FeministWiki:Server setup: Difference between revisions

    From FeministWiki
    No edit summary
    Line 3: Line 3:
    These are the steps required to set up a new FeministWiki Debian server.
    These are the steps required to set up a new FeministWiki Debian server.


    === Add repositories ===
    === Update & upgrade ===


    Install <code>software-properties-common</code>:
    First of all, let's make sure the system is up to date.


       apt-get update
       apt-get update
      apt-get upgrade
      apt-get dist-upgrade
    === Install miscellaneous tools ===
    Some of these are needed further down, some are just good to have.
      apt-get install dnsutils
      apt-get install git
      apt-get install mg
      apt-get install moreutils
      apt-get install net-tools
      apt-get install nmap
       apt-get install software-properties-common
       apt-get install software-properties-common
      apt-get install tree
    === Fetch scripts & config repo ===
     
    Set up GitHub ssh access by copying the <code>.ssh/id_rsa</code> from the old server.  After that:
     
      cd ~
      git clone git@github.com:FeministWiki/FeministWiki.git repo
      cp -a repo/root/* .
      openssl aes-256-cbc -d -md sha512 -pbkdf2 -iter 100000 -in repo/pwd.enc -out - | tar -xzf-
    The <code>openssl</code> decryption command will prompt you for a password.  Enter the password stored in <code>/root/pwd/meta</code> on old server.
    === Set up firewall ===
    For now, block everything but SSH.
      apt-get install ufw
      ufw allow proto tcp to 0.0.0.0/0 port 22
      ufw enable
    === Install server components ===
    We will now install all the software used for the various FeministWiki services.  But first we might want to add some additional package repositories so we can use the latest version of some of the used software.


    Backports:
    Backports:
    Line 23: Line 60:
       wget https://mariadb.org/mariadb_release_signing_key.asc
       wget https://mariadb.org/mariadb_release_signing_key.asc
       apt-key add mariadb_release_signing_key.asc
       apt-key add mariadb_release_signing_key.asc
      rm mariadb_release_signing_key.asc
       echo "deb http://mirror.23media.de/mariadb/repo/10.4/debian $(lsb_release -sc) main" > /etc/apt/sources.list.d/mariadb.list
       echo "deb http://mirror.23media.de/mariadb/repo/10.4/debian $(lsb_release -sc) main" > /etc/apt/sources.list.d/mariadb.list


    === Update & upgrade ===
    Now we can install everything:
     
      apt-get update
      apt-get upgrade
      apt-get dist-upgrade
     
    === Set up firewall ===
     
      apt-get install ufw
     
      for port in 22 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777
      do ufw allow proto tcp to 0.0.0.0/0 port $port
      done
     
      ufw enable
     
    === Install server components ===
     
    Now install all the software used by FeministWiki. You might want to install some of these from backports instead to get newer versions.


       apt-get install apache2
       apt-get install apache2
       apt-get install dovecot-core
       apt-get install dovecot-core
       apt-get install ejabberd
       apt-get install ejabberd # good candidate for backports
       apt-get install fail2ban
       apt-get install fail2ban
       apt-get install mariadb-server
       apt-get install mariadb-server
    Line 54: Line 74:
       apt-get install postfix
       apt-get install postfix
       apt-get install slapd
       apt-get install slapd
      apt-get install ufw


    Example for installing ejabberd from backports instead:
    Example for installing ejabberd from backports instead:


       apt-get install ejabberd/$(lsb_release -sc)-backports
       apt-get install ejabberd/$(lsb_release -sc)-backports
    === Put config files in place ===
    TODO
    === Copy over LDAP databases ===
    TODO
    === Copy over SQL databases ===
    TODO
    === Copy over /var/www ===
    TODO
    === Open ports ===
    We are finally ready to serve:
      for port in 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777
      do ufw allow proto tcp to 0.0.0.0/0 port $port
      done
    === Update DNS entries ===
    TODO

    Revision as of 04:40, 4 June 2021

    !!! WORK IN PROGRESS !!!

    These are the steps required to set up a new FeministWiki Debian server.

    Update & upgrade

    First of all, let's make sure the system is up to date.

     apt-get update
     apt-get upgrade
     apt-get dist-upgrade
    

    Install miscellaneous tools

    Some of these are needed further down, some are just good to have.

     apt-get install dnsutils
     apt-get install git
     apt-get install mg
     apt-get install moreutils
     apt-get install net-tools
     apt-get install nmap
     apt-get install software-properties-common
     apt-get install tree
    

    Fetch scripts & config repo

    Set up GitHub ssh access by copying the .ssh/id_rsa from the old server. After that:

     cd ~
     git clone git@github.com:FeministWiki/FeministWiki.git repo
     cp -a repo/root/* .
     openssl aes-256-cbc -d -md sha512 -pbkdf2 -iter 100000 -in repo/pwd.enc -out - | tar -xzf-
    

    The openssl decryption command will prompt you for a password. Enter the password stored in /root/pwd/meta on old server.

    Set up firewall

    For now, block everything but SSH.

     apt-get install ufw
     ufw allow proto tcp to 0.0.0.0/0 port 22
     ufw enable
    

    Install server components

    We will now install all the software used for the various FeministWiki services. But first we might want to add some additional package repositories so we can use the latest version of some of the used software.

    Backports:

     echo deb http://deb.debian.org/debian $(lsb_release -sc)-backports main > /etc/apt/sources.list.d/backports.list
    

    PHP repo only if a very new version is needed:

     wget -O /etc/apt/trusted.gpg.d/sury-php.gpg https://packages.sury.org/php/apt.gpg
     echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/sury-php.list
    

    MariaDB repo only if a very new version is needed:

     wget https://mariadb.org/mariadb_release_signing_key.asc
     apt-key add mariadb_release_signing_key.asc
     rm mariadb_release_signing_key.asc
     echo "deb http://mirror.23media.de/mariadb/repo/10.4/debian $(lsb_release -sc) main" > /etc/apt/sources.list.d/mariadb.list
    

    Now we can install everything:

     apt-get install apache2
     apt-get install dovecot-core
     apt-get install ejabberd # good candidate for backports
     apt-get install fail2ban
     apt-get install mariadb-server
     apt-get install opendkim
     apt-get install php7.4 # or whatever version we're on
     apt-get install postfix
     apt-get install slapd
    

    Example for installing ejabberd from backports instead:

     apt-get install ejabberd/$(lsb_release -sc)-backports
    

    Put config files in place

    TODO

    Copy over LDAP databases

    TODO

    Copy over SQL databases

    TODO

    Copy over /var/www

    TODO

    Open ports

    We are finally ready to serve:

     for port in 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777
     do ufw allow proto tcp to 0.0.0.0/0 port $port
     done
    

    Update DNS entries

    TODO