FeministWiki:Server setup: Difference between revisions

(8 intermediate revisions by the same user not shown)

Line 28:

bsdutils \

certbot \

composer \

curl \

dnsutils \

Line 33:

Line 34:

git \

imagemagick \

iotop \

ldap-utils \

mg \

Line 144:

Line 146:

mariadb-server \

nginx-extras \

~~opendkim \~~

postfix \

postfix-ldap \

rspamd \

slapd

Line 154:

Line 156:

apt-get install ejabberd/$(lsb_release -sc)-backports # e.g. ejabberd/bookworm-backports

~~=== Make sure Postfix can connect to OpenDKIM ===~~

~~mkdir -p /var/spool/postfix/opendkim~~

~~chown opendkim:opendkim /var/spool/postfix/opendkim~~

~~adduser postfix opendkim~~

=== Install PHP and modules ===

Line 165:

Line 161:

This should really be part of the last section, but due to the sheer number of PHP modules we want to install, it's in its own section:

php_version=8.1 # or whatever version we're on

php_version=8.4 # or whatever version we're on

apt-get install php${php_version} \

php${php_version}-apcu \

php${php_version}-bcmath \

php${php_version}-bz2 \

php${php_version}-cli \

php${php_version}-curl \

Line 185:

Line 182:

php${php_version}-zip

We also want {{C|php-luasandbox}}, which may not have a PHP version attached to the package name, in which case you'll have to make sure it supports the PHP version currently in use. If not, you can use the standalone Lua binary instead by setting {{C|$wgScribuntoDefaultEngine = 'luastandalone';}} in MediaWiki's {{C|LocalSettings.php}} configuration file.

We also want {{C|php-luasandbox}}, which may not have a PHP version attached to the package name, in which case you'll have to make sure it supports the PHP version currently in use. If not, you can use the standalone Lua binary instead by setting {{C|$wgScribuntoDefaultEngine {{=}} 'luastandalone';}} in MediaWiki's {{C|LocalSettings.php}} configuration file.

# See if this works first:

Line 195:

Line 192:

dpkg -L php-luasandbox

=== Copy over certificates ===

=== Copy over certificates and DKIM key ===

Copy over the certs from the old server:

# Run on old server

rsync -avz /etc/~~fw-~~certs feministwiki.dev:/etc/~~fw-certs~~

rsync -avz /etc/feministwiki/certs feministwiki.dev:/etc/feministwiki

The {{C|/etc/~~fw-~~certs}} directory and its contents should be owned by the group {{C|ssl-cert}}. Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server. If the group doesn't exist at all, just create it.

The {{C|/etc/feministwiki/certs}} directory and its contents should be owned by the group {{C|ssl-cert}}. Make sure this is the case on the new server after running the command above, since the group ID might be different on the new server. If the group doesn't exist at all, just create it.

Further, files in that directory which contain the private key ({{C|privkey.pem}} and {{C|bundle.pem}}) should only be readable by group members. That is, their permission mode should be 640, displayed as {{C|-rw-r-----}} in the output of {{C|ls -l}}. Make sure this really the case.

Line 216:

Line 213:

# Run on old server

rsync -avz /etc/letsencrypt/{archive,live} feministwiki.dev:/etc/letsencrypt

Finally, copy over the DKIM signing key:

rsync -avz /etc/feministwiki/dkim.key feministwiki.dev:/etc/feministwiki

This file must be owned by the {{C|_rspamd}} user and not readable by anyone else.

=== Put config files in place ===

Line 232:

Line 235:

Enable PHP FPM and other Apache modules:

a2enmod expires headers proxy_fcgi

a2enmod expires headers proxy_fcgi rewrite

a2enconf php${php_version}-fpm

Line 540:

Line 543:

systemctl stop inspircd

systemctl stop nginx

~~systemctl stop opendkim~~

systemctl stop postfix

systemctl stop rspamd

systemctl stop slapd

Line 565:

Line 568: