genpasswd

assets/gitdeploy/deploy-drupal.sh

@@ -1,25 +0,0 @@
-#!/bin/bash
-
-echo "updating drupal 8"
-echo "Switching to project docroot."
-cd ./app
-echo ""
-echo "Pulling down latest code."
-git pull --ff-only origin prod
-echo ""
-echo "Clearing drush caches."
-drush cache-clear drush
-echo ""
-echo "Composer install."
-composer install --no-dev
-echo ""
-echo "Running database updates."
-drush updb -y
-echo ""
-echo "Importing configuration."
-drush config-import -y
-echo ""
-echo "Clearing caches."
-drush cr
-echo ""
-echo "Deployment complete."

assets/gitdeploy/deploy-simple.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-
-echo "updating"
-echo "Switching to project docroot."
-cd ./app
-echo ""
-echo "Pulling down latest code."
-git pull --ff-only origin prod
-echo ""
-echo "Deployment complete."

assets/gitdeploy/git-post-receive

@@ -1,20 +0,0 @@
-#!/bin/bash
-#hook/post-receive
-#CONFIG
-
-PRODDIR="www"
-
-read oldrev newrev refname
-if [ $refname = "refs/heads/prod" ]; then
-  echo "===== DEPLOYING APP ====="
-  unset GIT_DIR
-  cd ~
-  cd $PRODDIR
-  # git pull --ff-only origin prod
-  # run deploy script instead
-  . deploy.sh
-  echo $?
-  echo "====== OK ====="
-else
-  echo "Warning Commit not deployed, please use prod branch"
-fi

assets/lemp/default.nginxconf

@@ -21,7 +21,7 @@ server {
 	root /var/www/html;
 
 	# Add index.php to the list if you are using PHP
-	index index.html index.htm index.php;
+	index index.html index.htm index.nginx-debian.html index.php;
 
 	server_name _;
 
@@ -31,49 +31,6 @@ server {
 		try_files $uri $uri/ =404;
 	}
 
-	location /phpmyadmin {
-		root /usr/share/webapps/;
-		auth_basic "Admin Login";
-    auth_basic_user_file passwds;
-
-    # Deny static files
-    location ~ ^/phpMyAdmin/(README|LICENSE|ChangeLog|DCO)$ {
-      deny all;
-    }
-
-    # Deny .md files
-    location ~ ^/phpMyAdmin/(.+\.md)$ {
-      deny all;
-    }
-
-    # Deny setup directories
-    location ~ ^/phpMyAdmin/(doc|sql|setup)/ {
-      deny all;
-    }
-
-    location ~ ^/phpmyadmin/(.+\.php)$ {
-      fastcgi_pass      127.0.0.1:9000;
-      fastcgi_index     index.php;
-      include           fastcgi.conf;
-      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-      try_files $uri $document_root$fastcgi_script_name =404;
-
-      fastcgi_split_path_info ^(.+\.php)(/.*)$;
-      fastcgi_param PATH_INFO $fastcgi_path_info;
-
-      fastcgi_param HTTP_PROXY "";
-      fastcgi_param HTTPS off;
-      fastcgi_request_buffering off;
-    }
-
-    location ~ ^/phpmyadmin/(.*\.(eot|otf|woff|ttf|css|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|xls|tar|bmp))$ {
-      root /usr/share/webapps/;
-      expires 30d;
-      log_not_found off;
-      access_log off;
-    }
-	}
-
 	# pass PHP scripts to FastCGI server
 	location ~ \.php$ {
 		fastcgi_pass      127.0.0.1:9000;
@@ -106,7 +63,4 @@ server {
 	  # allow CURRENT-SERVER-IP;
 	  deny all;
 	}
-
-  # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options DENY;
 }

assets/mysqlbackup.sh

@@ -1,58 +0,0 @@
-#!/bin/bash
-# Simple script to backup MySQL databases
-
-# Parent backup directory
-backup_parent_dir="/var/backups/mysql"
-
-# MySQL settings
-mysql_user="root"
-mysql_password="ROOTPASSWD"
-
-# Read MySQL password from stdin if empty
-# if [ -z "${mysql_password}" ]; then
-#   echo -n "Enter MySQL ${mysql_user} password: "
-#   read -s mysql_password
-#   echo
-# fi
-
-# Check MySQL password
-echo exit | mysql --user=${mysql_user} --password=${mysql_password} -B 2>/dev/null
-if [ "$?" -gt 0 ]; then
-  echo "MySQL ${mysql_user} password incorrect"
-  exit 1
-else
-  echo "MySQL ${mysql_user} password correct."
-fi
-
-# Create backup directory and set permissions
-backup_date=`date +%Y_%m_%d_%H_%M`
-backup_dir="${backup_parent_dir}/${backup_date}"
-echo "Backup directory: ${backup_dir}"
-mkdir -p "${backup_dir}"
-chmod 644 "${backup_dir}"
-
-# Get MySQL databases
-mysql_databases=`echo 'show databases' | mysql --user=${mysql_user} --password=${mysql_password} -B | sed /^Database$/d`
-
-# Backup and compress each database
-for database in $mysql_databases
-do
-  if [ "${database}" == "information_schema" ] || [ "${database}" == "performance_schema" ]; then
-        additional_mysqldump_params="--skip-lock-tables --compact --no-autocommit "
-  else
-        additional_mysqldump_params=""
-  fi
-  echo "Creating backup of \"${database}\" database"
-  mysqldump ${additional_mysqldump_params} --user=${mysql_user} --password=${mysql_password} ${database} | gzip > "${backup_dir}/${database}.sql.gz"
-  chmod 644 "${backup_dir}/${database}.sql.gz"
-done
-
-# compress the folder
-# tar -zcvf "${backup_dir}.tar.gz" "${backup_dir}"
-# rm -rf "${backup_dir}"
-
-# Rotate backups
-# Delete files older than 30 days
-find $backup_parent_dir/ -type f -mtime +60 -delete;
-# Delete empty directories
-find $backup_parent_dir/ -type d -empty -delete;

assets/opendkim/opendkim.conf

@@ -1,21 +0,0 @@
-Socket local:/run/opendkim/opendkim.sock
-Syslog yes
-UMask 002
-UserID postfix:postfix
-
-Selector mail
-Mode sv
-SubDomains yes
-AutoRestart yes
-Background yes
-Canonicalization relaxed/relaxed
-DNSTimeout 5
-SignatureAlgorithm rsa-sha256
-X-Header yes
-Logwhy yes
-
-InternalHosts /etc/internalhosts
-KeyTable /etc/opendkim/keytable
-SigningTable refile:/etc/opendkim/signtable
-
-OversignHeaders From

