added warning about drupal 9 mariadb version and zfs+maridb bug

assets/d7-drush-composer.json

@@ -0,0 +1,13 @@
+{
+  "require": {
+    "drush/drush": "~8.0",
+    "webflo/drupal-finder": "^1.0.0"
+  },
+  "extra": {
+    "installer-paths": {
+      ".": [
+        "type:drupal-core"
+      ]
+    }
+  }
+}

assets/gitdeploy/deploy-drupal.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+echo "updating drupal 8"
+echo "Switching to project docroot."
+cd ./app
+echo ""
+echo "Pulling down latest code and submodules."
+git pull --ff-only origin prod
+git submodule update --init --recursive --remote
+
+echo ""
+echo "Clearing drush caches."
+drush cache-clear drush
+echo ""
+echo "Composer install."
+composer install --no-dev
+echo ""
+echo "Running database updates."
+drush updb -y
+echo ""
+echo "Importing configuration."
+drush config-import -y
+echo ""
+echo "Clearing caches."
+drush cr
+echo ""
+echo "Deployment complete."

assets/gitdeploy/deploy-simple.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+echo "updating"
+echo "Switching to project docroot."
+cd ./app
+echo ""
+echo "Pulling down latest code."
+git pull --ff-only origin prod
+git submodule update --init --recursive --remote
+echo ""
+echo "Deployment complete."

assets/gitdeploy/git-post-receive

@@ -0,0 +1,20 @@
+#!/bin/bash
+#hook/post-receive
+#CONFIG
+
+PRODDIR="www"
+
+read oldrev newrev refname
+if [ $refname = "refs/heads/prod" ]; then
+  echo "===== DEPLOYING APP ====="
+  unset GIT_DIR
+  cd ~
+  cd $PRODDIR
+  # git pull --ff-only origin prod
+  # run deploy script instead
+  . deploy.sh
+  echo $?
+  echo "====== OK ====="
+else
+  echo "Warning Commit not deployed, please use prod branch"
+fi

assets/lemp/default.nginxconf

@@ -21,7 +21,7 @@ server {
 	root /var/www/html;
 
 	# Add index.php to the list if you are using PHP
-	index index.html index.htm index.nginx-debian.html index.php;
+	index index.html index.htm index.php;
 
 	server_name _;
 
@@ -31,6 +31,49 @@ server {
 		try_files $uri $uri/ =404;
 	}
 
+	location /phpmyadmin {
+		root /usr/share/webapps/;
+		auth_basic "Admin Login";
+    auth_basic_user_file passwds;
+
+    # Deny static files
+    location ~ ^/phpMyAdmin/(README|LICENSE|ChangeLog|DCO)$ {
+      deny all;
+    }
+
+    # Deny .md files
+    location ~ ^/phpMyAdmin/(.+\.md)$ {
+      deny all;
+    }
+
+    # Deny setup directories
+    location ~ ^/phpMyAdmin/(doc|sql|setup)/ {
+      deny all;
+    }
+
+    location ~ ^/phpmyadmin/(.+\.php)$ {
+      fastcgi_pass      127.0.0.1:9000;
+      fastcgi_index     index.php;
+      include           fastcgi.conf;
+      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+      try_files $uri $document_root$fastcgi_script_name =404;
+
+      fastcgi_split_path_info ^(.+\.php)(/.*)$;
+      fastcgi_param PATH_INFO $fastcgi_path_info;
+
+      fastcgi_param HTTP_PROXY "";
+      fastcgi_param HTTPS off;
+      fastcgi_request_buffering off;
+    }
+
+    location ~ ^/phpmyadmin/(.*\.(eot|otf|woff|ttf|css|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|xls|tar|bmp))$ {
+      root /usr/share/webapps/;
+      expires 30d;
+      log_not_found off;
+      access_log off;
+    }
+	}
+
 	# pass PHP scripts to FastCGI server
 	location ~ \.php$ {
 		fastcgi_pass      127.0.0.1:9000;
@@ -63,4 +106,7 @@ server {
 	  # allow CURRENT-SERVER-IP;
 	  deny all;
 	}
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options DENY;
 }

assets/mysqlbackup.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Simple script to backup MySQL databases
+
+# Parent backup directory
+backup_parent_dir="/var/backups/mysql"
+
+# MySQL settings
+mysql_user="root"
+mysql_password="ROOTPASSWD"
+
+# Read MySQL password from stdin if empty
+# if [ -z "${mysql_password}" ]; then
+#   echo -n "Enter MySQL ${mysql_user} password: "
+#   read -s mysql_password
+#   echo
+# fi
+
+# Check MySQL password
+echo exit | mysql --user=${mysql_user} --password=${mysql_password} -B 2>/dev/null
+if [ "$?" -gt 0 ]; then
+  echo "MySQL ${mysql_user} password incorrect"
+  exit 1
+else
+  echo "MySQL ${mysql_user} password correct."
+fi
+
+# Create backup directory and set permissions
+backup_date=`date +%Y_%m_%d_%H_%M`
+backup_dir="${backup_parent_dir}/${backup_date}"
+echo "Backup directory: ${backup_dir}"
+mkdir -p "${backup_dir}"
+chmod 644 "${backup_dir}"
+
+# Get MySQL databases
+mysql_databases=`echo 'show databases' | mysql --user=${mysql_user} --password=${mysql_password} -B | sed /^Database$/d`
+
+# Backup and compress each database
+for database in $mysql_databases
+do
+  if [ "${database}" == "information_schema" ] || [ "${database}" == "performance_schema" ]; then
+        additional_mysqldump_params="--skip-lock-tables --compact --no-autocommit "
+  else
+        additional_mysqldump_params=""
+  fi
+  echo "Creating backup of \"${database}\" database"
+  mysqldump ${additional_mysqldump_params} --user=${mysql_user} --password=${mysql_password} ${database} | gzip > "${backup_dir}/${database}.sql.gz"
+  chmod 644 "${backup_dir}/${database}.sql.gz"
+done
+
+# compress the folder
+# tar -zcvf "${backup_dir}.tar.gz" "${backup_dir}"
+# rm -rf "${backup_dir}"
+
+# Rotate backups
+# Delete files older than 30 days
+find $backup_parent_dir/ -type f -mtime +60 -delete;
+# Delete empty directories
+find $backup_parent_dir/ -type d -empty -delete;

assets/opendkim/opendkim.conf

@@ -0,0 +1,21 @@
+Socket local:/run/opendkim/opendkim.sock
+Syslog yes
+UMask 002
+UserID postfix:postfix
+
+Selector mail
+Mode sv
+SubDomains yes
+AutoRestart yes
+Background yes
+Canonicalization relaxed/relaxed
+DNSTimeout 5
+SignatureAlgorithm rsa-sha256
+X-Header yes
+Logwhy yes
+
+InternalHosts /etc/internalhosts
+KeyTable /etc/opendkim/keytable
+SigningTable refile:/etc/opendkim/signtable
+
+OversignHeaders From

