From 0844732f8e6296c63a4c09acf6de4d9f0e8b1e18 Mon Sep 17 00:00:00 2001 From: Julien Moutinho Date: Wed, 28 May 2014 13:32:30 +0200 Subject: [PATCH] Ajout : forum.cyclocoop.org . --- etc/gitolite | 2 +- etc/nginx/site.d/cyclo-forum-tls/local.conf | 6 + etc/nginx/site.d/cyclo-forum-tls/local.sh | 10 ++ etc/nginx/site.d/cyclo-forum-tls/site.conf | 70 ++++++++++++ etc/nginx/site.d/cyclo-forum-tls/x509_host | 1 + etc/nginx/site.d/cyclo-forum/http.conf | 5 + etc/nginx/site.d/cyclo-forum/local.conf | 3 + etc/nginx/site.d/cyclo-forum/local.sh | 29 +++++ etc/nginx/site.d/cyclo-forum/site.conf | 1 + etc/nginx/site.d/lhc-stats/http.conf | 8 +- etc/nginx/site.d/lhc-stats/site.conf | 4 +- etc/nsd3/zone.d/cyclocoop.org.zone.m4 | 1 + etc/openssl/forum.cyclocoop.org/ca | 1 + etc/openssl/forum.cyclocoop.org/host.cfg | 70 ++++++++++++ etc/openssl/forum.cyclocoop.org/user.cfg | 14 +++ etc/php5/fpm/pool.d/cyclo_forum/php-fpm.conf | 36 ++++++ etc/phpbb3/database.inc.php | 13 +++ etc/phpbb3/forum.cyclocoop.org.inc.php | 15 +++ var/pub/x509/forum.cyclocoop.org/ca | 1 + var/pub/x509/forum.cyclocoop.org/crl.num | 1 + var/pub/x509/forum.cyclocoop.org/crl.num.old | 1 + var/pub/x509/forum.cyclocoop.org/crl.pem | 22 ++++ .../forum.cyclocoop.org/crl.self-signed.num | 1 + .../crl.self-signed.num.old | 1 + .../forum.cyclocoop.org/crl.self-signed.pem | 22 ++++ var/pub/x509/forum.cyclocoop.org/crt+ca.pem | 106 ++++++++++++++++++ var/pub/x509/forum.cyclocoop.org/crt+crl.pem | 77 +++++++++++++ .../crt+crl.self-signed.pem | 81 +++++++++++++ var/pub/x509/forum.cyclocoop.org/crt.pem | 55 +++++++++ var/pub/x509/forum.cyclocoop.org/crt.pem.asc | 18 +++ .../forum.cyclocoop.org/crt.self-signed.pem | 59 ++++++++++ .../crt.self-signed.pem.asc | 18 +++ .../forum.cyclocoop.org/idx.self-signed.txt | 0 var/pub/x509/forum.cyclocoop.org/idx.txt | 0 var/pub/x509/forum.cyclocoop.org/req.pem | 33 ++++++ 35 files changed, 778 insertions(+), 7 deletions(-) create mode 100644 etc/nginx/site.d/cyclo-forum-tls/local.conf create mode 100644 etc/nginx/site.d/cyclo-forum-tls/local.sh create mode 100644 etc/nginx/site.d/cyclo-forum-tls/site.conf create mode 100644 etc/nginx/site.d/cyclo-forum-tls/x509_host create mode 100644 etc/nginx/site.d/cyclo-forum/http.conf create mode 100644 etc/nginx/site.d/cyclo-forum/local.conf create mode 100644 etc/nginx/site.d/cyclo-forum/local.sh create mode 100644 etc/nginx/site.d/cyclo-forum/site.conf create mode 120000 etc/openssl/forum.cyclocoop.org/ca create mode 100644 etc/openssl/forum.cyclocoop.org/host.cfg create mode 100644 etc/openssl/forum.cyclocoop.org/user.cfg create mode 100644 etc/php5/fpm/pool.d/cyclo_forum/php-fpm.conf create mode 100644 etc/phpbb3/database.inc.php create mode 100644 etc/phpbb3/forum.cyclocoop.org.inc.php create mode 120000 var/pub/x509/forum.cyclocoop.org/ca create mode 100644 var/pub/x509/forum.cyclocoop.org/crl.num create mode 100644 var/pub/x509/forum.cyclocoop.org/crl.num.old create mode 100644 var/pub/x509/forum.cyclocoop.org/crl.