assets/vhosts/drupal-ssl.nginxconf

@@ -1,140 +0,0 @@
-# https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
-# https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
-server {
-  listen 80;
-  server_name DOMAIN.LTD;
-  return 301 https://$server_name$request_uri;
-}
-
-server {
-  listen 443 ssl;
-  listen [::]:443 ssl;
-
-  server_name DOMAIN.LTD;
-
-  root /var/www/DOMAIN.LTD/app/web;
-
-  #SSL Certificates
-  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-  ssl_certificate "/etc/letsencrypt/live/DOMAIN.LTD/fullchain.pem";
-  ssl_certificate_key "/etc/letsencrypt/live/DOMAIN.LTD/privkey.pem";
-  ssl_dhparam /etc/nginx/ssl/certs/DOMAIN.LTD/dhparam.pem;
-  # ssl_session_cache shared:SSL:1m;
-  ssl_session_timeout 10m;
-  ssl_ciphers HIGH:!aNULL:!MD5;
-  #ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
-  ssl_prefer_server_ciphers  on;
-
-  add_header Strict-Transport-Security "max-age=31536000;
-  #includeSubDomains" always;
-
-  charset utf-8;
-
-  location = /favicon.ico {
-    access_log off;
-    log_not_found off;
-  }
-
-  location = /robots.txt  {
-    allow all;
-    access_log off;
-    log_not_found off;
-  }
-
-  location ~ \..*/.*\.php$ {
-    return 403;
-  }
-
-  location ~ ^/sites/.*/private/ {
-    return 403;
-  }
-
-  # Block access to scripts in site files directory
-  location ~ ^/sites/[^/]+/files/.*\.php$ {
-    deny all;
-  }
-
-  # Allow "Well-Known URIs" as per RFC 5785
-  location ~* ^/.well-known/ {
-      allow all;
-  }
-
-  # Block access to "hidden" files and directories whose names begin with a
-  # period. This includes directories used by version control systems such
-  # as Subversion or Git to store control files.
-  location ~ (^|/)\. {
-    return 403;
-  }
-
-  location / {
-    # try_files $uri @rewrite; # For Drupal <= 6
-    try_files $uri /index.php?$query_string; # For Drupal >= 7
-  }
-
-  location @rewrite {
-    rewrite ^/(.*)$ /index.php?q=$1;
-  }
-
-  # Don't allow direct access to PHP files in the vendor directory.
-  location ~ /vendor/.*\.php$ {
-    deny all;
-    return 404;
-  }
-
-  location ~ /\.ht {
-    deny all;
-  }
-
-  access_log on;
-  error_log /var/www/DOMAIN.LTD/log/error.log;
-
-  sendfile off;
-
-  client_max_body_size 100m;
-
-  # In Drupal 8, we must also match new paths where the '.php' appears in
-  # the middle, such as update.php/selection. The rule we use is strict,
-  # and only allows this pattern with the update.php front controller.
-  # This allows legacy path aliases in the form of
-  # blog/index.php/legacy-path to continue to route to Drupal nodes. If
-  # you do not have any paths like that, then you might prefer to use a
-  # laxer rule, such as:
-  #   location ~ \.php(/|$) {
-  # The laxer rule will continue to work if Drupal uses this new URL
-  # pattern with front controllers other than update.php in a future
-  # release.
-  location ~ '\.php$|^/update.php' {
-    # fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
-    include fastcgi.conf;
-    # Block httpoxy attacks. See https://httpoxy.org/.
-    fastcgi_param HTTP_PROXY "";
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    fastcgi_param PATH_INFO $fastcgi_path_info;
-    fastcgi_param QUERY_STRING $query_string;
-    fastcgi_intercept_errors on;
-    # fastcgi_buffer_size 16k;
-    # fastcgi_buffers 4 16k;
-    fastcgi_pass 127.0.0.1:9000;
-  }
-  # Fighting with Styles? This little gem is amazing.
-  # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
-  location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
-    try_files $uri @rewrite;
-  }
-
-  # Handle private files through Drupal. Private file's path can come
-  # with a language prefix.
-  location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
-    try_files $uri /index.php?$query_string;
-  }
-
-  location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
-    try_files $uri @rewrite;
-    expires max;
-    log_not_found off;
-  }
-
-  # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
-}

assets/vhosts/drupal.nginxconf

@@ -1,117 +0,0 @@
-# https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
-server {
-    listen 80;
-    server_name DOMAIN.LTD;
-    root /var/www/DOMAIN.LTD/app/web;
-
-    charset utf-8;
-
-    location = /favicon.ico {
-      access_log off;
-      log_not_found off;
-    }
-
-    location = /robots.txt  {
-      allow all;
-      access_log off;
-      log_not_found off;
-    }
-
-    location ~ \..*/.*\.php$ {
-      return 403;
-    }
-
-    location ~ ^/sites/.*/private/ {
-      return 403;
-    }
-
-    # Block access to scripts in site files directory
-    location ~ ^/sites/[^/]+/files/.*\.php$ {
-      deny all;
-    }
-
-    # Allow "Well-Known URIs" as per RFC 5785
-    location ~* ^/.well-known/ {
-        allow all;
-    }
-
-    # Block access to "hidden" files and directories whose names begin with a
-    # period. This includes directories used by version control systems such
-    # as Subversion or Git to store control files.
-    location ~ (^|/)\. {
-      return 403;
-    }
-
-    location / {
-      # try_files $uri @rewrite; # For Drupal <= 6
-      try_files $uri /index.php?$query_string; # For Drupal >= 7
-    }
-
-    location @rewrite {
-      rewrite ^/(.*)$ /index.php?q=$1;
-    }
-
-    # Don't allow direct access to PHP files in the vendor directory.
-    location ~ /vendor/.*\.php$ {
-      deny all;
-      return 404;
-    }
-
-    location ~ /\.ht {
-      deny all;
-    }
-
-    access_log on;
-    error_log /var/www/DOMAIN.LTD/log/error.log;
-
-    sendfile off;
-
-    client_max_body_size 100m;
-
-    # In Drupal 8, we must also match new paths where the '.php' appears in
-    # the middle, such as update.php/selection. The rule we use is strict,
-    # and only allows this pattern with the update.php front controller.
-    # This allows legacy path aliases in the form of
-    # blog/index.php/legacy-path to continue to route to Drupal nodes. If
-    # you do not have any paths like that, then you might prefer to use a
-    # laxer rule, such as:
-    #   location ~ \.php(/|$) {
-    # The laxer rule will continue to work if Drupal uses this new URL
-    # pattern with front controllers other than update.php in a future
-    # release.
-    location ~ '\.php$|^/update.php' {
-      # fastcgi_split_path_info ^(.+\.php)(/.+)$;
-      fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
-      include fastcgi.conf;
-      # Block httpoxy attacks. See https://httpoxy.org/.
-      fastcgi_param HTTP_PROXY "";
-      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-      fastcgi_param PATH_INFO $fastcgi_path_info;
-      fastcgi_param QUERY_STRING $query_string;
-      fastcgi_intercept_errors on;
-      # fastcgi_buffer_size 16k;
-      # fastcgi_buffers 4 16k;
-      fastcgi_pass 127.0.0.1:9000;
-    }
-    # Fighting with Styles? This little gem is amazing.
-    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
-    location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
-      try_files $uri @rewrite;
-    }
-
-    # Handle private files through Drupal. Private file's path can come
-    # with a language prefix.
-    location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
-      try_files $uri /index.php?$query_string;
-    }
-
-    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
-      try_files $uri @rewrite;
-      expires max;
-      log_not_found off;
-    }
-
-    # website should not be displayed inside a <frame>, an <iframe> or an <object>
-    add_header X-Frame-Options SAMEORIGIN;;
-
-}

