debian/postinst

   1 #!/bin/sh
   2
   3 set -e
   4
   5 [ "$1" = "configure" ] || exit 0
   6 [ "$DEBIAN_SCRIPT_DEBUG" ] && set -vx
   7
   8 # Load Debconf
   9 . /usr/share/debconf/confmodule
  10
  11 # Load CARNet Tools
  12 . /usr/share/carnet-tools/functions.sh
  13
  14 PKG="apache2-cn"
  15 VERSION="2.4.10+1"
  16 CONFDIR="/etc/apache2"
  17 CONF="$CONFDIR/apache2.conf"
  18 PORTCONF="$CONFDIR/ports.conf"
  19 A2CNDIR=/usr/share/apache2-cn
  20 TMPLDIR=$A2CNDIR/templates
  21 CERTDIR=/etc/ssl/certs
  22
  23 HOST=$(hostname)
  24 FQDN=$(hostname --fqdn)
  25 WEBMASTER="webmaster@$FQDN"
  26 DOMAIN=$(hostname -d)
  27 BACKUPDIR="/var/backups/apache2-cn"
  28
  29 need_restart=0
  30 apache2_sslcf=
  31 apache2_sslckf=
  32 apache2_sslccf=
  33 has_vhosts=0
  34 temp_files=
  35 has_listen_ssl=0
  36 listen_ssl_mask=
  37
  38
  39 # cleanup()
  40 #
  41 #   Cleanup all temp files.
  42 #
  43 cleanup () {
  44     if [ -n "$temp_files" ]; then
  45         for item in $temp_files; do
  46             if [ -e "$item" ]; then
  47                 rm -f $item
  48             fi
  49         done
  50     fi
  51 }
  52
  53 # tag_conf()
  54 #
  55 #   Add CARNet package info lines to config's header.
  56 #
  57 tag_conf () {
  58     local conf_file
  59     conf_file="$1"
  60
  61     if [ -e "$conf_file" ]; then
  62         cat >> $conf_file <<EOF
  63 ## Begin - Generated by CARNet package apache2-cn
  64 #
  65 #  REMOVE this whole block if you DON'T WANT apache2-cn
  66 #  to edit or undo your changes to this configuration file.
  67 #
  68 ## End - Generated by CARNet package apache2-cn
  69 EOF
  70     fi
  71 }
  72
  73 # chk_conf_tag ()
  74 #
  75 #   Check if configuration file has CARNet package info lines.
  76 #   return:  $RET => 0 - tagged
  77 #                    1 - not tagged or file does not exists
  78 #                    2 - file exists, but it is not tagged
  79 #
  80 chk_conf_tag () {
  81     local conf_file
  82     conf_file="$1"
  83     RET=1
  84
  85     if [ -f "$conf_file" ]; then
  86         if egrep -q "^## Begin - Generated by CARNet package apache2-cn$" "$conf_file"; then
  87             RET=0
  88         else
  89             RET=2
  90         fi
  91     fi
  92 }
  93
  94 # generate_ssl()
  95 #
  96 #   Generate Apache2 web server SSL certificate.
  97 #
  98 generate_ssl () {
  99     generate_ssl_output=$($A2CNDIR/carnet-generate-ssl ignore "$FQDN" "$WEBMASTER" "$DOMAIN" 2> /dev/null)
 100     cp_echo "$generate_ssl_output"
 101     need_restart=1
 102 }
 103
 104 # listen_ssl()
 105 #
 106 #   Check if port 443 is configured in ports.conf file.
 107 #
 108 listen_ssl() {
 109
 110     if [ ! -f "$PORTCONF" ] || ! egrep -iq "^[[:space:]]*Listen[[:space:]]+443$" "$PORTCONF"; then
 111
 112         cp_echo "CN: Enabling SSL port (443) for Apache2 web server."
