv.chd.sx/owncloud|http://priv.chd.sx/owncloud]] | ||
| - | * l'initialisation de la base est incluse | ||
| - | |||
| - | ==== Certificat SSL LetsEncrypt ==== | ||
| - | |||
| - | * Utilisé pour https://priv.chd.sx | ||
| - | * LetsCrypt a été installé en root, il demande sudo de manière inconditionnelle de toutes façons | ||
| - | * Procédure inspirée de la doc officielle https://letsencrypt.org/howitworks/ | ||
| - | |||
| - | |||
| - | * Installer l'outil depuis git (pas encore stable / packagé) | ||
| - | <code bash> | ||
| - | cd /root | ||
| - | git clone https://github.com/letsencrypt/letsencrypt | ||
| - | cd letsencrypt | ||
| - | ./letsencrypt-auto --help | ||
| - | # Installe toutes les dépendances et fini par afficher l'aide | ||
| - | </code> | ||
| - | |||
| - | * Faire de sorte que le binaire ''letsencrypt'' soit dans le path | ||
| - | <code bash> | ||
| - | ln -s /root/.local/share/letsencrypt/bin ~/ | ||
| - | editor ~/.profile | ||
| - | </code> | ||
| - | |||
| - | <file bash /root/.profile> | ||
| - | # [...] | ||
| - | # set PATH so it includes user's private bin if it exists | ||
| - | if [ -d "$HOME/bin" ] ; then | ||
| - | PATH="$HOME/bin:$PATH" | ||
| - | fi | ||
| - | </file> | ||
| - | |||
| - | * Obtention des certificat initiaux | ||
| - | <code bash> | ||
| - | letsencrypt --apache | ||
| - | # Accepter les TOS | ||
| - | # Sélectionner priv.chd.sx et www.priv.chd.sx | ||
| - | </code> | ||
| - | |||
| - | * Arranger les vhosts, le comportement par défaut fait une boucle de redirection (sympa) | ||
| - | <code bash> | ||
| - | cat /etc/apache2/sites-available/redirect-le-ssl.conf | ||
| - | rm /etc/apache2/sites-available/redirect-le-ssl.conf | ||
| - | editor /etc/apache2/sites-available/default-ssl.conf | ||
| - | </code> | ||
| - | |||
| - | <file conf /etc/apache2/sites-available/default-ssl.conf> | ||
| - | # [...] | ||
| - | SSLCertificateFile /etc/letsencrypt/live/priv.chd.sx/fullchain.pem | ||
| - | SSLCertificateKeyFile /etc/letsencrypt/live/priv.chd.sx/privkey.pem | ||
| - | Include /etc/letsencrypt/options-ssl-apache.conf | ||
| - | BrowserMatch "MSIE [2-6]" \ | ||
| - | nokeepalive ssl-unclean-shutdown \ | ||
| - | downgrade-1.0 force-response-1.0 | ||
| - | # MSIE 7 and newer should be able to use keepalive | ||
| - | BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown | ||
| - | </file> | ||
| - | |||
| - | * Scripter le renewal automatique | ||
| - | <code bash> | ||
| - | editor /etc/cron.monthly/letsencrypt-renew.sh | ||
| - | chmod +x /etc/cron.monthly/letsencrypt-renew.sh | ||
| - | </code> | ||
| - | |||
| - | <file bash /etc/cron.monthly/letsencrypt-renew.sh> | ||
| - | #!/bin/sh | ||
| - | |||
| - | /root/bin/letsencrypt renew --agree-tos > /var/log/letsencrypt/renew.log 2>&1 | ||
| - | res=$? | ||
| - | |||
| - | if [ $res -ne 0 ]; then | ||
| - | echo Automated renewal failed: | ||
| - | cat /var/log/letsencrypt/renew.log | ||
| - | exit $res | ||
| - | fi | ||
| - | |||
| - | service apache2 reload | ||
| - | </file> | ||
| - | ===== Appli de gestion ===== | ||
| - | |||
| - | * Base créée via phpmyadmin (+ import fichier .sql) | ||
| - | |||
| - | ==== Installation et premier CRUD ==== | ||
| - | |||
| - | <code bash> | ||
| - | cd /var/www | ||
| - | wget https://getcomposer.org/composer.phar | ||
| - | php composer.phar create-project --prefer-dist cakephp/app chd_gestion'' | ||
| - | cd chd_gestion | ||
| - | # Config BDD | ||
| - | editor config/app.php | ||
| - | # Alias /gestion /var/www/chd_gestion/webroot | ||
| - | editor /etc/apache2/sites-enabled/default-ssl.conf | ||
| - | # Ajout RewriteBase /gestion | ||
| - | editor .htaccess webroot/.htaccess | ||
| - | # Test et vérifications embarquées dans Cake | ||
| - | www-browser https://priv.chd.sx/gestion | ||
| - | # Première génération de l'appli par rapport aux tables présentes dans la BDD | ||
| - | for i in adherents equipement_stock equipements ip4privees ip4publiques relais secteurs service_types services villes; do bin/cake bake all $i; done | ||
| - | # Changer la page d'accueil pour arriver directement sur la liste des adhérents | ||
| - | editor config/routes.php | ||
| - | # $routes->connect('/', ['controller' => 'Adherents', 'action' => 'index']); | ||
| - | # Tester l'appli | ||
| - | www-browser https://priv.chd.sx/gestion | ||
| - | </code> | ||
| - | |||
| - | ==== Ajouter phpunit pour faire des tests ==== | ||
