debian/postinst

   1 #!/bin/sh
   2
   3 set -e
   4
   5 [ "$DEBIAN_SCRIPT_DEBUG" ] && set -vx
   6
   7 # Source debconf library.
   8 . /usr/share/debconf/confmodule
   9
  10 case "$1" in
  11     configure)
  12         # continue below
  13         ;;
  14
  15     abort-upgrade|abort-remove|abort-deconfigure)
  16         exit 0
  17         ;;
  18
  19     *)
  20         echo "postinst called with unknown argument \`$1'" >&2
  21         exit 0
  22         ;;
  23 esac
  24
  25
  26 # Include CARNet functions.
  27 . /usr/share/carnet-tools/functions.sh
  28
  29 PKG="apache2-cn"
  30 VERSION="2.4.10+1"
  31 CONFDIR="/etc/apache2"
  32 CONF="$CONFDIR/apache2.conf"
  33 PORTCONF="$CONFDIR/ports.conf"
  34 A2CNDIR=/usr/share/apache2-cn
  35 TMPLDIR=$A2CNDIR/templates
  36 CERTDIR=/etc/ssl/certs
  37
  38 HOST=$(hostname)
  39 FQDN=$(hostname --fqdn)
  40 WEBMASTER="webmaster@$FQDN"
  41 DOMAIN=$(hostname -d)
  42 BACKUPDIR="/var/backups/apache2-cn"
  43
  44 need_restart=0
  45 apache2_sslcf=
  46 apache2_sslckf=
  47 apache2_sslccf=
  48 has_vhosts=0
  49 temp_files=
  50 has_listen_ssl=0
  51 listen_ssl_mask=
  52
  53
  54 # cleanup()
  55 #
  56 #   Cleanup all temp files.
  57 #
  58 cleanup () {
  59     if [ -n "$temp_files" ]; then
  60         for item in $temp_files; do
  61             if [ -e "$item" ]; then
  62                 rm -f $item
  63             fi
  64         done
  65     fi
  66 }
  67
  68 # tag_conf()
  69 #
  70 #   Add CARNet package info lines to config's header.
  71 #
  72 tag_conf () {
  73     local conf_file
  74     conf_file="$1"
  75
  76     if [ -e "$conf_file" ]; then
  77         cat >> $conf_file <<EOF
  78 ## Begin - Generated by CARNet package apache2-cn
  79 #
  80 #  REMOVE this whole block if you DON'T WANT apache2-cn
  81 #  to edit or undo your changes to this configuration file.
  82 #
  83 ## End - Generated by CARNet package apache2-cn
  84 EOF
  85     fi
  86 }
  87
  88 # chk_conf_tag ()
  89 #
  90 #   Check if configuration file has CARNet package info lines.
  91 #   return:  $RET => 0 - tagged
  92 #                    1 - not tagged or file does not exists
  93 #                    2 - file exists, but it is not tagged
  94 #
  95 chk_conf_tag () {
  96     local conf_file
  97     conf_file="$1"
  98     RET=1
  99
 100     if [ -f "$conf_file" ]; then
 101         if egrep -q "^## Begin - Generated by CARNet package apache2-cn$" "$conf_file"; then
 102             RET=0
 103         else
 104             RET=2
 105         fi
 106     fi
 107 }
 108
 109 # generate_ssl()
 110 #
 111 #   Generate Apache2 web server SSL certificate.
 112 #
 113 generate_ssl () {
 114     generate_ssl_output=$($A2CNDIR/carnet-generate-ssl ignore "$FQDN" "$WEBMASTER" "$DOMAIN" 2> /dev/null)
 115     cp_echo "$generate_ssl_output"
 116     need_restart=1
 117 }
 118
 119 # listen_ssl()
 120 #
 121 #   Check if port 443 is configured in ports.conf file.