 113
 114         out=$(mktemp ${PORTCONF}.XXXXXX)
 115         temp_files="${temp_files} ${out}"
 116
 117         if [ -f "$PORTCONF" ]; then
 118             cp $PORTCONF $out
 119         fi
 120
 121         echo "Listen 443" >> $out
 122         cp_mv $out $PORTCONF
 123         chmod 644 $PORTCONF
 124
 125         need_restart=1
 126     fi
 127 }
 128
 129 # install_conf()
 130 #
 131 #   Install specified Apache2 configuration file.
 132 #
 133 install_conf() {
 134     conftmpl="$A2CNDIR/$1.conf"
 135     conf="$CONFDIR/conf-available/$2.conf"
 136
 137     if [ ! -e "$conf" ]; then
 138         cp_echo "CN: Generating CARNet specific configuration."
 139         cp "$conftmpl" "$conf"
 140     else
 141         cp_echo "CN: $conf already exists, left untouched." 1>&2
 142     fi
 143
 144     cp_echo "CN: Enabling CARNet specific configuration."
 145     a2enconf -m -q "$2"
 146     need_restart=1
 147 }
 148
 149 # install_vhost()
 150 #
 151 #   Install specified VirtualHost for Apache2 web server.
 152 #
 153 #   Invocation:
 154 #
 155 #   install_vhost [-nvh] [-d] [-s docroot_symlink_dest] template site site-enabled-symlink
 156 #
 157 #     -nvh - add NameVirtualHost
 158 #     -d   - mkdir DocumentRoot
 159 #     -r   - set DocumentRoot
 160 #     -n   - set ServerName
 161 #     -s X - symlink DocumentRoot to X (all in /var/www)
 162 #
 163 #   site - host part of ServerName unless -r or -n is used
 164 #   site-enabled-symlink - name of file/symlink in sites-available/sites-enabled
 165 #                          (without .conf suffix)
 166 #
 167 install_vhost() {
 168     add_namevirthost=
 169     mkdir_docroot=
 170     symlink_docroot=
 171     docroot=
 172     vhostname=
 173
 174     while echo "x$1" | grep -q '^x-'; do
 175         case "$1" in
 176             -nvh)
 177                 add_namevirthost=1
 178                 shift
 179                 ;;
 180             -d)
 181                 mkdir_docroot=1
 182                 shift
 183                 ;;
 184             -s)
 185                 shift
 186                 symlink_docroot="$1"
 187                 shift
 188                 ;;
 189             -r)
 190                 shift
 191                 docroot="$1"
 192                 if ! echo "$docroot" | grep -q /; then
 193                     docroot="/var/www/$docroot"
 194                 fi
 195                 shift
 196                 ;;
 197             -n)
 198                 shift
 199                 vhostname="$1"
 200                 shift
 201                 ;;
 202         esac
 203     done
 204
 205     vhosttmpl="$1.template"
 206     vhost="$2"
 207     vsite="$3"
 208     venabled="$3.conf"
 209     [ -z "$vhostname" ] && vhostname=$(echo "$vhost"| awk -F. '{print $1}')
 210     force_vhost=
 211
 212     vhostdir=$CONFDIR/sites-available
 213     venabledir=$CONFDIR/sites-enabled
 214
 215     if [ ! -e "$TMPLDIR/${vhosttmpl}" ]; then
 216         echo "E: vhost template ${vhosttmpl} not found in $TMPLDIR!" 1>&2
 217         exit 2
 218     fi
 219
 220     [ -z "$docroot" ] && docroot="/var/www/$vhostname.$DOMAIN"
 221
 222     # if we were broken mid-installation, force
 223     if [ ! -e "$docroot" -a \( -n "$mkdir_docroot" -o -n "$symlink_docroot" \) ]; then
 224         force_vhost=1
 225     fi
 226
 227     # add vhost if either of these is true
 228     # - adding is forced OR
 229     # - it doesn't exist
 230     #
 231     if [ -n "$force_vhost" -o \( ! -e "$vhostdir/$venabled" -a ! -e "$venabledir/$venabled" \) ]; then
 232
 233         cp_echo "CN: Adding $vhost VirtualHost."