assets/vhosts/drupal-ssl.nginxconf

@@ -0,0 +1,139 @@
+# https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
+# https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
+server {
+  listen [::]:80;
+  server_name DOMAIN.LTD;
+  return 301 https://$server_name$request_uri;
+}
+
+server {
+  listen [::]:443 ssl;
+
+  server_name DOMAIN.LTD;
+
+  root /var/www/DOMAIN.LTD/app/web;
+
+  #SSL Certificates
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_certificate "/etc/letsencrypt/live/DOMAIN.LTD/fullchain.pem";
+  ssl_certificate_key "/etc/letsencrypt/live/DOMAIN.LTD/privkey.pem";
+  ssl_dhparam /etc/nginx/ssl/certs/DOMAIN.LTD/dhparam.pem;
+  # ssl_session_cache shared:SSL:1m;
+  ssl_session_timeout 10m;
+  ssl_ciphers HIGH:!aNULL:!MD5;
+  #ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+  ssl_prefer_server_ciphers  on;
+
+  add_header Strict-Transport-Security "max-age=31536000;
+  #includeSubDomains" always;
+
+  charset utf-8;
+
+  location = /favicon.ico {
+    access_log off;
+    log_not_found off;
+  }
+
+  location = /robots.txt  {
+    allow all;
+    access_log off;
+    log_not_found off;
+  }
+
+  location ~ \..*/.*\.php$ {
+    return 403;
+  }
+
+  location ~ ^/sites/.*/private/ {
+    return 403;
+  }
+
+  # Block access to scripts in site files directory
+  location ~ ^/sites/[^/]+/files/.*\.php$ {
+    deny all;
+  }
+
+  # Allow "Well-Known URIs" as per RFC 5785
+  location ~* ^/.well-known/ {
+      allow all;
+  }
+
+  # Block access to "hidden" files and directories whose names begin with a
+  # period. This includes directories used by version control systems such
+  # as Subversion or Git to store control files.
+  location ~ (^|/)\. {
+    return 403;
+  }
+
+  location / {
+    # try_files $uri @rewrite; # For Drupal <= 6
+    try_files $uri /index.php?$query_string; # For Drupal >= 7
+  }
+
+  location @rewrite {
+    rewrite ^/(.*)$ /index.php?q=$1;
+  }
+
+  # Don't allow direct access to PHP files in the vendor directory.
+  location ~ /vendor/.*\.php$ {
+    deny all;
+    return 404;
+  }
+
+  location ~ /\.ht {
+    deny all;
+  }
+
+  access_log on;
+  error_log /var/www/DOMAIN.LTD/log/error.log;
+
+  sendfile off;
+
+  client_max_body_size 100m;
+
+  # In Drupal 8, we must also match new paths where the '.php' appears in
+  # the middle, such as update.php/selection. The rule we use is strict,
+  # and only allows this pattern with the update.php front controller.
+  # This allows legacy path aliases in the form of
+  # blog/index.php/legacy-path to continue to route to Drupal nodes. If
+  # you do not have any paths like that, then you might prefer to use a
+  # laxer rule, such as:
+  #   location ~ \.php(/|$) {
+  # The laxer rule will continue to work if Drupal uses this new URL
+  # pattern with front controllers other than update.php in a future
+  # release.
+  location ~ '\.php$|^/update.php' {
+    # fastcgi_split_path_info ^(.+\.php)(/.+)$;
+    fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
+    include fastcgi.conf;
+    # Block httpoxy attacks. See https://httpoxy.org/.
+    fastcgi_param HTTP_PROXY "";
+    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    fastcgi_param PATH_INFO $fastcgi_path_info;
+    fastcgi_param QUERY_STRING $query_string;
+    fastcgi_intercept_errors on;
+    # fastcgi_buffer_size 16k;
+    # fastcgi_buffers 4 16k;
+    fastcgi_pass 127.0.0.1:9000;
+  }
+  # Fighting with Styles? This little gem is amazing.
+  # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
+  location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
+    try_files $uri @rewrite;
+  }
+
+  # Handle private files through Drupal. Private file's path can come
+  # with a language prefix.
+  location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
+    try_files $uri /index.php?$query_string;
+  }
+
+  location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+    try_files $uri @rewrite;
+    expires max;
+    log_not_found off;
+  }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;
+}

assets/vhosts/drupal.nginxconf

@@ -0,0 +1,117 @@
+# https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
+server {
+    listen [::]:80;
+    server_name DOMAIN.LTD;
+    root /var/www/DOMAIN.LTD/app/web;
+
+    charset utf-8;
+
+    location = /favicon.ico {
+      access_log off;
+      log_not_found off;
+    }
+
+    location = /robots.txt  {
+      allow all;
+      access_log off;
+      log_not_found off;
+    }
+
+    location ~ \..*/.*\.php$ {
+      return 403;
+    }
+
+    location ~ ^/sites/.*/private/ {
+      return 403;
+    }
+
+    # Block access to scripts in site files directory
+    location ~ ^/sites/[^/]+/files/.*\.php$ {
+      deny all;
+    }
+
+    # Allow "Well-Known URIs" as per RFC 5785
+    location ~* ^/.well-known/ {
+        allow all;
+    }
+
+    # Block access to "hidden" files and directories whose names begin with a
+    # period. This includes directories used by version control systems such
+    # as Subversion or Git to store control files.
+    location ~ (^|/)\. {
+      return 403;
+    }
+
+    location / {
+      # try_files $uri @rewrite; # For Drupal <= 6
+      try_files $uri /index.php?$query_string; # For Drupal >= 7
+    }
+
+    location @rewrite {
+      rewrite ^/(.*)$ /index.php?q=$1;
+    }
+
+    # Don't allow direct access to PHP files in the vendor directory.
+    location ~ /vendor/.*\.php$ {
+      deny all;
+      return 404;
+    }
+
+    location ~ /\.ht {
+      deny all;
+    }
+
+    access_log on;
+    error_log /var/www/DOMAIN.LTD/log/error.log;
+
+    sendfile off;
+
+    client_max_body_size 100m;
+
+    # In Drupal 8, we must also match new paths where the '.php' appears in
+    # the middle, such as update.php/selection. The rule we use is strict,
+    # and only allows this pattern with the update.php front controller.
+    # This allows legacy path aliases in the form of
+    # blog/index.php/legacy-path to continue to route to Drupal nodes. If
+    # you do not have any paths like that, then you might prefer to use a
+    # laxer rule, such as:
+    #   location ~ \.php(/|$) {
+    # The laxer rule will continue to work if Drupal uses this new URL
+    # pattern with front controllers other than update.php in a future
+    # release.
+    location ~ '\.php$|^/update.php' {
+      # fastcgi_split_path_info ^(.+\.php)(/.+)$;
+      fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
+      include fastcgi.conf;
+      # Block httpoxy attacks. See https://httpoxy.org/.
+      fastcgi_param HTTP_PROXY "";
+      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+      fastcgi_param PATH_INFO $fastcgi_path_info;
+      fastcgi_param QUERY_STRING $query_string;
+      fastcgi_intercept_errors on;
+      # fastcgi_buffer_size 16k;
+      # fastcgi_buffers 4 16k;
+      fastcgi_pass 127.0.0.1:9000;
+    }
+    # Fighting with Styles? This little gem is amazing.
+    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6
+    location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7
+      try_files $uri @rewrite;
+    }
+
+    # Handle private files through Drupal. Private file's path can come
+    # with a language prefix.
+    location ~ ^(/[a-z\-]+)?/system/files/ { # For Drupal >= 7
+      try_files $uri /index.php?$query_string;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+      try_files $uri @rewrite;
+      expires max;
+      log_not_found off;
+    }
+
+    # website should not be displayed inside a <frame>, an <iframe> or an <object>
+    add_header X-Frame-Options SAMEORIGIN;
+
+}

