added warning about drupal 9 mariadb version and zfs+maridb bug

assets/d7-drush-composer.json

@@ -0,0 +1,13 @@
+{
+  "require": {
+    "drush/drush": "~8.0",
+    "webflo/drupal-finder": "^1.0.0"
+  },
+  "extra": {
+    "installer-paths": {
+      ".": [
+        "type:drupal-core"
+      ]
+    }
+  }
+}

assets/gitdeploy/deploy-drupal.sh

@@ -4,8 +4,10 @@ echo "updating drupal 8"
 echo "Switching to project docroot."
 cd ./app
 echo ""
-echo "Pulling down latest code."
+echo "Pulling down latest code and submodules."
 git pull --ff-only origin prod
+git submodule update --init --recursive --remote
+
 echo ""
 echo "Clearing drush caches."
 drush cache-clear drush

assets/gitdeploy/deploy-simple.sh

@@ -6,5 +6,6 @@ cd ./app
 echo ""
 echo "Pulling down latest code."
 git pull --ff-only origin prod
+git submodule update --init --recursive --remote
 echo ""
 echo "Deployment complete."

assets/lemp/default.nginxconf

@@ -62,7 +62,7 @@ server {
       fastcgi_param PATH_INFO $fastcgi_path_info;
 
       fastcgi_param HTTP_PROXY "";
-      fastcgi_param HTTPS on;
+      fastcgi_param HTTPS off;
       fastcgi_request_buffering off;
     }
 

assets/vhosts/drupal-ssl.nginxconf

@@ -1,18 +1,17 @@
 # https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
 # https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
 server {
-  listen 80;
+  listen [::]:80;
   server_name DOMAIN.LTD;
   return 301 https://$server_name$request_uri;
 }
 
 server {
-  listen 443 ssl;
   listen [::]:443 ssl;
 
   server_name DOMAIN.LTD;
 
-  root /var/www/DOMAIN.LTD/app/public_html;
+  root /var/www/DOMAIN.LTD/app/web;
 
   #SSL Certificates
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
@@ -136,5 +135,5 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
+  add_header X-Frame-Options SAMEORIGIN;
 }

assets/vhosts/drupal.nginxconf

@@ -1,8 +1,8 @@
 # https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/
 server {
-    listen 80;
+    listen [::]:80;
     server_name DOMAIN.LTD;
-    root /var/www/DOMAIN.LTD/app/public_html;
+    root /var/www/DOMAIN.LTD/app/web;
 
     charset utf-8;
 
@@ -112,6 +112,6 @@ server {
     }
 
     # website should not be displayed inside a <frame>, an <iframe> or an <object>
-    add_header X-Frame-Options SAMEORIGIN;;
+    add_header X-Frame-Options SAMEORIGIN;
 
 }

assets/vhosts/simple-phpfpm-ssl.nginxconf

@@ -1,18 +1,17 @@
 # https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in-debian-9/
 
 server {
-  listen 80;
+  listen [::]:80;
   server_name DOMAIN.LTD;
   return 301 https://$server_name$request_uri;
 }
 
 server {
-  listen 443 ssl;
   listen [::]:443 ssl;
 
   server_name DOMAIN.LTD;
 
-  root /var/www/DOMAIN.LTD/app/public_html;
+  root /var/www/DOMAIN.LTD/app/web;
   index index.html index.php;
 
   charset utf-8;
@@ -61,6 +60,6 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
+  add_header X-Frame-Options SAMEORIGIN;
 
 }

assets/vhosts/simple-phpfpm.nginxconf

@@ -1,8 +1,8 @@
 server {
-  listen 80;
+  listen [::]:80;
   server_name DOMAIN.LTD;
 
-  root /var/www/DOMAIN.LTD/app/public_html;
+  root /var/www/DOMAIN.LTD/app/web;
   index index.html index.php;
 
   charset utf-8;
@@ -37,6 +37,6 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options SAMEORIGIN;;
+  add_header X-Frame-Options SAMEORIGIN;
 