 122 #
 123 listen_ssl() {
 124
 125     if [ ! -f "$PORTCONF" ] || ! egrep -iq "^[[:space:]]*Listen[[:space:]]+443$" "$PORTCONF"; then
 126
 127         cp_echo "CN: Enabling SSL port (443) for Apache2 web server."
 128
 129         out=$(mktemp ${PORTCONF}.XXXXXX)
 130         temp_files="${temp_files} ${out}"
 131
 132         if [ -f "$PORTCONF" ]; then
 133             cp $PORTCONF $out
 134         fi
 135
 136         echo "Listen 443" >> $out
 137         cp_mv $out $PORTCONF
 138         chmod 644 $PORTCONF
 139
 140         need_restart=1
 141     fi
 142 }
 143
 144 # install_conf()
 145 #
 146 #   Install specified Apache2 configuration file.
 147 #
 148 install_conf() {
 149     conftmpl="$A2CNDIR/$1.conf"
 150     conf="$CONFDIR/conf-available/$2.conf"
 151
 152     if [ ! -e "$conf" ]; then
 153         cp_echo "CN: Generating CARNet specific configuration."
 154         cp "$conftmpl" "$conf"
 155     else
 156         cp_echo "CN: $conf already exists, left untouched." 1>&2
 157     fi
 158
 159     cp_echo "CN: Enabling CARNet specific configuration."
 160     a2enconf -m -q "$2"
 161     need_restart=1
 162 }
 163
 164 # install_vhost()
 165 #
 166 #   Install specified VirtualHost for Apache2 web server.
 167 #
 168 #   Invocation:
 169 #
 170 #   install_vhost [-nvh] [-d] [-s docroot_symlink_dest] template site site-enabled-symlink
 171 #
 172 #     -nvh - add NameVirtualHost
 173 #     -d   - mkdir DocumentRoot
 174 #     -r   - set DocumentRoot
 175 #     -n   - set ServerName
 176 #     -s X - symlink DocumentRoot to X (all in /var/www)
 177 #
 178 #   site - host part of ServerName unless -r or -n is used
 179 #   site-enabled-symlink - name of file/symlink in sites-available/sites-enabled
 180 #                          (without .conf suffix)
 181 #
 182 install_vhost() {
 183     add_namevirthost=
 184     mkdir_docroot=
 185     symlink_docroot=
 186     docroot=
 187     vhostname=
 188
 189     while echo "x$1" | grep -q '^x-'; do
 190         case "$1" in
 191             -nvh)
 192                 add_namevirthost=1
 193                 shift
 194                 ;;
 195             -d)
 196                 mkdir_docroot=1
 197                 shift
 198                 ;;
 199             -s)
 200                 shift
 201                 symlink_docroot="$1"
 202                 shift
 203                 ;;
 204             -r)
 205                 shift
 206                 docroot="$1"
 207                 if ! echo "$docroot" | grep -q /; then
 208                     docroot="/var/www/$docroot"
 209                 fi
 210                 shift
 211                 ;;
 212             -n)
 213                 shift
 214                 vhostname="$1"
 215                 shift
 216                 ;;
 217         esac
 218     done
 219
 220     vhosttmpl="$1.template"
 221     vhost="$2"
 222     vsite="$3"
 223     venabled="$3.conf"
 224     [ -z "$vhostname" ] && vhostname=$(echo "$vhost"| awk -F. '{print $1}')
 225     force_vhost=
 226
 227     vhostdir=$CONFDIR/sites-available
 228     venabledir=$CONFDIR/sites-enabled
 229
 230     if [ ! -e "$TMPLDIR/${vhosttmpl}" ]; then
 231         echo "E: vhost template ${vhosttmpl} not found in $TMPLDIR!" 1>&2
 232         exit 2
 233     fi
 234
 235     [ -z "$docroot" ] && docroot="/var/www/$vhostname.$DOMAIN"
 236
 237     # if we were broken mid-installation, force
 238     if [ ! -e "$docroot" -a \( -n "$mkdir_docroot" -o -n "$symlink_docroot" \) ]; then
 239         force_vhost=1
 240     fi
 241
 242     # add vhost if either of these is true
 243     # - adding is forced OR
 244     # - it doesn't exist
 245     #
 246     if [ -n "$force_vhost" -o \( ! -e "$vhostdir/$venabled" -a ! -e "$venabledir/$venabled" \) ]; then
 247
 248         cp_echo "CN: Adding $vhost VirtualHost."