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crl.self-signed.num create mode 100644 var/pub/x509/forum.cyclocoop.org/crl.self-signed.num.old create mode 100644 var/pub/x509/forum.cyclocoop.org/crl.self-signed.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crt+ca.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crt+crl.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crt+crl.self-signed.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crt.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crt.pem.asc create mode 100644 var/pub/x509/forum.cyclocoop.org/crt.self-signed.pem create mode 100644 var/pub/x509/forum.cyclocoop.org/crt.self-signed.pem.asc create mode 100644 var/pub/x509/forum.cyclocoop.org/idx.self-signed.txt create mode 100644 var/pub/x509/forum.cyclocoop.org/idx.txt create mode 100644 var/pub/x509/forum.cyclocoop.org/req.pem diff --git a/etc/gitolite b/etc/gitolite index 541f85c..0dbe0bb 160000 --- a/etc/gitolite +++ b/etc/gitolite @@ -1 +1 @@ -Subproject commit 541f85c3999bb851aeb68611ab74ba047044220a +Subproject commit 0dbe0bb9a10796622eaf30f27b1d2c26f7771397 diff --git a/etc/nginx/site.d/cyclo-forum-tls/local.conf b/etc/nginx/site.d/cyclo-forum-tls/local.conf new file mode 100644 index 0000000..9643dd6 --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum-tls/local.conf @@ -0,0 +1,6 @@ +listen 443; +include /etc/nginx/conf.d/ssl.conf; +ssl_certificate /etc/nginx/x509.d/cyclo-forum-tls/crt.pem; +ssl_certificate_key /etc/nginx/x509.d/cyclo-forum-tls/key.pem; + +# vim: ft=sh diff --git a/etc/nginx/site.d/cyclo-forum-tls/local.sh b/etc/nginx/site.d/cyclo-forum-tls/local.sh new file mode 100644 index 0000000..1d8dd7d --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum-tls/local.sh @@ -0,0 +1,10 @@ +hint="run before: remote/runit-configure nginx -- $site" +assert "sudo test -f /etc/nginx/x509.d/\"$site\"/key.pem" hint + +sudo install -m 664 -o www -g www \ + "$tool"/var/pub/x509/forum.cyclocoop.org/crt+ca.pem \ + /etc/nginx/x509.d/"$site"/crt.pem + +sudo rmdir ~www-data/"$site" || true +sudo ln -fns "${site%-tls}" ~www-data/"$site" + diff --git a/etc/nginx/site.d/cyclo-forum-tls/site.conf b/etc/nginx/site.d/cyclo-forum-tls/site.conf new file mode 100644 index 0000000..224c99f --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum-tls/site.conf @@ -0,0 +1,70 @@ +server_name forum.cyclocoop.org; + +client_body_buffer_size 8k; +client_max_body_size 10m; + +location = / { + root /usr/share/phpbb3/www; + index index.php; + } +location ~ /\. { + access_log off; + deny all; + log_not_found off; + return 403; + } +location ~ /(config\.php|common\.php|cache|files|images/avatars/upload|includes|store) { + deny all; + return 403; + } +location ~ ^/docs/ { + root /usr/share/phpbb3; + } +location ~* \.(gif|jpe?g|png|css)$ { + root /usr/share/phpbb3/www; + access_log off; + expires 30d; + log_not_found off; + } +location ~* ^.+\.php(|/.