added warning about drupal 9 mariadb version and zfs+maridb bug

assets/d7-drush-composer.json

@@ -0,0 +1,13 @@
+{
+  "require": {
+    "drush/drush": "~8.0",
+    "webflo/drupal-finder": "^1.0.0"
+  },
+  "extra": {
+    "installer-paths": {
+      ".": [
+        "type:drupal-core"
+      ]
+    }
+  }
+}

assets/gitdeploy/deploy-drupal.sh

@@ -4,8 +4,10 @@ echo "updating drupal 8"
 echo "Switching to project docroot."
 cd ./app
 echo ""
-echo "Pulling down latest code."
+echo "Pulling down latest code and submodules."
 git pull --ff-only origin prod
+git submodule update --init --recursive --remote
+
 echo ""
 echo "Clearing drush caches."
 drush cache-clear drush

assets/gitdeploy/deploy-simple.sh

@@ -6,5 +6,6 @@ cd ./app
 echo ""
 echo "Pulling down latest code."
 git pull --ff-only origin prod
+git submodule update --init --recursive --remote
 echo ""
 echo "Deployment complete."

assets/vhosts/drupal-ssl.nginxconf

@@ -1,13 +1,12 @@
 # https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
 # https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
 server {
-  listen 80;
+  listen [::]:80;
   server_name DOMAIN.LTD;
   return 301 https://$server_name$request_uri;
 }
 
 server {
-  listen 443 ssl;
   listen [::]:443 ssl;
 
   server_name DOMAIN.LTD;
@@ -136,5 +135,5 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
+  add_header X-Frame-Options SAMEORIGIN;
 }

assets/vhosts/drupal.nginxconf

@@ -1,6 +1,6 @@
 # https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
 server {
-    listen 80;
+    listen [::]:80;
     server_name DOMAIN.LTD;
     root /var/www/DOMAIN.LTD/app/web;
 
@@ -112,6 +112,6 @@ server {
     }
 
     # website should not be displayed inside a <frame>, an <iframe> or an <object>
-    add_header X-Frame-Options SAMEORIGIN;;
+    add_header X-Frame-Options SAMEORIGIN;
 
 }

assets/vhosts/simple-phpfpm-ssl.nginxconf

@@ -1,13 +1,12 @@
 # https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
 
 server {
-  listen 80;
+  listen [::]:80;
   server_name DOMAIN.LTD;
   return 301 https://$server_name$request_uri;
 }
 
 server {
-  listen 443 ssl;
   listen [::]:443 ssl;
 
   server_name DOMAIN.LTD;

assets/vhosts/simple-phpfpm.nginxconf

@@ -1,5 +1,5 @@
 server {
-  listen 80;
+  listen [::]:80;
   server_name DOMAIN.LTD;
 
   root /var/www/DOMAIN.LTD/app/web;
@@ -37,6 +37,6 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
+  add_header X-Frame-Options SAMEORIGIN;
 
 }

bin/gitdeploy.sh

@@ -125,7 +125,7 @@ if [ "$yn" = "yes" ]; then
   _cur_ip=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
   echo "git repos for $_domain install succeed"
   echo "your site stay now to /home/$user/www/$_domain/app"
-  echo "you can push updates on prod branch through $user@$_cur_ip:git-repositories/$_domain.git"
+  echo "you can push updates on prod branch through $user@$_cur_ip:git-repos/$_domain.git"
   cd "$_cwd"
 else
   echo "Git barre repo creation aborted"

bin/lemp.sh

@@ -74,7 +74,7 @@ echo -e '
 '
 echo -e "Installing PHP 7.0"
 sleep 3
-apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json php7-dom php7-tokenizer php7-iconv php7-xmlwriter
+apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json php7-dom php7-tokenizer php7-iconv php7-xmlwriter php7-simplexml
 
 # to make php5 availabe
 # echo "http://dl-cdn.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
@@ -83,6 +83,8 @@ apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-z
 echo -e "Configuring PHP"
 
 sed -i "s/memory_limit\ =\ 128M/memory_limit = 512M/g" /etc/php7/php.ini
+sed -i "s/post_max_size\ =\ 8M/post_max_size = 20M/g" /etc/php7/php.ini
+sed -i "s/upload_max_filesize\ =\ 2M/upload_max_filesize = 20M/g" /etc/php7/php.ini
 
 TIMEZONE="Europe/Paris"
 sed -i "s|;*date.timezone =.*|date.timezone = ${TIMEZONE}|i" /etc/php7/php.ini
@@ -119,15 +121,7 @@ sed -i "s|$cfg['blowfish_secret'] = ''|$cfg['blowfish_secret'] = '${_blowfish}'|
 
 mkdir /usr/share/webapps/phpmyadmin/tmp
 chmod 777 /usr/share/webapps/phpmyadmin/tmp
-
-echo -e "securing phpMyAdmin"
-_pass="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c8)"
-_encrypted=$(openssl passwd -apr1 $_pass)
-echo -e "pma:$_encrypted" > /etc/nginx/passwds
-# service apache2 restart
-echo -e "phpMyAdmin installed"
-echo -e "You can access it at yourip/phpmyadmin"
-echo -e "please note the credentials user: pma passwd:$_pass"
+# finishing the pma install after nginx
 
 echo -e '
              _ _
@@ -159,6 +153,7 @@ echo -e "Installing Composer"
 sleep 3
 export COMPOSER_HOME=/usr/local/composer
 curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+ln -sf /usr/local/bin/composer /usr/bin/composer
 composer about
 echo -e "Composer installed"
 
