FeministWiki:Server setup
!!! WORK IN PROGRESS !!!
These are the steps required to set up a new FeministWiki Debian server.
Update & upgrade
First of all, let's make sure the system is up to date.
apt-get update apt-get upgrade apt-get dist-upgrade
Install miscellaneous tools
Some of these are needed further down, some are just good to have.
apt-get install certbot apt-get install dnsutils apt-get install emacs apt-get install git apt-get install mg apt-get install moreutils apt-get install net-tools apt-get install nmap apt-get install software-properties-common apt-get install tree
Set up firewall
For now, block everything but SSH.
apt-get install ufw ufw allow proto tcp to 0.0.0.0/0 port 22 ufw enable
Install server components
We will now install all the software used for the various FeministWiki services. But first we might want to add some additional package repositories so we can use the latest version of some of the used software.
Backports:
echo deb http://deb.debian.org/debian $(lsb_release -sc)-backports main > /etc/apt/sources.list.d/backports.list
PHP repo only if a very new version is needed:
wget -O /etc/apt/trusted.gpg.d/sury-php.gpg https://packages.sury.org/php/apt.gpg echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/sury-php.list
MariaDB repo only if a very new version is needed:
wget https://mariadb.org/mariadb_release_signing_key.asc apt-key add mariadb_release_signing_key.asc rm mariadb_release_signing_key.asc echo "deb http://mirror.23media.de/mariadb/repo/10.4/debian $(lsb_release -sc) main" > /etc/apt/sources.list.d/mariadb.list
Now we can install everything:
php_version=7.4 # or whatever version we're on apt-get install apache2 apt-get install dovecot-core apt-get install ejabberd # good candidate for backports apt-get install fail2ban apt-get install inspircd apt-get install mailman apt-get install mariadb-server apt-get install opendkim apt-get install php${php_version} apt-get install php${php_version}-mbstring apt-get install php${php_version}-xml apt-get install postfix apt-get install slapd
Example for installing ejabberd from backports instead:
apt-get install ejabberd/$(lsb_release -sc)-backports
Fetch scripts & config repo
Set up GitHub ssh access by copying the .ssh/id_rsa
from the old server. After that:
cd ~ git clone git@github.com:FeministWiki/FeministWiki.git repo cp -a repo/root/* . openssl aes-256-cbc -d -md sha512 -pbkdf2 -iter 100000 -in repo/pwd.enc -out - | tar -xzf-
The openssl
decryption command will prompt you for a password. Enter the password stored in /root/pwd/meta
on the old server.
Put config files in place
The principle is simple: take all the config files from /root/repo/etc
and put them where they belong in /etc
. However, since a new server might mean much newer software, it's possible that some config files aren't compatible anymore, or that some new sensible defaults might be overwritten by the old config. Sadly figuring out these incompatibilities is a manual process (compare new default config with old config) and this guide cannot help you much.
There's one special thing to remember, which is that after copying in the new /etc/aliases
file, you have to run the newaliases
command for the changes to take effect.
Create vmail user
groupadd -g 5000 vmail useradd -u 5000 -g vmail -s /usr/sbin/nologin -d /home/vmail -m vmail
Initialize LetsEncrypt
The first run of Certbot has to be interactive, so we will do that now. Since the DNS entries still point to the old server, we can't get a cert for the real domains. For now, make feministwiki.dev point to the IP address of the new server, then proceed with the commands below.
systemctl stop apache2 certbot certonly --cert-name feministwiki.org # Yes, it should be .org and not .dev
Then follow the on-screen instructions of certbot. Use the "standalone" authentication method when asked, and enter feministwiki.dev as the sole domain.
Stop services on old server
At this point, all services on the old server should be stopped, because we will now begin to transfer all the actual data.
Copy over LDAP databases
TODO
Copy over SQL databases
The following command can be used to create a dump of all databases and import it on the new server. You can use the show databases;
command in the SQL console to make sure that the list of databases is complete. (Unfortunately they have to be listed manually, because using the --all-databases
option includes system databases that we don't want.)
mysqldump -u root -p"$(cat /root/pwd/mysql)" \ --databases blogs \ feministblog \ feministfiles \ feministforum \ feministmail \ feministsocial \ feministwiki \ feministwiki_de \ feministwiki_es \ feministwiki_it \ feministwiki_pt \ fff \ | ssh root@feministwiki.dev 'mysql -u root -p"$(cat /root/pwd/mysql)"'
Copy over /var/www
This is very simple but takes a lot of time to finish:
cd /var/www tar -czf - . | ssh root@feministwiki.dev 'cd /var/www; tar -xzf -'
Open ports
We are finally ready to serve:
for port in 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777 do ufw allow proto tcp to 0.0.0.0/0 port $port done
At this point you might want to do some testing with the feministwiki.dev domain.
Reboot
We could restart a lot of services manually, but it's easiest to just reboot.
reboot
Update DNS entries
You have to change the configuration of the following domains:
- feministwiki.org
- feministwiki.net
- feministwiki.de
- fem.wiki
- fffrauen.de
feministwiki.org
You only have to change three DNS entries, since most of the subdomains work via CNAME entries:
- The main
A
entry for@
(self-reference i.e. feministwiki.org) - The
A
entry forsmtp
since this is not allowed to be a CNAME - The
A
entry forxmpp
since this is not allowed to be a CNAME
feministwiki.net, feministwiki.de, fem.wiki, fffrauen.de
For these, you only have to change the main A
entry, since they don't use SMTP or XMPP.
Update the certificate
Run the letsencrypt-refresh
script to get a new certificate which includes all our domain names, since we had started out with just feministwiki.dev.