*)$ { + root /usr/share/phpbb3/www; + include /etc/nginx/conf.d/fastcgi.conf; + index index.php; + set $no_cache "0"; + if ($request_method !~ ^(GET|HEAD)$) { + # NOTE: if non GET/HEAD, don't cache and mark user as uncacheable for 1 second via cookie. + set $no_cache "1"; + } + if ($no_cache = "1") { + # NOTE: drop no cache cookie if need be (for some reason, add_header fails if included in prior if-block). + add_header Set-Cookie "_mcnc=1; Max-Age=2; Path=/"; + add_header X-Microcachable "0"; + } + if ($http_cookie ~* "_mcnc") { + # NOTE: bypass cache if no-cache cookie is set + set $no_cache "1"; + } + expires epoch; + fastcgi_cache microcache; + fastcgi_cache_bypass $no_cache; + fastcgi_cache_use_stale error timeout invalid_header updating http_500; + fastcgi_cache_valid 200 1m; + fastcgi_cache_valid 301 2h; + fastcgi_cache_valid 302 30m; + fastcgi_cache_valid 404 10m; + fastcgi_ignore_headers Cache-Control Expires Set-Cookie; + fastcgi_index index.php; + fastcgi_split_path_info ^(.+\.php)(.*)$; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_no_cache $no_cache; + fastcgi_param REDIRECT_STATUS 200; + # NOTE: PHP only, required if PHP was built with --enable-force-cgi-redirect + fastcgi_pass_header Cookie; + fastcgi_pass_header Set-Cookie; + + fastcgi_pass unix:/run/php5/fpm/cyclo_forum; + } + +# vim: ft=sh diff --git a/etc/nginx/site.d/cyclo-forum-tls/x509_host b/etc/nginx/site.d/cyclo-forum-tls/x509_host new file mode 100644 index 0000000..4a9f339 --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum-tls/x509_host @@ -0,0 +1 @@ +forum.cyclocoop.org diff --git a/etc/nginx/site.d/cyclo-forum/http.conf b/etc/nginx/site.d/cyclo-forum/http.conf new file mode 100644 index 0000000..9ee5d12 --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum/http.conf @@ -0,0 +1,5 @@ +upstream php_fpm_cyclo_forum { + server unix:/run/php5/fpm/cyclo_forum; + } + +# vim: ft=sh diff --git a/etc/nginx/site.d/cyclo-forum/local.conf b/etc/nginx/site.d/cyclo-forum/local.conf new file mode 100644 index 0000000..df9c39b --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum/local.conf @@ -0,0 +1,3 @@ +listen 80; + +return 301 "https://$host$request_uri"; diff --git a/etc/nginx/site.d/cyclo-forum/local.sh b/etc/nginx/site.d/cyclo-forum/local.sh new file mode 100644 index 0000000..198d7aa --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum/local.sh @@ -0,0 +1,29 @@ +pool=cyclo_forum +sudo adduser php_"$pool" www-"$site" +sudo adduser php_"$pool" postgres-data +sudo adduser www-"$site"-tls www-"$site" +"$tool"/local/postgresql-user-create "$pool" +if test ! "$pool" = "$(sudo -u postgres psql -AqtX -c \ + "SELECT datname + FROM pg_catalog.pg_database + WHERE datname = '$pool' + LIMIT 1;")" + then + "$tool"/local/postgresql-database-create "$pool" + sudo -u postgres psql "$pool" -AqtX --set ON_ERROR_STOP=1 \ + -f /usr/share/phpbb3/dbconfig-common/data/phpbb3/install/pgsql + #-f /usr/share/phpbb3/install/schemas/postgres_schema.sql + fi +"$tool"/local/postgresql-schema-create "$pool" +sudo -u postgres psql "$pool" -AqtX --set ON_ERROR_STOP=1 <<-EOF + GRANT USAGE ON SCHEMA pg_catalog TO $pool; + GRANT SELECT ON TABLE pg_proc TO $pool; + GRANT SELECT ON TABLE pg_database TO $pool; + EOF + +sudo install -m 640 -o root -g php_"$pool" \ + "$tool"/etc/phpbb3/forum.cyclocoop.org.inc.php \ + /etc/phpbb3/forum.cyclocoop.org.inc.php +sudo install -m 664 -o root -g www-data \ + "$tool"/etc/phpbb3/database.inc.php \ + /etc/phpbb3/database.inc.php diff --git a/etc/nginx/site.d/cyclo-forum/site.conf b/etc/nginx/site.d/cyclo-forum/site.conf new file mode 100644 index 0000000..40738c2 --- /dev/null +++ b/etc/nginx/site.d/cyclo-forum/site.conf @@ -0,0 +1 @@ +server_name forum.cyclocoop.org; diff --git a/etc/nginx/site.d/lhc-stats/http.conf b/etc/nginx/site.d/lhc-stats/http.conf index a208d3b..eed8b10 100644 --- a/etc/nginx/site.d/lhc-stats/http.conf +++ b/etc/nginx/site.d/lhc-stats/http.conf @@ -2,24 +2,24 @@ upstream php_fpm_lhc_stats { server unix:/run/php5/fpm/lhc_stats; } -map $request_method $no_cache { +map $request_method $lhc_stats_no_cache { # NOTE: if non GET/HEAD, don't cache. default 1; HEAD 0; GET 0; } -map $arg_module $no_cache { +map $arg_module $lhc_stats_no_cache { ## When we go through installation ## or when we're on the dashboard for specific tasks. Installation 1; # when invoking the installation module. ~[^\&]*(?:Dashboard|Live|Goals|Admin|Manager) 1; # some tasks } -map $arg_action $no_cache { +map $arg_action $lhc_stats_no_cache { ## The first installation steps don't invoke the installation module. systemCheck 1; databaseSetup 1; } -map $http_cookie $no_cache { +map $http_cookie $lhc_stats_no_cache { ## Testing for the session cookie being present. ## If there is then no caching is to be done. ~PIWIK_SESSID 1; # Piwik session cookie diff --git a/etc/nginx/site.d/lhc-stats/site.conf b/etc/nginx/site.d/lhc-stats/site.conf index 047d31e..a70dfea 100644 --- a/etc/nginx/site.d/lhc-stats/site.conf +++ b/etc/nginx/site.d/lhc-stats/site.conf @@ -51,13 +51,13 @@ location = /piwik.php { add_header X-Piwik-Long-Cache $upstream_cache_status; expires epoch; fastcgi_cache microcache; - fastcgi_cache_bypass $no_cache; + fastcgi_cache_bypass $lhc_stats_no_cache; fastcgi_cache_use_stale error timeout invalid_header updating http_500; fastcgi_cache_valid 200 301 2h; fastcgi_cache_valid 302 30m; fastcgi_cache_valid 404 10m; fastcgi_ignore_headers Cache-Control Expires; - fastcgi_no_cache $no_cache; + fastcgi_no_cache $lhc_stats_no_cache; fastcgi_param REDIRECT_STATUS 200; fastcgi_pass php_fpm_lhc_stats; diff --git a/etc/nsd3/zone.d/cyclocoop.org.zone.m4 b/etc/nsd3/zone.d/cyclocoop.org.zone.m4 index 072bf95..0fa84e0 100644 --- a/etc/nsd3/zone.d/cyclocoop.org.zone.m4 +++ b/etc/nsd3/zone.d/cyclocoop.org.zone.m4 @@ -38,6 +38,7 @@ autoconfig A IP4(GRESILLE) caldavzap A IP4(GRESILLE) burette A IP4(GRESILLE) davical A IP4(GRESILLE) +forum A IP4(GRESILLE) ftp A IP4(GRESILLE) git A IP4(GRESILLE) imap A IP4(GRESILLE) diff --git a/etc/openssl/forum.cyclocoop.org/ca