assets/vhosts/index.php

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en" dir="ltr">
+  <head>
+    <meta charset="utf-8">
+    <title>DOMAIN.LTD</title>
+  </head>
+  <body>
+    <h1>DOMAIN.LTD</h1>
+
+    <?php phpinfo(); ?>
+
+  </body>
+</html>

assets/vhosts/simple-phpfpm-ssl.nginxconf

@@ -0,0 +1,65 @@
+# https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
+
+server {
+  listen [::]:80;
+  server_name DOMAIN.LTD;
+  return 301 https://$server_name$request_uri;
+}
+
+server {
+  listen [::]:443 ssl;
+
+  server_name DOMAIN.LTD;
+
+  root /var/www/DOMAIN.LTD/app/web;
+  index index.html index.php;
+
+  charset utf-8;
+
+  location / {
+    try_files $uri $uri/ /index.php?$query_string;
+  }
+
+  location = /favicon.ico { access_log off; log_not_found off; }
+  location = /robots.txt  { access_log off; log_not_found off; }
+
+  access_log on;
+  error_log /var/www/DOMAIN.LTD/log/error.log;
+
+  sendfile off;
+
+  client_max_body_size 100m;
+
+  #SSL Certificates
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_certificate "/etc/letsencrypt/live/DOMAIN.LTD/fullchain.pem";
+  ssl_certificate_key "/etc/letsencrypt/live/DOMAIN.LTD/privkey.pem";
+  ssl_dhparam /etc/nginx/ssl/certs/DOMAIN.LTD/dhparam.pem;
+  # ssl_session_cache shared:SSL:1m;
+  ssl_session_timeout 10m;
+  ssl_ciphers HIGH:!aNULL:!MD5;
+  #ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+  ssl_prefer_server_ciphers  on;
+
+  add_header Strict-Transport-Security "max-age=31536000;
+  #includeSubDomains" always;
+
+  location ~ \.php$ {
+    fastcgi_split_path_info ^(.+\.php)(/.+)$;
+    fastcgi_pass 127.0.0.1;
+    fastcgi_index index.php;
+    include fastcgi.conf;
+    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    fastcgi_intercept_errors off;
+    fastcgi_buffer_size 16k;
+    fastcgi_buffers 4 16k;
+  }
+
+  location ~ /\.ht {
+    deny all;
+  }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;
+
+}

assets/vhosts/simple-phpfpm.nginxconf

@@ -0,0 +1,42 @@
+server {
+  listen [::]:80;
+  server_name DOMAIN.LTD;
+
+  root /var/www/DOMAIN.LTD/app/web;
+  index index.html index.php;
+
+  charset utf-8;
+
+  location / {
+    try_files $uri $uri/ /index.php?$query_string;
+  }
+
+  location = /favicon.ico { access_log off; log_not_found off; }
+  location = /robots.txt  { access_log off; log_not_found off; }
+
+  access_log on;
+  error_log /var/www/DOMAIN.LTD/log/error.log;
+
+  sendfile off;
+
+  client_max_body_size 100m;
+
+  location ~ \.php$ {
+    fastcgi_split_path_info ^(.+\.php)(/.+)$;
+    fastcgi_pass 127.0.0.1:9000;
+    fastcgi_index index.php;
+    include fastcgi.conf;
+    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    fastcgi_intercept_errors off;
+    fastcgi_buffer_size 16k;
+    fastcgi_buffers 4 16k;
+  }
+
+  location ~ /\.ht {
+    deny all;
+  }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;
+
+}

bin/checkroot.sh

@@ -3,8 +3,8 @@
 echo -e "checking root"
 
 if [ "$EUID" = 0 ]; then
+  echo -e "root ok"
+else
   echo -e "Please run as root"
   exit
-else
-  echo -e "root ok"
 fi

bin/email.sh

@@ -22,10 +22,9 @@ if [ ! -d "$_assets" ]; then
   fi
 fi
 
-# http://www.sycha.com/lamp-setup-debian-linux-apache-mysql-php#anchor13
 sleep 2
 
-apk add mailx postfix
+apk add postfix mailx
 
 mkdir /var/mail
 postmap /etc/postfix/aliases
@@ -33,38 +32,54 @@ postmap /etc/postfix/aliases
 rc-update add postfix
 /etc/init.d/postfix start
 
+# https://www.cyberciti.biz/faq/how-to-find-out-the-ip-address-assigned-to-eth0-and-display-ip-only/
+_IP=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
+_MASK=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f4)
 
+# TODO: change bounce email
+# echo -n "Please provide a bounce email address: "
+# read _bounce_email
 
+# TODO: DMARC
 
-# dkim spf
-# echo "\033[35;1mConfiguring DKIM \033[0m"
-# while [ "$installdkim" != "y" ] && [ "$installdkim" != "n" ]
-# do
-#   echo -n "Should we install dkim for exim4 ? [y|n] "
-#   read installdkim
-# done
-# if [ "$installdkim" = "y" ]; then
-#   echo -n "Choose a domain for dkim (same domain as you chose before for exim4): "
-#   read domain
-#   selector=$(date +%Y%m%d)
-#
-#   mkdir /etc/exim4/dkim
-#   openssl genrsa -out /etc/exim4/dkim/"$domain"-private.pem 1024 -outform PEM
-#   openssl rsa -in /etc/exim4/dkim/"$domain"-private.pem -out /etc/exim4/dkim/"$domain".pem -pubout -outform PEM
-#   chown root:Debian-exim /etc/exim4/dkim/"$domain"-private.pem
-#   chmod 440 /etc/exim4/dkim/"$domain"-private.pem
-#
-#   cp "$_assets"/exim4_dkim.conf /etc/exim4/conf.d/main/00_local_macros
-#   sed -i -r "s/DOMAIN_TO_CHANGE/$domain/g" /etc/exim4/conf.d/main/00_local_macros
-#   sed -i -r "s/DATE_TO_CHANGE/$selector/g" /etc/exim4/conf.d/main/00_local_macros
-#
-#   update-exim4.conf
-#   systemctl restart exim4
-#   echo "please create a TXT entry in your dns zone : $selector._domainkey.$domain \n"
-#   echo "your public key is : \n"
-#   cat /etc/exim4/dkim/"$domain".pem
-#   echo "press any key to continue."
-#   read continu
-# else
-#   echo 'dkim not installed'
-# fi
+# reverse dns
+
+# dkim
+echo "Configuring DKIM"
+
+apk add opendkim opendkim-utils
+
+mkdir /etc/opendkim/keys
+opendkim-genkey -b 2048 -d "$HOSTNAME" -s "$HOSTNAME".dkim --directory=/etc/opendkim/keys/
+
+chown opendkim:opendkim /etc/opendkim/keys/*
+
+mv /etc/opendkim/opendkim.conf /etc/opendkim/opendkim.conf.back
+cp "$_assets"/opendkim/opendkim.conf /etc/opendkim/opendkim.conf
+
+echo "*@$HOSTNAME $HOSTNAME" > /etc/opendkim/signtable
+echo "$HOSTNAME $HOSTNAME:mail:/etc/opendkim/keys/$HOSTNAME.dkim.private" > /etc/opendkim/keytable
+echo -e "localhost\n127.0.0.1\n$HOSTNAME\n$_IP/$_MASK" > /etc/internalhosts
+echo -e "smtpd_milters = unix:/run/opendkim/opendkim.sock\nnon_smtpd_milters = unix:/run/opendkim/opendkim.sock" >> /etc/postfix/main.cf
+
+rc-update add opendkim
+service opendkim start
+
+usermod -a -G opendkim postfix
+
+service postfix restart
+
+echo -e "DKIM"
+echo -e "please create a DKIM entry in your dns zone : mail._domainkey.$HOSTNAME \n"
+echo -e "your public key is : \n"
+cat /etc/opendkim/keys/"$HOSTNAME".dkim.txt
+
+echo -e "SPF"
+echo -e "you should edit an spf entry for $HOSTNAME in your dns zone :"
+echo -e "v=spf1 a mx ip4:$_IP"
+
+echo -e "MX"
+echo -e "If it does not exists, you should create an mx zone record for $HOSTNAME"
+
+echo "press any key to continue."
+read continu

