debian/postinst

   1 #!/bin/sh
   2
   3 set -e
   4
   5 [ "$DEBIAN_SCRIPT_DEBUG" ] && set -vx
   6
   7 # Source debconf library.
   8 . /usr/share/debconf/confmodule
   9
  10 case "$1" in
  11         configure)
  12                 # continue below
  13                 ;;
  14
  15         abort-upgrade|abort-remove|abort-deconfigure)
  16                 exit 0
  17                 ;;
  18
  19         *)
  20                 echo "postinst called with unknown argument \`$1'" >&2
  21                 exit 0
  22                 ;;
  23 esac
  24
  25
  26 # Include CARNet functions.
  27 . /usr/share/carnet-tools/functions.sh
  28
  29 PKG="apache2-cn"
  30 VERSION="2.2-5"
  31 CONFDIR="/etc/apache2"
  32 CONF="$CONFDIR/apache2.conf"
  33 A2MODEDIR="$CONFDIR/mods-enabled"
  34 PORTCONF="$CONFDIR/ports.conf"
  35 A2CNDIR=/usr/share/apache2-cn
  36 TMPLDIR=$A2CNDIR/templates
  37 CERTDIR=/etc/ssl/certs
  38 A2PHPINI="/etc/php5/apache2/php.ini"
  39
  40 HOST=$(hostname)
  41 FQDN=$(hostname --fqdn)
  42 WEBMASTER="webmaster@$FQDN"
  43 DOMAIN=$(hostname -d)
  44 BACKUPDIR="/var/backups/apache2-cn"
  45
  46 backup_done=0
  47 need_restart=0
  48 apache2_sslcert=0
  49 apache2_sslcf=
  50 apache2_sslckf=
  51 apache2_sslccf=
  52 has_vhosts=0
  53 temp_files=
  54 has_listen_ssl=0
  55 listen_ssl_mask=
  56
  57
  58 # cleanup()
  59 #
  60 #   Cleanup all temp files.
  61 #
  62 cleanup () {
  63
  64         if [ -n "$temp_files" ]; then
  65                 for item in $temp_files; do
  66                         if [ -e "$item" ]; then
  67                                 rm -f $item
  68                         fi
  69                 done
  70         fi
  71 }
  72
  73 # tag_conf()
  74 #
  75 #   Add CARNet package info lines to config's header.
  76 #
  77 tag_conf () {
  78
  79         local conf_file
  80         conf_file="$1"
  81
  82         if [ -e "$conf_file" ]; then
  83
  84                 cat >> $conf_file <<EOF
  85 ## Begin - Generated by CARNet package apache2-cn
  86 #
  87 #  REMOVE this whole block if you DON'T WANT apache2-cn
  88 #  to edit your configuration file.
  89 #
  90 ## End - Generated by CARNet package apache2-cn
  91 EOF
  92         fi
  93 }
  94
  95 # chk_conf_tag ()
  96 #
  97 #   Check if configuration file has CARNet package info lines.
  98 #   return:  $RET => 0 - tagged
  99 #                    1 - not tagged or file does not exists
 100 #                    2 - file exists, but it is not tagged
 101 #
 102 chk_conf_tag () {
 103
 104         local conf_file
 105         conf_file="$1"
 106         RET=1
 107
 108         if [ -f "$conf_file" ]; then
 109                 if egrep -q "^## Begin - Generated by CARNet package apache2-cn$" "$conf_file"; then
 110                         RET=0
 111                 else
 112                         RET=2
 113                 fi
 114         fi
 115 }
 116
 117 # generate_ssl()
 118 #
 119 #   Generate Apache2 web server SSL certificate.
 120 #
 121 generate_ssl () {
 122
 123         generate_ssl_output=$($A2CNDIR/carnet-generate-ssl ignore "$FQDN" "$WEBMASTER" "$DOMAIN" 2> /dev/null)
 124         cp_echo "$generate_ssl_output"
 125         need_restart=1
 126 }
 127
 128 # listen_ssl()
 129 #
 130 #   Check if port 443 is configured in ports.conf file.
