FeministWiki

FeministWiki:Server setup: Difference between revisions

← Older edit
VisualWikitext
No edit summary
 
(25 intermediate revisions by the same user not shown)
Line 28: Line 28:
                 bsdutils \
                 bsdutils \
                 certbot \
                 certbot \
                composer \
                 curl \
                 curl \
                 dnsutils \
                 dnsutils \
Line 33: Line 34:
                 git \
                 git \
                 imagemagick \
                 imagemagick \
                iotop \
                 ldap-utils \
                 ldap-utils \
                 mg \
                 mg \
Line 144: Line 146:
     mariadb-server \
     mariadb-server \
     nginx-extras \
     nginx-extras \
    opendkim \
     postfix \
     postfix \
     postfix-ldap \
     postfix-ldap \
    rspamd \
     slapd
     slapd


Line 159: Line 161:
This should really be part of the last section, but due to the sheer number of PHP modules we want to install, it's in its own section:
This should really be part of the last section, but due to the sheer number of PHP modules we want to install, it's in its own section:


  php_version=8.1 # or whatever version we're on
  php_version=8.4 # or whatever version we're on
   
   
  apt-get install php${php_version} \
  apt-get install php${php_version} \
                 php${php_version}-apcu \
                 php${php_version}-apcu \
                 php${php_version}-bcmath \
                 php${php_version}-bcmath \
                php${php_version}-bz2 \
                 php${php_version}-cli \
                 php${php_version}-cli \
                 php${php_version}-curl \
                 php${php_version}-curl \
Line 179: Line 182:
                 php${php_version}-zip
                 php${php_version}-zip


=== Copy over certificates ===
We also want {{C|php-luasandbox}}, which may not have a PHP version attached to the package name, in which case you'll have to make sure it supports the PHP version currently in use. If not, you can use the standalone Lua binary instead by setting {{C|$wgScribuntoDefaultEngine {{=}} 'luastandalone';}} in MediaWiki's {{C|LocalSettings.php}} configuration file.
 
# See if this works first:
apt-get install php${php_version}-luasandbox
# Otherwise...
apt-get install php-luasandbox
# Check the package contents to see which PHP versions are supported
dpkg -L php-luasandbox
 
=== Copy over certificates and DKIM key ===


Copy over the certs from the old server:
Copy over the certs from the old server:


  # Run on old server
  # Run on old server
  rsync -avz /etc/fw-certs feministwiki.dev:/etc/fw-certs
  rsync -avz /etc/feministwiki/certs feministwiki.dev:/etc/feministwiki


The {{C|/etc/fw-certs}} directory and its contents should be owned by the group {{C|ssl-cert}}.  Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server.  If the group doesn't exist at all, just create it.
The {{C|/etc/feministwiki/certs}} directory and its contents should be owned by the group {{C|ssl-cert}}.  Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server.  If the group doesn't exist at all, just create it.


Further, files in that directory which contain the private key ({{C|privkey.pem}} and {{C|bundle.pem}}) should only be readable by group members.  That is, their permission mode should be 640, displayed as {{C|-rw-r-----}} in the output of {{C|ls -l}}.  Make sure this really the case.
Further, files in that directory which contain the private key ({{C|privkey.pem}} and {{C|bundle.pem}}) should only be readable by group members.  That is, their permission mode should be 640, displayed as {{C|-rw-r-----}} in the output of {{C|ls -l}}.  Make sure this really the case.
Line 200: Line 213:
  # Run on old server
  # Run on old server
  rsync -avz /etc/letsencrypt/{archive,live} feministwiki.dev:/etc/letsencrypt
  rsync -avz /etc/letsencrypt/{archive,live} feministwiki.dev:/etc/letsencrypt
Finally, copy over the DKIM signing key:
rsync -avz /etc/feministwiki/dkim.key feministwiki.dev:/etc/feministwiki
This file must be owned by the {{C|_rspamd}} user and not readable by anyone else.


=== Put config files in place ===
=== Put config files in place ===
Line 216: Line 235:
Enable PHP FPM and other Apache modules:
Enable PHP FPM and other Apache modules:


  a2enmod expires headers proxy_fcgi
  a2enmod expires headers proxy_fcgi rewrite
  a2enconf php${php_version}-fpm
  a2enconf php${php_version}-fpm


Line 397: Line 416:


Note that the trailing slash in {{C|/var/www/}} is important; if not provided, it will copy the directory to {{C|/var/www/www}} on the new server.
Note that the trailing slash in {{C|/var/www/}} is important; if not provided, it will copy the directory to {{C|/var/www/www}} on the new server.
There's actually a systemd service found in {{C|/var/www/fw/wiki}} that you'll want to enable on the new server:
systemctl enable /var/www/fw/wiki/fw-wiki-job-runner.service
No need to actually start it yet.