@@ -173,13 +168,16 @@ echo -e "Installing Drush and DrupalConsole"
 sleep 3
 curl https://drupalconsole.com/installer -L -o /usr/local/bin/drupal
 chmod +x /usr/local/bin/drupal
+ln -sf /usr/local/bin/drupal /usr/bin/drupal
 drupal about
 # curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
 wget -O /usr/local/bin/drush https://github.com/drush-ops/drush-launcher/releases/latest/download/drush.phar
 chmod +x /usr/local/bin/drush
+ln -sf /usr/local/bin/drush /usr/bin/drush
+drush status
+echo -e "Drush and DrupalConsole installed"
 
-echo -e "Drush and DrupalConsoleinstalled"
-
+# for non composer installed D7 site add assets/d7-drush-composer.json in root-folder/composer.json and run composer install
 
 echo -e '
             _
@@ -198,10 +196,20 @@ chown -R www:www /var/lib/nginx
 chown -R www:www /var/www/html
 chown -R www:www /var/tmp/nginx
 
+sed -i "s|user nginx;|user www;|i" /etc/nginx/nginx.conf
+
 mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.ori
 cp "$_assets"/lemp/default.nginxconf /etc/nginx/conf.d/default.conf
 cp "$_assets"/lemp/index.php /var/www/html/
-
 rc-update add nginx
 service nginx start
 echo -e "Nginx installed"
+
+echo -e "securing phpMyAdmin"
+_pass="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
+_encrypted=$(openssl passwd -apr1 $_pass)
+echo -e "pma:$_encrypted" > /etc/nginx/passwds
+echo -e "phpMyAdmin installed"
+echo -e "You can access it at yourip/phpmyadmin"
+echo -e "please note the credentials user: pma passwd:$_pass"
+sleep 3

bin/misc.sh

@@ -17,7 +17,7 @@ echo '@edge http://dl-cdn.alpinelinux.org/alpine/edge/main
 
 apk update
 
-apk add procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen rsync # needrestart
+apk add procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen rsync patch #ntp # needrestart
 
 # sed -i "s/^# en_GB.UTF-8/en_GB.UTF-8/g" /etc/locale.gen
 # locale-gen

bin/mysql-db.sh

@@ -40,13 +40,13 @@ do
   fi
 done
 
-# generate random password for zabbix mysql user
+# generate random password for new mysql user
 _passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
 
-# create zabbix mysql user
+# create new mysql user
 mysql -u root -p$_root_mysql_passwd -e "CREATE DATABASE $db_name;"
 mysql -u root -p$_root_mysql_passwd -e "CREATE USER '$db_name'@'localhost' IDENTIFIED BY '$_passwd';"
-mysql -u root -p$_root_mysql_passwd -e "GRANT USAGE ON $db_name.* TO '$db_name'@'localhost';"
+mysql -u root -p$_root_mysql_passwd -e "GRANT ALL ON $db_name.* TO '$db_name'@'localhost';"
 
 mysql -u root -p$_root_mysql_passwd -e "show databases;"
 

bin/ufw.sh

@@ -22,7 +22,7 @@ sleep 2
 
 
 # ufw
-apk add ufw@testing
+apk add ufw@edgecommunity
 ufw allow ssh # knockd will open the ssh port
 ufw allow http
 ufw allow https

bin/user.sh

@@ -39,6 +39,8 @@ adduser "$user"
 
 sed -i "s/$user:\/bin\/ash/$user:\/bin\/bash/g" /etc/passwd
 
+usermod -a -G www "$user"
+
 # TODO limiting su to the admin group
 yn="reset"
 while [ "$yn" != "y" ] && [ "$yn" != "n" ]

install.sh

@@ -7,6 +7,8 @@ echo -e '
  /_/ \_\_| .__/_|_||_\___| |____|___|_|  |_|_|
          |_|
 '
+# https://wiki.alpinelinux.org/wiki/Alpine_setup_scripts
+
 echo -e "\033[35;1mThis script has been tested only on Alpine Linux \033[0m"
 
 . bin/checkroot.sh
@@ -30,7 +32,7 @@ _cwd="$(pwd)"
 . bin/ssh.sh
 . bin/ufw.sh
 . bin/fail2ban.sh
-. bin/knockd.sh
+# . bin/knockd.sh
 . bin/email.sh
 . bin/lemp.sh
 . bin/mysqlbackup.sh

readme.md

@@ -1,10 +1,15 @@
-# Install web server and secure it on alpine linux 3.9
+# Install web server and secure it on alpine linux 3.12
+/!\ WARNING if your file system is ZFS, will not be compatible with drupal 9 because of mariadb bug
+
+https://bugs.alpinelinux.org/issues/9046
 
 ## Branches
 each alpine linux stable release has it's branch (master is a clone of the last one)
 - [3.8](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.8)
 - [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9)
-- [3.10](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.10) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
+- [3.10](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.10)
+- [3.11](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.11)
+- [3.12](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.12) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
 
 ## Features
 
@@ -14,12 +19,12 @@ each alpine linux stable release has it's branch (master is a clone of the last
 - [x] dotfiles
 - [x] user
 - [x] secure openssh
-- [ ] Ufw (may be eventualy replaced by awall ?)
+- [x] Ufw@edgecommunity
 - [x] Fail2ban
 - [ ] Knockd
 - [x] Mariadb (bug https://bugs.alpinelinux.org/issues/9046)
 - [x] mysql backups
-- [x] php7-fpm (7.2)
+- [x] php7-fpm (7.3.22)
 - [x] redis
 - [x] Nginx
 - [x] drush
@@ -50,7 +55,7 @@ apk add git
 
 2 clone the repo
 ```
-git clone -b 3.10 --single-branch https://figureslibres.io/gogs/bachir/alpine-web-werver.git
+git clone -b 3.12 --single-branch https://figureslibres.io/gogs/bachir/alpine-web-werver.git
 ```
 
 3 you have to be root