 249         out=$(mktemp $vhostdir/$venabled.XXXXXX)
 250         temp_files="${temp_files} ${out}"
 251
 252         # CARNet header.
 253         tag_conf "$out"
 254
 255         if [ "$add_namevirthost" ]; then
 256             nvh=$(awk -F'[ >]' '/^<VirtualHost/ {print $2}' $TMPLDIR/$vhosttmpl |\
 257                 sed "s/IPADDR/$MYIP/g")
 258             echo "NameVirtualHost $nvh" >> $out
 259         fi
 260
 261         sed "s/HOST/$vhostname/g; s/DOMAIN/$DOMAIN/g;
 262             s#DOCROOT#$docroot#g; s/IPADDR/$MYIP/g" < $TMPLDIR/$vhosttmpl >> $out
 263         cp_mv $out $vhostdir/$venabled
 264         chmod 644 $vhostdir/$venabled
 265         a2ensite -m -q "$vsite"
 266
 267         if [ -n "$mkdir_docroot" -a ! -d "$docroot" ]; then
 268             mkdir "$docroot"
 269             echo '<html><body><h1>Radi!</h1></body></html>' > "$docroot/index.html"
 270         elif [ -n "$symlink_docroot" ]; then
 271             ln -fs "$symlink_docroot" "$docroot"
 272         fi
 273
 274         need_restart=1
 275     fi
 276 }
 277
 278 # backup_conf()
 279 #
 280 #   Backup configuration files located in specified directory.
 281 #
 282 backup_conf () {
 283     local dir file backup_dir
 284
 285     dir="$1"
 286
 287     if [ -d "${dir}" ] && [ -n "$(ls -A ${dir}/)" ]; then
 288         cp_echo "CN: Doing backup for all files in $dir"
 289         for file in ${dir}/*; do
 290             if [ -f "$file" ]; then
 291                 if [ -z "$(echo "$file" | egrep '^/.*(~|(\.(old|staro|bkp|bak|swp|tmp|dpkg-.+|cn-.+)))$')" ]; then
 292                     backup_dir="$BACKUPDIR/$(basename $(dirname "$file"))"
 293                     cp_backup_conffile -d "$backup_dir" -p "$file"
 294                 fi
 295             fi
 296         done
 297     fi
 298 }
 299
 300 # move_conf()
 301 #
 302 #   Move configuration files from one directory to another. The .conf suffix
 303 #   will be added. Will try to enable the configuration if -e is specified.
 304 #
 305 move_conf () {
 306     local toenable ctype dir newdir file newfile
 307
 308     if [ "$1" = "-e" ]; then
 309         toenable="$1"
 310         shift
 311     fi
 312
 313     ctype="$1"
 314     dir="$2"
 315     newdir="$3"
 316
 317     case "$ctype" in
 318         site|conf)
 319             # continue below
 320             ;;
 321         *)
 322             return 1
 323             ;;
 324     esac
 325
 326     if [ -z "$newdir" ]; then
 327         newdir="$dir"
 328     fi
 329
 330     if [ -d "${dir}" ] && [ -n "$(ls -A ${dir}/)" ]; then
 331         mkdir -p "$newdir"
 332         for file in ${dir}/*; do
 333             [ -z "$(echo "$file" | egrep '^/.*(~|(\.(old|staro|bkp|bak|swp|tmp|dpkg-.+|cn-.+)))$')" ] || continue
 334             newfile="${newdir}/$(basename "$file" .conf).conf"
 335             if [ ! -e "$newfile" ]; then
 336                 cp_echo "CN: Preserving changes to $newfile (renamed from $file)."
