From: Christian Heller Date: Thu, 9 Dec 2021 22:03:28 +0000 (+0100) Subject: Add bullseye website setup. X-Git-Url: https://plomlompom.com/repos/%7B%7B%20web_path%20%7D%7D/static/%7B%7Bdb.prefix%7D%7D/%7B%7Bprefix%7D%7D/todos?a=commitdiff_plain;h=0deff7ca381f991effd74682bffa8a5a642f260e;p=config Add bullseye website setup. --- diff --git a/bullseye/apt-mark/website b/bullseye/apt-mark/website new file mode 100644 index 0000000..c046f50 --- /dev/null +++ b/bullseye/apt-mark/website @@ -0,0 +1,8 @@ +# for gitweb +gitweb +fcgiwrap +# for plomlombot +gnupg +dirmngr +python3-venv +screen diff --git a/bullseye/etc_files/website/etc/gitweb.conf b/bullseye/etc_files/website/etc/gitweb.conf new file mode 100644 index 0000000..88dea47 --- /dev/null +++ b/bullseye/etc_files/website/etc/gitweb.conf @@ -0,0 +1,22 @@ +# path to git projects (.git) +$projectroot = "/var/repos"; + +# don't show repos without git-daemon-export-ok file +$export_ok = "git-daemon-export-ok"; + +# directory to use for temp files +# explicitely set by Debian so it's probably a good choice +$git_temp = "/tmp"; + +# git-diff-tree(1) options to use for generated patches +# we don't want to to guess renames, so empty +@diff_opts = (); + +# Base path for where to find the repos for cloning. +@git_base_url_list = ('https://REPLACE_fqdn_ECALPER/repos/clone'); + +# allow snapshots +$feature{'snapshot'}{'default'} = ['zip', 'tgz']; + +# insert header for GDPR compliance +$site_header = "/var/www/header.html" diff --git a/bullseye/etc_files/website/etc/nginx/sites-available/website.nginx b/bullseye/etc_files/website/etc/nginx/sites-available/website.nginx new file mode 100644 index 0000000..cbad304 --- /dev/null +++ b/bullseye/etc_files/website/etc/nginx/sites-available/website.nginx @@ -0,0 +1,40 @@ +server { + listen 443 ssl; + server_name REPLACE_fqdn_ECALPER; + ssl_certificate /etc/letsencrypt/live/REPLACE_fqdn_ECALPER/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/REPLACE_fqdn_ECALPER/privkey.pem; + root /var/www/html/; + index index.html index.htm index.nginx-debian.html; + + # serve /var/repos/* for HTTPS git cloning + location ~ /repos/clone(/.*) { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend; + # Commented out so only repos are served that contain a + # git-daemon-export-ok file. + # fastcgi_param GIT_HTTP_EXPORT_ALL ""; + fastcgi_param GIT_PROJECT_ROOT /var/repos; + fastcgi_param PATH_INFO $1; + fastcgi_pass unix:/var/run/fcgiwrap.socket; + } + + # gitweb static files + location /repos/static/ { + alias /usr/share/gitweb/static/; + } + + # gitweb; this needs packages fcgiwrap and gitweb + location /repos/ { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/share/gitweb/gitweb.cgi; + fastcgi_param GITWEB_CONFIG /etc/gitweb.conf; + fastcgi_pass unix:/var/run/fcgiwrap.socket; + } + + # login-protected IRC logs + location ~ ^/irclogs/([^/]+)/ { + auth_basic "$1 logs"; + auth_basic_user_file /var/www/irclogs_pw/$1; + autoindex on; + } +} diff --git a/bullseye/etc_files/website/etc/systemd/system/plomlombot.service b/bullseye/etc_files/website/etc/systemd/system/plomlombot.service new file mode 100644 index 0000000..a4f6769 --- /dev/null +++ b/bullseye/etc_files/website/etc/systemd/system/plomlombot.service @@ -0,0 +1,11 @@ +[Unit] +Description=plomlombot screen + +[Service] +Type=simple +User=plom +ExecStart=/bin/sh -c '~/plomlombot_daemon.sh' +Restart=always + +[Install] +WantedBy=multi-user.target diff --git a/bullseye/setup_scripts/setup_website.sh b/bullseye/setup_scripts/setup_website.sh new file mode 100755 index 0000000..45a52b5 --- /dev/null +++ b/bullseye/setup_scripts/setup_website.sh @@ -0,0 +1,137 @@ +#!/bin/sh +set -e + +if [ "$#" -ne 4 ] && [ "$#" -ne 5 ]; then + echo 'Need domain name and mail and key ID and init state and possibly old server IP as argument.' + false +fi +if [ ! "$4" = "copy" ] && [ ! "$4" = "new" ] && [ ! "$4" = "upgrade" ]; then + echo "Need init state to be either 'copy' or 'new' or 'upgrade'" + false +fi +if [ ! "$4" = "new" ] && [ "$#" -ne 5 ]; then + echo "With init state != 'new' need fifth argument old server IP." + false +fi +domain="$1" +mail="$2" +gpg_key="$3" +init_state="$4" +old_server="$5" + +# NOTE: init_state=upgrade is for migration from older stretch server setup + +# Install configs, set up