assets/vhosts/index.php

@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" dir="ltr">
-  <head>
-    <meta charset="utf-8">
-    <title>DOMAIN.LTD</title>
-  </head>
-  <body>
-    <h1>DOMAIN.LTD</h1>
-
-    <?php phpinfo(); ?>
-
-  </body>
-</html>

assets/vhosts/simple-phpfpm-ssl.nginxconf

@@ -1,66 +0,0 @@
-# https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
-
-server {
-  listen 80;
-  server_name DOMAIN.LTD;
-  return 301 https://$server_name$request_uri;
-}
-
-server {
-  listen 443 ssl;
-  listen [::]:443 ssl;
-
-  server_name DOMAIN.LTD;
-
-  root /var/www/DOMAIN.LTD/app/web;
-  index index.html index.php;
-
-  charset utf-8;
-
-  location / {
-    try_files $uri $uri/ /index.php?$query_string;
-  }
-
-  location = /favicon.ico { access_log off; log_not_found off; }
-  location = /robots.txt  { access_log off; log_not_found off; }
-
-  access_log on;
-  error_log /var/www/DOMAIN.LTD/log/error.log;
-
-  sendfile off;
-
-  client_max_body_size 100m;
-
-  #SSL Certificates
-  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-  ssl_certificate "/etc/letsencrypt/live/DOMAIN.LTD/fullchain.pem";
-  ssl_certificate_key "/etc/letsencrypt/live/DOMAIN.LTD/privkey.pem";
-  ssl_dhparam /etc/nginx/ssl/certs/DOMAIN.LTD/dhparam.pem;
-  # ssl_session_cache shared:SSL:1m;
-  ssl_session_timeout 10m;
-  ssl_ciphers HIGH:!aNULL:!MD5;
-  #ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
-  ssl_prefer_server_ciphers  on;
-
-  add_header Strict-Transport-Security "max-age=31536000;
-  #includeSubDomains" always;
-
-  location ~ \.php$ {
-    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass 127.0.0.1;
-    fastcgi_index index.php;
-    include fastcgi.conf;
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    fastcgi_intercept_errors off;
-    fastcgi_buffer_size 16k;
-    fastcgi_buffers 4 16k;
-  }
-
-  location ~ /\.ht {
-    deny all;
-  }
-
-  # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;
-
-}

assets/vhosts/simple-phpfpm.nginxconf

@@ -1,42 +0,0 @@
-server {
-  listen 80;
-  server_name DOMAIN.LTD;
-
-  root /var/www/DOMAIN.LTD/app/web;
-  index index.html index.php;
-
-  charset utf-8;
-
-  location / {
-    try_files $uri $uri/ /index.php?$query_string;
-  }
-
-  location = /favicon.ico { access_log off; log_not_found off; }
-  location = /robots.txt  { access_log off; log_not_found off; }
-
-  access_log on;
-  error_log /var/www/DOMAIN.LTD/log/error.log;
-
-  sendfile off;
-
-  client_max_body_size 100m;
-
-  location ~ \.php$ {
-    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass 127.0.0.1:9000;
-    fastcgi_index index.php;
-    include fastcgi.conf;
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    fastcgi_intercept_errors off;
-    fastcgi_buffer_size 16k;
-    fastcgi_buffers 4 16k;
-  }
-
-  location ~ /\.ht {
-    deny all;
-  }
-
-  # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
-
-}

bin/checkroot.sh

@@ -3,8 +3,8 @@
 echo -e "checking root"
 
 if [ "$EUID" = 0 ]; then
-  echo -e "root ok"
-else
   echo -e "Please run as root"
   exit
+else
+  echo -e "root ok"
 fi

bin/email.sh

@@ -22,9 +22,10 @@ if [ ! -d "$_assets" ]; then
   fi
 fi
 
+# http://www.sycha.com/lamp-setup-debian-linux-apache-mysql-php#anchor13
 sleep 2
 
-apk add postfix mailx
+apk add mailx postfix
 
 mkdir /var/mail
 postmap /etc/postfix/aliases
@@ -32,54 +33,38 @@ postmap /etc/postfix/aliases
 rc-update add postfix
 /etc/init.d/postfix start
 
-# https://www.cyberciti.biz/faq/how-to-find-out-the-ip-address-assigned-to-eth0-and-display-ip-only/
-_IP=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
-_MASK=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f4)
 
-# TODO: change bounce email
-# echo -n "Please provide a bounce email address: "
-# read _bounce_email
 
-# TODO: DMARC
 
-# reverse dns
-
-# dkim
-echo "Configuring DKIM"
-
-apk add opendkim opendkim-utils
-
-mkdir /etc/opendkim/keys
-opendkim-genkey -b 2048 -d "$HOSTNAME" -s "$HOSTNAME".dkim --directory=/etc/opendkim/keys/
-
-chown opendkim:opendkim /etc/opendkim/keys/*
-
-mv /etc/opendkim/opendkim.conf /etc/opendkim/opendkim.conf.back
-cp "$_assets"/opendkim/opendkim.conf /etc/opendkim/opendkim.conf
-
-echo "*@$HOSTNAME $HOSTNAME" > /etc/opendkim/signtable
-echo "$HOSTNAME $HOSTNAME:mail:/etc/opendkim/keys/$HOSTNAME.dkim.private" > /etc/opendkim/keytable
-echo -e "localhost\n127.0.0.1\n$HOSTNAME\n$_IP/$_MASK" > /etc/internalhosts
-echo -e "smtpd_milters = unix:/run/opendkim/opendkim.sock\nnon_smtpd_milters = unix:/run/opendkim/opendkim.sock" >> /etc/postfix/main.cf
-
-rc-update add opendkim
-service opendkim start
-
-usermod -a -G opendkim postfix
-
-service postfix restart
-
-echo -e "DKIM"
-echo -e "please create a DKIM entry in your dns zone : mail._domainkey.$HOSTNAME \n"
-echo -e "your public key is : \n"
-cat /etc/opendkim/keys/"$HOSTNAME".dkim.txt
-
-echo -e "SPF"
-echo -e "you should edit an spf entry for $HOSTNAME in your dns zone :"
-echo -e "v=spf1 a mx ip4:$_IP"
-
-echo -e "MX"
-echo -e "If it does not exists, you should create an mx zone record for $HOSTNAME"
-
-echo "press any key to continue."
-read continu
+# dkim spf
+# echo "\033[35;1mConfiguring DKIM \033[0m"
+# while [ "$installdkim" != "y" ] && [ "$installdkim" != "n" ]
+# do
+#   echo -n "Should we install dkim for exim4 ? [y|n] "
+#   read installdkim
+# done
+# if [ "$installdkim" = "y" ]; then
+#   echo -n "Choose a domain for dkim (same domain as you chose before for exim4): "
+#   read domain
+#   selector=$(date +%Y%m%d)
+#
+#   mkdir /etc/exim4/dkim
+#   openssl genrsa -out /etc/exim4/dkim/"$domain"-private.pem 1024 -outform PEM
+#   openssl rsa -in /etc/exim4/dkim/"$domain"-private.pem -out /etc/exim4/dkim/"$domain".pem -pubout -outform PEM
+#   chown root:Debian-exim /etc/exim4/dkim/"$domain"-private.pem
+#   chmod 440 /etc/exim4/dkim/"$domain"-private.pem
+#
+#   cp "$_assets"/exim4_dkim.conf /etc/exim4/conf.d/main/00_local_macros
+#   sed -i -r "s/DOMAIN_TO_CHANGE/$domain/g" /etc/exim4/conf.d/main/00_local_macros
+#   sed -i -r "s/DATE_TO_CHANGE/$selector/g" /etc/exim4/conf.d/main/00_local_macros
+#
+#   update-exim4.conf
+#   systemctl restart exim4
+#   echo "please create a TXT entry in your dns zone : $selector._domainkey.$domain \n"
+#   echo "your public key is : \n"
+#   cat /etc/exim4/dkim/"$domain".pem
+#   echo "press any key to continue."
+#   read continu
+# else
+#   echo 'dkim not installed'
+# fi