 337                 cp_mv "$file" "$newfile"
 338                 if [ -n "$toenable" ]; then
 339                     cp_echo "CN: Enabling configuration $newfile"
 340                     a2en$ctype -m -q "$(basename "$newfile" .conf)" || true
 341                 fi
 342                 need_restart=1
 343             fi
 344         done
 345     fi
 346 }
 347
 348 # rename_conf()
 349 #
 350 #   Append the .conf suffix to all configuration files located in specified
 351 #   available and enabled directories. Updated symlinks if necessary.
 352 #
 353 #
 354 rename_conf () {
 355     local ctype adir edir afile efile newfile
 356
 357     ctype="$1"
 358     adir="$2"
 359     edir="$3"
 360
 361     case "$ctype" in
 362         site|conf)
 363             # continue below
 364             ;;
 365         *)
 366             return 1
 367             ;;
 368     esac
 369
 370     if [ -d "${edir}" ] && [ -n "$(ls -A ${edir}/)" ]; then
 371         mkdir -p "$adir"
 372         for efile in ${edir}/*; do
 373             [ -z "$(echo "$efile" | egrep '^/.*(~|(\.(old|staro|bkp|bak|swp|tmp|dpkg-.+|cn-.+)))$')" ] || continue
 374
 375             [ ! -e "${edir}/$(basename "$efile" .conf).conf" ] || continue
 376
 377             afile="$(readlink -q -m "$efile")"
 378
 379             [ "$(dirname "$afile")" = "$adir" ] || continue
 380             [ "$(basename "$afile" .conf)" = "$(basename "$efile" .conf)" ] || continue
 381
 382             newfile="${adir}/$(basename "$afile" .conf).conf"
 383             [ ! -e "$newfile" ] || continue
 384
 385             cp_echo "CN: Preserving changes to $newfile (renamed from $afile)."
 386             cp_mv "$afile" "$newfile"
 387
 388             cp_echo "CN: Removing obsolete symlink $efile"
 389             rm -f "$efile"
 390
 391             cp_echo "CN: Enabling configuration $newfile"
 392             a2en$ctype -m -q "$(basename "$newfile" .conf)" || true
 393             need_restart=1
 394         done
 395     fi
 396 }
 397
 398 # listconffiles()
 399 #
 400 #   Recursively walks /etc/apache2/apache2.conf for Include and
 401 #   IncludeOptional directives.
 402 #   Prints all configfiles so defined.
 403 #
 404 listconffiles () {
 405     local i incs
 406     local base_dir="`dirname $1`"
 407
 408     incs=`awk 'tolower($1) ~ /include(optional)?/ { sub("/$","/*",$2); print $2; }' $1`
 409     incs=`echo "$incs" | sed -r "s#^([^/])#${base_dir}/\1#"`
 410     if [ -n "$incs" ]; then
 411         for i in $incs; do
 412             if [ -e "$i" ]; then echo "`readlink -m -q $i`"; listconffiles "$i"; fi
 413         done
 414     fi
 415 }
 416
 417
 418 # Set trap for deleting all temp files.
 419 #
 420 trap cleanup 0 1 2 15
 421
 422
 423 # Backup all configuration located in /etc/apache2/conf.d/,
 424 # /etc/apache2/conf-available/ and /etc/apache2/sites-available/
 425 # directories.
 426 #
 427 if [ -e "$CONF" ]; then
 428     cp_echo "CN: Doing backup for $CONF"
 429     cp_backup_conffile -d $BACKUPDIR -p $CONF
 430 fi
 431
 432 backup_conf $CONFDIR/conf.d
 433 backup_conf $CONFDIR/conf-available
 434 backup_conf $CONFDIR/sites-available
 435
 436 cp_echo "CN: Backup is located in directory: $BACKUPDIR/"
 437
 438
 439 # Enable Apache2 web server modules (mpm_prefork, cgi, rewrite, userdir, suexec, php7.0, ssl).