 234         out=$(mktemp $vhostdir/$venabled.XXXXXX)
 235         temp_files="${temp_files} ${out}"
 236
 237         # CARNet header.
 238         tag_conf "$out"
 239
 240         if [ "$add_namevirthost" ]; then
 241             nvh=$(awk -F'[ >]' '/^<VirtualHost/ {print $2}' $TMPLDIR/$vhosttmpl |\
 242                 sed "s/IPADDR/$MYIP/g")
 243             echo "NameVirtualHost $nvh" >> $out
 244         fi
 245
 246         sed "s/HOST/$vhostname/g; s/DOMAIN/$DOMAIN/g;
 247             s#DOCROOT#$docroot#g; s/IPADDR/$MYIP/g" < $TMPLDIR/$vhosttmpl >> $out
 248         cp_mv $out $vhostdir/$venabled
 249         chmod 644 $vhostdir/$venabled
 250         a2ensite -m -q "$vsite"
 251
 252         if [ -n "$mkdir_docroot" -a ! -d "$docroot" ]; then
 253             mkdir "$docroot"
 254             echo '<html><body><h1>Radi!</h1></body></html>' > "$docroot/index.html"
 255         elif [ -n "$symlink_docroot" ]; then
 256             ln -fs "$symlink_docroot" "$docroot"
 257         fi
 258
 259         need_restart=1
 260     fi
 261 }
 262
 263 # backup_conf()
 264 #
 265 #   Backup configuration files located in specified directory.
 266 #
 267 backup_conf () {
 268     local dir file backup_dir
 269
 270     dir="$1"
 271
 272     if [ -d "${dir}" ] && [ -n "$(ls -A ${dir}/)" ]; then
 273         cp_echo "CN: Doing backup for all files in $dir"
 274         for file in ${dir}/*; do
 275             if [ -f "$file" ]; then
 276                 if [ -z "$(echo "$file" | egrep '^/.*(~|(\.(old|staro|bkp|bak|swp|tmp|dpkg-.+|cn-.+)))$')" ]; then
 277                     backup_dir="$BACKUPDIR/$(basename $(dirname "$file"))"
 278                     cp_backup_conffile -d "$backup_dir" -p "$file"
 279                 fi
 280             fi
 281         done
 282     fi
 283 }
 284
 285 # move_conf()
 286 #
 287 #   Move configuration files from one directory to another. The .conf suffix
 288 #   will be added. Will try to enable the configuration if -e is specified.
 289 #
 290 move_conf () {
 291     local toenable ctype dir newdir file newfile
 292
 293     if [ "$1" = "-e" ]; then
 294         toenable="$1"
 295         shift
 296     fi
 297
 298     ctype="$1"
 299     dir="$2"
 300     newdir="$3"
 301
 302     case "$ctype" in
 303         site|conf)
 304             # continue below
 305             ;;
 306         *)
 307             return 1
 308             ;;
 309     esac
 310
 311     if [ -z "$newdir" ]; then
 312         newdir="$dir"
 313     fi
 314
 315     if [ -d "${dir}" ] && [ -n "$(ls -A ${dir}/)" ]; then
 316         mkdir -p "$newdir"
 317         for file in ${dir}/*; do
 318             [ -z "$(echo "$file" | egrep '^/.*(~|(\.(old|staro|bkp|bak|swp|tmp|dpkg-.+|cn-.+)))$')" ] || continue
 319             newfile="${newdir}/$(basename "$file" .conf).conf"
 320             if [ ! -e "$newfile" ]; then
 321                 cp_echo "CN: Preserving changes to $newfile (renamed from $file)."