bin/gitdeploy.sh

@@ -0,0 +1,132 @@
+#!/bin/sh
+# bachir soussi chiadmi
+
+# get the current position
+_cwd="$(pwd)"
+
+echo -e '
+       _ _
+  __ _(_) |_
+ / _` | |  _|
+ \__, |_|\__|
+ |___/
+'
+echo -e "Create new git barre repos and deploy script"
+echo "Git barre repo will be installed in chosen user home directory"
+echo "git prod repos will be installed in app directory of provided domain, the domain have to exists as shortcut in chosen /home/user/www before running this script. Please run first bin/vhost.sh script and say yes to the question create a shortcut !"
+
+. bin/checkroot.sh
+
+while [ "$yn" != "yes" ] && [ "$yn" != "no" ]
+do
+  echo -n "Should we installl git deployement? [yes|no] "
+  read yn
+  # yn=${yn:-y}
+done
+if [ "$yn" = "yes" ]; then
+
+  # get the current position
+  _cwd="$(pwd)"
+
+  # check for assets forlder
+  _assets="$_cwd/assets"
+  if [ ! -d "$_assets" ]; then
+    _assets="$_cwd/../assets"
+    if [ ! -d "$_assets" ]; then
+      echo "!! can't find assets directory !!"
+      exit
+    fi
+  fi
+
+  # if $user var does not exists (gitdeploy.sh ran directly) ask for it
+  if [ -z ${user+x} ]; then
+    while [ "$user" = "" ]
+    do
+      read -p "enter an existing user name ? " user
+      if [ "$user" != "" ]; then
+        # check if user already exists
+        if id "$user" >/dev/null 2>&1; then
+          read -p "is user name $user correcte [y|n] " validated
+          if [ "$validated" = "y" ]; then
+            break
+          else
+            user=""
+          fi
+        else
+          echo -e "user $user doesn't exists, you must provide an existing user"
+          user=""
+        fi
+      fi
+    done
+  fi
+
+  # if $_domain var does not exists (gitdeploy.sh ran directly) ask for it
+  if [ -z ${_domain+x} ]; then
+    while [ "$_domain" = "" ]
+    do
+      read -p "enter a domain name ? " _domain
+      if [ "$_domain" != "" ]; then
+        if [ ! -d /home/"$user"/www/"$_domain" ]; then
+          echo "/home/$user/www/$_domain does not exists !"
+          # exit
+          _domain=""
+        else
+          read -p "is domain $_domain correcte [y|n] " validated
+          if [ "$validated" = "y" ]; then
+            break
+          else
+            _domain=""
+          fi
+        fi
+      fi
+    done
+  fi
+
+  # ask for simple php conf or drupal conf
+  while [ "$_drupal" != "yes" ] && [ "$_drupal" != "no" ]
+  do
+    echo -n "Is your site is a drupal 8 instance? [yes|no] "
+    read _drupal
+  done
+
+  echo "seting up bare repositorie to push to"
+  mkdir /home/"$user"/git-repos
+  mkdir /home/"$user"/git-repos/"$_domain".git
+  cd /home/"$user"/git-repos/"$_domain".git
+  git init --bare
+
+  echo "creating hooks that will update the site repo"
+  cp "$_assets"/gitdeploy/git-post-receive /home/"$user"/git-repos/"$_domain".git/hooks/post-receive
+  sed -i -r "s#PRODDIR=\"www\"#PRODDIR=\"/home/$user/www/$_domain\"#g" /home/"$user"/git-repos/"$_domain".git/hooks/post-receive
+  chown -R "$user":"$user" /home/"$user"/git-repos
+  chmod +x /home/"$user"/git-repos/"$_domain".git/hooks/post-receive
+
+  echo "seting up git repo on site folder"
+  rm -rf /home/"$user"/www/"$_domain"/app/*
+  cd /home/"$user"/www/"$_domain"/app
+  git init
+  # link to the bare repo
+  git remote add origin /home/"$user"/git-repos/"$_domain".git
+  chown -R www:"$user" /home/"$user"/www/"$_domain"/app
+  chmod -R g+rw /home/"$user"/www/"$_domain"/app
+  git remote -v
+  git status
+
+  echo "adding deploy script"
+  if [ "$_drupal" = "yes" ]; then
+    cp "$_assets"/gitdeploy/deploy-drupal.sh /home/"$user"/www/"$_domain"/deploy.sh
+  else
+    cp "$_assets"/gitdeploy/deploy-simple.sh /home/"$user"/www/"$_domain"/deploy.sh
+  fi
+  chown "$user":"$user" /home/"$user"/www/"$_domain"/deploy.sh
+  chmod +x /home/"$user"/www/"$_domain"/deploy.sh
+
+  # done
+  _cur_ip=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
+  echo "git repos for $_domain install succeed"
+  echo "your site stay now to /home/$user/www/$_domain/app"
+  echo "you can push updates on prod branch through $user@$_cur_ip:git-repos/$_domain.git"
+  cd "$_cwd"
+else
+  echo "Git barre repo creation aborted"
+fi

bin/knockd.sh

@@ -33,22 +33,24 @@ echo -n "checking if ufw is installed"
 ufw_installed=$(apk list -I | grep "ufw")
 if ! $ufw_installed; then
   echo -n "ufw installed"
+
+  mv /etc/knockd.conf /etc/knockd.conf.ori
+  cp "$_assets"/knockd.conf /etc/knockd.conf
+  echo -n "define a sequence number for opening ssh (as 7000,8000,9000) : "
+  read sq
+  sed -i "s/7000,8000,9000/$sq/g" /etc/knockd.conf
+
+  rc-update add knockd
+  /etc/init.d/knockd start
+
+  ufw delete allow ssh
+
+  echo -e "knockd installed and configured"
+  echo -e "please note this sequence for future ssh knocking"
+  echo "$sq"
 else
-  . bin/ufw.sh
+  #. bin/ufw.sh
+  echo -n "ufw not installed, needed by knockd, configuration aborted"
 fi
 