bin/gitdeploy.sh

@@ -1,132 +0,0 @@
-#!/bin/sh
-# bachir soussi chiadmi
-
-# get the current position
-_cwd="$(pwd)"
-
-echo -e '
-       _ _
-  __ _(_) |_
- / _` | |  _|
- \__, |_|\__|
- |___/
-'
-echo -e "Create new git barre repos and deploy script"
-echo "Git barre repo will be installed in chosen user home directory"
-echo "git prod repos will be installed in app directory of provided domain, the domain have to exists as shortcut in chosen /home/user/www before running this script. Please run first bin/vhost.sh script and say yes to the question create a shortcut !"
-
-. bin/checkroot.sh
-
-while [ "$yn" != "yes" ] && [ "$yn" != "no" ]
-do
-  echo -n "Should we installl git deployement? [yes|no] "
-  read yn
-  # yn=${yn:-y}
-done
-if [ "$yn" = "yes" ]; then
-
-  # get the current position
-  _cwd="$(pwd)"
-
-  # check for assets forlder
-  _assets="$_cwd/assets"
-  if [ ! -d "$_assets" ]; then
-    _assets="$_cwd/../assets"
-    if [ ! -d "$_assets" ]; then
-      echo "!! can't find assets directory !!"
-      exit
-    fi
-  fi
-
-  # if $user var does not exists (gitdeploy.sh ran directly) ask for it
-  if [ -z ${user+x} ]; then
-    while [ "$user" = "" ]
-    do
-      read -p "enter an existing user name ? " user
-      if [ "$user" != "" ]; then
-        # check if user already exists
-        if id "$user" >/dev/null 2>&1; then
-          read -p "is user name $user correcte [y|n] " validated
-          if [ "$validated" = "y" ]; then
-            break
-          else
-            user=""
-          fi
-        else
-          echo -e "user $user doesn't exists, you must provide an existing user"
-          user=""
-        fi
-      fi
-    done
-  fi
-
-  # if $_domain var does not exists (gitdeploy.sh ran directly) ask for it
-  if [ -z ${_domain+x} ]; then
-    while [ "$_domain" = "" ]
-    do
-      read -p "enter a domain name ? " _domain
-      if [ "$_domain" != "" ]; then
-        if [ ! -d /home/"$user"/www/"$_domain" ]; then
-          echo "/home/$user/www/$_domain does not exists !"
-          # exit
-          _domain=""
-        else
-          read -p "is domain $_domain correcte [y|n] " validated
-          if [ "$validated" = "y" ]; then
-            break
-          else
-            _domain=""
-          fi
-        fi
-      fi
-    done
-  fi
-
-  # ask for simple php conf or drupal conf
-  while [ "$_drupal" != "yes" ] && [ "$_drupal" != "no" ]
-  do
-    echo -n "Is your site is a drupal 8 instance? [yes|no] "
-    read _drupal
-  done
-
-  echo "seting up bare repositorie to push to"
-  mkdir /home/"$user"/git-repos
-  mkdir /home/"$user"/git-repos/"$_domain".git
-  cd /home/"$user"/git-repos/"$_domain".git
-  git init --bare
-
-  echo "creating hooks that will update the site repo"
-  cp "$_assets"/gitdeploy/git-post-receive /home/"$user"/git-repos/"$_domain".git/hooks/post-receive
-  sed -i -r "s#PRODDIR=\"www\"#PRODDIR=\"/home/$user/www/$_domain\"#g" /home/"$user"/git-repos/"$_domain".git/hooks/post-receive
-  chown -R "$user":"$user" /home/"$user"/git-repos
-  chmod +x /home/"$user"/git-repos/"$_domain".git/hooks/post-receive
-
-  echo "seting up git repo on site folder"
-  rm -rf /home/"$user"/www/"$_domain"/app/*
-  cd /home/"$user"/www/"$_domain"/app
-  git init
-  # link to the bare repo
-  git remote add origin /home/"$user"/git-repos/"$_domain".git
-  chown -R www:"$user" /home/"$user"/www/"$_domain"/app
-  chmod -R g+rw /home/"$user"/www/"$_domain"/app
-  git remote -v
-  git status
-
-  echo "adding deploy script"
-  if [ "$_drupal" = "yes" ]; then
-    cp "$_assets"/gitdeploy/deploy-drupal.sh /home/"$user"/www/"$_domain"/deploy.sh
-  else
-    cp "$_assets"/gitdeploy/deploy-simple.sh /home/"$user"/www/"$_domain"/deploy.sh
-  fi
-  chown "$user":"$user" /home/"$user"/www/"$_domain"/deploy.sh
-  chmod +x /home/"$user"/www/"$_domain"/deploy.sh
-
-  # done
-  _cur_ip=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
-  echo "git repos for $_domain install succeed"
-  echo "your site stay now to /home/$user/www/$_domain/app"
-  echo "you can push updates on prod branch through $user@$_cur_ip:git-repositories/$_domain.git"
-  cd "$_cwd"
-else
-  echo "Git barre repo creation aborted"
-fi

bin/knockd.sh

@@ -33,24 +33,22 @@ echo -n "checking if ufw is installed"
 ufw_installed=$(apk list -I | grep "ufw")
 if ! $ufw_installed; then
   echo -n "ufw installed"
-
-  mv /etc/knockd.conf /etc/knockd.conf.ori
-  cp "$_assets"/knockd.conf /etc/knockd.conf
-  echo -n "define a sequence number for opening ssh (as 7000,8000,9000) : "
-  read sq
-  sed -i "s/7000,8000,9000/$sq/g" /etc/knockd.conf
-
-  rc-update add knockd
-  /etc/init.d/knockd start
-
-  ufw delete allow ssh
-
-  echo -e "knockd installed and configured"
-  echo -e "please note this sequence for future ssh knocking"
-  echo "$sq"
 else
-  #. bin/ufw.sh
-  echo -n "ufw not installed, needed by knockd, configuration aborted"
+  . bin/ufw.sh
 fi
 