 440 #
 441 if [ -e "$CONF" ]; then
 442     cp_echo "CN: Enabling the prefork Apache2 MPM."
 443     if [ "$(a2query -M || true)" != "prefork" ]; then
 444         a2dismod -m -q "mpm_$(a2query -M || true)"
 445         a2enmod -m -q mpm_prefork
 446     fi
 447
 448     cp_echo "CN: Enabling required Apache2 web server modules."
 449     a2enmod -m -q access_compat
 450     a2enmod -m -q cgi
 451     a2enmod -m -q rewrite
 452     a2enmod -m -q userdir
 453     a2enmod -m -q suexec
 454     a2enmod -m -q php7.0
 455     a2enmod -m -q ssl
 456 fi
 457
 458
 459 # Make sure configuration files have the .conf suffix. Move them
 460 # to appropriate locations.
 461 #
 462 if [ -d "$CONFDIR/conf.d" ]; then
 463     cp_echo "CN: Obsolete configuration directory $CONFDIR/conf.d/ found."
 464     move_conf -e conf $CONFDIR/conf.d $CONFDIR/conf-available
 465 fi
 466
 467 rename_conf site $CONFDIR/sites-available $CONFDIR/sites-enabled
 468
 469
 470 # Check and add IncludeOptional lines to /etc/apache2/apache2.conf:
 471 #
 472 #   IncludeOptional conf-enabled/*.conf
 473 #   IncludeOptional sites-enabled/*.conf
 474 #
 475 if [ -e "$CONF" ]; then
 476
 477     cp_echo "CN: Checking IncludeOptional lines in $CONF"
 478
 479     CONFTMP=`mktemp $CONF.tmp.XXXXXX`
 480     temp_files="${temp_files} ${CONFTMP}"
 481     cp "$CONF" "$CONFTMP"
 482
 483     sed -r -i 's#^[[:space:]]*Include(Optional)?[[:space:]]+(/etc/apache2/)?conf\.d(/)?$#IncludeOptional conf-enabled/\*\.conf#I' \
 484         "$CONFTMP"
 485     sed -r -i 's#^[[:space:]]*Include(Optional)?[[:space:]]+(/etc/apache2/)?sites-enabled(/)?$#IncludeOptional sites-enabled/\*\.conf#I' \
 486         "$CONFTMP"
 487
 488     if ! egrep -iq "^[[:space:]]*IncludeOptional[[:space:]]+conf-enabled/\*\.conf$" "$CONFTMP"; then
 489         echo 'IncludeOptional conf-enabled/*.conf' >> "$CONFTMP"
 490     fi
 491     if ! egrep -iq "^[[:space:]]*IncludeOptional[[:space:]]+sites-enabled/\*\.conf$" "$CONFTMP"; then
 492         echo 'IncludeOptional sites-enabled/*.conf' >> "$CONFTMP"
 493     fi
 494
 495     if ! cmp -s "$CONFTMP" "$CONF"; then
 496         cp_mv "$CONFTMP" "$CONF"
 497         need_restart=1
 498     fi
 499     rm -f "$CONFTMP"
 500 fi
 501
 502 # Remove deprecated directives. Add default Mutex if not defined.