 }

bin/gitdeploy.sh

@@ -125,7 +125,7 @@ if [ "$yn" = "yes" ]; then
   _cur_ip=$(ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
   echo "git repos for $_domain install succeed"
   echo "your site stay now to /home/$user/www/$_domain/app"
-  echo "you can push updates on prod branch through $user@$_cur_ip:git-repositories/$_domain.git"
+  echo "you can push updates on prod branch through $user@$_cur_ip:git-repos/$_domain.git"
   cd "$_cwd"
 else
   echo "Git barre repo creation aborted"

bin/knockd.sh

@@ -33,22 +33,24 @@ echo -n "checking if ufw is installed"
 ufw_installed=$(apk list -I | grep "ufw")
 if ! $ufw_installed; then
   echo -n "ufw installed"
+
+  mv /etc/knockd.conf /etc/knockd.conf.ori
+  cp "$_assets"/knockd.conf /etc/knockd.conf
+  echo -n "define a sequence number for opening ssh (as 7000,8000,9000) : "
+  read sq
+  sed -i "s/7000,8000,9000/$sq/g" /etc/knockd.conf
+
+  rc-update add knockd
+  /etc/init.d/knockd start
+
+  ufw delete allow ssh
+
+  echo -e "knockd installed and configured"
+  echo -e "please note this sequence for future ssh knocking"
+  echo "$sq"
 else
-  . bin/ufw.sh
+  #. bin/ufw.sh
+  echo -n "ufw not installed, needed by knockd, configuration aborted"
 fi
 
-mv /etc/knockd.conf /etc/knockd.conf.ori
-cp "$_assets"/knockd.conf /etc/knockd.conf
-echo -n "define a sequence number for opening ssh (as 7000,8000,9000) : "
-read sq
-sed -i "s/7000,8000,9000/$sq/g" /etc/knockd.conf
-
-rc-update add knockd
-/etc/init.d/knockd start
-
-ufw delete allow ssh
-
-echo -e "knockd installed and configured"
-echo -e "please note this sequence for future ssh knocking"
-echo "$sq"
 sleep 3

bin/lemp.sh

@@ -38,7 +38,7 @@ sleep 3
 apk add mariadb mariadb-client mariadb-common
 
 # https://bugs.alpinelinux.org/issues/9046
-echo -n "are Maridb databases strored in a zfs file system? [y|n] "
+echo -n "are Maridb databases strored in a zfs file system (eg. through proxmox container)? [y|n] "
 read yn
 if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then
   echo -e "Stick with mariadb 10.1.x due to incompatibility of newer version with zfs"
@@ -74,15 +74,24 @@ echo -e '
 '
 echo -e "Installing PHP 7.0"
 sleep 3
-apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json
+apk add php7 php7-fpm php7-pdo_mysql php7-opcache php7-curl php7-mbstring php7-zip php7-xml php7-gd php7-mcrypt php7-imagick php7-phar php7-json php7-dom php7-tokenizer php7-iconv php7-xmlwriter php7-simplexml
+
+# to make php5 availabe
+# echo "http://dl-cdn.alpinelinux.org/alpine/v3.7/main" >> /etc/apk/repositories
+# apk add php5-fpm php5-pdo_mysql php5-opcache php5-curl php5-zip php5-xml php5-gd php5-mcrypt php5-phar php5-json php5-dom php5-iconv
 
 echo -e "Configuring PHP"
 
 sed -i "s/memory_limit\ =\ 128M/memory_limit = 512M/g" /etc/php7/php.ini
+sed -i "s/post_max_size\ =\ 8M/post_max_size = 20M/g" /etc/php7/php.ini
+sed -i "s/upload_max_filesize\ =\ 2M/upload_max_filesize = 20M/g" /etc/php7/php.ini
 
-TIMEZONE="Europe/Helsinki"
+TIMEZONE="Europe/Paris"
 sed -i "s|;*date.timezone =.*|date.timezone = ${TIMEZONE}|i" /etc/php7/php.ini
 
+sed -i "s|user = nobody|user = www|i" /etc/php7/php-fpm.d/www.conf
+sed -i "s|group = nobody|group = www|i" /etc/php7/php-fpm.d/www.conf
+
 rc-update add php-fpm7
 service php-fpm7 start
 