 131 #
 132 listen_ssl() {
 133
 134         if [ ! -f "$PORTCONF" ] || ! egrep -iq "^[[:space:]]*Listen[[:space:]]*.*443$" "$PORTCONF"; then
 135
 136                 cp_echo "CN: Enabling SSL port (443) for Apache2 web server."
 137
 138                 out=$(mktemp ${PORTCONF}.XXXXXX)
 139
 140                 if [ -f "$PORTCONF" ]; then
 141                         cp $PORTCONF $out
 142                 fi
 143
 144                 echo "Listen 443" >> $out
 145                 cp_mv $out $PORTCONF
 146                 chmod 644 $PORTCONF
 147
 148                 need_restart=1
 149                 temp_files="${temp_files} ${out}"
 150         fi
 151 }
 152
 153 # install_conf()
 154 #
 155 #   Install specified Apache2 configuration file.
 156 #
 157 install_conf() {
 158
 159         conftmpl="$A2CNDIR/$1.conf"
 160         conf="$CONFDIR/conf.d/$2.conf"
 161
 162         if [ ! -e "$conf" ]; then
 163
 164                 cp_echo "CN: Enabling CARNet specific configuration."
 165                 cp "$conftmpl" "$conf"
 166
 167                 need_restart=1
 168         else
 169                 cp_echo "CN: $conf already exists, left untouched." 1>&2
 170         fi
 171 }
 172
 173 # install_vhost()
 174 #
 175 #   Install specified VirtualHost for Apache2 web server.
 176 #
 177 #   Invocation:
 178 #
 179 #   install_vhost [-nvh] [-d] [-s docroot_symlink_dest] template site site-enabled-symlink
 180 #
 181 #     -nvh - add NameVirtualHost
 182 #     -d   - mkdir DocumentRoot
 183 #     -r   - set DocumentRoot
 184 #     -n   - set ServerName
 185 #     -s X - symlink DocumentRoot to X (all in /var/www)
 186 #
 187 #   site - name of file in sites-available, host part of ServerName unless -r or -n is used
 188 #   site-enabled-symlink - name of symlink in sites-enabled
 189 #
 190 install_vhost() {
 191
 192         add_namevirthost=
 193         mkdir_docroot=
 194         symlink_docroot=
 195         docroot=
 196         vhostname=
 197
 198         while echo "x$1" | grep -q '^x-'; do
 199             case "$1" in
 200                 -nvh)
 201                     add_namevirthost=1
 202                     shift
 203                     ;;
 204                 -d)
 205                     mkdir_docroot=1
 206                     shift
 207                     ;;
 208                 -s)
 209                     shift
 210                     symlink_docroot="$1"
 211                     shift
 212                     ;;
 213                 -r)
 214                     shift
 215                     docroot="$1"
 216                     if ! echo "$docroot" | grep -q /; then
 217                             docroot="/var/www/$docroot"
 218                     fi
 219                     shift
 220                     ;;
 221                 -n)
 222                     shift
 223                     vhostname="$1"
 224                     shift
 225                     ;;
 226             esac
 227         done
 228
 229         vhosttmpl="$1.template"
 230         vhost="$2"
 231         venabled="$3"
 232         [ -z "$vhostname" ] && vhostname=$(echo "$vhost"| awk -F. '{print $1}')
 233         force_vhost=
 234
 235         vhostdir=$CONFDIR/sites-available
 236         venabledir=$CONFDIR/sites-enabled
 237
 238         if [ ! -e "$TMPLDIR/${vhosttmpl}" ]; then
 239                 echo "E: vhost template ${vhosttmpl} not found in $TMPLDIR!" 1>&2
 240                 exit 2
 241         fi
 242
 243         [ -z "$docroot" ] && docroot="/var/www/$vhostname.$DOMAIN"
 244
 245         # if we were broken mid-installation, force
 246         if [ ! -e "$docroot" -a \( -n "$mkdir_docroot" -o -n "$symlink_docroot" \) ]; then
 247                 force_vhost=1
 248         fi
 249
 250         # add vhost if either of these is true
 251         # - adding is forced OR
 252         # - it doesn't exist
 253         #
 254         if [ -n "$force_vhost" -o \( ! -e "$vhostdir/$vhost" -a ! -e "$venabledir/$venabled" \) ]; then
 255
 256                 cp_echo "CN: Adding $vhost VirtualHost."
