• Machine virtuelle (KVM amd64)
• Debian 8

• Outils collaboratif de l'asso
• Appli de gestion des adhérents
• Surveillance (monitoring) des équipements en Comminges
• Tests de débit des liens vers Saint-Gaudens

# Parti d'un template Debian 8 préinstallé sur un disque de 8 giga
editor /etc/hosts /etc/hostname /etc/network/interfaces /etc/resolv.conf
ifup eth0
ping 185.61.116.254
ping 8.8.8.8
ping google.fr
passwd root
reboot
hostname --fqdn
apt-get update
apt-get install openssh-server
deluser temp
editor ~root/.ssh/authorized_keys
editor ~/.bashrc
passwd -dl root
apt-get autoremove --purge rpcbind nfs-common
apt-get install sudo arping ethtool fail2ban iftop iperf lldpd molly-guard nmap ntp powertop procps rdiff-backup rsync screen sshpass strace sysstat tcpdump vim w3m unzip
apt-get install apache2 libapache2-mod-php5 mysql-server automysqlbackup phpmyadmin munin munin-node pdns-recursor
rm /etc/munin/plugins/ntp_kernel_*
rm /etc/munin/plugins/nfs*
service munin-node reload

apt-get install dokuwiki owncloud cgit
zless /usr/share/doc/owncloud/README.Debian.gz
a2disconf dokuwiki
a2disconf munin
a2disconf cgit
a2disconf owncloud
a2disconf phpmyadmin
a2disconf serve-cgi-bin
editor /etc/apache2/sites-available/000-default.conf
editor /etc/apache2/sites-available/default-ssl.conf
editor /etc/apache2/sites-available/redirect.conf
editor /etc/apache2/sites-available/www.conf
editor /etc/apache2/conf-available/dokuwiki.conf
editor /etc/apache2/conf-available/phpmyadmin.conf
editor /etc/apache2/conf-available/munin.conf
editor /etc/apache2/conf-available/security.conf
editor /etc/cgitrc
a2ensite default-ssl
a2ensite redirect
a2ensite www
a2enmod rewrite
a2enmod cgi
a2enmod fcgid
a2enmod ssl
htpasswd -Bc /etc/apache2/priv.htpasswd admin
chgrp www-data /etc/apache2/priv.htpasswd
chmod 640 /etc/apache2/priv.htpasswd
service apache2 restart
mkdir /var/www/priv
editor /var/www/html/index.html
editor /var/www/priv/index.html
editor /usr/local/bin/tailapache
chmod 755 /usr/local/bin/tailapache
editor /etc/dokuwiki/dokuwiki.php
editor /etc/dokuwiki/mime.php # Ajouter eps (même mimetype que ps)
rm /etc/dokuwiki/local.php
chown www-data /var/lib/dokuwiki/lib/plugins/
 
mysql --defaults-file=/etc/mysql/debian.cnf

CREATE DATABASE owncloud;
CREATE USER owncloud@localhost IDENTIFIED BY 'monsupermotdepasse';
GRANT ALL PRIVILEGES ON owncloud.* TO owncloud@localhost;
FLUSH privileges;
quit

• le config.php se remplit à partir de http://priv.chd.sx/owncloud
• l'initialisation de la base est incluse

• Utilisé pour https://priv.chd.sx
• LetsCrypt a été installé en root, il demande sudo de manière inconditionnelle de toutes façons
• Procédure inspirée de la doc officielle https://letsencrypt.org/howitworks/

• Installer l'outil depuis git (pas encore stable / packagé)

cd /root
git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
./letsencrypt-auto --help
# Installe toutes les dépendances et fini par afficher l'aide

• Faire de sorte que le binaire letsencrypt soit dans le path

ln -s /root/.local/share/letsencrypt/bin ~/
editor ~/.profile

/root/.profile

# [...]
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ]; then
    PATH="$HOME/bin:$PATH"
fi

• Obtention des certificat initiaux

letsencrypt --apache
# Accepter les TOS
# Sélectionner priv.chd.sx et www.priv.chd.sx

• Arranger les vhosts, le comportement par défaut fait une boucle de redirection (sympa)

cat /etc/apache2/sites-available/redirect-le-ssl.conf
rm /etc/apache2/sites-available/redirect-le-ssl.conf
editor /etc/apache2/sites-available/default-ssl.conf

/etc/apache2/sites-available/default-ssl.conf

        # [...]
        SSLCertificateFile /etc/letsencrypt/live/priv.chd.sx/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/priv.chd.sx/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
        BrowserMatch "MSIE [2-6]" \
                nokeepalive ssl-unclean-shutdown \
                downgrade-1.0 force-response-1.0
        # MSIE 7 and newer should be able to use keepalive
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

• Scripter le renewal automatique

editor /etc/cron.monthly/letsencrypt-renew
chmod +x /etc/cron.monthly/letsencrypt-renew

/etc/cron.monthly/letsencrypt-renew.sh

#!/bin/sh
 
/root/bin/letsencrypt renew --agree-tos > /var/log/letsencrypt/renew.log 2>&1
res=$?
 