b/etc/openssl/forum.cyclocoop.org/ca new file mode 120000 index 0000000..2ef2817 --- /dev/null +++ b/etc/openssl/forum.cyclocoop.org/ca @@ -0,0 +1 @@ +../cyclocoop.org \ No newline at end of file diff --git a/etc/openssl/forum.cyclocoop.org/host.cfg b/etc/openssl/forum.cyclocoop.org/host.cfg new file mode 100644 index 0000000..6b875cb --- /dev/null +++ b/etc/openssl/forum.cyclocoop.org/host.cfg @@ -0,0 +1,70 @@ + SERVICE = forum + RANDFILE = var/sec/x509/openssl.rand + oid_section = extra_oids +[ extra_oids ] + # NOTE: pour une éventuelle validation étendue (Extended Validation (EV)) + jurisdictionOfIncorporationLocalityName = 1.3.6.1.4.1.311.60.2.1.1 + jurisdictionOfIncorporationStateOrProvinceName = 1.3.6.1.4.1.311.60.2.1.2 + jurisdictionOfIncorporationCountryName = 1.3.6.1.4.1.311.60.2.1.3 +[ req ] + prompt = no + distinguished_name = distinguished_name + string_mask = pkix + #x509_extensions = root_extensions + #req_extensions = extension + #attributes = req_attributes +[ distinguished_name ] + countryName = $ENV::x509_country + stateOrProvinceName = $ENV::x509_state_or_province + localityName = $ENV::x509_state_or_province + 0.organizationName = $ENV::x509_organization + organizationalUnitName = Service Forum + commonName = $SERVICE.$ENV::x509_host + businessCategory = $ENV::x509_business_category + jurisdictionOfIncorporationLocalityName = $ENV::x509_state_or_province + jurisdictionOfIncorporationStateOrProvinceName = $ENV::x509_state_or_province + jurisdictionOfIncorporationCountryName = $ENV::x509_country +[ extensions ] + basicConstraints = critical,CA:TRUE,pathlen:0 + keyUsage = keyCertSign,cRLSign,digitalSignature,keyEncipherment + subjectAltName = email:contact+$SERVICE@$ENV::x509_host,DNS:$SERVICE.$ENV::x509_host,DNS:$ENV::x509_host,DNS:cyclocoop.heureux-cyclage.org + subjectKeyIdentifier = hash + issuerAltName = issuer:copy + authorityKeyIdentifier = keyid:always,issuer:always + authorityInfoAccess = caIssuers;URI:http://www.$ENV::x509_host/x509/crt.pem + crlDistributionPoints = URI:http://www.$ENV::x509_host/x509/$SERVICE/crl.pem + certificatePolicies = @certificate_policies +[ self_signed_extensions ] + basicConstraints = critical,CA:TRUE,pathlen:0 + keyUsage = keyCertSign,cRLSign,digitalSignature,keyEncipherment + subjectAltName = email:contact+$SERVICE@$ENV::x509_host,DNS:$SERVICE.$ENV::x509_host,DNS:$ENV::x509_host,DNS:cyclocoop.heureux-cyclage.org + subjectKeyIdentifier = hash + issuerAltName = issuer:copy + authorityKeyIdentifier = keyid:always,issuer:always + authorityInfoAccess = caIssuers;URI:http://www.$ENV::x509_host/x509/$SERVICE/crt.pem + crlDistributionPoints = URI:http://www.$ENV::x509_host/x509/$SERVICE/crl.pem +[ user_extensions ] + basicConstraints = critical,CA:FALSE,pathlen:0 + keyUsage = digitalSignature,keyEncipherment + subjectAltName = email:$ENV::user@$ENV::x509_host + subjectKeyIdentifier = hash + issuerAltName = issuer:copy + authorityKeyIdentifier = keyid:always,issuer:always + authorityInfoAccess = caIssuers;URI:http://www.