 257                 out=$(mktemp $vhostdir/$vhost.XXXXXX)
 258                 temp_files="${temp_files} ${out}"
 259
 260                 # CARNet header.
 261                 tag_conf "$out"
 262
 263                 if [ "$add_namevirthost" ]; then
 264                         nvh=$(awk -F'[ >]' '/^<VirtualHost/ {print $2}' $TMPLDIR/$vhosttmpl |\
 265                             sed "s/IPADDR/$MYIP/g")
 266                         echo "NameVirtualHost $nvh" >> $out
 267                 fi
 268
 269                 sed "s/HOST/$vhostname/g; s/DOMAIN/$DOMAIN/g;
 270                      s#DOCROOT#$docroot#g; s/IPADDR/$MYIP/g" < $TMPLDIR/$vhosttmpl >> $out
 271                 cp_mv $out $vhostdir/$vhost
 272                 chmod 644 $vhostdir/$vhost
 273                 ln -fs ../sites-available/$vhost $venabledir/$venabled
 274
 275                 if [ -n "$mkdir_docroot" -a ! -d "$docroot" ]; then
 276                         mkdir "$docroot"
 277                         echo '<html><body><h1>Radi!</h1></body></html>' > "$docroot/index.html"
 278                 elif [ -n "$symlink_docroot" ]; then
 279                         ln -fs "$symlink_docroot" "$docroot"
 280                 fi
 281
 282                 need_restart=1
 283         fi
 284 }
 285
 286
 287 # Set trap for deleting all temp files.
 288 #
 289 trap cleanup 0 1 2 15
 290
 291
 292 # Backup all configuration located in /etc/apache2/conf.d/ and
 293 # /etc/apache2/sites-available/ directories.
 294 #
 295 if [ -e "$CONF" ]; then
 296         cp_echo "CN: Doing backup for $CONF"
 297         cp_backup_conffile -d $BACKUPDIR -p $CONF
 298         backup_done=1
 299 fi
 300 if [ -d "$CONFDIR/conf.d" ] && [ -n "$(ls ${CONFDIR}/conf.d/)" ]; then
 301         cp_echo "CN: Doing backup for all files in /etc/apache2/conf.d/"
 302         for file in /etc/apache2/conf.d/*; do
 303             if [ -z "$(echo $file | egrep '^/.*~')" ]; then
 304                 cp_backup_conffile -d $BACKUPDIR -p $file
 305             fi
 306         done
 307         backup_done=1
 308 fi
 309 if [ -d "$CONFDIR/sites-available" ] && [ -n "$(ls ${CONFDIR}/sites-available/)" ]; then
 310         cp_echo "CN: Doing backup for all files in /etc/apache2/sites-available/"
 311         for file in /etc/apache2/sites-available/*; do
 312             if [ -z "$(echo $file | egrep '^/.*~')" ]; then
 313                 cp_backup_conffile -d $BACKUPDIR -p $file
 314             fi
 315         done
 316         backup_done=1
 317 fi
 318 if [ $backup_done -eq 1 ]; then
 319         cp_echo "CN: Backup is located in directory: $BACKUPDIR/"
 320 fi
 321
 322
 323 # Enable Apache2 web server modules (cgi, rewrite, userdir, suexec, php5, ssl).
 324 #
 325 if [ -e "$CONF" ]; then
 326
 327         if [ ! -e "$A2MODEDIR/cgi.load" ]; then
 328                 cp_echo "CN: Enabling CGI module for Apache2 web server."
 329                 a2enmod cgi >/dev/null || true
 330                 need_restart=1
 331         fi
 332
 333         if [ ! -e "$A2MODEDIR/rewrite.load" ]; then
 334                 cp_echo "CN: Enabling rewrite module for Apache2 web server."