-mv /etc/knockd.conf /etc/knockd.conf.ori
-cp "$_assets"/knockd.conf /etc/knockd.conf
-echo -n "define a sequence number for opening ssh (as 7000,8000,9000) : "
-read sq
-sed -i "s/7000,8000,9000/$sq/g" /etc/knockd.conf
-
-rc-update add knockd
-/etc/init.d/knockd start
-
-ufw delete allow ssh
-
-echo -e "knockd installed and configured"
-echo -e "please note this sequence for future ssh knocking"
-echo "$sq"
 sleep 3

bin/lemp.sh

@@ -35,20 +35,23 @@ echo -e '
 echo -e "installing Mysql"
 sleep 3
 
+apk add mariadb mariadb-client mariadb-common
+
 # https://bugs.alpinelinux.org/issues/9046
-echo -n "are Maridb databases strored in a zfs file system? [y|n] "
+echo -n "are Maridb databases strored in a zfs file system (eg. through proxmox container)? [y|n] "
 read yn
 if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
   echo -e "Stick with mariadb 10.1.x due to incompatibility of newer version with zfs"
   echo -e "Please see this bug https://bugs.alpinelinux.org/issues/9046"
-  echo "http://dl-5.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
-  echo -e "mariadb<10.1.99\nmariadb-client<10.1.99\nmariadb-common<10.1.99" >> /etc/apk/world
-  apk update
+  echo "http://dl-cdn.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
+  # echo -e "mariadb<10.1.99\nmariadb-client<10.1.99\nmariadb-common<10.1.99" >> /etc/apk/world
+  sed -i "s|^mariadb$|mariadb<10.1.99|g" /etc/apk/world
+  sed -i "s|^mariadb-client$|mariadb-client<10.1.99|g" /etc/apk/world
+  sed -i "s|^mariadb-common$|mariadb-common<10.1.99|g" /etc/apk/world
+  apk update && apk upgrade
 fi
 
-apk add mariadb mariadb-client
-
-mysql_install_db --user=mysql --datadir=/var/lib/mysql
+mysql_install_db --user=mysql --datadir="/var/lib/mysql"
 
 rc-update add mariadb
 service mariadb start
@@ -71,15 +74,24 @@ echo -e '
 '
 echo -e "Installing PHP 7.0"
 sleep 3
-apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json
+apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json php7-dom php7-tokenizer php7-iconv php7-xmlwriter php7-simplexml
+
+# to make php5 availabe
+# echo "http://dl-cdn.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
+# apk add php5-fpm php5-pdo_mysql php5-opcache php5-curl php5-zip php5-xml php5-gd php5-mcrypt php5-phar php5-json php5-dom php5-iconv
 
 echo -e "Configuring PHP"
 
 sed -i "s/memory_limit\ =\ 128M/memory_limit = 512M/g" /etc/php7/php.ini
+sed -i "s/post_max_size\ =\ 8M/post_max_size = 20M/g" /etc/php7/php.ini
+sed -i "s/upload_max_filesize\ =\ 2M/upload_max_filesize = 20M/g" /etc/php7/php.ini
 
-TIMEZONE="Europe/Helsinki"
+TIMEZONE="Europe/Paris"
 sed -i "s|;*date.timezone =.*|date.timezone = ${TIMEZONE}|i" /etc/php7/php.ini
 
+sed -i "s|user = nobody|user = www|i" /etc/php7/php-fpm.d/www.conf
+sed -i "s|group = nobody|group = www|i" /etc/php7/php-fpm.d/www.conf
+
 rc-update add php-fpm7
 service php-fpm7 start
 
@@ -88,51 +100,28 @@ service php-fpm7 start
 echo -e "php installed"
 
 echo -e '
-            _
-  _ _  __ _(_)_ _ __ __
- | ` \/ _` | | ` \\ \ /
- |_||_\__, |_|_||_/_\_\
-      |___/
+       _         __  __        _      _       _
+  _ __| |_  _ __|  \/  |_  _  /_\  __| |_ __ (_)_ _
+ | `_ \ ` \| `_ \ |\/| | || |/ _ \/ _` | `  \| | ` \
+ | .__/_||_| .__/_|  |_|\_, /_/ \_\__,_|_|_|_|_|_||_|
+ |_|       |_|          |__/
 '
-echo -e "Installing Nginx"
-sleep 3
-apk add nginx
+echo -e "Installing phpMyAdmin"
+apk add phpmyadmin php7-mysqli
+service php-fpm7 restart
 
-adduser -D -g 'www' www
-mkdir -p /var/www/html
-chown -R www:www /var/lib/nginx
-chown -R www:www /var/www/html
+chmod +r /etc/phpmyadmin/config.inc.php
 
-mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.ori
-cp "$_assets"/lemp/default.nginxconf /etc/nginx/conf.d/default.conf
-cp "$_assets"/lemp/index.php /var/www/html/
+# /**
+#  * This is needed for cookie based authentication to encrypt password in
+#  * cookie. Needs to be 32 chars long.
+#  */
+_blowfish="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c32)"
+sed -i "s|$cfg['blowfish_secret'] = ''|$cfg['blowfish_secret'] = '${_blowfish}'|i" /etc/phpmyadmin/config.inc.php
 
-rc-update add nginx
-service nginx start
-echo -e "Nginx installed"
-
-# echo -e '
-#        _         __  __        _      _       _
-#   _ __| |_  _ __|  \/  |_  _  /_\  __| |_ __ (_)_ _
-#  | `_ \ ` \| `_ \ |\/| | || |/ _ \/ _` | `  \| | ` \
-#  | .__/_||_| .__/_|  |_|\_, /_/ \_\__,_|_|_|_|_|_||_|
-#  |_|       |_|          |__/
-# '
-# echo -e "Installing phpMyAdmin"
-# apk add phpmyadmin
-# ln -s /usr/share/phpmyadmin /var/www/html/
-# cp "$_assets"/nginx-phpmyadmin.conf > /etc/nginx/sites-available/phpmyadmin.conf
-# ln -s /etc/nginx/sites-available/phpmyadmin.conf /etc/nginx/sites-enabled/phpmyadmin.conf
-#
-# # echo -e "securing phpMyAdmin"
-# # sed -i "s/DirectoryIndex index.php/DirectoryIndex index.php\nAllowOverride all/"
-# # cp "$_assets"/phpmyadmin_htaccess > /usr/share/phpmyadmin/.htaccess
-# # echo -n "define a user name for phpmyadmin : "
-# # read un
-# # htpasswd -c /etc/phpmyadmin/.htpasswd $un
-# # service apache2 restart
-# echo -e "phpMyAdmin installed"
-# echo -e "You can access it at yourip/phpmyadmin"
+mkdir /usr/share/webapps/phpmyadmin/tmp
+chmod 777 /usr/share/webapps/phpmyadmin/tmp
+# finishing the pma install after nginx
 
 echo -e '
              _ _
@@ -142,7 +131,7 @@ echo -e '
 '
 echo -e "Installing Redis"
 sleep 3
-apk add redis php7-pecl-redis@edgecommunity
+apk add redis php7-pecl-redis
 
 # TODO set maxmemory=2gb
 # TODO set maxmemory-policy=volatile-lru
@@ -164,7 +153,8 @@ echo -e "Installing Composer"
 sleep 3
 export COMPOSER_HOME=/usr/local/composer
 curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
-
+ln -sf /usr/local/bin/composer /usr/bin/composer
+composer about
 echo -e "Composer installed"
 