| - | |||
| - | [[https://getcomposer.org/doc/03-cli.md#require|Doc de composer]] | ||
| - | |||
| - | <code bash> | ||
| - | php ../composer.phar require --dev phpunit/phpunit:5.* | ||
| - | # Ecrire un premier Test (bake en génère tout plein par ailleurs) | ||
| - | editor tests/TestCase/View/I18nBasicTest | ||
| - | </code> | ||
| - | |||
| - | ==== Traduire les textes en français ==== | ||
| - | |||
| - | === Générer le fichier modèle de traduction (.pot) === | ||
| - | |||
| - | <code bash> | ||
| - | bin/cake i18n extract | ||
| - | # Toutes les réponses par défaut. Overwrite : yes. | ||
| - | </code> | ||
| - | |||
| - | === Écrire un fichier po (au bon endroit) === | ||
| - | |||
| - | <code bash> | ||
| - | root@chd-tls1:/var/www/chd_gestion# find src/Locale/ -ls | ||
| - | 395603 4 drwxr-x--- 3 root root 4096 oct. 17 20:01 src/Locale/ | ||
| - | 406962 36 -rw-r--r-- 1 root root 32982 oct. 17 16:11 src/Locale/default.pot | ||
| - | 395531 4 drwxr-xr-x 2 root root 4096 oct. 17 20:15 src/Locale/fr_FR | ||
| - | 407961 40 -rw-r--r-- 1 root root 38367 oct. 17 20:15 src/Locale/fr_FR/default.po | ||
| - | </code> | ||
| - | |||
| - | === Ajouter les outils de vérification des fichiers de traductions gettext === | ||
| - | |||
| - | <code> | ||
| - | apt-get install gettext-lint gettext | ||
| - | POFileChecker src/Locale/fr_FR/default.po | ||
| - | msgfmt -v -c src/Locale/fr_FR/default.po | ||
| - | vendor/bin/phpunit --filter testBasicTranslation tests/TestCase/View/I18nBasicTest | ||
| - | </code> | ||
| - | |||
| - | |||
| - | ===== Système mail ===== | ||
| - | |||
| - | <code bash> | ||
| - | editor /etc/mailname | ||
| - | dpkg-reconfigure exim4-config | ||
| - | # Listen 25 : 127.0.0.1, ::1 | ||
| - | # Split config : oui | ||
| - | update-exim4.conf | ||
| - | apt-get install sympa | ||
| - | a2disconf sympa | ||
| - | editor /etc/apache2/sites-available/www.conf | ||
| - | editor /etc/apache2/conf-available/sympa.conf | ||
| - | editor /etc/sympa/wwsympa.conf | ||
| - | service apache2 reload | ||
| - | |||
| - | editor /etc/sympa/sympa.conf # Penser notamment a passer use_fast_cgi à 1 | ||
| - | editor /etc/sympa/topics.conf # C'est là dedans les catégories moches | ||
| - | service sympa restart | ||
| - | |||
| - | editor /etc/aliases | ||
| - | #editor /etc/exim4/conf.d/main/00_exim4-my-config | ||
| - | cp -a /etc/exim4/conf.d/router/{400_exim4-config_system_aliases,450_local-config_sympa-aliases} | ||
| - | editor /etc/exim4/conf.d/router/450_local-config_sympa-aliases | ||
| - | cp -a /etc/exim4/conf.d/router/{450_local-config_sympa-aliases,440_local-config_sympa-global-aliases} | ||
| - | editor /etc/exim4/conf.d/router/440_local-config_sympa-global-aliases | ||
| - | update-exim4.conf | ||
| - | service exim4 reload | ||
| - | |||
| - | www-browser http://chd.sx/sympa | ||
| - | mkdir /etc/sympa/families/village | ||
| - | cp /var/lib/sympa/list_data/adhesion/config /etc/sympa/families/village/config.tt2 | ||
| - | editor /etc/sympa/families/village/config.tt2 | ||
| - | editor /etc/sympa/families/village/data.sh | ||
| - | editor /etc/sympa/families/village/instantiate.sh | ||
| - | </code> | ||
| - | |||
| - | ==== Mettre à jour la famille de listes des villages ==== | ||
| - | |||
| - | <code> | ||
| - | root@chd-tls1:~# cd /etc/sympa/families/village | ||
| - | root@chd-tls1:/etc/sympa/families/village# ./instantiate.sh | ||
| - | </code> | ||
| - | |||
| - | <code> | ||
| - | err Family::_load_param_constraint_conf() No file /etc/sympa/families/village/param_constraint.conf. Assuming no constraints to apply. | ||
| - | |||
| - | ****************************************************************************** | ||
| - | |||
| - | ******************** INSTANTIATION of village FAMILY ******************** | ||
| - | |||
| - | ****************************************************************************** | ||
| - | |||
| - | These lists have been created and aliases are ok : | ||
| - | ardiege, clarac, estancarbon, figarol, huos, labarthe-inard, labarthe-riviere, lalouret-laffiteau, landorthe, larcan, le-cuing, lieoux, lodes, martres-de-riviere, miramont-de-comminges, montespan, pointis-de-riviere, pointis-inard, saint-gaudens, saint-ignan, saux-et-pomarede, savarthes, villeneuve-de-riviere | ||
| - | </code> | ||
technique/chd-tls1.1456158524.txt.gz · Dernière modification: 2016/02/22 17:28 par admin
Outils de la page