+mv /etc/knockd.conf /etc/knockd.conf.ori
+cp "$_assets"/knockd.conf /etc/knockd.conf
+echo -n "define a sequence number for opening ssh (as 7000,8000,9000) : "
+read sq
+sed -i "s/7000,8000,9000/$sq/g" /etc/knockd.conf
+
+rc-update add knockd
+/etc/init.d/knockd start
+
+ufw delete allow ssh
+
+echo -e "knockd installed and configured"
+echo -e "please note this sequence for future ssh knocking"
+echo "$sq"
 sleep 3

bin/lemp.sh

@@ -35,23 +35,20 @@ echo -e '
 echo -e "installing Mysql"
 sleep 3
 
-apk add mariadb mariadb-client mariadb-common
-
 # https://bugs.alpinelinux.org/issues/9046
-echo -n "are Maridb databases strored in a zfs file system (eg. through proxmox container)? [y|n] "
+echo -n "are Maridb databases strored in a zfs file system? [y|n] "
 read yn
 if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
   echo -e "Stick with mariadb 10.1.x due to incompatibility of newer version with zfs"
   echo -e "Please see this bug https://bugs.alpinelinux.org/issues/9046"
-  echo "http://dl-cdn.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
-  # echo -e "mariadb<10.1.99\nmariadb-client<10.1.99\nmariadb-common<10.1.99" >> /etc/apk/world
-  sed -i "s|^mariadb$|mariadb<10.1.99|g" /etc/apk/world
-  sed -i "s|^mariadb-client$|mariadb-client<10.1.99|g" /etc/apk/world
-  sed -i "s|^mariadb-common$|mariadb-common<10.1.99|g" /etc/apk/world
-  apk update && apk upgrade
+  echo "http://dl-5.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
+  echo -e "mariadb<10.1.99\nmariadb-client<10.1.99\nmariadb-common<10.1.99" >> /etc/apk/world
+  apk update
 fi
 
-mysql_install_db --user=mysql --datadir="/var/lib/mysql"
+apk add mariadb mariadb-client
+
+mysql_install_db --user=mysql --datadir=/var/lib/mysql
 
 rc-update add mariadb
 service mariadb start
@@ -74,22 +71,15 @@ echo -e '
 '
 echo -e "Installing PHP 7.0"
 sleep 3
-apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json php7-dom php7-tokenizer php7-iconv php7-xmlwriter
-
-# to make php5 availabe
-# echo "http://dl-cdn.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
-# apk add php5-fpm php5-pdo_mysql php5-opcache php5-curl php5-zip php5-xml php5-gd php5-mcrypt php5-phar php5-json php5-dom php5-iconv
+apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json
 
 echo -e "Configuring PHP"
 
 sed -i "s/memory_limit\ =\ 128M/memory_limit = 512M/g" /etc/php7/php.ini
 
-TIMEZONE="Europe/Paris"
+TIMEZONE="Europe/Helsinki"
 sed -i "s|;*date.timezone =.*|date.timezone = ${TIMEZONE}|i" /etc/php7/php.ini
 
-sed -i "s|user = nobody|user = www|i" /etc/php7/php-fpm.d/www.conf
-sed -i "s|group = nobody|group = www|i" /etc/php7/php-fpm.d/www.conf
-
 rc-update add php-fpm7
 service php-fpm7 start
 
@@ -98,36 +88,51 @@ service php-fpm7 start
 echo -e "php installed"
 
 echo -e '
-       _         __  __        _      _       _
-  _ __| |_  _ __|  \/  |_  _  /_\  __| |_ __ (_)_ _
- | `_ \ ` \| `_ \ |\/| | || |/ _ \/ _` | `  \| | ` \
- | .__/_||_| .__/_|  |_|\_, /_/ \_\__,_|_|_|_|_|_||_|
- |_|       |_|          |__/
+            _
+  _ _  __ _(_)_ _ __ __
+ | ` \/ _` | | ` \\ \ /
+ |_||_\__, |_|_||_/_\_\
+      |___/
 '
-echo -e "Installing phpMyAdmin"
-apk add phpmyadmin php7-mysqli
-service php-fpm7 restart
+echo -e "Installing Nginx"
+sleep 3
+apk add nginx
 
-chmod +r /etc/phpmyadmin/config.inc.php
+adduser -D -g 'www' www
+mkdir -p /var/www/html
+chown -R www:www /var/lib/nginx
+chown -R www:www /var/www/html
 
-# /**
-#  * This is needed for cookie based authentication to encrypt password in
-#  * cookie. Needs to be 32 chars long.
-#  */
-_blowfish="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c32)"
-sed -i "s|$cfg['blowfish_secret'] = ''|$cfg['blowfish_secret'] = '${_blowfish}'|i" /etc/phpmyadmin/config.inc.php
+mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.ori
+cp "$_assets"/lemp/default.nginxconf /etc/nginx/conf.d/default.conf
+cp "$_assets"/lemp/index.php /var/www/html/
 
-mkdir /usr/share/webapps/phpmyadmin/tmp
-chmod 777 /usr/share/webapps/phpmyadmin/tmp
+rc-update add nginx
+service nginx start
+echo -e "Nginx installed"
 
-echo -e "securing phpMyAdmin"
-_pass="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c8)"
-_encrypted=$(openssl passwd -apr1 $_pass)
-echo -e "pma:$_encrypted" > /etc/nginx/passwds
-# service apache2 restart
-echo -e "phpMyAdmin installed"
-echo -e "You can access it at yourip/phpmyadmin"
-echo -e "please note the credentials user: pma passwd:$_pass"
+# echo -e '
+#        _         __  __        _      _       _
+#   _ __| |_  _ __|  \/  |_  _  /_\  __| |_ __ (_)_ _
+#  | `_ \ ` \| `_ \ |\/| | || |/ _ \/ _` | `  \| | ` \
+#  | .__/_||_| .__/_|  |_|\_, /_/ \_\__,_|_|_|_|_|_||_|
+#  |_|       |_|          |__/
+# '
+# echo -e "Installing phpMyAdmin"
+# apk add phpmyadmin
+# ln -s /usr/share/phpmyadmin /var/www/html/
+# cp "$_assets"/nginx-phpmyadmin.conf > /etc/nginx/sites-available/phpmyadmin.conf
+# ln -s /etc/nginx/sites-available/phpmyadmin.conf /etc/nginx/sites-enabled/phpmyadmin.conf
+#
+# # echo -e "securing phpMyAdmin"
+# # sed -i "s/DirectoryIndex index.php/DirectoryIndex index.php\nAllowOverride all/"
+# # cp "$_assets"/phpmyadmin_htaccess > /usr/share/phpmyadmin/.htaccess
+# # echo -n "define a user name for phpmyadmin : "
+# # read un
+# # htpasswd -c /etc/phpmyadmin/.htpasswd $un
+# # service apache2 restart
+# echo -e "phpMyAdmin installed"
+# echo -e "You can access it at yourip/phpmyadmin"
 
 echo -e '
              _ _
@@ -137,7 +142,7 @@ echo -e '
 '
 echo -e "Installing Redis"
 sleep 3
-apk add redis php7-pecl-redis
+apk add redis php7-pecl-redis@edgecommunity
 
 # TODO set maxmemory=2gb
 # TODO set maxmemory-policy=volatile-lru
@@ -159,7 +164,7 @@ echo -e "Installing Composer"
 sleep 3
 export COMPOSER_HOME=/usr/local/composer
 curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
-composer about
+
 echo -e "Composer installed"
 