 335                 a2enmod rewrite >/dev/null || true
 336                 need_restart=1
 337         fi
 338
 339         if [ ! -e "$A2MODEDIR/userdir.load" ] || [ ! -e "$A2MODEDIR/userdir.conf" ]; then
 340                 cp_echo "CN: Enabling userdir module for Apache2 web server."
 341                 a2enmod userdir >/dev/null || true
 342                 need_restart=1
 343         fi
 344
 345         if [ ! -e "$A2MODEDIR/suexec.load" ]; then
 346                 cp_echo "CN: Enabling SUEXEC module for Apache2 web server."
 347                 a2enmod suexec >/dev/null || true
 348                 need_restart=1
 349         fi
 350
 351         if [ ! -e "$A2MODEDIR/php5.load" ] || [ ! -e "$A2MODEDIR/php5.conf" ]; then
 352             if [ -e "/usr/lib/apache2/modules/libphp5.so" ]; then
 353                 cp_echo "CN: Enabling PHP5 module for Apache2 web server."
 354                 a2enmod php5 >/dev/null || true
 355                 need_restart=1
 356             fi
 357         fi
 358
 359         if [ ! -e "$A2MODEDIR/ssl.load" ] || [ ! -e "$A2MODEDIR/ssl.conf" ]; then
 360                 cp_echo "CN: Enabling SSL module for Apache2 web server."
 361                 a2enmod ssl >/dev/null || true
 362                 need_restart=1
 363         fi
 364 fi
 365
 366
 367 # Install CARNet specific configuration file.
 368 #
 369 install_conf carnet 000-carnet
 370
 371 # Enable SSL port (443).
 372 #
 373 listen_ssl
 374
 375 # Disable default site configuration.
 376 #
 377 if [ -e "$CONF" ]; then
 378         if [ -e "$CONFDIR/sites-enabled/000-default" ]; then
 379                 cp_echo "CN: Disabling 000-default site configuration."
 380                 a2dissite 000-default >/dev/null || true
 381
 382                 need_restart=1
 383         fi
 384 fi
 385
 386
 387 # Apache2 SSL certificate.
 388 #
 389 has_listen_ssl=0
 390
 391 if [ -d "$CONFDIR/conf.d" ] && [ -n "$(ls $CONFDIR/conf.d)" ]; then
 392         listen_ssl_mask=$CONFDIR/conf.d/*
 393 fi
 394 if [ -d "$CONFDIR/sites-enabled" ] && [ -n "$(ls $CONFDIR/sites-enabled)" ]; then
 395         listen_ssl_mask=$listen_ssl_mask" "$CONFDIR/sites-enabled/*
 396 fi
 397
 398 for file in $CONF $listen_ssl_mask; do
 399         if [ -f "$file" ]; then
 400                 if egrep -iq '^[[:space:]]*<VirtualHost .*443[[:space:]]*>' $file; then
 401                         has_listen_ssl=1
 402                         apache2_sslcert=1
 403                         break
 404                 fi
 405         fi
 406 done
 407
 408 if [ $apache2_sslcert -eq 0 ]; then
 409
 410         db_get apache2-cn/sslcf || true
 411         apache2_sslcf="$RET"
 412
 413         if [ -n "$apache2_sslcf" ]; then
 414
 415                 db_get apache2-cn/sslckf || true
 416                 apache2_sslckf="$RET"
 417
 418                 db_get apache2-cn/sslccf || true
 419                 apache2_sslccf="$RET"
 420
 421                 need_restart=1
 422         else
 423
 424                 # Generate new SSL certificate files.
 425                 generate_ssl
 426
 427                 apache2_sslcf=
 428                 apache2_sslckf=
 429                 apache2_sslccf=
 430         fi
 431 fi
 432
 433
 434 # Add VirtualHosts.
 435 # - on fresh install
 436 #
 437 if [ -z "$2" ]; then
 438
 439     db_get apache2-cn/wwwhost || true
 440     if [ "$RET" = "true" ]; then
 441
 442         # Add WWW VirtualHost.