@@ -103,14 +112,16 @@ service php-fpm7 restart
 
 chmod +r /etc/phpmyadmin/config.inc.php
 
-echo -e "securing phpMyAdmin"
-_pass="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c8)"
-_encrypted=$(openssl passwd -apr1 $_pass)
-echo -e "pma:$_encrypted" > /etc/nginx/passwds
-# service apache2 restart
-echo -e "phpMyAdmin installed"
-echo -e "You can access it at yourip/phpmyadmin"
-echo -e "please note the credentials user: pma passwd:$_pass"
+# /**
+#  * This is needed for cookie based authentication to encrypt password in
+#  * cookie. Needs to be 32 chars long.
+#  */
+_blowfish="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c32)"
+sed -i "s|$cfg['blowfish_secret'] = ''|$cfg['blowfish_secret'] = '${_blowfish}'|i" /etc/phpmyadmin/config.inc.php
+
+mkdir /usr/share/webapps/phpmyadmin/tmp
+chmod 777 /usr/share/webapps/phpmyadmin/tmp
+# finishing the pma install after nginx
 
 echo -e '
              _ _
@@ -142,6 +153,7 @@ echo -e "Installing Composer"
 sleep 3
 export COMPOSER_HOME=/usr/local/composer
 curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+ln -sf /usr/local/bin/composer /usr/bin/composer
 composer about
 echo -e "Composer installed"
 
@@ -156,12 +168,16 @@ echo -e "Installing Drush and DrupalConsole"
 sleep 3
 curl https://drupalconsole.com/installer -L -o /usr/local/bin/drupal
 chmod +x /usr/local/bin/drupal
+ln -sf /usr/local/bin/drupal /usr/bin/drupal
 drupal about
-curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
+# curl https://github.com/drush-ops/drush-launcher/releases/download/0.6.0/drush.phar -L -o /usr/local/bin/drush
+wget -O /usr/local/bin/drush https://github.com/drush-ops/drush-launcher/releases/latest/download/drush.phar
 chmod +x /usr/local/bin/drush
+ln -sf /usr/local/bin/drush /usr/bin/drush
+drush status
+echo -e "Drush and DrupalConsole installed"
 
-echo -e "Drush and DrupalConsoleinstalled"
-
+# for non composer installed D7 site add assets/d7-drush-composer.json in root-folder/composer.json and run composer install
 
 echo -e '
             _
@@ -178,11 +194,22 @@ adduser -D -g 'www' www
 mkdir -p /var/www/html
 chown -R www:www /var/lib/nginx
 chown -R www:www /var/www/html
+chown -R www:www /var/tmp/nginx
+
+sed -i "s|user nginx;|user www;|i" /etc/nginx/nginx.conf
 
 mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.ori
 cp "$_assets"/lemp/default.nginxconf /etc/nginx/conf.d/default.conf
 cp "$_assets"/lemp/index.php /var/www/html/
-
 rc-update add nginx
 service nginx start
 echo -e "Nginx installed"
+
+echo -e "securing phpMyAdmin"
+_pass="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
+_encrypted=$(openssl passwd -apr1 $_pass)
+echo -e "pma:$_encrypted" > /etc/nginx/passwds
+echo -e "phpMyAdmin installed"
+echo -e "You can access it at yourip/phpmyadmin"
+echo -e "please note the credentials user: pma passwd:$_pass"
+sleep 3

bin/misc.sh

@@ -17,7 +17,7 @@ echo '@edge http://dl-cdn.alpinelinux.org/alpine/edge/main
 
 apk update
 
-apk add procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot # needrestart
+apk add procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen rsync patch #ntp # needrestart
 
 # sed -i "s/^# en_GB.UTF-8/en_GB.UTF-8/g" /etc/locale.gen
 # locale-gen

bin/mysql-db.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+
+echo -e '
+     _ _      _   _
+  __| | |__  | | | |___ ___ _ _
+ / _` |  _ \ | |_| (_-</ -_)  _|
+ \__,_|_.__/  \___//__/\___|_|
+'
+
+echo -e "Create new mysql db and user (you will be asked a db name and a password)"
+
+. bin/checkroot.sh
+
+sleep 3
+
+# configure
+echo -n "Please provide the mysql root passwd : "
+read _root_mysql_passwd
+
+mysql -u root -p$_root_mysql_passwd -e "show databases;"
+
+echo -n "Enter new db name: "
+read db_name
+while [ "$db_name" = "" ]
+do
+  read -p "enter a db name ? " db_name
+  if [ "$db_name" != "" ]; then
+    # TODO check if db already exists
+    # if id "$db_name" >/dev/null 2>&1; then
+    #   echo "user $db_name alreday exists, you must provide a non existing user name."
+    #   db=""
+    # else
+      read -p "is db name $db_name correcte [y|n] " validated
+      if [ "$validated" = "y" ]; then
+        break
+      else
+        db_name=""
+      fi
+    # fi
+  fi
+done
+
+# generate random password for new mysql user
+_passwd="$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c16)"
+
+# create new mysql user
+mysql -u root -p$_root_mysql_passwd -e "CREATE DATABASE $db_name;"
+mysql -u root -p$_root_mysql_passwd -e "CREATE USER '$db_name'@'localhost' IDENTIFIED BY '$_passwd';"
+mysql -u root -p$_root_mysql_passwd -e "GRANT ALL ON $db_name.* TO '$db_name'@'localhost';"
+
+mysql -u root -p$_root_mysql_passwd -e "show databases;"
+
+echo "database and user : $db_name installed"
+echo " please record your password $_passwd"
+echo "press any key to continue."
+read continu