 
@@ -173,35 +178,6 @@ echo -e "Installing Drush and DrupalConsole"
 sleep 3
 curl https://drupalconsole.com/installer -L -o /usr/local/bin/drupal
 chmod +x /usr/local/bin/drupal
-drupal about
-# curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
-wget -O /usr/local/bin/drush https://github.com/drush-ops/drush-launcher/releases/latest/download/drush.phar
+curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
 chmod +x /usr/local/bin/drush
-
 echo -e "Drush and DrupalConsoleinstalled"
-
-
-echo -e '
-            _
-  _ _  __ _(_)_ _ __ __
- | ` \/ _` | | ` \\ \ /
- |_||_\__, |_|_||_/_\_\
-      |___/
-'
-echo -e "Installing Nginx"
-sleep 3
-apk add nginx
-
-adduser -D -g 'www' www
-mkdir -p /var/www/html
-chown -R www:www /var/lib/nginx
-chown -R www:www /var/www/html
-chown -R www:www /var/tmp/nginx
-
-mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.ori
-cp "$_assets"/lemp/default.nginxconf /etc/nginx/conf.d/default.conf
-cp "$_assets"/lemp/index.php /var/www/html/
-
-rc-update add nginx
-service nginx start
-echo -e "Nginx installed"

bin/misc.sh

@@ -17,7 +17,7 @@ echo '@edge http://dl-cdn.alpinelinux.org/alpine/edge/main
 
 apk update
 
-apk add procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen rsync # needrestart
+apk add procps vim curl tmux etckeeper htop lynx unzip # needrestart
 
 # sed -i "s/^# en_GB.UTF-8/en_GB.UTF-8/g" /etc/locale.gen
 # locale-gen
@@ -31,8 +31,4 @@ rc-service crond start && rc-update add crond
 
 git config --global core.safecrlf false
 
-echo "limiting su to the admin group"
-groupadd admin
-echo -e "auth       required   pam_wheel.so    group=admin" >> /etc/pam.d/su
-
 echo -e "Misc done"

bin/mysql-db.sh

@@ -1,56 +0,0 @@
-#!/bin/sh
-
-echo -e '
-     _ _      _   _
-  __| | |__  | | | |___ ___ _ _
- / _` |  _ \ | |_| (_-</ -_)  _|
- \__,_|_.__/  \___//__/\___|_|
-'
-
-echo -e "Create new mysql db and user (you will be asked a db name and a password)"
-
-. bin/checkroot.sh
-
-sleep 3
-
-# configure
-echo -n "Please provide the mysql root passwd : "
-read _root_mysql_passwd
-
-mysql -u root -p$_root_mysql_passwd -e "show databases;"
-
-echo -n "Enter new db name: "
-read db_name
-while [ "$db_name" = "" ]
-do
-  read -p "enter a db name ? " db_name
-  if [ "$db_name" != "" ]; then
-    # TODO check if db already exists
-    # if id "$db_name" >/dev/null 2>&1; then
-    #   echo "user $db_name alreday exists, you must provide a non existing user name."
-    #   db=""
-    # else
-      read -p "is db name $db_name correcte [y|n] " validated
-      if [ "$validated" = "y" ]; then
-        break
-      else
-        db_name=""
-      fi
-    # fi
-  fi
-done
-
-# generate random password for zabbix mysql user
-_passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
-
-# create zabbix mysql user
-mysql -u root -p$_root_mysql_passwd -e "CREATE DATABASE $db_name;"
-mysql -u root -p$_root_mysql_passwd -e "CREATE USER '$db_name'@'localhost' IDENTIFIED BY '$_passwd';"
-mysql -u root -p$_root_mysql_passwd -e "GRANT USAGE ON $db_name.* TO '$db_name'@'localhost';"
-
-mysql -u root -p$_root_mysql_passwd -e "show databases;"
-
-echo "database and user : $db_name installed"
-echo " please record your password $_passwd"
-echo "press any key to continue."
-read continu

bin/mysqlbackup.sh

@@ -1,41 +0,0 @@
-#!/bin/sh
-
-echo -e '
-  __  __               _   ___          _
- |  \/  |_  _ ___ __ _| | | _ ) __ _ __| |___  _ _ __ ___
- | |\/| | || (_-</ _  | | | _ \/ _  / _| / / || |  _ (_-<
- |_|  |_|\_, /__/\__, |_| |___/\__,_\__|_\_\\_,_| .__/__/
-         |__/       |_|                         |_|
-'
-
-. bin/checkroot.sh
-
-# get the current position
-_cwd="$(pwd)"
-# check for assets forlder
-_assets="$_cwd/assets"
-if [ ! -d "$_assets" ]; then
-  _assets="$_cwd/../assets"
-  if [ ! -d "$_assets" ]; then
-    echo "!! can't find assets directory !!"
-    exit
-  fi
-fi
-
-# adding the script
-cp "$_assets"/mysqlbackup.sh /usr/local/bin/
-chmod +x /usr/local/bin/mysqlbackup.sh
-
-# configure
-echo -n "Please provide the mysql root passwd : "
-read _root_mysql_passwd
-sed -i "s/ROOTPASSWD/$_root_mysql_passwd/g" /usr/local/bin/mysqlbackup.sh
-
-# creating crontab
-touch /var/spool/cron/crontabs/root
-crontab -l > /tmp/mycron
-echo "30 2 */2 * * /usr/local/bin/mysqlbackup.sh" >> /tmp/mycron
-crontab /tmp/mycron
-rm -f /tmp/mycron
-
-echo -e "mysql backup script installed"

bin/ufw.sh

@@ -13,14 +13,6 @@ sleep 2
 
 # TODO use awall instead of ufw ?
 
-# BUG
-# ufw
-# Traceback (most recent call last):
-#   File "/usr/sbin/ufw", line 25, in <module>
-#     import ufw.frontend
-# ModuleNotFoundError: No module named 'ufw'
-
-
 # ufw
 apk add ufw@testing
 ufw allow ssh # knockd will open the ssh port

bin/urbackup.sh

@@ -38,17 +38,12 @@ apk add linux-headers "g++" zlib zlib-dev "crypto++@testing" "crypto++-dev@testi
 ln -s /usr/lib/libcryptopp.so /usr/lib/libcryptopp.so.5.6
 
 # Download the UrBackup client source files and extract them
-# wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
-# wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.8/urbackup-client-2.4.8.0.tar.gz
-wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.10/urbackup-client-2.4.10.0.tar.gz
-
+wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
 cd /tmp
-# tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
-tar xzf /tmp/urbackup-client-2.4.10.0.tar.gz
+tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
 
 # Build the UrBackup client and install it
-# cd /tmp/urbackup-client-2.3.4.0
-cd /tmp/urbackup-client-2.4.10.0
+cd /tmp/urbackup-client-2.3.4.0
 ./configure --enable-headless
 make -j4
 make install
@@ -59,22 +54,19 @@ make install
 # configure
 echo -n "Please provide the urbackup-server's ip : "
 read _ip
-# echo -n "Please provide the internet_authkey of server : "
-# read _authkey
-# echo -n "Please provide the computer name of this client : "
-# read _computername
-_computername=$HOSTNAME
+echo -n "Please provide the internet_authkey of server : "
+read _authkey
+echo -n "Please provide the computer name of this client : "
+read _computername
 