if [ $res -ne 0 ]; then
    echo Automated renewal failed:
    cat /var/log/letsencrypt/renew.log
    exit $res
fi
 
service apache2 reload

apt-get install bind9
editor /etc/bind/{named.conf.options,named.conf.local,db.185.131.40,db.185.131.41}
service bind9 restart

• Base créée via phpmyadmin (+ import fichier .sql)

cd /var/www
wget https://getcomposer.org/composer.phar
php composer.phar create-project --prefer-dist cakephp/app chd_gestion''
cd chd_gestion
# Config BDD
editor config/app.php
# Alias /gestion /var/www/chd_gestion/webroot
editor /etc/apache2/sites-enabled/default-ssl.conf
# Ajout RewriteBase /gestion
editor .htaccess webroot/.htaccess
# Test et vérifications embarquées dans Cake
www-browser https://priv.chd.sx/gestion
# Première génération de l'appli par rapport aux tables présentes dans la BDD
for i in adherents equipement_stock equipements ip4privees ip4publiques relais secteurs service_types services villes; do bin/cake bake all $i; done
# Changer la page d'accueil pour arriver directement sur la liste des adhérents
editor config/routes.php
# $routes->connect('/', ['controller' => 'Adherents', 'action' => 'index']);
# Tester l'appli
www-browser https://priv.chd.sx/gestion

Doc de composer

php ../composer.phar require --dev phpunit/phpunit:5.*
# Ecrire un premier Test (bake en génère tout plein par ailleurs)
editor tests/TestCase/View/I18nBasicTest

bin/cake i18n extract
# Toutes les réponses par défaut. Overwrite : yes.

root@chd-tls1:/var/www/chd_gestion# find src/Locale/ -ls
395603    4 drwxr-x---   3 root     root         4096 oct. 17 20:01 src/Locale/
406962   36 -rw-r--r--   1 root     root        32982 oct. 17 16:11 src/Locale/default.pot
395531    4 drwxr-xr-x   2 root     root         4096 oct. 17 20:15 src/Locale/fr_FR
407961   40 -rw-r--r--   1 root     root        38367 oct. 17 20:15 src/Locale/fr_FR/default.po

apt-get install gettext-lint gettext
POFileChecker src/Locale/fr_FR/default.po
msgfmt -v -c src/Locale/fr_FR/default.po
vendor/bin/phpunit --filter testBasicTranslation tests/TestCase/View/I18nBasicTest

editor /etc/cron.daily/ecampaign-export
chmod +x /etc/cron.daily/ecampaign-export

/etc/cron.daily/ecampaign-export

#!/bin/sh
php /root/chd_gestion/api/export_ecampaign_cron.php >/dev/null

editor /etc/mailname
dpkg-reconfigure exim4-config
# Listen 25 : 127.0.0.1, ::1
# Split config : oui
rm /etc/exim4/exim4.conf.template # Pour éviter de se tromper (inutilisé, cf conf.d)
 
update-exim4.conf
apt-get install sympa
a2disconf sympa
editor /etc/apache2/sites-available/www.conf
editor /etc/apache2/conf-available/sympa.conf
editor /etc/sympa/wwsympa.conf
service apache2 reload
 
editor /etc/sympa/sympa.conf # Penser notamment a passer use_fast_cgi à 1
editor /etc/sympa/topics.conf # C'est là dedans les catégories moches
service sympa restart
 
editor /etc/aliases
cp -a /etc/exim4/conf.d/router/{400_exim4-config_system_aliases,450_local-config_sympa-aliases}
editor /etc/exim4/conf.d/router/450_local-config_sympa-aliases
cp -a /etc/exim4/conf.d/router/{450_local-config_sympa-aliases,440_local-config_sympa-global-aliases}
editor /etc/exim4/conf.d/router/440_local-config_sympa-global-aliases
update-exim4.conf
service exim4 reload
 
www-browser http://chd.sx/sympa
mkdir /etc/sympa/families/village
cp /var/lib/sympa/list_data/adhesion/config /etc/sympa/families/village/config.tt2
editor /etc/sympa/families/village/config.tt2
editor /etc/sympa/families/village/data.sh
editor /etc/sympa/families/village/instantiate.sh

root@chd-tls1:~# cd /etc/sympa/families/village
root@chd-tls1:/etc/sympa/families/village# ./instantiate.sh

err Family::_load_param_constraint_conf() No file /etc/sympa/families/village/param_constraint.conf. Assuming no constraints to apply.

******************************************************************************
******************** INSTANTIATION of village FAMILY ********************
******************************************************************************

These lists have been created and aliases are ok :
  ardiege, clarac, estancarbon, figarol, huos, labarthe-inard, labarthe-riviere, lalouret-laffiteau, landorthe, larcan, le-cuing, lieoux, lodes, martres-de-riviere, miramont-de-comminges, montespan, pointis-de-riviere, pointis-inard, saint-gaudens, saint-ignan, saux-et-pomarede, savarthes, villeneuve-de-riviere

apt-get install spf-tools-perl
cd /etc/exim4/conf.d
editor main/00_localmacros # Nouveau fichier

main/00_localmacros

CHECK_RCPT_SPF = true

update-exim4.conf
service exim4 reload