 
@@ -178,6 +168,48 @@ echo -e "Installing Drush and DrupalConsole"
 sleep 3
 curl https://drupalconsole.com/installer -L -o /usr/local/bin/drupal
 chmod +x /usr/local/bin/drupal
-curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
+ln -sf /usr/local/bin/drupal /usr/bin/drupal
+drupal about
+# curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
+wget -O /usr/local/bin/drush https://github.com/drush-ops/drush-launcher/releases/latest/download/drush.phar
 chmod +x /usr/local/bin/drush
-echo -e "Drush and DrupalConsoleinstalled"
+ln -sf /usr/local/bin/drush /usr/bin/drush
+drush status
+echo -e "Drush and DrupalConsole installed"
+
+# for non composer installed D7 site add assets/d7-drush-composer.json in root-folder/composer.json and run composer install
+
+echo -e '
+            _
+  _ _  __ _(_)_ _ __ __
+ | ` \/ _` | | ` \\ \ /
+ |_||_\__, |_|_||_/_\_\
+      |___/
+'
+echo -e "Installing Nginx"
+sleep 3
+apk add nginx
+
+adduser -D -g 'www' www
+mkdir -p /var/www/html
+chown -R www:www /var/lib/nginx
+chown -R www:www /var/www/html
+chown -R www:www /var/tmp/nginx
+
+sed -i "s|user nginx;|user www;|i" /etc/nginx/nginx.conf
+
+mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.ori
+cp "$_assets"/lemp/default.nginxconf /etc/nginx/conf.d/default.conf
+cp "$_assets"/lemp/index.php /var/www/html/
+rc-update add nginx
+service nginx start
+echo -e "Nginx installed"
+
+echo -e "securing phpMyAdmin"
+_pass="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
+_encrypted=$(openssl passwd -apr1 $_pass)
+echo -e "pma:$_encrypted" > /etc/nginx/passwds
+echo -e "phpMyAdmin installed"
+echo -e "You can access it at yourip/phpmyadmin"
+echo -e "please note the credentials user: pma passwd:$_pass"
+sleep 3

bin/misc.sh

@@ -17,7 +17,7 @@ echo '@edge http://dl-cdn.alpinelinux.org/alpine/edge/main
 
 apk update
 
-apk add procps vim curl tmux etckeeper htop lynx unzip # needrestart
+apk add procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen rsync patch #ntp # needrestart
 
 # sed -i "s/^# en_GB.UTF-8/en_GB.UTF-8/g" /etc/locale.gen
 # locale-gen
@@ -31,4 +31,8 @@ rc-service crond start && rc-update add crond
 
 git config --global core.safecrlf false
 
+echo "limiting su to the admin group"
+groupadd admin
+echo -e "auth       required   pam_wheel.so    group=admin" >> /etc/pam.d/su
+
 echo -e "Misc done"

bin/mysql-db.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+
+echo -e '
+     _ _      _   _
+  __| | |__  | | | |___ ___ _ _
+ / _` |  _ \ | |_| (_-</ -_)  _|
+ \__,_|_.__/  \___//__/\___|_|
+'
+
+echo -e "Create new mysql db and user (you will be asked a db name and a password)"
+
+. bin/checkroot.sh
+
+sleep 3
+
+# configure
+echo -n "Please provide the mysql root passwd : "
+read _root_mysql_passwd
+
+mysql -u root -p$_root_mysql_passwd -e "show databases;"
+
+echo -n "Enter new db name: "
+read db_name
+while [ "$db_name" = "" ]
+do
+  read -p "enter a db name ? " db_name
+  if [ "$db_name" != "" ]; then
+    # TODO check if db already exists
+    # if id "$db_name" >/dev/null 2>&1; then
+    #   echo "user $db_name alreday exists, you must provide a non existing user name."
+    #   db=""
+    # else
+      read -p "is db name $db_name correcte [y|n] " validated
+      if [ "$validated" = "y" ]; then
+        break
+      else
+        db_name=""
+      fi
+    # fi
+  fi
+done
+
+# generate random password for new mysql user
+_passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
+
+# create new mysql user
+mysql -u root -p$_root_mysql_passwd -e "CREATE DATABASE $db_name;"
+mysql -u root -p$_root_mysql_passwd -e "CREATE USER '$db_name'@'localhost' IDENTIFIED BY '$_passwd';"
+mysql -u root -p$_root_mysql_passwd -e "GRANT ALL ON $db_name.* TO '$db_name'@'localhost';"
+
+mysql -u root -p$_root_mysql_passwd -e "show databases;"
+
+echo "database and user : $db_name installed"
+echo " please record your password $_passwd"
+echo "press any key to continue."
+read continu

bin/mysqlbackup.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+
+echo -e '
+  __  __               _   ___          _
+ |  \/  |_  _ ___ __ _| | | _ ) __ _ __| |___  _ _ __ ___
+ | |\/| | || (_-</ _  | | | _ \/ _  / _| / / || |  _ (_-<
+ |_|  |_|\_, /__/\__, |_| |___/\__,_\__|_\_\\_,_| .__/__/
+         |__/       |_|                         |_|
+'
+
+. bin/checkroot.sh
+
+# get the current position
+_cwd="$(pwd)"
+# check for assets forlder
+_assets="$_cwd/assets"
+if [ ! -d "$_assets" ]; then
+  _assets="$_cwd/../assets"
+  if [ ! -d "$_assets" ]; then
+    echo "!! can't find assets directory !!"
+    exit
+  fi
+fi
+
+# adding the script
+cp "$_assets"/mysqlbackup.sh /usr/local/bin/
+chmod +x /usr/local/bin/mysqlbackup.sh
+
+# configure
+echo -n "Please provide the mysql root passwd : "
+read _root_mysql_passwd
+sed -i "s/ROOTPASSWD/$_root_mysql_passwd/g" /usr/local/bin/mysqlbackup.sh
+
+# creating crontab
+touch /var/spool/cron/crontabs/root
+crontab -l > /tmp/mycron
+echo "30 2 */2 * * /usr/local/bin/mysqlbackup.sh" >> /tmp/mycron
+crontab /tmp/mycron
+rm -f /tmp/mycron
+
+echo -e "mysql backup script installed"

bin/ufw.sh

@@ -13,8 +13,16 @@ sleep 2
 
 # TODO use awall instead of ufw ?
 
+# BUG
 # ufw
-apk add ufw@testing
+# Traceback (most recent call last):
+#   File "/usr/sbin/ufw", line 25, in <module>
+#     import ufw.frontend
+# ModuleNotFoundError: No module named 'ufw'
+
+
+# ufw
+apk add ufw@edgecommunity
 ufw allow ssh # knockd will open the ssh port
 ufw allow http
 ufw allow https

bin/urbackup.sh

@@ -38,12 +38,17 @@ apk add linux-headers "g++" zlib zlib-dev "crypto++@testing" "crypto++-dev@testi
 ln -s /usr/lib/libcryptopp.so /usr/lib/libcryptopp.so.5.6
 
 # Download the UrBackup client source files and extract them
-wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.8/urbackup-client-2.4.8.0.tar.gz
+wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.10/urbackup-client-2.4.10.0.tar.gz
+
 cd /tmp
-tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
+# tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
+tar xzf /tmp/urbackup-client-2.4.10.0.tar.gz
 
 # Build the UrBackup client and install it
-cd /tmp/urbackup-client-2.3.4.0
+# cd /tmp/urbackup-client-2.3.4.0
+cd /tmp/urbackup-client-2.4.10.0
 ./configure --enable-headless
 make -j4
 make install
@@ -54,19 +59,22 @@ make install
 # configure
 echo -n "Please provide the urbackup-server's ip : "
 read _ip
-echo -n "Please provide the internet_authkey of server : "
-read _authkey
-echo -n "Please provide the computer name of this client : "
-read _computername
+# echo -n "Please provide the internet_authkey of server : "
+# read _authkey
+# echo -n "Please provide the computer name of this client : "
+# read _computername
+_computername=$HOSTNAME
 
+# internet_authkey=$_authkey
 echo "internet_server=$_ip
 internet_server_port=55415
-internet_authkey=$_authkey
 internet_mode_enabled=true
 internet_image_backups_def=false
-default_dirs_def=/etc;var/www;/var/backups/mysql
+default_dirs_def=/etc;/var/www;/var/backups/mysql
 startup_backup_delay_def=3
-computername=$_computername" > /usr/local/var/urbackup/data/settings.cfg
+computername=$_computername" > /etc/conf.d/urbackupclient
+
+# /usr/local/var/urbackup/data/settings.cfg
 