-# internet_authkey=$_authkey
 echo "internet_server=$_ip
 internet_server_port=55415
+internet_authkey=$_authkey
 internet_mode_enabled=true
 internet_image_backups_def=false
-default_dirs_def=/etc;/var/www;/var/backups/mysql
+default_dirs_def=/etc;var/www;/var/backups/mysql
 startup_backup_delay_def=3
-computername=$_computername" > /etc/conf.d/urbackupclient
-
-# /usr/local/var/urbackup/data/settings.cfg
+computername=$_computername" > /usr/local/var/urbackup/data/settings.cfg
 
 # firewall
 ufw allow from "$_ip" to any port 35621

bin/user.sh

@@ -40,15 +40,10 @@ adduser "$user"
 sed -i "s/$user:\/bin\/ash/$user:\/bin\/bash/g" /etc/passwd
 
 # TODO limiting su to the admin group
-yn="reset"
-while [ "$yn" != "y" ] && [ "$yn" != "n" ]
-do
-  echo -n "Should we allow $user to su? [y|n] "
-  read yn
-done
-if [ "$yn" = "y" ]; then
-  echo "adding $user to admin group"
-  # admin group is created by misc
-  usermod -a -G admin "$user"
-fi
+# echo "adding $user to admin group and limiting su to the admin group"
+# groupadd admin
+# usermod -a -G admin "$user"
+# allow admin group to su
+# dpkg-statoverride --update --add root admin 4750 /bin/su
+
 echo -e "user $user configured"

bin/vhost.sh

@@ -1,153 +0,0 @@
-#!/bin/bash
-
-echo -e '
-      _           _
- __ _| |_  ___ __| |_
- \ V / ` \/ _ (_-<  _|
-  \_/|_||_\___/__/\__|
-'
-echo -e "Nginx VHOST install "
-
-. bin/checkroot.sh
-
-# get the current position
-_cwd="$(pwd)"
-
-# check for assets forlder
-_assets="$_cwd/assets"
-if [ ! -d "$_assets" ]; then
-  _assets="$_cwd/../assets"
-  if [ ! -d "$_assets" ]; then
-    echo "!! can't find assets directory !!"
-    exit
-  fi
-fi
-
-_domain=""
-_validated=""
-_drupal=""
-_letsencrypt=""
-
-while [ "$_domain" = "" ]
-do
-  read -p "enter a domain name ? " _domain
-  if [ "$_domain" != "" ]; then
-    read -p "is domain $_domain correcte [y|n] " validated
-    if [ "$validated" = "y" ]; then
-      break
-    else
-      _domain=""
-    fi
-  fi
-done
-
-# ask for simple php conf or drupal conf
-while [ "$_drupal" != "yes" ] && [ "$_drupal" != "no" ]
-do
-  echo -n "Is your site is a drupal one? [yes|no] "
-  read _drupal
-done
-
-# ask for let's encrypt
-while [ "$_letsencrypt" != "yes" ] && [ "$_letsencrypt" != "no" ]
-do
-  echo -e "Let's encrypt"
-  echo -e "Let's encrypt needs a public registered domain name with proper DNS records ( A records or CNAME records for subdomains pointing to your server)."
-  echo -n "Should we install let's encrypt certificate with $_domain? [yes|no] "
-  read _letsencrypt
-done
-
-service nginx stop
-
-# lets'encrypt
-# https://certbot.eff.org/lets-encrypt/debianstretch-nginx
-if [ "$_letsencrypt" = "yes" ]; then
-  apk add certbot
-  certbot certonly --standalone -d "$_domain" --cert-name "$_domain"
-  # TODO stop the whole process if letsencrypt faile
-  mkdir -p /etc/nginx/ssl/certs/"$_domain"
-  openssl dhparam -out /etc/nginx/ssl/certs/"$_domain"/dhparam.pem 2048
-  # renewing
-  touch /var/spool/cron/crontabs/root
-  crontab -l > mycron
-  echo -e "0 3 * * * certbot renew --pre-hook 'service nginx stop' --post-hook 'service nginx start' --cert-name $_domain" >> mycron
-  crontab mycron
-  rm -f mycron
-fi
-
-if [ "$_drupal" = "yes" ]; then
-  if [ "$_letsencrypt" = "yes" ]; then
-    _conffile="drupal-ssl.nginxconf"
-  else
-    _conffile="drupal.nginxconf"
-  fi
-else
-  if [ "$_letsencrypt" = "yes" ]; then
-    _conffile="simple-phpfpm-ssl.nginxconf"
-  else
-    _conffile="simple-phpfpm.nginxconf"
-  fi
-fi
-
-cp "$_assets/vhosts/$_conffile" /etc/nginx/conf.d/"$_domain".conf
-sed -i -r "s/DOMAIN\.LTD/$_domain/g" /etc/nginx/conf.d/"$_domain".conf
-
-mkdir -p /var/www/"$_domain"/app/web
-mkdir /var/www/"$_domain"/log
-
-cp "$_assets/vhosts/index.php" /var/www/"$_domain"/app/web/
-sed -i -r "s/DOMAIN\.LTD/$_domain/g" /var/www/"$_domain"/app/web/index.php
-
-#set proper right to user will handle the app
-chown -R www:www  /var/www/"$_domain"/
-# chmod -R g+w /var/www/"$_domain"/
-# chmod -R g+r /var/www/"$_domain"/
-
-# create a shortcut to the site
-echo -n "Should we install a shortcut for a user? [Y|n] "
-read yn
-yn=${yn:-y}
-if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
-  # if $user var does not exists (vhost.sh ran directly) ask for it
-  if [ -z ${user+x} ]; then
-    while [ "$user" = "" ]
-    do
-      read -p "enter an existing user name ? " user
-      if [ "$user" != "" ]; then
-        # check if user already exists
-        if id "$user" >/dev/null 2>&1; then
-          read -p "is user name $user correcte [y|n] " validated
-          if [ "$validated" = "y" ]; then
-            break
-          else
-            user=""
-          fi
-        else
-          echo -e "user $user doesn't exists, you must provide an existing user"
-          user=""
-        fi
-      fi
-    done
-  fi
-
-  echo -e "installing shortcut for '$user'";
-
-  mkdir /home/"$user"/www/
-  chown "$user":"$user" /home/"$user"/www/
-  ln -s /var/www/"$_domain" /home/"$user"/www/"$_domain"
-  chown "$user":"$user" /home/"$user"/www/"$_domain"
-  chown -R www:"$user" /home/"$user"/www/"$_domain"/app
-  chmod -R g+rw /home/"$user"/www/"$_domain"/app
-
-  . bin/gitdeploy.sh
-else
-  echo -e 'no shortcut installed'
-fi
-# activate the vhost
-# ln -s /etc/nginx/sites-available/"$_domain".conf /etc/nginx/sites-enabled/"$_domain".conf
-
-nginx -t
-
-# restart nginx
-service nginx start
-echo -e "vhost $_domain configured"

bin/zabbix.sh

@@ -22,35 +22,21 @@ if [ ! -d "$_assets" ]; then
   fi
 fi
 
-echo -n "do you want to limit zabbix-agent to 3.4? [y|n] "
-read yn
-if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
-  echo -e "Stick with zabbix-agent 3.4"
-  echo "http://dl-cdn.alpinelinux.org/alpine/v3.8/main" >> /etc/apk/repositories
-  echo "http://dl-cdn.alpinelinux.org/alpine/v3.8/community" >> /etc/apk/repositories
-  # echo -e "zabbix-agent<3.4.99" >> /etc/apk/world
-  apk update
-  # apk upgrade
-  apk add 'zabbix-agent=~3.4'
-else
-  apk add zabbix-agent
-fi
-
+apk add zabbix-agent
 
