FeministWiki:Server setup - Revision history

Technician at 13:25, 4 March 2026

2026-03-04T13:25:31Z

← Older revision		Revision as of 13:25, 4 March 2026
Line 146:		Line 146:
	mariadb-server \		mariadb-server \
	nginx-extras \		nginx-extras \
	~~opendkim \~~
	~~opendmarc \~~
	postfix \		postfix \
	postfix-ldap \		postfix-ldap \
			rspamd \
	slapd		slapd

Line 157:		Line 156:

	apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports		apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports

	~~=== Make sure Postfix can connect to OpenDKIM & OpenDMARC ===~~

	Postfix's SMTPD daemon runs in a chroot in {{C\|/var/spool/postfix}}, so the configuration of OpenDKIM and OpenDMARC arrange for their respective Unix sockets to be created in subdirectories therein; we must ensure that these exist and have the correct permissions:

	~~mkdir -p /var/spool/postfix/opendkim~~
	~~mkdir -p /var/spool/postfix/opendmarc~~
	~~chown opendkim:opendkim /var/spool/postfix/opendkim~~
	~~chown opendmarc:opendmarc /var/spool/postfix/opendmarc~~
	~~adduser postfix opendkim~~
	~~adduser postfix opendmarc~~

	=== Install PHP and modules ===		=== Install PHP and modules ===
Line 204:		Line 192:
	dpkg -L php-luasandbox		dpkg -L php-luasandbox

	=== Copy over certificates ===		=== Copy over certificates and DKIM key ===

	Copy over the certs from the old server:		Copy over the certs from the old server:

	# Run on old server		# Run on old server
	rsync -avz /etc/feministwiki/certs feministwiki.dev:/etc/feministwiki~~/certs~~		rsync -avz /etc/feministwiki/certs feministwiki.dev:/etc/feministwiki

	The {{C\|/etc/feministwiki/certs}} directory and its contents should be owned by the group {{C\|ssl-cert}}. Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server. If the group doesn't exist at all, just create it.		The {{C\|/etc/feministwiki/certs}} directory and its contents should be owned by the group {{C\|ssl-cert}}. Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server. If the group doesn't exist at all, just create it.
Line 225:		Line 213:
	# Run on old server		# Run on old server
	rsync -avz /etc/letsencrypt/{archive,live} feministwiki.dev:/etc/letsencrypt		rsync -avz /etc/letsencrypt/{archive,live} feministwiki.dev:/etc/letsencrypt

			Finally, copy over the DKIM signing key:

			rsync -avz /etc/feministwiki/dkim.key feministwiki.dev:/etc/feministwiki

			This file must be owned by the {{C\|_rspamd}} user and not readable by anyone else.

	=== Put config files in place ===		=== Put config files in place ===
Line 549:		Line 543:
	systemctl stop inspircd		systemctl stop inspircd
	systemctl stop nginx		systemctl stop nginx
	~~systemctl stop opendkim~~
	systemctl stop postfix		systemctl stop postfix
			systemctl stop rspamd
	systemctl stop slapd		systemctl stop slapd

Line 574:		Line 568:
	systemctl stop inspircd		systemctl stop inspircd
	systemctl stop nginx		systemctl stop nginx
	~~systemctl stop opendkim~~
	systemctl stop postfix		systemctl stop postfix
			systemctl stop rspamd
	systemctl stop slapd		systemctl stop slapd

Technician at 09:17, 2 March 2026

2026-03-02T09:17:22Z

← Older revision		Revision as of 09:17, 2 March 2026
Line 147:		Line 147:
	nginx-extras \		nginx-extras \
	opendkim \		opendkim \
			opendmarc \
	postfix \		postfix \
	postfix-ldap \		postfix-ldap \
	~~rspamd \~~
	slapd		slapd

Line 158:		Line 158:
	apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports		apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports

	=== Make sure Postfix can connect to OpenDKIM ===		=== Make sure Postfix can connect to OpenDKIM & OpenDMARC ===

			Postfix's SMTPD daemon runs in a chroot in {{C\|/var/spool/postfix}}, so the configuration of OpenDKIM and OpenDMARC arrange for their respective Unix sockets to be created in subdirectories therein; we must ensure that these exist and have the correct permissions:

	mkdir -p /var/spool/postfix/opendkim		mkdir -p /var/spool/postfix/opendkim
			mkdir -p /var/spool/postfix/opendmarc
	chown opendkim:opendkim /var/spool/postfix/opendkim		chown opendkim:opendkim /var/spool/postfix/opendkim
			chown opendmarc:opendmarc /var/spool/postfix/opendmarc
	adduser postfix opendkim		adduser postfix opendkim
			adduser postfix opendmarc

	=== Install PHP and modules ===		=== Install PHP and modules ===
Line 168:		Line 173:
	This should really be part of the last section, but due to the sheer number of PHP modules we want to install, it's in its own section:		This should really be part of the last section, but due to the sheer number of PHP modules we want to install, it's in its own section:

	php_version=8.1 # or whatever version we're on		php_version=8.4 # or whatever version we're on

	apt-get install php${php_version} \		apt-get install php${php_version} \

Technician: /* Install server components */ Add rspamd.

2026-03-02T06:44:46Z

Install server components: Add rspamd.