 # firewall
 ufw allow from "$_ip" to any port 35621

bin/user.sh

@@ -39,11 +39,18 @@ adduser "$user"
 
 sed -i "s/$user:\/bin\/ash/$user:\/bin\/bash/g" /etc/passwd
 
-# TODO limiting su to the admin group
-# echo "adding $user to admin group and limiting su to the admin group"
-# groupadd admin
-# usermod -a -G admin "$user"
-# allow admin group to su
-# dpkg-statoverride --update --add root admin 4750 /bin/su
+usermod -a -G www "$user"
 
+# TODO limiting su to the admin group
+yn="reset"
+while [ "$yn" != "y" ] && [ "$yn" != "n" ]
+do
+  echo -n "Should we allow $user to su? [y|n] "
+  read yn
+done
+if [ "$yn" = "y" ]; then
+  echo "adding $user to admin group"
+  # admin group is created by misc
+  usermod -a -G admin "$user"
+fi
 echo -e "user $user configured"

bin/vhost.sh

@@ -0,0 +1,153 @@
+#!/bin/bash
+
+echo -e '
+      _           _
+ __ _| |_  ___ __| |_
+ \ V / ` \/ _ (_-<  _|
+  \_/|_||_\___/__/\__|
+'
+echo -e "Nginx VHOST install "
+
+. bin/checkroot.sh
+
+# get the current position
+_cwd="$(pwd)"
+
+# check for assets forlder
+_assets="$_cwd/assets"
+if [ ! -d "$_assets" ]; then
+  _assets="$_cwd/../assets"
+  if [ ! -d "$_assets" ]; then
+    echo "!! can't find assets directory !!"
+    exit
+  fi
+fi
+
+_domain=""
+_validated=""
+_drupal=""
+_letsencrypt=""
+
+while [ "$_domain" = "" ]
+do
+  read -p "enter a domain name ? " _domain
+  if [ "$_domain" != "" ]; then
+    read -p "is domain $_domain correcte [y|n] " validated
+    if [ "$validated" = "y" ]; then
+      break
+    else
+      _domain=""
+    fi
+  fi
+done
+
+# ask for simple php conf or drupal conf
+while [ "$_drupal" != "yes" ] && [ "$_drupal" != "no" ]
+do
+  echo -n "Is your site is a drupal one? [yes|no] "
+  read _drupal
+done
+
+# ask for let's encrypt
+while [ "$_letsencrypt" != "yes" ] && [ "$_letsencrypt" != "no" ]
+do
+  echo -e "Let's encrypt"
+  echo -e "Let's encrypt needs a public registered domain name with proper DNS records ( A records or CNAME records for subdomains pointing to your server)."
+  echo -n "Should we install let's encrypt certificate with $_domain? [yes|no] "
+  read _letsencrypt
+done
+
+service nginx stop
+
+# lets'encrypt
+# https://certbot.eff.org/lets-encrypt/debianstretch-nginx
+if [ "$_letsencrypt" = "yes" ]; then
+  apk add certbot
+  certbot certonly --standalone -d "$_domain" --cert-name "$_domain"
+  # TODO stop the whole process if letsencrypt faile
+  mkdir -p /etc/nginx/ssl/certs/"$_domain"
+  openssl dhparam -out /etc/nginx/ssl/certs/"$_domain"/dhparam.pem 2048
+  # renewing
+  touch /var/spool/cron/crontabs/root
+  crontab -l > mycron
+  echo -e "0 3 * * * certbot renew --pre-hook 'service nginx stop' --post-hook 'service nginx start' --cert-name $_domain" >> mycron
+  crontab mycron
+  rm -f mycron
+fi
+
+if [ "$_drupal" = "yes" ]; then
+  if [ "$_letsencrypt" = "yes" ]; then
+    _conffile="drupal-ssl.nginxconf"
+  else
+    _conffile="drupal.nginxconf"
+  fi
+else
+  if [ "$_letsencrypt" = "yes" ]; then
+    _conffile="simple-phpfpm-ssl.nginxconf"
+  else
+    _conffile="simple-phpfpm.nginxconf"
+  fi
+fi
+
+cp "$_assets/vhosts/$_conffile" /etc/nginx/conf.d/"$_domain".conf
+sed -i -r "s/DOMAIN\.LTD/$_domain/g" /etc/nginx/conf.d/"$_domain".conf
+
+mkdir -p /var/www/"$_domain"/app/web
+mkdir /var/www/"$_domain"/log
+
+cp "$_assets/vhosts/index.php" /var/www/"$_domain"/app/web/
+sed -i -r "s/DOMAIN\.LTD/$_domain/g" /var/www/"$_domain"/app/web/index.php
+
+#set proper right to user will handle the app
+chown -R www:www  /var/www/"$_domain"/
+# chmod -R g+w /var/www/"$_domain"/
+# chmod -R g+r /var/www/"$_domain"/
+
+# create a shortcut to the site
+echo -n "Should we install a shortcut for a user? [Y|n] "
+read yn
+yn=${yn:-y}
+if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
+  # if $user var does not exists (vhost.sh ran directly) ask for it
+  if [ -z ${user+x} ]; then
+    while [ "$user" = "" ]
+    do
+      read -p "enter an existing user name ? " user
+      if [ "$user" != "" ]; then
+        # check if user already exists
+        if id "$user" >/dev/null 2>&1; then
+          read -p "is user name $user correcte [y|n] " validated
+          if [ "$validated" = "y" ]; then
+            break
+          else
+            user=""
+          fi
+        else
+          echo -e "user $user doesn't exists, you must provide an existing user"
+          user=""
+        fi
+      fi
+    done
+  fi
+
+  echo -e "installing shortcut for '$user'";
+
+  mkdir /home/"$user"/www/
+  chown "$user":"$user" /home/"$user"/www/
+  ln -s /var/www/"$_domain" /home/"$user"/www/"$_domain"
+  chown "$user":"$user" /home/"$user"/www/"$_domain"
+  chown -R www:"$user" /home/"$user"/www/"$_domain"/app
+  chmod -R g+rw /home/"$user"/www/"$_domain"/app
+
+  . bin/gitdeploy.sh
+else
+  echo -e 'no shortcut installed'
+fi
+# activate the vhost
+# ln -s /etc/nginx/sites-available/"$_domain".conf /etc/nginx/sites-enabled/"$_domain".conf
+
+nginx -t
+
+# restart nginx
+service nginx start
+echo -e "vhost $_domain configured"

bin/zabbix.sh

@@ -22,21 +22,35 @@ if [ ! -d "$_assets" ]; then
   fi
 fi
 
-apk add zabbix-agent
+echo -n "do you want to limit zabbix-agent to 3.4? [y|n] "
+read yn
+if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
+  echo -e "Stick with zabbix-agent 3.4"
+  echo "http://dl-cdn.alpinelinux.org/alpine/v3.8/main" >> /etc/apk/repositories
+  echo "http://dl-cdn.alpinelinux.org/alpine/v3.8/community" >> /etc/apk/repositories
+  # echo -e "zabbix-agent<3.4.99" >> /etc/apk/world
+  apk update
+  # apk upgrade
+  apk add 'zabbix-agent=~3.4'
+else
+  apk add zabbix-agent
+fi
+
 