 322                 cp_mv "$file" "$newfile"
 323                 if [ -n "$toenable" ]; then
 324                     cp_echo "CN: Enabling configuration $newfile"
 325                     a2en$ctype -m -q "$(basename "$newfile" .conf)" || true
 326                 fi
 327                 need_restart=1
 328             fi
 329         done
 330     fi
 331 }
 332
 333 # rename_conf()
 334 #
 335 #   Append the .conf suffix to all configuration files located in specified
 336 #   available and enabled directories. Updated symlinks if necessary.
 337 #
 338 #
 339 rename_conf () {
 340     local ctype adir edir afile efile newfile
 341
 342     ctype="$1"
 343     adir="$2"
 344     edir="$3"
 345
 346     case "$ctype" in
 347         site|conf)
 348             # continue below
 349             ;;
 350         *)
 351             return 1
 352             ;;
 353     esac
 354
 355     if [ -d "${edir}" ] && [ -n "$(ls -A ${edir}/)" ]; then
 356         mkdir -p "$adir"
 357         for efile in ${edir}/*; do
 358             [ -z "$(echo "$efile" | egrep '^/.*(~|(\.(old|staro|bkp|bak|swp|tmp|dpkg-.+|cn-.+)))$')" ] || continue
 359
 360             [ ! -e "${edir}/$(basename "$efile" .conf).conf" ] || continue
 361
 362             afile="$(readlink -q -m "$efile")"
 363
 364             [ "$(dirname "$afile")" = "$adir" ] || continue
 365             [ "$(basename "$afile" .conf)" = "$(basename "$efile" .conf)" ] || continue
 366
 367             newfile="${adir}/$(basename "$afile" .conf).conf"
 368             [ ! -e "$newfile" ] || continue
 369
 370             cp_echo "CN: Preserving changes to $newfile (renamed from $afile)."
 371             cp_mv "$afile" "$newfile"
 372
 373             cp_echo "CN: Removing obsolete symlink $efile"
 374             rm -f "$efile"
 375
 376             cp_echo "CN: Enabling configuration $newfile"
 377             a2en$ctype -m -q "$(basename "$newfile" .conf)" || true
 378             need_restart=1
 379         done
 380     fi
 381 }
 382
 383 # listconffiles()
 384 #
 385 #   Recursively walks /etc/apache2/apache2.conf for Include and
 386 #   IncludeOptional directives.
 387 #   Prints all configfiles so defined.
 388 #
 389 listconffiles () {
 390     local i incs
 391     local base_dir="`dirname $1`"
 392
 393     incs=`awk 'tolower($1) ~ /include(optional)?/ { sub("/$","/*",$2); print $2; }' $1`
 394     incs=`echo "$incs" | sed -r "s#^([^/])#${base_dir}/\1#"`
 395     if [ -n "$incs" ]; then
 396         for i in $incs; do
 397             if [ -e "$i" ]; then echo "`readlink -m -q $i`"; listconffiles "$i"; fi
 398         done
 399     fi
 400 }
 401
 402
 403 # Set trap for deleting all temp files.
 404 #
 405 trap cleanup 0 1 2 15
 406
 407
 408 # Backup all configuration located in /etc/apache2/conf.d/,
 409 # /etc/apache2/conf-available/ and /etc/apache2/sites-available/
 410 # directories.
 411 #
 412 if [ -e "$CONF" ]; then
 413     cp_echo "CN: Doing backup for $CONF"
 414     cp_backup_conffile -d $BACKUPDIR -p $CONF
 415 fi
 416
 417 backup_conf $CONFDIR/conf.d
 418 backup_conf $CONFDIR/conf-available
 419 backup_conf $CONFDIR/sites-available
 420
 421 cp_echo "CN: Backup is located in directory: $BACKUPDIR/"
 422
 423
 424 # Enable Apache2 web server modules (mpm_prefork, cgi, rewrite, userdir, suexec, php7.0, ssl).
 425 #
 426 if [ -e "$CONF" ]; then
 427     cp_echo "CN: Enabling the prefork Apache2 MPM."