bin/ufw.sh

@@ -13,8 +13,16 @@ sleep 2
 
 # TODO use awall instead of ufw ?
 
+# BUG
 # ufw
-apk add ufw@testing
+# Traceback (most recent call last):
+#   File "/usr/sbin/ufw", line 25, in <module>
+#     import ufw.frontend
+# ModuleNotFoundError: No module named 'ufw'
+
+
+# ufw
+apk add ufw@edgecommunity
 ufw allow ssh # knockd will open the ssh port
 ufw allow http
 ufw allow https

bin/urbackup.sh

@@ -38,12 +38,17 @@ apk add linux-headers "g++" zlib zlib-dev "crypto++@testing" "crypto++-dev@testi
 ln -s /usr/lib/libcryptopp.so /usr/lib/libcryptopp.so.5.6
 
 # Download the UrBackup client source files and extract them
-wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/latest/urbackup-client-2.3.4.0.tar.gz
+# wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.8/urbackup-client-2.4.8.0.tar.gz
+wget -P /tmp/ https://hndl.urbackup.org/Client/2.4.10/urbackup-client-2.4.10.0.tar.gz
+
 cd /tmp
-tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
+# tar xzf /tmp/urbackup-client-2.3.4.0.tar.gz
+tar xzf /tmp/urbackup-client-2.4.10.0.tar.gz
 
 # Build the UrBackup client and install it
-cd /tmp/urbackup-client-2.3.4.0
+# cd /tmp/urbackup-client-2.3.4.0
+cd /tmp/urbackup-client-2.4.10.0
 ./configure --enable-headless
 make -j4
 make install
@@ -65,9 +70,11 @@ echo "internet_server=$_ip
 internet_server_port=55415
 internet_mode_enabled=true
 internet_image_backups_def=false
-default_dirs_def=/etc;var/www;/var/backups/mysql
+default_dirs_def=/etc;/var/www;/var/backups/mysql
 startup_backup_delay_def=3
-computername=$_computername" > /usr/local/var/urbackup/data/settings.cfg
+computername=$_computername" > /etc/conf.d/urbackupclient
+
+# /usr/local/var/urbackup/data/settings.cfg
 
 # firewall
 ufw allow from "$_ip" to any port 35621

bin/user.sh

@@ -39,8 +39,11 @@ adduser "$user"
 
 sed -i "s/$user:\/bin\/ash/$user:\/bin\/bash/g" /etc/passwd
 
+usermod -a -G www "$user"
+
 # TODO limiting su to the admin group
-whie [ "$vh" != "y" ] && [ "$vh" != "n" ]
+yn="reset"
+while [ "$yn" != "y" ] && [ "$yn" != "n" ]
 do
   echo -n "Should we allow $user to su? [y|n] "
   read yn

bin/vhost.sh

@@ -23,6 +23,11 @@ if [ ! -d "$_assets" ]; then
   fi
 fi
 
+_domain=""
+_validated=""
+_drupal=""
+_letsencrypt=""
+
 while [ "$_domain" = "" ]
 do
   read -p "enter a domain name ? " _domain
@@ -87,11 +92,11 @@ fi
 cp "$_assets/vhosts/$_conffile" /etc/nginx/conf.d/"$_domain".conf
 sed -i -r "s/DOMAIN\.LTD/$_domain/g" /etc/nginx/conf.d/"$_domain".conf
 
-mkdir -p /var/www/"$_domain"/app/public_html
+mkdir -p /var/www/"$_domain"/app/web
 mkdir /var/www/"$_domain"/log
 