 503 #
 504 if [ -e "$CONF" ]; then
 505
 506     ( listconffiles "$CONF"; echo "$CONF" ) | while read -r a2cfile; do
 507
 508         a2cfiletmp=`mktemp $a2cfile.tmp.XXXXXX`
 509         temp_files="${temp_files} ${a2cfiletmp}"
 510         cp "$a2cfile" "$a2cfiletmp"
 511
 512         if egrep -iq "^[[:space:]]*NameVirtualHost[[:space:]]+" "$a2cfiletmp"; then
 513             cp_echo "CN: Removing deprecated NameVirtualHost from $a2cfile"
 514             sed -r -i '/^[[:space:]]*NameVirtualHost[[:space:]]+/Id' \
 515                 "$a2cfiletmp"
 516         fi
 517
 518         if egrep -iq "^[[:space:]]*SSLMutex[[:space:]]+" "$a2cfiletmp"; then
 519             cp_echo "CN: Removing deprecated SSLMutex from $a2cfile"
 520             sed -r -i '/^[[:space:]]*SSLMutex[[:space:]]+/Id' \
 521                 "$a2cfiletmp"
 522         fi
 523
 524         if [ "$a2cfile" = "$CONF" ]; then
 525             if ! egrep -iq "^[[:space:]]*Mutex[[:space:]]+" "$a2cfiletmp"; then
 526                 cp_echo "CN: Adding default Mutex to $a2cfile"
 527                 echo 'Mutex file:${APACHE_LOCK_DIR} default' >> "$a2cfiletmp"
 528             fi
 529         fi
 530
 531         if ! cmp -s "$a2cfiletmp" "$a2cfile"; then
 532             cp_mv "$a2cfiletmp" "$a2cfile"
 533             need_restart=1
 534         fi
 535         rm -f "$a2cfiletmp"
 536     done
 537 fi
 538
 539
 540 # Install CARNet specific configuration file.
 541 #
 542 install_conf carnet 000-carnet
 543
 544 # Enable SSL port (443).
 545 #
 546 listen_ssl
 547
 548 # Disable default site configuration.
 549 #
 550 if [ -e "$CONF" ]; then
 551     cp_echo "CN: Disabling default site configuration."
 552     a2dissite -m -f -q 000-default || true
 553     need_restart=1
 554 fi
 555
 556
 557 # Apache2 SSL certificate.
 558 #
 559 if [ -d "$CONFDIR/conf-enabled" ] && [ -n "$(ls -A $CONFDIR/conf-enabled/)" ]; then
 560     listen_ssl_mask=$CONFDIR/conf-enabled/*.conf
 561 fi
 562 if [ -d "$CONFDIR/sites-enabled" ] && [ -n "$(ls -A $CONFDIR/sites-enabled/)" ]; then
 563     listen_ssl_mask=$listen_ssl_mask" "$CONFDIR/sites-enabled/*.conf
 564 fi
 565
 566 for file in $CONF $listen_ssl_mask; do
 567     if [ -f "$file" ]; then
 568         if egrep -iq '^[[:space:]]*<VirtualHost .*443[[:space:]]*>' $file; then
 569             has_listen_ssl=1
 570             break
 571         fi
 572     fi
 573 done
 574
 575 if [ $has_listen_ssl -eq 0 ]; then
 576
 577     db_get apache2-cn/sslcf || true
 578     apache2_sslcf="$RET"
 579
 580     if [ -n "$apache2_sslcf" ]; then
 581
 582         db_get apache2-cn/sslckf || true
 583         apache2_sslckf="$RET"
 584
 585         db_get apache2-cn/sslccf || true
 586         apache2_sslccf="$RET"
 587
 588         need_restart=1
 589     else
 590
 591         # Generate new SSL certificate files.
 592         generate_ssl
 593
 594         apache2_sslcf=
 595         apache2_sslckf=
 596         apache2_sslccf=
 597     fi
 598 fi
 599
 600
 601 # Add VirtualHosts.
 602 # - on fresh install
 603 #
 604 if [ -z "$2" ]; then
 605
 606     db_get apache2-cn/wwwhost || true
 607     if [ "$RET" = "true" ]; then
 608
 609         # Add WWW VirtualHost.