 428     if [ "$(a2query -M || true)" != "prefork" ]; then
 429         a2dismod -m -q "mpm_$(a2query -M || true)"
 430         a2enmod -m -q mpm_prefork
 431     fi
 432
 433     cp_echo "CN: Enabling required Apache2 web server modules."
 434     a2enmod -m -q access_compat
 435     a2enmod -m -q cgi
 436     a2enmod -m -q rewrite
 437     a2enmod -m -q userdir
 438     a2enmod -m -q suexec
 439     a2enmod -m -q php7.0
 440     a2enmod -m -q ssl
 441 fi
 442
 443
 444 # Make sure configuration files have the .conf suffix. Move them
 445 # to appropriate locations.
 446 #
 447 if [ -d "$CONFDIR/conf.d" ]; then
 448     cp_echo "CN: Obsolete configuration directory $CONFDIR/conf.d/ found."
 449     move_conf -e conf $CONFDIR/conf.d $CONFDIR/conf-available
 450 fi
 451
 452 rename_conf site $CONFDIR/sites-available $CONFDIR/sites-enabled
 453
 454
 455 # Check and add IncludeOptional lines to /etc/apache2/apache2.conf:
 456 #
 457 #   IncludeOptional conf-enabled/*.conf
 458 #   IncludeOptional sites-enabled/*.conf
 459 #
 460 if [ -e "$CONF" ]; then
 461
 462     cp_echo "CN: Checking IncludeOptional lines in $CONF"
 463
 464     CONFTMP=`mktemp $CONF.tmp.XXXXXX`
 465     temp_files="${temp_files} ${CONFTMP}"
 466     cp "$CONF" "$CONFTMP"
 467
 468     sed -r -i 's#^[[:space:]]*Include(Optional)?[[:space:]]+(/etc/apache2/)?conf\.d(/)?$#IncludeOptional conf-enabled/\*\.conf#I' \
 469         "$CONFTMP"
 470     sed -r -i 's#^[[:space:]]*Include(Optional)?[[:space:]]+(/etc/apache2/)?sites-enabled(/)?$#IncludeOptional sites-enabled/\*\.conf#I' \
 471         "$CONFTMP"
 472
 473     if ! egrep -iq "^[[:space:]]*IncludeOptional[[:space:]]+conf-enabled/\*\.conf$" "$CONFTMP"; then
 474         echo 'IncludeOptional conf-enabled/*.conf' >> "$CONFTMP"
 475     fi
 476     if ! egrep -iq "^[[:space:]]*IncludeOptional[[:space:]]+sites-enabled/\*\.conf$" "$CONFTMP"; then
 477         echo 'IncludeOptional sites-enabled/*.conf' >> "$CONFTMP"
 478     fi
 479
 480     if ! cmp -s "$CONFTMP" "$CONF"; then
 481         cp_mv "$CONFTMP" "$CONF"
 482         need_restart=1
 483     fi
 484     rm -f "$CONFTMP"
 485 fi
 486
 487 # Remove deprecated directives. Add default Mutex if not defined.
 488 #
 489 if [ -e "$CONF" ]; then
 490
 491     ( listconffiles "$CONF"; echo "$CONF" ) | while read -r a2cfile; do
 492
 493         a2cfiletmp=`mktemp $a2cfile.tmp.XXXXXX`
 494         temp_files="${temp_files} ${a2cfiletmp}"
 495         cp "$a2cfile" "$a2cfiletmp"
 496
 497         if egrep -iq "^[[:space:]]*NameVirtualHost[[:space:]]+" "$a2cfiletmp"; then
 498             cp_echo "CN: Removing deprecated NameVirtualHost from $a2cfile"
 499             sed -r -i '/^[[:space:]]*NameVirtualHost[[:space:]]+/Id' \
 500                 "$a2cfiletmp"
 501         fi
 502
 503         if egrep -iq "^[[:space:]]*SSLMutex[[:space:]]+" "$a2cfiletmp"; then
 504             cp_echo "CN: Removing deprecated SSLMutex from $a2cfile"
 505             sed -r -i '/^[[:space:]]*SSLMutex[[:space:]]+/Id' \
 506                 "$a2cfiletmp"
 507         fi
 508
 509         if [ "$a2cfile" = "$CONF" ]; then
 510             if ! egrep -iq "^[[:space:]]*Mutex[[:space:]]+" "$a2cfiletmp"; then
 511                 cp_echo "CN: Adding default Mutex to $a2cfile"
 512                 echo 'Mutex file:${APACHE_LOCK_DIR} default' >> "$a2cfiletmp"
 513             fi
 514         fi
 515
 516         if ! cmp -s "$a2cfiletmp" "$a2cfile"; then
 517             cp_mv "$a2cfiletmp" "$a2cfile"
 518             need_restart=1
 519         fi
 520         rm -f "$a2cfiletmp"
 521     done
 522 fi
 523
 524
 525 # Install CARNet specific configuration file.