← Older revision		Revision as of 06:44, 2 March 2026
Line 149:		Line 149:
	postfix \		postfix \
	postfix-ldap \		postfix-ldap \
			rspamd \
	slapd		slapd

Technician at 17:37, 1 June 2024

2024-06-01T17:37:00Z

← Older revision		Revision as of 17:37, 1 June 2024
Line 188:		Line 188:
	php${php_version}-zip		php${php_version}-zip

	We also want {{C\|php-luasandbox}}, which may not have a PHP version attached to the package name, in which case you'll have to make sure it supports the PHP version currently in use. If not, you can use the standalone Lua binary instead by setting {{C\|$wgScribuntoDefaultEngine = 'luastandalone';}} in MediaWiki's {{C\|LocalSettings.php}} configuration file.		We also want {{C\|php-luasandbox}}, which may not have a PHP version attached to the package name, in which case you'll have to make sure it supports the PHP version currently in use. If not, you can use the standalone Lua binary instead by setting {{C\|$wgScribuntoDefaultEngine {{=}} 'luastandalone';}} in MediaWiki's {{C\|LocalSettings.php}} configuration file.

	# See if this works first:		# See if this works first:

Technician: /* Copy over certificates */

2024-05-10T11:54:54Z

Copy over certificates

← Older revision		Revision as of 11:54, 10 May 2024
Line 203:		Line 203:

	# Run on old server		# Run on old server
	rsync -avz /etc/~~fw-~~certs feministwiki.dev:/etc/~~fw-~~certs		rsync -avz /etc/feministwiki/certs feministwiki.dev:/etc/feministwiki/certs

	The {{C\|/etc/~~fw-~~certs}} directory and its contents should be owned by the group {{C\|ssl-cert}}. Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server. If the group doesn't exist at all, just create it.		The {{C\|/etc/feministwiki/certs}} directory and its contents should be owned by the group {{C\|ssl-cert}}. Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server. If the group doesn't exist at all, just create it.

	Further, files in that directory which contain the private key ({{C\|privkey.pem}} and {{C\|bundle.pem}}) should only be readable by group members. That is, their permission mode should be 640, displayed as {{C\|-rw-r-----}} in the output of {{C\|ls -l}}. Make sure this really the case.		Further, files in that directory which contain the private key ({{C\|privkey.pem}} and {{C\|bundle.pem}}) should only be readable by group members. That is, their permission mode should be 640, displayed as {{C\|-rw-r-----}} in the output of {{C\|ls -l}}. Make sure this really the case.

Technician: /* Install miscellaneous tools */

2024-01-18T18:28:54Z

Install miscellaneous tools

← Older revision		Revision as of 18:28, 18 January 2024
Line 34:		Line 34:
	git \		git \
	imagemagick \		imagemagick \
			iotop \
	ldap-utils \		ldap-utils \
	mg \		mg \

Technician: /* Install miscellaneous tools */

2024-01-18T12:52:32Z

Install miscellaneous tools

← Older revision		Revision as of 12:52, 18 January 2024
Line 28:		Line 28:
	bsdutils \		bsdutils \
	certbot \		certbot \
			composer \
	curl \		curl \
	dnsutils \		dnsutils \

Technician: /* Install PHP and modules */

2024-01-16T17:25:41Z

Install PHP and modules

← Older revision		Revision as of 17:25, 16 January 2024
Line 170:		Line 170:
	php${php_version}-apcu \		php${php_version}-apcu \
	php${php_version}-bcmath \		php${php_version}-bcmath \
			php${php_version}-bz2 \
	php${php_version}-cli \		php${php_version}-cli \
	php${php_version}-curl \		php${php_version}-curl \

Technician: /* Apache modules and configuration */

2024-01-16T13:48:17Z

Apache modules and configuration

← Older revision		Revision as of 13:48, 16 January 2024
Line 232:		Line 232:
	Enable PHP FPM and other Apache modules:		Enable PHP FPM and other Apache modules:

	a2enmod expires headers proxy_fcgi		a2enmod expires headers proxy_fcgi rewrite
	a2enconf php${php_version}-fpm		a2enconf php${php_version}-fpm

Technician at 19:13, 14 January 2024

2024-01-14T19:13:42Z

← Older revision		Revision as of 19:13, 14 January 2024
Line 127:		Line 127:
	groupadd -g 5000 vmail		groupadd -g 5000 vmail
	useradd -u 5000 -g vmail -s /usr/sbin/nologin -d /home/vmail -m vmail		useradd -u 5000 -g vmail -s /usr/sbin/nologin -d /home/vmail -m vmail

	~~=== Make sure Postfix can connect to OpenDKIM ===~~

	~~mkdir -p /var/spool/postfix/opendkim~~
	~~chown opendkim:opendkim /var/spool/postfix/opendkim~~
	~~adduser postfix opendkim~~

	=== Install server components ===		=== Install server components ===
Line 160:		Line 154:

	apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports		apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports

			=== Make sure Postfix can connect to OpenDKIM ===

			mkdir -p /var/spool/postfix/opendkim
			chown opendkim:opendkim /var/spool/postfix/opendkim
			adduser postfix opendkim

	=== Install PHP and modules ===		=== Install PHP and modules ===