 610         if [ -f "$CONFDIR/sites-available/000-$FQDN.conf" ]; then
 611             cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/000-$FQDN.conf
 612         fi
 613         if [ -f "$CONFDIR/sites-available/www.$DOMAIN.conf" ]; then
 614             cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/www.$DOMAIN.conf
 615         fi
 616
 617         chk_conf_tag "$CONFDIR/sites-available/000-$FQDN.conf"
 618         if [ ! -f "$CONFDIR/sites-available/000-$FQDN.conf" ] || [ $RET -eq 0 ]; then
 619             if egrep -qi "^[[:space:]]*NameVirtualHost[[:space:]]+\*:80$" "$PORTCONF"; then
 620                 install_vhost -d -r www.$DOMAIN default $FQDN 000-$FQDN
 621             else
 622                 install_vhost -nvh -d -r www.$DOMAIN default $FQDN 000-$FQDN
 623             fi
 624             need_restart=1
 625         fi
 626
 627         chk_conf_tag "$CONFDIR/sites-available/www.$DOMAIN.conf"
 628         if [ ! -f "$CONFDIR/sites-available/www.$DOMAIN.conf" ] || [ $RET -eq 0 ]; then
 629             install_vhost default www.$DOMAIN www.$DOMAIN
 630             need_restart=1
 631         fi
 632     else
 633
 634         # No WWW VirtualHost.
 635         if [ -f "$CONFDIR/sites-available/000-$FQDN.conf" ]; then
 636             cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/000-$FQDN.conf
 637         fi
 638
 639         chk_conf_tag "$CONFDIR/sites-available/000-$FQDN.conf"
 640         if [ ! -f "$CONFDIR/sites-available/000-$FQDN.conf" ] || [ $RET -eq 0 ]; then
 641             if egrep -qi "^[[:space:]]*NameVirtualHost[[:space:]]+\*:80$" "$PORTCONF"; then
 642                 install_vhost -d -r $FQDN default $FQDN 000-$FQDN
 643             else
 644                 install_vhost -nvh -d -r $FQDN default $FQDN 000-$FQDN
 645             fi
 646             need_restart=1
 647         fi
 648     fi
 649 fi
 650
 651
 652 # Add VirtualHost for SSL?
 653 #
 654 if [ $has_listen_ssl -eq 0 ]; then
 655
 656     if [ -f "$CONFDIR/sites-available/001-ssl.conf" ]; then
 657         cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/001-ssl.conf
 658     fi
 659
 660     # No active SSL VirtualHosts found - add new one.
 661     chk_conf_tag "$CONFDIR/sites-available/001-ssl.conf"
 662     if [ ! -f "$CONFDIR/sites-available/001-ssl.conf" ] || [ $RET -eq 0 ]; then
 663
 664         db_get apache2-cn/wwwhost || true
 665         if [ "$RET" = "true" ]; then
 666             install_vhost -r www.$DOMAIN -n $HOST ssl ssl 001-ssl
 667         else
 668             install_vhost -r $FQDN -n $HOST ssl ssl 001-ssl
 669         fi
 670         need_restart=1
 671     fi
 672 fi
 673
 674
 675 # Check SSL certificates location for VirtualHosts.
 676 #
 677 if [ $has_listen_ssl -eq 0 ]; then
 678
 679     chk_conf_tag "${CONFDIR}/sites-available/001-ssl.conf"
 680     if [ $RET -eq 0 ] && [ -n "$apache2_sslcf" ]; then
 681
 682         SSLTMP=$(mktemp ${CONFDIR}/ssltmp.XXXXXX)
 683         temp_files="${temp_files} ${SSLTMP} ${SSLTMP}.cn-old"
 684         cp ${CONFDIR}/sites-available/001-ssl.conf $SSLTMP
 685
 686         # SSLCertificateFile
 687         cp_check_and_sed "^[[:space:]]*SSLCertificateFile \/etc\/ssl\/certs\/apache2\.pem" \
 688             "s#SSLCertificateFile /etc/ssl/certs/apache2.pem#SSLCertificateFile $apache2_sslcf #g" \
 689         $SSLTMP || true
 690
 691         # SSLCertificateKeyFile
 692         cp_check_and_sed "^[[:space:]]*SSLCertificateKeyFile \/etc\/ssl\/private\/apache2\.key" \
 693             "s#SSLCertificateKeyFile /etc/ssl/private/apache2.key#SSLCertificateKeyFile $apache2_sslckf #g" \
 694         $SSLTMP || true
 695
 696         # SSLCertificateChainFile
 697         if [ -n "$apache2_sslccf" ]; then
 698             cp_check_and_sed "^[[:space:]]*# SSLCertificateChainFile \/etc\/ssl\/certs\/(sureserverEDU|cert-chain)\.pem" \
 699                 "s#\# SSLCertificateChainFile /etc/ssl/certs/\(sureserverEDU\|cert-chain\).pem#SSLCertificateChainFile $apache2_sslccf #g" \
 700             $SSLTMP || true
 701         fi
 702
 703         cp_mv $SSLTMP ${CONFDIR}/sites-available/001-ssl.conf
 704
 705         need_restart=1
 706
 707         # Just to be sure.