 # configure
-# echo -n "Please provide the current server's public ip : "
-# read _cur_ip
-# https://www.cyberciti.biz/faq/how-to-find-out-the-ip-address-assigned-to-eth0-and-display-ip-only/
-_cur_ip=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
-# echo -n "Please provide the hostname of this agent : "
-# read _host_name
-_host_name=$HOSTNAME
+echo -n "Please provide the current server's public ip : "
+read _cur_ip
 echo -n "Please provide the zabbix-server's ip : "
 read _ip
+echo -n "Please provide the hostname of this agent : "
+read _host_name
 echo -n "Please provide the mysql root password : "
 read _root_mysql_passwd
 
 
+
+
 # configure zabbix agent
 sed -i "s#Server=127.0.0.1#Server=$_ip#g" /etc/zabbix/zabbix_agentd.conf
 sed -i "s#ServerActive=127.0.0.1#ServerActive=$_ip#g" /etc/zabbix/zabbix_agentd.conf
@@ -63,21 +49,21 @@ sed -i "s|#\ Include=$|Include= $_agent_conf_d|g" /etc/zabbix/zabbix_agentd.conf
 # apk
 # check for alpine security updates
 
-# MYSQL
-# https://serverfault.com/questions/737018/zabbix-user-parameter-mysql-status-setting-home
-# create zabbix user home
-mkdir /var/lib/zabbix
-# generate random password for zabbix mysql user
-_passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
-# add mysql credentials to zabbix home
-printf "[client]\n
-user=zabbix\n
-password=$_passwd" > /var/lib/zabbix/.my.cnf
-# create zabbix mysql user
-mysql -uroot -p"$_root_mysql_passwd" -e "CREATE USER 'zabbix' IDENTIFIED BY '$_passwd';"
-mysql -uroot -p"$_root_mysql_passwd" -e "GRANT USAGE ON *.* TO 'zabbix'@'localhost' IDENTIFIED BY '$_passwd';"
-# add zabbix-agent parameter
-cp "$_assets"/zabbix/userparameter_mysql.conf "$_agent_conf_d"/
+# # MYSQL
+# # https://serverfault.com/questions/737018/zabbix-user-parameter-mysql-status-setting-home
+# # create zabbix user home
+# mkdir /var/lib/zabbix
+# # generate random password for zabbix mysql user
+# _passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c12)"
+# # add mysql credentials to zabbix home
+# printf "[client]\n
+# user=zabbix\n
+# password=$_passwd" > /var/lib/zabbix/.my.cnf
+# # create zabbix mysql user
+# mysql -uroot -p"$_root_mysql_passwd" -e "CREATE USER 'zabbix' IDENTIFIED BY '$_passwd';"
+# mysql -uroot -p"$_root_mysql_passwd" -e "GRANT USAGE ON *.* TO 'zabbix'@'localhost' IDENTIFIED BY '$_passwd';"
+# # add zabbix-agent parameter
+# cp "$_assets"/zabbix/userparameter_mysql.conf "$_agent_conf_d"/
 
 # NGINX
 # https://github.com/sfuerte/zbx-nginx
@@ -88,7 +74,7 @@ mkdir /etc/zabbix/zabbix_agentd.scripts
 cp "$_assets"/zabbix/scripts/nginx-stat.py /etc/zabbix/zabbix_agentd.scripts/
 chmod +x /etc/zabbix/zabbix_agentd.scripts/nginx-stat.py
 
-echo -n "Is This box a proxmox CT? [Y|n] "
+echo -n "This is box is a proxmox CT? [Y|n] "
 read yn
 yn=${yn:-y}
 if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then

install.sh

@@ -31,16 +31,8 @@ _cwd="$(pwd)"
 . bin/ufw.sh
 . bin/fail2ban.sh
 . bin/knockd.sh
-. bin/email.sh
+# . bin/email.sh
 . bin/lemp.sh
-. bin/mysqlbackup.sh
-  while [ "$vh" != "y" ] && [ "$vh" != "n" ]
-  do
-    echo -n "Should we install a vhost? [y|n] "
-    read vh
-  done
-  if [ "$vh" = "y" ]; then
-    . bin/vhost.sh
-  fi
+# . bin/vhost.sh
 . bin/zabbix.sh
 . bin/urbackup.sh

readme.md

@@ -1,48 +1,41 @@
-# Install web server and secure it on alpine linux 3.9
+# Install web server and secure it on alpine linux 3.8
 
 ## Branches
 each alpine linux stable release has it's branch (master is a clone of the last one)
 - [3.8](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.8)
-- [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9)
-- [3.10](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.10) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
+- [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
 
 ## Features
 
 - [x] upgrade
 - [x] bash
-- [x] misc (procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen tzdata)
+- [x] misc
 - [x] dotfiles
 - [x] user
 - [x] secure openssh
-- [ ] Ufw (may be eventualy replaced by awall ?)
+- [x] Ufw (may be eventualy replaced by awall ?)
 - [x] Fail2ban
-- [ ] Knockd
+- [x] Knockd
 - [x] Mariadb (bug https://bugs.alpinelinux.org/issues/9046)
-- [x] mysql backups
-- [x] php7-fpm (7.2)
-- [x] redis
+- [ ] mysql backups
+- [x] php7-fpm (7.1)
 - [x] Nginx
 - [x] drush
 - [x] composer
-- [x] vhosts
-- [x] letsencrypt
-- [x] git barre repos
-- [x] zabbix-agent (3.4 || 4)
+- [ ] letsencrypt
+- [ ] vhosts
+- [x] redis
+- [x] zabbix-agent (3.4)
 - [x] urbackup-client
 - [ ] solr
+- [ ] git barre repos
 - [ ] Proftpd
+- [x] passwd generator
 
 ## how to use it
 on a fresh install
 as root
 
-0 you may need to install ssh server
-```
-apk add openssh
-rc-update add sshd
-/etc/init.d/sshd start
-```
-
 1 install git
 ```
 apk add git
@@ -50,7 +43,8 @@ apk add git
 
 2 clone the repo
 ```
-git clone -b 3.10 --single-branch https://figureslibres.io/gogs/bachir/alpine-web-werver.git
+git clone -b 3.8 --single-branch https://figureslibres.io/gogs/bachir/al
+pine-web-werver.git
 ```
 
 3 you have to be root
@@ -69,8 +63,10 @@ cd alpine-web-server
 . install.sh
 ```
 
-All script in bin/ can be ran seperatly, but from the repos source exclusively eg: ```. bin/vhost.sh```. Be aware that all scripts need bash and some depends on packages and config installed by bin/misc.sh, run it once right after bin/bash.sh if you wont use the full install.sh.
-
+all script in bin/ can be ran seperatly, but from the repos source exclusively
+```
+. bin/misc.sh
+```
 
 ## ref
 [Alpine Linux wiki](https://wiki.alpinelinux.org)