FeministWiki:Server setup

    From FeministWiki

    !!! WORK IN PROGRESS !!!

    These are the steps required to set up a new FeministWiki Debian server.

    Update & upgrade

    First of all, let's make sure the system is up to date.

    apt-get update
    apt-get upgrade
    apt-get dist-upgrade
    

    Install miscellaneous tools

    Some of these are needed further down, some are just good to have.

    apt-get install certbot
    apt-get install dnsutils
    apt-get install emacs
    apt-get install git
    apt-get install mg
    apt-get install moreutils
    apt-get install net-tools
    apt-get install nmap
    apt-get install software-properties-common
    apt-get install tree
    

    Set up firewall

    For now, block everything but SSH.

    apt-get install ufw
    ufw allow proto tcp to 0.0.0.0/0 port 22
    ufw enable
    

    Install server components

    We will now install all the software used for the various FeministWiki services. But first we might want to add some additional package repositories so we can use the latest version of some of the used software.

    Backports:

    echo deb http://deb.debian.org/debian $(lsb_release -sc)-backports main > /etc/apt/sources.list.d/backports.list
    

    PHP repo only if a very new version is needed:

    wget -O /etc/apt/trusted.gpg.d/sury-php.gpg https://packages.sury.org/php/apt.gpg
    echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/sury-php.list
    

    MariaDB repo only if a very new version is needed:

    wget https://mariadb.org/mariadb_release_signing_key.asc
    apt-key add mariadb_release_signing_key.asc
    rm mariadb_release_signing_key.asc
    echo "deb http://mirror.23media.de/mariadb/repo/10.4/debian $(lsb_release -sc) main" > /etc/apt/sources.list.d/mariadb.list
    

    Now we can install everything:

    php_version=7.4 # or whatever version we're on
    
    apt-get install apache2
    apt-get install dovecot-core
    apt-get install dovecot-imapd
    apt-get install dovecot-pop3d
    apt-get install ejabberd # good candidate for backports
    apt-get install fail2ban
    apt-get install inspircd
    apt-get install mailman
    apt-get install mariadb-server
    apt-get install opendkim
    apt-get install php${php_version}
    apt-get install php${php_version}-mbstring
    apt-get install php${php_version}-xml
    apt-get install postfix
    apt-get install slapd # Use password from /root/pwd/ldap on old server!
    

    Example for installing ejabberd from backports instead:

    apt-get install ejabberd/$(lsb_release -sc)-backports
    

    Enable Apache modules

    We need a number of Apache modules to be enabled which might not be enabled by default:

    a2enmod expires
    a2enmod headers
    a2enmod macro
    a2enmod rewrite
    a2enmod ssl
    

    Fetch scripts & config repo

    Set up GitHub ssh access by copying the .ssh/id_rsa from the old server. After that:

    cd ~
    git clone git@github.com:FeministWiki/FeministWiki.git repo
    cp -a repo/root/* .
    sh repo/decrypt-pwd.sh
    

    The decryption script will prompt you for a password the first time it's used. Enter the password stored in /root/pwd/meta on the old server.

    Create vmail user

    groupadd -g 5000 vmail
    useradd -u 5000 -g vmail -s /usr/sbin/nologin -d /home/vmail -m vmail
    

    Put config files in place

    The principle is simple: take all the config files from /root/repo/etc and put them where they belong in /etc. However, since a new server might mean much newer software, it's possible that some config files aren't compatible anymore, or that some new sensible defaults might be overwritten by the old config. Sadly figuring out these incompatibilities is a manual process (compare new default config with old config) and this guide cannot help you much.

    There's one special thing to remember, which is that after copying in the new /etc/aliases file, you have to run the newaliases command for the changes to take effect.

    Make feministwiki.dev point to the new server

    This is a good time to change the DNS record for feministwiki.dev to point to the new IP address.

    Initialize LetsEncrypt

    First, initialize the certbot configuration:

    certbot register -n --agree-tos -m technician@feministwiki.org
    

    Since various DNS entries still point to the old server, we can't get a cert for the real domains yet. For now, just get one for feministwiki.dev:

    ufw allow 80
    letsencrypt-refresh --dev-only
    ufw delete allow 80
    

    Our letsencrypt-refresh script makes sure that the cert files are found in /etc/fw-certs and that the private key and cert-and-key bundle are owned by the "ssl-cert" group and are readable by group members. A number of users have to be added to this group so they can read said files:

    adduser ejabberd ssl-cert
    adduser irc ssl-cert
    

    Stop services on old server

    At this point, all services on the old server should be stopped, because we will now begin to transfer all the actual data.

    Copy over LDAP databases

    TODO

    Copy over SQL databases

    The following command can be used to create a dump of all databases and import it on the new server. You can use the show databases; command in the SQL console to make sure that the list of databases is complete. (Unfortunately they have to be listed manually, because using the --all-databases option includes system databases that we don't want.)

    mysqldump -u root -p"$(cat /root/pwd/mysql)" \
      --databases blogs \
                  feministblog \
                  feministfiles \
                  feministforum \
                  feministmail \
                  feministsocial \
                  feministwiki \
                  feministwiki_de \
                  feministwiki_es \
                  feministwiki_it \
                  feministwiki_pt \
                  fff \
      | ssh root@feministwiki.dev 'mysql -u root -p"$(cat /root/pwd/mysql)"'
    

    Copy over /var/www

    This is very simple but takes a lot of time to finish:

    cd /var/www
    tar -czf - . | ssh root@feministwiki.dev 'cd /var/www; tar -xzf -'
    

    Open ports

    We are finally ready to serve:

    for port in 25 80 443 465 587 993 995 5222 5223 5269 5270 5443 6697 7777
    do ufw allow proto tcp to 0.0.0.0/0 port $port
    done
    

    Reboot

    We could restart a lot of services manually, but it's easiest to just reboot.

    reboot
    

    After that, you might want to do some testing with the feministwiki.dev domain.

    Update DNS entries

    You have to change the configuration of the following domains:

    • feministwiki.org
    • feministwiki.net
    • feministwiki.de
    • fem.wiki
    • fffrauen.de

    feministwiki.org

    You only have to change three DNS entries, since most of the subdomains work via CNAME entries:

    • The main A entry for @ (self-reference i.e. feministwiki.org)
    • The A entry for smtp since this is not allowed to be a CNAME
    • The A entry for xmpp since this is not allowed to be a CNAME

    feministwiki.net, feministwiki.de, fem.wiki, fffrauen.de

    For these, you only have to change the main A entry, since they don't use SMTP or XMPP.

    Update the certificate

    Run the letsencrypt-refresh script to get a new certificate which includes all our domain names, since we had started out with just feministwiki.dev.