$ENV::x509_host/x509/$SERVICE/crt.pem +[ certificate_policies ] + policyIdentifier = 1.2.250.1.42 + CPS.1 = https://www.$ENV::x509_host/x509/cps +[ ca ] + private_key = var/sec/x509/$ENV::x509/key.pem + dir = var/pub/x509/$ENV::x509 + crl_dir = $dir + crlnumber = $dir/crl.num + crl = $dir/crl.pem + database = $dir/idx.txt +[ self_signed_ca ] + private_key = var/sec/x509/$ENV::x509/key.pem + dir = var/pub/x509/$ENV::x509 + crl_dir = $dir + crlnumber = $dir/crl.self-signed.num + crl = $dir/crl.self-signed.pem + database = $dir/idx.self-signed.txt diff --git a/etc/openssl/forum.cyclocoop.org/user.cfg b/etc/openssl/forum.cyclocoop.org/user.cfg new file mode 100644 index 0000000..a4d999c --- /dev/null +++ b/etc/openssl/forum.cyclocoop.org/user.cfg @@ -0,0 +1,14 @@ + SERVICE = forum + HOME = . + RANDFILE = var/sec/x509/openssl.rand +[ req ] + prompt = no + distinguished_name = user_distinguished_name + string_mask = pkix +[ user_distinguished_name ] + countryName = $ENV::x509_country + stateOrProvinceName = $ENV::x509_state_or_province + #localityName = + 0.organizationName = $ENV::x509_organization + organizationalUnitName = Certificat utilisateurice du service Forum + commonName = $ENV::user diff --git a/etc/php5/fpm/pool.d/cyclo_forum/php-fpm.conf b/etc/php5/fpm/pool.d/cyclo_forum/php-fpm.conf new file mode 100644 index 0000000..da2cafe --- /dev/null +++ b/etc/php5/fpm/pool.d/cyclo_forum/php-fpm.conf @@ -0,0 +1,36 @@ +php_admin_value[default_charset] = "UTF-8" +php_admin_value[display_errors] = Off +php_admin_value[error_log] = logs/errors +php_admin_value[error_reporting] = "30711" +php_admin_value[extension] = intl.so +php_admin_value[extension] = mcrypt.so +php_admin_value[extension] = pdo_pgsql.so +php_admin_value[extension] = pgsql.so +php_admin_value[extension] = pspell.so +php_admin_value[file_uploads] = 1 +php_admin_value[log_errors] = On +php_admin_value[magic_quotes_gpc] = 0 +php_admin_value[magic_quotes_runtime] = 0 +php_admin_value[mbstring.func_overload] = 0 +php_admin_value[memory_limit] = 64M +php_admin_value[post_max_size] = 6M +php_admin_value[session.auto_start] = 0 +php_admin_value[session.cookie_path] = / +php_admin_value[session.gc_divisor] = 500 +php_admin_value[session.gc_maxlifetime] = 21600 +php_admin_value[session.gc_probability] = 1 +php_admin_value[suhosin.session.encrypt] = 0 +php_admin_value[upload_max_filesize] = 5M +php_admin_value[zend.ze1_compatibility_mode] = 0 +php_admin_value[zlib.output_compression] = Off +pm.max_children = 15 +pm.max_requests = 200 +pm.max_spare_servers = 5 +pm.min_spare_servers = 1 +pm.process_idle_timeout = 60s +pm.start_servers = 1 +request_slowlog_timeout = 5s +request_terminate_timeout = 120s +rlimit_core = unlimited +rlimit_files = 131072 +security.limit_extensions = .php diff --git a/etc/phpbb3/database.inc.php b/etc/phpbb3/database.inc.php new file mode 100644 index 0000000..b153c0d --- /dev/null +++ b/etc/phpbb3/database.inc.php @@ -0,0 +1,13 @@ +