 526 #
 527 install_conf carnet 000-carnet
 528
 529 # Enable SSL port (443).
 530 #
 531 listen_ssl
 532
 533 # Disable default site configuration.
 534 #
 535 if [ -e "$CONF" ]; then
 536     cp_echo "CN: Disabling default site configuration."
 537     a2dissite -m -f -q 000-default || true
 538     need_restart=1
 539 fi
 540
 541
 542 # Apache2 SSL certificate.
 543 #
 544 if [ -d "$CONFDIR/conf-enabled" ] && [ -n "$(ls -A $CONFDIR/conf-enabled/)" ]; then
 545     listen_ssl_mask=$CONFDIR/conf-enabled/*.conf
 546 fi
 547 if [ -d "$CONFDIR/sites-enabled" ] && [ -n "$(ls -A $CONFDIR/sites-enabled/)" ]; then
 548     listen_ssl_mask=$listen_ssl_mask" "$CONFDIR/sites-enabled/*.conf
 549 fi
 550
 551 for file in $CONF $listen_ssl_mask; do
 552     if [ -f "$file" ]; then
 553         if egrep -iq '^[[:space:]]*<VirtualHost .*443[[:space:]]*>' $file; then
 554             has_listen_ssl=1
 555             break
 556         fi
 557     fi
 558 done
 559
 560 if [ $has_listen_ssl -eq 0 ]; then
 561
 562     db_get apache2-cn/sslcf || true
 563     apache2_sslcf="$RET"
 564
 565     if [ -n "$apache2_sslcf" ]; then
 566
 567         db_get apache2-cn/sslckf || true
 568         apache2_sslckf="$RET"
 569
 570         db_get apache2-cn/sslccf || true
 571         apache2_sslccf="$RET"
 572
 573         need_restart=1
 574     else
 575
 576         # Generate new SSL certificate files.
 577         generate_ssl
 578
 579         apache2_sslcf=
 580         apache2_sslckf=
 581         apache2_sslccf=
 582     fi
 583 fi
 584
 585
 586 # Add VirtualHosts.
 587 # - on fresh install
 588 #
 589 if [ -z "$2" ]; then
 590
 591     db_get apache2-cn/wwwhost || true
 592     if [ "$RET" = "true" ]; then
 593
 594         # Add WWW VirtualHost.
 595         if [ -f "$CONFDIR/sites-available/000-$FQDN.conf" ]; then
 596             cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/000-$FQDN.conf
 597         fi
 598         if [ -f "$CONFDIR/sites-available/www.$DOMAIN.conf" ]; then
 599             cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/www.$DOMAIN.conf
 600         fi
 601
 602         chk_conf_tag "$CONFDIR/sites-available/000-$FQDN.conf"
 603         if [ ! -f "$CONFDIR/sites-available/000-$FQDN.conf" ] || [ $RET -eq 0 ]; then
 604             if egrep -qi "^[[:space:]]*NameVirtualHost[[:space:]]+\*:80$" "$PORTCONF"; then
 605                 install_vhost -d -r www.$DOMAIN default $FQDN 000-$FQDN
 606             else
 607                 install_vhost -nvh -d -r www.$DOMAIN default $FQDN 000-$FQDN
 608             fi
 609             need_restart=1
 610         fi
 611
 612         chk_conf_tag "$CONFDIR/sites-available/www.$DOMAIN.conf"
 613         if [ ! -f "$CONFDIR/sites-available/www.$DOMAIN.conf" ] || [ $RET -eq 0 ]; then
 614             install_vhost default www.$DOMAIN www.$DOMAIN
 615             need_restart=1
 616         fi
 617     else
 618
 619         # No WWW VirtualHost.