firewall. +config_tree_prefix="${HOME}/config/bullseye" +./install_for_target.sh web website +./copy_dirtree.sh "${config_tree_prefix}/etc_files" "" web website +nft -f /etc/nftables.conf + +# Set up letsencrypt certificate. TODO: Is it auto-renewed? +ln -sf /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default +certbot --nginx --agree-tos --redirect --no-eff-email -m "${mail}" -d "${domain}" +rm /etc/nginx/sites-enabled/default + +# Set up connection to old server. +if [ ! "${init_state}" = "new" ]; then + cp "${config_tree_prefix}/setup_scripts/prepare_to_meet_server.sh" /home/plom/ + chown plom:plom /home/plom/prepare_to_meet_server.sh + su -lc "./prepare_to_meet_server.sh ${old_server}" plom + read -p'Hit Enter when you are done.' ignore + rm /home/plom/prepare_to_meet_server.sh +fi + +# Set up repos dir. +# To use this dir, "git clone --mirror" repo source paths into it as user plom. +# As user plom, touch git-daemon-export-ok files into it to make the repo +# publically available. +if [ "${init_state}" = "new" ]; then + mkdir /var/repos + chown plom:plom /var/repos +else + cp "${config_tree_prefix}/setup_scripts/mirror_dir.sh" /home/plom/ + chmod a+w /var + if [ "${init_state}" = "copy" ]; then + su -lc "./mirror_dir.sh ${old_server} /var/repos" plom + else + su -lc "./mirror_dir.sh ${old_server} /var/public_repos" plom + fi + chmod a-w /var + rm /home/plom/mirror_dir.sh +fi + +# Prepare NGINX and GitWeb config. +sed -i "s/REPLACE_fqdn_ECALPER/${domain}/g" /etc/gitweb.conf +sed -i "s/REPLACE_fqdn_ECALPER/${domain}/g" /etc/nginx/sites-available/website.nginx +ln -s /etc/nginx/sites-available/website.nginx /etc/nginx/sites-enabled/website.nginx + +# Set up website. TODO: use non-/var/www dir for better separation to dump site +rm -rf /var/www +mkdir /var/www +chown plom:plom /var/www +if [ "${init_state}" = "upgrade" ]; then + # This assumes the old core.plomlompom.com filesystem hierarchy. + su -lc "cd /var/repos && git clone --mirror plom@core.plomlompom.com:repos/website" plom +elif [ "${init_state}" = "new" ]; then + su -lc "cd /var/repos && git init --bare website.git" plom +fi +cp "${config_tree_prefix}/other_files/website_hook_post-receive" /var/repos/website.git/hooks/post-receive +su -lc 'cd /var/www && git clone /var/repos/website.git .' plom + +# Add encryption key. +keyservers='sks-keyservers.net/ keys.gnupg.net' +set +e +while true; do + do_break=0 + for keyserver in $(echo "${keyservers}"); do + su plom -c "gpg --no-tty --keyserver $keyserver --recv-key ${gpg_key}" + if [ $? -eq "0" ]; then + do_break=1 + break + fi + echo "Attempt with keyserver ${keyserver} unsuccessful, trying other." + done + if [ "${do_break}" -eq "1" ]; then + break + fi +done +set -e + +# Set up plomlombot. +irclogs_dir=/var/www/html/irclogs +irclogs_pw_dir=/var/www/irclogs_pw +mkdir -p "${irclogs_dir}" +chown -R plom:plom "${irclogs_dir}" +mkdir -p "${irclogs_pw_dir}" +chown -R plom:plom "${irclogs_pw_dir}" +if [ "${init_state}" = "new" ]; then + # Handle the case that the repo is in the old pre-buster server setup – + # even then, the URL should be the same. + su -lc "cd /var/repos && git clone --mirror https://plomlompom.com/repos/clone/plomlombot-irc" plom + su -lc "touch /var/repos/plomlombot-irc.git/git-daemon-export-ok" plom + cp "${config_tree_prefix}/other_files/plomlombot_hook_post-receive" /var/repos/plomlombot-irc.git/hooks/post-receive +fi +su -lc "git clone /var/repos/plomlombot-irc.git" plom +cp "${config_tree_prefix}/other_files/plomlombot_daemon.sh" /home/plom/ +chown plom:plom /home/plom/plomlombot_daemon.sh +if [ "${init_state}" = "new" ]; then + echo 'bot: plomlombog plomlombog #plomlomtest irc.freenode.net foo bar' >> /home/plom/.plomlombot + chown plom:plom /home/plom/.plomlombot +else + cp "${config_tree_prefix}/setup_scripts/mirror_dir.sh" /home/plom/ + su -lc "./mirror_dir.sh ${old_server} /home/plom/plomlombot_db" plom + rm /home/plom/mirror_dir.sh + su -lc "scp plom@${old_server}:.plomlombot ~" plom + su -lc "ssh plom@${old_server} \"su -lc 'service plomlombot stop'\"" plom +fi +systemctl enable plomlombot.service +service plomlombot start + +# In the above step, we might have created a root-owned /var/www/html – +# fix this here. +chown -R plom:plom /var/www/html + +# TODO: +# - rename /home/plom/public_repos to /home/plom/repos + +service nginx restart