 443         if [ -f "$CONFDIR/sites-available/$FQDN" ]; then
 444                 cp_backup_conffile -d $BACKUPDIR -p $CONFDIR/sites-available/$FQDN
 445         fi
 446         if [ -f "$CONFDIR/sites-available/www.$DOMAIN" ]; then
 447                 cp_backup_conffile -d $BACKUPDIR -p $CONFDIR/sites-available/www.$DOMAIN
 448         fi
 449
 450         chk_conf_tag "$CONFDIR/sites-available/$FQDN"
 451         if [ ! -f "$CONFDIR/sites-available/$FQDN" ] || [ $RET -eq 0 ]; then
 452                 install_vhost -nvh -d -r www.$DOMAIN default $FQDN 000-$FQDN
 453                 need_restart=1
 454         fi
 455
 456         chk_conf_tag "$CONFDIR/sites-available/www.$DOMAIN"
 457         if [ ! -f "$CONFDIR/sites-available/www.$DOMAIN" ] || [ $RET -eq 0 ]; then
 458                 install_vhost default www.$DOMAIN www.$DOMAIN
 459                 need_restart=1
 460         fi
 461     else
 462
 463         # No WWW VirtualHost.
 464         if [ -f "$CONFDIR/sites-available/$FQDN" ]; then
 465                 cp_backup_conffile -d $BACKUPDIR -p $CONFDIR/sites-available/$FQDN
 466         fi
 467
 468         chk_conf_tag "$CONFDIR/sites-available/$FQDN"
 469         if [ ! -f "$CONFDIR/sites-available/$FQDN" ] || [ $RET -eq 0 ]; then
 470                 install_vhost -nvh -d -r $FQDN default $FQDN 000-$FQDN
 471                 need_restart=1
 472         fi
 473     fi
 474 fi
 475
 476
 477 # Add VirtualHost for SSL?
 478 #
 479 if [ $apache2_sslcert -eq 0 ]; then
 480
 481         if [ -f "$CONFDIR/sites-available/ssl" ]; then
 482                 cp_backup_conffile -d $BACKUPDIR -p $CONFDIR/sites-available/ssl
 483         fi
 484
 485         # No active SSL VirtualHosts found - add new one.
 486         chk_conf_tag "$CONFDIR/sites-available/ssl"
 487         if [ ! -f "$CONFDIR/sites-available/ssl" ] || [ $RET -eq 0 ]; then
 488                 install_vhost -r $FQDN -n $HOST ssl ssl 001-ssl
 489                 need_restart=1
 490         fi
 491 fi
 492
 493
 494 # Check SSL certificates location for VirtualHosts.
 495 #
 496 if [ $apache2_sslcert -eq 0 ]; then
 497
 498         chk_conf_tag "${CONFDIR}/sites-available/ssl"
 499         if [ $RET -eq 0 ] && [ -n "$apache2_sslcf" ]; then
 500
 501                 SSLTMP=$(mktemp ${CONFDIR}/ssltmp.XXXXXX)
 502                 temp_files="${temp_files} ${SSLTMP} ${SSLTMP}.cn-old"
 503                 cp ${CONFDIR}/sites-available/ssl $SSLTMP
 504
 505                 # SSLCertificateFile
 506                 cp_check_and_sed "^[[:space:]]*SSLCertificateFile \/etc\/ssl\/certs\/apache2\.pem" \
 507                     "s#SSLCertificateFile /etc/ssl/certs/apache2.pem#SSLCertificateFile $apache2_sslcf #g" \
 508                     $SSLTMP || true
 509
 510                 # SSLCertificateKeyFile
 511                 cp_check_and_sed "^[[:space:]]*SSLCertificateKeyFile \/etc\/ssl\/private\/apache2\.key" \
 512                     "s#SSLCertificateKeyFile /etc/ssl/private/apache2.key#SSLCertificateKeyFile $apache2_sslckf #g" \
 513                     $SSLTMP || true
 514
 515                 # SSLCertificateChainFile
 516                 if [ -n "$apache2_sslccf" ]; then
 517                     cp_check_and_sed "^# SSLCertificateChainFile \/etc\/ssl\/certs/sureserverEDU\.pem" \
 518                         "s#\# SSLCertificateChainFile /etc/ssl/certs/sureserverEDU.pem#SSLCertificateChainFile $apache2_sslccf #g" \
 519                         $SSLTMP || true
 520                 fi
 521
 522                 cp_mv $SSLTMP ${CONFDIR}/sites-available/ssl
 523
 524                 need_restart=1
 525
 526                 # Just to be sure.