 # configure
-echo -n "Please provide the current server's public ip : "
-read _cur_ip
+# echo -n "Please provide the current server's public ip : "
+# read _cur_ip
+# https://www.cyberciti.biz/faq/how-to-find-out-the-ip-address-assigned-to-eth0-and-display-ip-only/
+_cur_ip=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
+# echo -n "Please provide the hostname of this agent : "
+# read _host_name
+_host_name=$HOSTNAME
 echo -n "Please provide the zabbix-server's ip : "
 read _ip
-echo -n "Please provide the hostname of this agent : "
-read _host_name
 echo -n "Please provide the mysql root password : "
 read _root_mysql_passwd
 
 
-
-
 # configure zabbix agent
 sed -i "s#Server=127.0.0.1#Server=$_ip#g" /etc/zabbix/zabbix_agentd.conf
 sed -i "s#ServerActive=127.0.0.1#ServerActive=$_ip#g" /etc/zabbix/zabbix_agentd.conf
@@ -49,21 +63,21 @@ sed -i "s|#\ Include=$|Include= $_agent_conf_d|g" /etc/zabbix/zabbix_agentd.conf
 # apk
 # check for alpine security updates
 
-# # MYSQL
-# # https://serverfault.com/questions/737018/zabbix-user-parameter-mysql-status-setting-home
-# # create zabbix user home
-# mkdir /var/lib/zabbix
-# # generate random password for zabbix mysql user
-# _passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c12)"
-# # add mysql credentials to zabbix home
-# printf "[client]\n
-# user=zabbix\n
-# password=$_passwd" > /var/lib/zabbix/.my.cnf
-# # create zabbix mysql user
-# mysql -uroot -p"$_root_mysql_passwd" -e "CREATE USER 'zabbix' IDENTIFIED BY '$_passwd';"
-# mysql -uroot -p"$_root_mysql_passwd" -e "GRANT USAGE ON *.* TO 'zabbix'@'localhost' IDENTIFIED BY '$_passwd';"
-# # add zabbix-agent parameter
-# cp "$_assets"/zabbix/userparameter_mysql.conf "$_agent_conf_d"/
+# MYSQL
+# https://serverfault.com/questions/737018/zabbix-user-parameter-mysql-status-setting-home
+# create zabbix user home
+mkdir /var/lib/zabbix
+# generate random password for zabbix mysql user
+_passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
+# add mysql credentials to zabbix home
+printf "[client]\n
+user=zabbix\n
+password=$_passwd" > /var/lib/zabbix/.my.cnf
+# create zabbix mysql user
+mysql -uroot -p"$_root_mysql_passwd" -e "CREATE USER 'zabbix' IDENTIFIED BY '$_passwd';"
+mysql -uroot -p"$_root_mysql_passwd" -e "GRANT USAGE ON *.* TO 'zabbix'@'localhost' IDENTIFIED BY '$_passwd';"
+# add zabbix-agent parameter
+cp "$_assets"/zabbix/userparameter_mysql.conf "$_agent_conf_d"/
 
 # NGINX
 # https://github.com/sfuerte/zbx-nginx
@@ -74,7 +88,7 @@ mkdir /etc/zabbix/zabbix_agentd.scripts
 cp "$_assets"/zabbix/scripts/nginx-stat.py /etc/zabbix/zabbix_agentd.scripts/
 chmod +x /etc/zabbix/zabbix_agentd.scripts/nginx-stat.py
 
-echo -n "This is box is a proxmox CT? [Y|n] "
+echo -n "Is This box a proxmox CT? [Y|n] "
 read yn
 yn=${yn:-y}
 if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then

install.sh

@@ -7,6 +7,8 @@ echo -e '
  /_/ \_\_| .__/_|_||_\___| |____|___|_|  |_|_|
          |_|
 '
+# https://wiki.alpinelinux.org/wiki/Alpine_setup_scripts
+
 echo -e "\033[35;1mThis script has been tested only on Alpine Linux \033[0m"
 
 . bin/checkroot.sh
@@ -30,9 +32,17 @@ _cwd="$(pwd)"
 . bin/ssh.sh
 . bin/ufw.sh
 . bin/fail2ban.sh
-. bin/knockd.sh
-# . bin/email.sh
+# . bin/knockd.sh
+. bin/email.sh
 . bin/lemp.sh
-# . bin/vhost.sh
+. bin/mysqlbackup.sh
+  while [ "$vh" != "y" ] && [ "$vh" != "n" ]
+  do
+    echo -n "Should we install a vhost? [y|n] "
+    read vh
+  done
+  if [ "$vh" = "y" ]; then
+    . bin/vhost.sh
+  fi
 . bin/zabbix.sh
 . bin/urbackup.sh

readme.md

@@ -1,41 +1,53 @@
-# Install web server and secure it on alpine linux 3.8
+# Install web server and secure it on alpine linux 3.12
+/!\ WARNING if your file system is ZFS, will not be compatible with drupal 9 because of mariadb bug
+
+https://bugs.alpinelinux.org/issues/9046
 
 ## Branches
 each alpine linux stable release has it's branch (master is a clone of the last one)
 - [3.8](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.8)
-- [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
+- [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9)
+- [3.10](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.10)
+- [3.11](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.11)
+- [3.12](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.12) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
 
 ## Features
 
 - [x] upgrade
 - [x] bash
-- [x] misc
+- [x] misc (procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen tzdata)
 - [x] dotfiles
 - [x] user
 - [x] secure openssh
-- [x] Ufw (may be eventualy replaced by awall ?)
+- [x] Ufw@edgecommunity
 - [x] Fail2ban
-- [x] Knockd
+- [ ] Knockd
 - [x] Mariadb (bug https://bugs.alpinelinux.org/issues/9046)
-- [ ] mysql backups
-- [x] php7-fpm (7.1)
+- [x] mysql backups
+- [x] php7-fpm (7.3.22)
+- [x] redis
 - [x] Nginx
 - [x] drush
 - [x] composer
-- [ ] letsencrypt
-- [ ] vhosts
-- [x] redis
-- [x] zabbix-agent (3.4)
+- [x] vhosts
+- [x] letsencrypt
+- [x] git barre repos
+- [x] zabbix-agent (3.4 || 4)
 - [x] urbackup-client
 - [ ] solr
-- [ ] git barre repos
 - [ ] Proftpd
-- [x] passwd generator
 
 ## how to use it
 on a fresh install
 as root
 
+0 you may need to install ssh server
+```
+apk add openssh
+rc-update add sshd
+/etc/init.d/sshd start
+```
+
 1 install git
 ```
 apk add git
@@ -43,8 +55,7 @@ apk add git
 
 2 clone the repo
 ```
-git clone -b 3.8 --single-branch https://figureslibres.io/gogs/bachir/al
-pine-web-werver.git
+git clone -b 3.12 --single-branch https://figureslibres.io/gogs/bachir/alpine-web-werver.git
 ```
 
 3 you have to be root
@@ -63,10 +74,8 @@ cd alpine-web-server
 . install.sh
 ```
 
-all script in bin/ can be ran seperatly, but from the repos source exclusively
-```
-. bin/misc.sh
-```
+All script in bin/ can be ran seperatly, but from the repos source exclusively eg: ```. bin/vhost.sh```. Be aware that all scripts need bash and some depends on packages and config installed by bin/misc.sh, run it once right after bin/bash.sh if you wont use the full install.sh.
+
 
 ## ref
 [Alpine Linux wiki](https://wiki.alpinelinux.org)