Add bullseye website setup.

diff --git a/bullseye/apt-mark/website b/bullseye/apt-mark/website
new file mode 100644 (file)
index 0000000..c046f50
--- /dev/null
+++ b/bullseye/apt-mark/website
@@ -0,0 +1,8 @@
+# for gitweb
+gitweb
+fcgiwrap
+# for plomlombot
+gnupg
+dirmngr
+python3-venv
+screen

diff --git a/bullseye/etc_files/website/etc/gitweb.conf b/bullseye/etc_files/website/etc/gitweb.conf
new file mode 100644 (file)
index 0000000..88dea47
--- /dev/null
+++ b/bullseye/etc_files/website/etc/gitweb.conf
@@ -0,0 +1,22 @@
+# path to git projects (<project>.git)
+$projectroot = "/var/repos";
+
+# don't show repos without git-daemon-export-ok file
+$export_ok = "git-daemon-export-ok";
+
+# directory to use for temp files
+# explicitely set by Debian so it's probably a good choice
+$git_temp = "/tmp";
+
+# git-diff-tree(1) options to use for generated patches
+# we don't want to to guess renames, so empty
+@diff_opts = ();
+
+# Base path for where to find the repos for cloning.
+@git_base_url_list = ('https://REPLACE_fqdn_ECALPER/repos/clone');
+
+# allow snapshots
+$feature{'snapshot'}{'default'} = ['zip', 'tgz'];
+
+# insert header for GDPR compliance
+$site_header = "/var/www/header.html"

diff --git a/bullseye/etc_files/website/etc/nginx/sites-available/website.nginx b/bullseye/etc_files/website/etc/nginx/sites-available/website.nginx
new file mode 100644 (file)
index 0000000..cbad304
--- /dev/null
+++ b/bullseye/etc_files/website/etc/nginx/sites-available/website.nginx
@@ -0,0 +1,40 @@
+server {
+    listen 443 ssl;
+    server_name REPLACE_fqdn_ECALPER;
+    ssl_certificate /etc/letsencrypt/live/REPLACE_fqdn_ECALPER/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/REPLACE_fqdn_ECALPER/privkey.pem;
+    root /var/www/html/;
+    index index.html index.htm index.nginx-debian.html;
+
+    # serve /var/repos/* for HTTPS git cloning
+    location ~ /repos/clone(/.*) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+        # Commented out so only repos are served that contain a
+        # git-daemon-export-ok file.
+        # fastcgi_param GIT_HTTP_EXPORT_ALL "";
+        fastcgi_param GIT_PROJECT_ROOT /var/repos;
+        fastcgi_param PATH_INFO $1;
+        fastcgi_pass unix:/var/run/fcgiwrap.socket;
+    }
+
+    # gitweb static files
+    location /repos/static/ {
+        alias /usr/share/gitweb/static/;
+    }
+
+    # gitweb; this needs packages fcgiwrap and gitweb
+    location /repos/ {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/share/gitweb/gitweb.cgi;
+        fastcgi_param GITWEB_CONFIG /etc/gitweb.conf;
+        fastcgi_pass unix:/var/run/fcgiwrap.socket;
+    }
+
+    # login-protected IRC logs
+    location ~ ^/irclogs/([^/]+)/ {
+        auth_basic "$1 logs";
+        auth_basic_user_file /var/www/irclogs_pw/$1;
+        autoindex on;
+    }
+}

diff --git a/bullseye/etc_files/website/etc/systemd/system/plomlombot.service b/bullseye/etc_files/website/etc/systemd/system/plomlombot.service
new file mode 100644 (file)
index 0000000..a4f6769
--- /dev/null
+++ b/bullseye/etc_files/website/etc/systemd/system/plomlombot.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=plomlombot screen
+
+[Service]
+Type=simple
+User=plom
+ExecStart=/bin/sh -c '~/plomlombot_daemon.sh'
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