 620         if [ -f "$CONFDIR/sites-available/000-$FQDN.conf" ]; then
 621             cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/000-$FQDN.conf
 622         fi
 623
 624         chk_conf_tag "$CONFDIR/sites-available/000-$FQDN.conf"
 625         if [ ! -f "$CONFDIR/sites-available/000-$FQDN.conf" ] || [ $RET -eq 0 ]; then
 626             if egrep -qi "^[[:space:]]*NameVirtualHost[[:space:]]+\*:80$" "$PORTCONF"; then
 627                 install_vhost -d -r $FQDN default $FQDN 000-$FQDN
 628             else
 629                 install_vhost -nvh -d -r $FQDN default $FQDN 000-$FQDN
 630             fi
 631             need_restart=1
 632         fi
 633     fi
 634 fi
 635
 636
 637 # Add VirtualHost for SSL?
 638 #
 639 if [ $has_listen_ssl -eq 0 ]; then
 640
 641     if [ -f "$CONFDIR/sites-available/001-ssl.conf" ]; then
 642         cp_backup_conffile -d $BACKUPDIR/sites-available -p $CONFDIR/sites-available/001-ssl.conf
 643     fi
 644
 645     # No active SSL VirtualHosts found - add new one.
 646     chk_conf_tag "$CONFDIR/sites-available/001-ssl.conf"
 647     if [ ! -f "$CONFDIR/sites-available/001-ssl.conf" ] || [ $RET -eq 0 ]; then
 648
 649         db_get apache2-cn/wwwhost || true
 650         if [ "$RET" = "true" ]; then
 651             install_vhost -r www.$DOMAIN -n $HOST ssl ssl 001-ssl
 652         else
 653             install_vhost -r $FQDN -n $HOST ssl ssl 001-ssl
 654         fi
 655         need_restart=1
 656     fi
 657 fi
 658
 659
 660 # Check SSL certificates location for VirtualHosts.
 661 #
 662 if [ $has_listen_ssl -eq 0 ]; then
 663
 664     chk_conf_tag "${CONFDIR}/sites-available/001-ssl.conf"
 665     if [ $RET -eq 0 ] && [ -n "$apache2_sslcf" ]; then
 666
 667         SSLTMP=$(mktemp ${CONFDIR}/ssltmp.XXXXXX)
 668         temp_files="${temp_files} ${SSLTMP} ${SSLTMP}.cn-old"
 669         cp ${CONFDIR}/sites-available/001-ssl.conf $SSLTMP
 670
 671         # SSLCertificateFile
 672         cp_check_and_sed "^[[:space:]]*SSLCertificateFile \/etc\/ssl\/certs\/apache2\.pem" \
 673             "s#SSLCertificateFile /etc/ssl/certs/apache2.pem#SSLCertificateFile $apache2_sslcf #g" \
 674         $SSLTMP || true
 675
 676         # SSLCertificateKeyFile
 677         cp_check_and_sed "^[[:space:]]*SSLCertificateKeyFile \/etc\/ssl\/private\/apache2\.key" \
 678             "s#SSLCertificateKeyFile /etc/ssl/private/apache2.key#SSLCertificateKeyFile $apache2_sslckf #g" \
 679         $SSLTMP || true
 680
 681         # SSLCertificateChainFile
 682         if [ -n "$apache2_sslccf" ]; then
 683             cp_check_and_sed "^[[:space:]]*# SSLCertificateChainFile \/etc\/ssl\/certs\/(sureserverEDU|cert-chain)\.pem" \
 684                 "s#\# SSLCertificateChainFile /etc/ssl/certs/\(sureserverEDU\|cert-chain\).pem#SSLCertificateChainFile $apache2_sslccf #g" \
 685             $SSLTMP || true
 686         fi
 687
 688         cp_mv $SSLTMP ${CONFDIR}/sites-available/001-ssl.conf
 689
 690         need_restart=1
 691
 692         # Just to be sure.