 527                 [ -e "${SSLTMP}" ] && rm -f ${SSLTMP}
 528                 [ -e "${SSLTMP}.cn-old" ] && rm -f ${SSLTMP}.cn-old
 529         fi
 530 fi
 531
 532
 533 # Check file access permissions for SSL certificates.
 534 #
 535 cp_echo "CN: Checking file access permissions for Apache2 SSL certificates."
 536 sslkey=/etc/ssl/private
 537 sslcerts="${sslkey}/ca.key ${sslkey}/apache2-ca.key ${sslkey}/apache2.key"
 538 for certf in $sslcerts; do
 539         if [ -f "$certf" ]; then
 540             chmod 600 $certf
 541         fi
 542 done
 543
 544
 545 # Check and remove obsolete "Include /etc/apache2/sites-enabled/[^.#]*" from
 546 # /etc/apache2/apache2.conf.
 547 #
 548 if egrep -iq "^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/\[\^\.\#\]\*$" "$CONF"; then
 549
 550         cp_echo "CN: Fixing obsolete Include line in $CONF."
 551         CONFTMP=`mktemp $CONF.tmp.XXXXXX`
 552         sed -r "/^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/\[\^\.\#\]\*$/Id" \
 553                 "$CONF" > "$CONFTMP"
 554
 555         if ! egrep -iq "^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/$" "$CONFTMP"; then
 556                 echo "Include /etc/apache2/sites-enabled/" >> "$CONFTMP"
 557         fi
 558
 559         cp_mv "$CONFTMP" "$CONF"
 560         need_restart=1
 561 fi
 562
 563
 564 db_stop || true
 565
 566
 567 # Remove old AOSI configuration for Apache: aosi-www.conf, aosi.conf.
 568 #
 569 if [ -e "$CONFDIR/conf.d/aosi-www.conf" ] || [ -e "$CONFDIR/conf.d/aosi.conf" ]; then
 570         cp_echo "CN: Removing old AOSI configuration files for Apache2."
 571         need_restart=1
 572 fi
 573 [ -e "$CONFDIR/conf.d/aosi-www.conf" ] && rm -f $CONFDIR/conf.d/aosi-www.conf
 574 [ -e "$CONFDIR/conf.d/aosi.conf" ] && rm -f $CONFDIR/conf.d/aosi.conf
 575
 576
 577 # Restart Apache2 web server if needed.
 578 #
 579 if [ $need_restart -eq 1 ]; then
 580
 581         # Check Apache2 web server configuration.
 582         if apache2ctl configtest 2>/dev/null; then
 583
 584                 # Restart Apache2 web server.
 585                 if [ -x "/etc/init.d/apache2" ]; then
 586                     if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
 587                         invoke-rc.d apache2 restart || true
 588                     else
 589                         /etc/init.d/apache2 restart || true
 590                     fi
 591                 fi
 592         else
 593
 594                 # Something is broken.
 595                 cp_echo "CN: Your Apache2 configuration seem to be broken."
 596                 cp_echo "CN: Please, check the service after the installation finishes!"
 597         fi
 598 fi
 599
 600
 601 # Mail root
 602 #
 603 cp_mail "$PKG"
 604
 605
 606 # (re)generate monit.d files if monit-cn is installed.
 607 #
 608 if [ -x "/usr/sbin/update-monit.d" ]; then
 609         cp_echo "CN: Updating monit configuration..."
 610         update-monit.d || true
 611 fi
 612
 613
 614 exit 0