diff --git a/bullseye/setup_scripts/setup_website.sh b/bullseye/setup_scripts/setup_website.sh
new file mode 100755 (executable)
index 0000000..45a52b5
--- /dev/null
+++ b/bullseye/setup_scripts/setup_website.sh
@@ -0,0 +1,137 @@
+#!/bin/sh
+set -e
+
+if [ "$#" -ne 4 ] && [ "$#" -ne 5 ]; then
+    echo 'Need domain name and mail and key ID and init state and possibly old server IP as argument.'
+    false
+fi
+if [ ! "$4" = "copy" ] && [ ! "$4" = "new" ] && [ ! "$4" = "upgrade" ]; then
+    echo "Need init state to be either 'copy' or 'new' or 'upgrade'"
+    false
+fi
+if [ ! "$4" = "new" ] && [ "$#" -ne 5 ]; then
+    echo "With init state != 'new' need fifth argument old server IP."
+    false
+fi
+domain="$1"
+mail="$2"
+gpg_key="$3"
+init_state="$4"
+old_server="$5"
+
+# NOTE: init_state=upgrade is for migration from older stretch server setup
+
+# Install configs, set up firewall.
+config_tree_prefix="${HOME}/config/bullseye"
+./install_for_target.sh web website
+./copy_dirtree.sh "${config_tree_prefix}/etc_files" "" web website
+nft -f /etc/nftables.conf
+
+# Set up letsencrypt certificate. TODO: Is it auto-renewed?
+ln -sf /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default
+certbot --nginx --agree-tos --redirect --no-eff-email -m "${mail}" -d "${domain}"
+rm /etc/nginx/sites-enabled/default
+
+# Set up connection to old server.
+if [ ! "${init_state}" = "new" ]; then
+  cp "${config_tree_prefix}/setup_scripts/prepare_to_meet_server.sh" /home/plom/
+  chown plom:plom /home/plom/prepare_to_meet_server.sh
+  su -lc "./prepare_to_meet_server.sh ${old_server}" plom
+  read -p'Hit Enter when you are done.' ignore
+  rm /home/plom/prepare_to_meet_server.sh
+fi
+
+# Set up repos dir.
+# To use this dir, "git clone --mirror" repo source paths into it as user plom.
+# As user plom, touch git-daemon-export-ok files into it to make the repo
+# publically available.
+if [ "${init_state}" = "new" ]; then
+  mkdir /var/repos
+  chown plom:plom /var/repos
+else
+  cp "${config_tree_prefix}/setup_scripts/mirror_dir.sh" /home/plom/
+  chmod a+w /var
+  if [ "${init_state}" = "copy" ]; then
+    su -lc "./mirror_dir.sh ${old_server} /var/repos" plom
+  else
+    su -lc "./mirror_dir.sh ${old_server} /var/public_repos" plom
+  fi
+  chmod a-w /var
+  rm /home/plom/mirror_dir.sh
+fi
+
+# Prepare NGINX and GitWeb config.
+sed -i "s/REPLACE_fqdn_ECALPER/${domain}/g" /etc/gitweb.conf
+sed -i "s/REPLACE_fqdn_ECALPER/${domain}/g" /etc/nginx/sites-available/website.nginx
+ln -s /etc/nginx/sites-available/website.nginx /etc/nginx/sites-enabled/website.nginx
+
+# Set up website. TODO: use non-/var/www dir for better separation to dump site
+rm -rf /var/www
+mkdir /var/www
+chown plom:plom /var/www
+if [ "${init_state}" = "upgrade" ]; then
+  # This assumes the old core.plomlompom.com filesystem hierarchy.
+  su -lc "cd /var/repos && git clone --mirror plom@core.plomlompom.com:repos/website" plom
+elif [ "${init_state}" = "new" ]; then
+  su -lc "cd /var/repos && git init --bare website.git" plom
+fi
+cp "${config_tree_prefix}/other_files/website_hook_post-receive" /var/repos/website.git/hooks/post-receive
+su -lc 'cd /var/www && git clone /var/repos/website.git .' plom
+
+# Add encryption key.
+keyservers='sks-keyservers.net/ keys.gnupg.net'
+set +e
+while true; do
+    do_break=0
+    for keyserver in $(echo "${keyservers}"); do
+        su plom -c "gpg --no-tty --keyserver $keyserver --recv-key ${gpg_key}"
+        if [ $? -eq "0" ]; then
+            do_break=1
+            break
+        fi
+        echo "Attempt with keyserver ${keyserver} unsuccessful, trying other."
+    done
+    if [ "${do_break}" -eq "1" ]; then
+        break
+    fi
+done
+set -e
+
+# Set up plomlombot.
+irclogs_dir=/var/www/html/irclogs
+irclogs_pw_dir=/var/www/irclogs_pw
+mkdir -p "${irclogs_dir}"
+chown -R plom:plom "${irclogs_dir}"
+mkdir -p "${irclogs_pw_dir}"
+chown -R plom:plom "${irclogs_pw_dir}"
+if [ "${init_state}" = "new" ]; then
+    # Handle the case that the repo is in the old pre-buster server setup –
+    # even then, the URL should be the same.
+  su -lc "cd /var/repos && git clone --mirror https://plomlompom.com/repos/clone/plomlombot-irc" plom
+  su -lc "touch /var/repos/plomlombot-irc.git/git-daemon-export-ok" plom
+  cp "${config_tree_prefix}/other_files/plomlombot_hook_post-receive" /var/repos/plomlombot-irc.git/hooks/post-receive
+fi
+su -lc "git clone /var/repos/plomlombot-irc.git" plom
+cp "${config_tree_prefix}/other_files/plomlombot_daemon.sh" /home/plom/
+chown plom:plom /home/plom/plomlombot_daemon.sh
+if [ "${init_state}" = "new" ]; then
+  echo 'bot: plomlombog plomlombog #plomlomtest irc.freenode.net foo bar' >> /home/plom/.plomlombot
+  chown plom:plom /home/plom/.plomlombot
+else
+  cp "${config_tree_prefix}/setup_scripts/mirror_dir.sh" /home/plom/
+  su -lc "./mirror_dir.sh ${old_server} /home/plom/plomlombot_db" plom
+  rm /home/plom/mirror_dir.sh
+  su -lc "scp plom@${old_server}:.plomlombot ~" plom
+  su -lc "ssh plom@${old_server} \"su -lc 'service plomlombot stop'\"" plom
+fi
+systemctl enable plomlombot.service
+service plomlombot start
+
+# In the above step, we might have created a root-owned /var/www/html –
+# fix this here.
+chown -R plom:plom /var/www/html
+
+# TODO:
+# - rename /home/plom/public_repos to /home/plom/repos
+
+service nginx restart