 693         [ -e "${SSLTMP}" ] && rm -f ${SSLTMP}
 694         [ -e "${SSLTMP}.cn-old" ] && rm -f ${SSLTMP}.cn-old
 695     fi
 696 fi
 697
 698
 699 # Check file access permissions for SSL certificates.
 700 #
 701 cp_echo "CN: Checking file access permissions for Apache2 SSL certificates."
 702 sslkey=/etc/ssl/private
 703 sslcerts="${sslkey}/ca.key ${sslkey}/apache2-ca.key ${sslkey}/apache2.key"
 704 for certf in $sslcerts; do
 705     if [ -f "$certf" ]; then
 706         chmod 600 $certf
 707     fi
 708 done
 709
 710
 711 # Check and remove obsolete "Include /etc/apache2/sites-enabled/[^.#]*" from
 712 # /etc/apache2/apache2.conf.
 713 #
 714 if egrep -iq "^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/\[\^\.\#\]\*$" "$CONF"; then
 715
 716     cp_echo "CN: Fixing obsolete Include line in $CONF."
 717     CONFTMP=`mktemp $CONF.tmp.XXXXXX`
 718     temp_files="${temp_files} ${CONFTMP}"
 719
 720     sed -r "/^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/\[\^\.\#\]\*$/Id" \
 721         "$CONF" > "$CONFTMP"
 722
 723     if ! egrep -iq "^[[:space:]]*Include[[:space:]]+\/etc\/apache2\/sites-enabled\/$" "$CONFTMP"; then
 724         echo "Include /etc/apache2/sites-enabled/" >> "$CONFTMP"
 725     fi
 726
 727     cp_mv "$CONFTMP" "$CONF"
 728     need_restart=1
 729 fi
 730
 731
 732 db_stop || true
 733
 734
 735 # Remove old AOSI configuration for Apache: aosi-www.conf, aosi.conf.
 736 #
 737 if [ -e "$CONFDIR/conf.d/aosi-www.conf" ] || [ -e "$CONFDIR/conf.d/aosi.conf" ]; then
 738     cp_echo "CN: Removing old AOSI configuration files for Apache2."
 739     rm -f $CONFDIR/conf.d/aosi-www.conf
 740     rm -f $CONFDIR/conf.d/aosi.conf
 741     need_restart=1
 742 fi
 743
 744
 745 # Restart Apache2 web server if needed.
 746 #
 747 if [ $need_restart -eq 1 ]; then
 748
 749     # Check Apache2 web server configuration.
 750     if apache2ctl configtest 2>/dev/null; then
 751
 752         # Restart Apache2 web server.
 753         service apache2 reload || true
 754     else
 755
 756         # Something is broken.
 757         cp_echo "CN: Your Apache2 configuration seems to be broken."
 758         cp_echo "CN: Please, check the service after the installation finishes!"
 759     fi
 760 fi
 761
 762
 763 # Mail root
 764 #
 765 cp_mail "$PKG"
 766
 767
 768 # (re)generate monit.d files if monit-cn is installed.
 769 #
 770 if [ -x "/usr/sbin/update-monit.d" ]; then
 771     cp_echo "CN: Updating monit configuration..."
 772     update-monit.d || true
 773 fi
 774
 775 #DEBHELPER#
 776
 777 exit 0