 708         [ -e "${SSLTMP}" ] && rm -f ${SSLTMP}
 709         [ -e "${SSLTMP}.cn-old" ] && rm -f ${SSLTMP}.cn-old
 710     fi
 711 fi
 712
 713
 714 # Check file access permissions for SSL certificates.
 715 #
 716 cp_echo "CN: Checking file access permissions for Apache2 SSL certificates."
 717 sslkey=/etc/ssl/private
 718 sslcerts="${sslkey}/ca.key ${sslkey}/apache2-ca.key ${sslkey}/apache2.key"
 719 for certf in $sslcerts; do
 720     if [ -f "$certf" ]; then
 721         chmod 600 $certf
 722     fi
 723 done
 724
 725
 726 # Check and remove obsolete "Include /etc/apache2/sites-enabled/[^.#]*" from
 727 # /etc/apache2/apache2.conf.
 728 #
 729 if egrep -iq "^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/\[\^\.\#\]\*$" "$CONF"; then
 730
 731     cp_echo "CN: Fixing obsolete Include line in $CONF."
 732     CONFTMP=`mktemp $CONF.tmp.XXXXXX`
 733     temp_files="${temp_files} ${CONFTMP}"
 734
 735     sed -r "/^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/\[\^\.\#\]\*$/Id" \
 736         "$CONF" > "$CONFTMP"
 737
 738     if ! egrep -iq "^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/$" "$CONFTMP"; then
 739         echo "Include /etc/apache2/sites-enabled/" >> "$CONFTMP"
 740     fi
 741
 742     cp_mv "$CONFTMP" "$CONF"
 743     need_restart=1
 744 fi
 745
 746
 747 db_stop || true
 748
 749
 750 # Remove old AOSI configuration for Apache: aosi-www.conf, aosi.conf.
 751 #
 752 if [ -e "$CONFDIR/conf.d/aosi-www.conf" ] || [ -e "$CONFDIR/conf.d/aosi.conf" ]; then
 753     cp_echo "CN: Removing old AOSI configuration files for Apache2."
 754     rm -f $CONFDIR/conf.d/aosi-www.conf
 755     rm -f $CONFDIR/conf.d/aosi.conf
 756     need_restart=1
 757 fi
 758
 759
 760 # Restart Apache2 web server if needed.
 761 #
 762 if [ $need_restart -eq 1 ]; then
 763
 764     # Check Apache2 web server configuration.
 765     if apache2ctl configtest 2>/dev/null; then
 766
 767         # Restart Apache2 web server.
 768         service apache2 reload || true
 769     else
 770
 771         # Something is broken.
 772         cp_echo "CN: Your Apache2 configuration seems to be broken."
 773         cp_echo "CN: Please, check the service after the installation finishes!"
 774     fi
 775 fi
 776
 777
 778 # Mail root
 779 #
 780 cp_mail "$PKG"
 781
 782
 783 # (re)generate monit.d files if monit-cn is installed.
 784 #
 785 if [ -x "/usr/sbin/update-monit.d" ]; then
 786     cp_echo "CN: Updating monit configuration..."
 787     update-monit.d || true
 788 fi
 789
 790 #DEBHELPER#
 791
 792 exit 0