=== SQL databases ===
=== SQL databases ===
Line 402: Line 427:
Run the following command from the old server:
Run the following command from the old server:


  mysqldump -u root -p"$(cat /root/pwd/mysql)" \
  mariadb-dump -u root -p"$(cat /root/pwd/mariadb)" \
   --add-drop-database \
   --add-drop-database \
   --databases blogs \
   --databases feministblogs \
               feministfiles \
               feministfiles \
               feministforum \
               feministforum \
Line 426: Line 451:


Note that the trailing slash in {{C|/home/vmail/}} is important.
Note that the trailing slash in {{C|/home/vmail/}} is important.
=== Elasticsearch ===
Temporarily stop Elasticsearch on the old server and copy over the data:
systemctl stop elasticsearch
rsync -az --delete /var/lib/elasticsearch/ feministwiki.dev:/var/lib/elasticsearch
systemctl start elasticsearch


=== Mailman data ===
=== Mailman data ===
Line 445: Line 478:


  /root/bin/sql << EOF
  /root/bin/sql << EOF
  create user blogs@localhost identified by '$(cat ~/pwd/mysql-blogs)';
  create user 'feministblogs'@localhost identified by '$(cat ~/pwd/mariadb-feministblogs)';
  create user feministfiles@localhost identified by '$(cat ~/pwd/mysql-files)';
  create user 'feministfiles'@localhost identified by '$(cat ~/pwd/mariadb-feministfiles)';
  create user feministforum@localhost identified by '$(cat ~/pwd/mysql-forum)';
  create user 'feministforum'@localhost identified by '$(cat ~/pwd/mariadb-feministforum)';
  create user feministmail@localhost identified by '$(cat ~/pwd/mysql-mail)';
  create user 'feministmail'@localhost identified by '$(cat ~/pwd/mariadb-feministmail)';
  create user feministwiki@localhost identified by '$(cat ~/pwd/mysql-wiki)';
  create user 'feministwiki'@localhost identified by '$(cat ~/pwd/mariadb-feministwiki)';
  create user fff@localhost identified by '$(cat ~/pwd/mysql-fff)';
  create user 'fff'@localhost identified by '$(cat ~/pwd/mariadb-fff)';
  EOF
  EOF


Line 456: Line 489:


  /root/bin/sql << EOF
  /root/bin/sql << EOF
  grant all on blogs.* to blogs@localhost;
  grant all on feministblogs.* to feministblogs@localhost;
  grant all on feministfiles.* to feministfiles@localhost;
  grant all on feministfiles.* to feministfiles@localhost;
  grant all on feministforum.* to feministforum@localhost;
  grant all on feministforum.* to feministforum@localhost;
Line 506: Line 539:
  systemctl stop dovecot
  systemctl stop dovecot
  systemctl stop ejabberd
  systemctl stop ejabberd
systemctl stop elasticsearch
systemctl stop fw-wiki-job-runner
  systemctl stop inspircd
  systemctl stop inspircd
  systemctl stop mailman
  systemctl stop nginx
  systemctl stop postfix
  systemctl stop postfix
systemctl stop rspamd
  systemctl stop slapd
  systemctl stop slapd
Note that we leave MariaDB running, since it needs to be live for data transfer.


== Finishing up ==
== Finishing up ==
Line 519: Line 557:
Stop all the services that interface with users and/or are responsible for modifying live data:
Stop all the services that interface with users and/or are responsible for modifying live data:


for port in 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777
do ufw delete allow proto tcp to 0.0.0.0/0 port $port
done
  systemctl stop apache2
  systemctl stop apache2
  systemctl stop dovecot
  systemctl stop dovecot
  systemctl stop ejabberd
  systemctl stop ejabberd
systemctl stop elasticsearch
systemctl stop fw-wiki-job-runner
  systemctl stop inspircd
  systemctl stop inspircd
  systemctl stop mailman
  systemctl stop nginx
  systemctl stop postfix
  systemctl stop postfix
systemctl stop rspamd
  systemctl stop slapd
  systemctl stop slapd


Close all the relevant ports just to be double-sure:
As with the old server, we leave MariaDB running since it will be needed for data transfer.
 
for port in 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777
do ufw delete allow proto tcp to 0.0.0.0/0 port $port
done


=== Copy over the live data one more time ===
=== Copy over the live data one more time ===
Line 537: Line 578:
'''Simply repeat the whole section ''Copying over live data''.'''
'''Simply repeat the whole section ''Copying over live data''.'''


The techniques and commands described above in the section ''Copying over live data'' are ''idempotent'', meaning you can simply repeat them and they will make sure that the new copy of the live data is fresh and doesn't leave any outdated data on the new server.  For instance, the {{C|--delete}} argument to the {{C|rsync}} command and the {{C|--add-drop-database}} argument to the {{C|mysqldump}} command help to make sure of this.
The techniques and commands described above in the section ''Copying over live data'' are ''idempotent'', meaning you can simply repeat them and they will make sure that the new copy of the live data is fresh and doesn't leave any outdated data on the new server.  For instance, the {{C|--delete}} argument to the {{C|rsync}} command and the {{C|--add-drop-database}} argument to the {{C|mariadb-dump}} command help to make sure of this.


So just repeat the steps from that section exactly one more time.
So just repeat the steps from that section exactly one more time.
Retrieved from "https://feministwiki.org/wiki/FeministWiki:Server_setup"