-cp "$_assets/vhosts/index.php" /var/www/"$_domain"/app/public_html/
-sed -i -r "s/DOMAIN\.LTD/$_domain/g" /var/www/"$_domain"/app/public_html/index.php
+cp "$_assets/vhosts/index.php" /var/www/"$_domain"/app/web/
+sed -i -r "s/DOMAIN\.LTD/$_domain/g" /var/www/"$_domain"/app/web/index.php
 
 #set proper right to user will handle the app
 chown -R www:www  /var/www/"$_domain"/

bin/zabbix.sh

@@ -88,7 +88,7 @@ mkdir /etc/zabbix/zabbix_agentd.scripts
 cp "$_assets"/zabbix/scripts/nginx-stat.py /etc/zabbix/zabbix_agentd.scripts/
 chmod +x /etc/zabbix/zabbix_agentd.scripts/nginx-stat.py
 
-echo -n "This is box is a proxmox CT? [Y|n] "
+echo -n "Is This box a proxmox CT? [Y|n] "
 read yn
 yn=${yn:-y}
 if [ "$yn" = "Y" ] || [ "$yn" = "y" ]; then

install.sh

@@ -7,6 +7,8 @@ echo -e '
  /_/ \_\_| .__/_|_||_\___| |____|___|_|  |_|_|
          |_|
 '
+# https://wiki.alpinelinux.org/wiki/Alpine_setup_scripts
+
 echo -e "\033[35;1mThis script has been tested only on Alpine Linux \033[0m"
 
 . bin/checkroot.sh
@@ -30,11 +32,11 @@ _cwd="$(pwd)"
 . bin/ssh.sh
 . bin/ufw.sh
 . bin/fail2ban.sh
-. bin/knockd.sh
+# . bin/knockd.sh
 . bin/email.sh
 . bin/lemp.sh
 . bin/mysqlbackup.sh
-  whie [ "$vh" != "y" ] && [ "$vh" != "n" ]
+  while [ "$vh" != "y" ] && [ "$vh" != "n" ]
   do
     echo -n "Should we install a vhost? [y|n] "
     read vh

readme.md

@@ -1,41 +1,53 @@
-# Install web server and secure it on alpine linux 3.9
+# Install web server and secure it on alpine linux 3.12
+/!\ WARNING if your file system is ZFS, will not be compatible with drupal 9 because of mariadb bug
+
+https://bugs.alpinelinux.org/issues/9046
 
 ## Branches
 each alpine linux stable release has it's branch (master is a clone of the last one)
 - [3.8](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.8)
-- [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
+- [3.9](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.9)
+- [3.10](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.10)
+- [3.11](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.11)
+- [3.12](https://figureslibres.io/gogs/bachir/alpine-web-werver/src/3.12) ([master](https://figureslibres.io/gogs/bachir/alpine-web-werver))
 
 ## Features
 
 - [x] upgrade
 - [x] bash
-- [x] misc
+- [x] misc (procps vim curl tmux etckeeper htop lynx unzip grep shadow coreutils certbot pwgen tzdata)
 - [x] dotfiles
 - [x] user
 - [x] secure openssh
-- [x] Ufw (may be eventualy replaced by awall ?)
+- [x] Ufw@edgecommunity
 - [x] Fail2ban
-- [x] Knockd
+- [ ] Knockd
 - [x] Mariadb (bug https://bugs.alpinelinux.org/issues/9046)
-- [ ] mysql backups
-- [x] php7-fpm (7.2)
+- [x] mysql backups
+- [x] php7-fpm (7.3.22)
+- [x] redis
 - [x] Nginx
 - [x] drush
 - [x] composer
-- [ ] letsencrypt
-- [ ] vhosts
-- [x] redis
+- [x] vhosts
+- [x] letsencrypt
+- [x] git barre repos
 - [x] zabbix-agent (3.4 || 4)
 - [x] urbackup-client
 - [ ] solr
-- [ ] git barre repos
 - [ ] Proftpd
-- [x] passwd generator
 
 ## how to use it
 on a fresh install
 as root
 
+0 you may need to install ssh server
+```
+apk add openssh
+rc-update add sshd
+/etc/init.d/sshd start
+```
+
 1 install git
 ```
 apk add git
@@ -43,7 +55,7 @@ apk add git
 
 2 clone the repo
 ```
-git clone -b 3.9 --single-branch https://figureslibres.io/gogs/bachir/alpine-web-werver.git
+git clone -b 3.12 --single-branch https://figureslibres.io/gogs/bachir/alpine-web-werver.git
 ```
 
 3 you have to be root