iankelling.org Git - distro-setup/blob - disabled/phabricator-setup

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16
  17
  18 # Automated phabricator setup. Not currently using it,
  19 # but it worked last time I tried it.
  20
  21 if [[ -s ~/.bashrc ]];then . ~/.bashrc;fi
  22
  23 set -x
  24
  25
  26 # lj is test server
  27 case $HOSTNAME in
  28     lj)
  29         domain=phab.iank.bid
  30         alt_domain=fastmail.wiki
  31         ;;
  32     lk)
  33         domain=phab.iankelling.org
  34         alt_domain=iankellingusercontent.org
  35         ;;
  36 esac
  37
  38
  39 pass=`cat /p/c/machine_specific/$HOSTNAME/phabricator_admin`
  40 webroot=/usr/share/phabricator/webroot
  41 user=iank
  42 name="Ian Kelling"
  43 email=ian@iankelling.org
  44 ssh_port=222
  45
  46 fbin() { bin=$1; shift; sudo /usr/share/phabricator/bin/$bin "$@"; }
  47 fsetd() { fbin config set --database "$@"; }
  48
  49 # phabricator complained about wanting arcanist first
  50 pi arcanist/unstable mercurial
  51
  52 # duplicated in mediawiki setup. todo fix that.
  53 s DEBIAN_FRONTEND=noninteractive pi mysql-server
  54 cd  # mysql_secure_installation writes some temp files to the current dir,
  55 # so we need to make sure it's writable.
  56 if echo exit|mysql -u root -p"$dbpass"; then
  57     echo -e "$dbpass\nn\n\n\n\n" | mysql_secure_installation
  58 else
  59     echo -e "\n\n$dbpass\n$dbpass\n\n\n\n\n" | mysql_secure_installation
  60 fi
  61
  62 mysql -u root -p$dbpass <<EOF
  63 grant all privileges on \`phabricator\\_%\`.* to 'phabricator'@localhost identified by '$pass';
  64 EOF
  65
  66 phab-sel() {
  67     s debconf-set-selections<<EOF
  68 phabricator     phabricator/pwd_check   password        $pass
  69 phabricator     phabricator/phabricator_mysql_pwd       password        $pass
  70 phabricator     phabricator/webserver   select  None
  71 phabricator     phabricator/phabricator_mysql_user      string  phabricator
  72 phabricator     phabricator/mysql_host  string  localhost
  73 # Domain name or subdomain name used by phabricator:
  74 phabricator     phabricator/domain_name string  $domain
  75 EOF
  76 }
  77 phab-sel
  78
  79 pi phabricator/unstable
  80
  81 # debian sets http, but we want https
  82 s sed -i --follow-symlinks 's/http:/https:/' /usr/share/phabricator/conf/local/local.json
  83
  84
  85 acme-tiny-wrapper $domain
  86 acme-tiny-wrapper $alt_domain
  87
  88 for x in $domain $alt_domain; do
  89     web-conf -r $webroot - $x <<EOF
  90 RewriteEngine on
  91 RewriteRule ^/rsrc/(.*)     -                       [L,QSA]
  92 RewriteRule ^/favicon.ico   -                       [L,QSA]
  93 RewriteRule ^/php5-fcgi     -                       [L]
  94 RewriteRule ^(.*)\$          /index.php?__path__=\$1  [B,L,QSA]
  95 <Directory "$webroot">
  96     Require all granted
  97 </Directory>
  98 EOF
  99 done
 100
 101
 102 # Before I figured out how to setup the admin in the script,
 103 # this would limit the site to localhost,
 104 # and access it through an ssh tunnel until its secure.
 105 #phab-site -p 127.0.0.1:443
 106
 107 # settings are stored in conf/local/local.json.
 108 # some settings could also be stored in the database with
 109 # --database arg. database has higher priority than
 110 # the config file.
 111
 112 # if you need to restart phabricator, just ser restart apache2
 113 # https://secure.phabricator.com/book/phabricator/article/restarting/
 114
 115 # to reset things, you can do.
 116 # fbin storage destroy; pu phabricator; phab-sel; pi phabricator/unstable
 117 # # but under debian, prolly better to purge, cause db gets created on install
 118
 119
 120 # On first run went to the website, registered manually, then
 121 # went through the gui setup items to get the configuration below.
 122
 123
 124 #expect "*"
 125 #sleep 1
 126
 127 # expect's exits with 0 by default on timeout of an expect command.
 128 # You can modify this, but it was simpler to use an irregular code to detect
 129 # actual success.
 130 sudo expect -d <<EOF
 131 # The expect lines use shell type globbing. They are not actually
 132 # needed, but they make the script likely to fail if the questions
 133 # content changes drastically, and make the script self documenting.
 134
 135 # adds a short delay after each send for more reliable operation
 136 # (reference: comment in any autoexpect generated script)
 137 set force_conservative 0
 138 spawn "/usr/share/phabricator/bin/accountadmin"
 139 # If we've already set our user, detect different prompt and exit
 140 # expect basics: when the last alternative matches, there is no need
 141 # to specify an action, we just continue.
 142 expect {
 143   timeout {exit 1}
 144   -nocase "enter a username" exit
 145   -nocase "y/n"
 146 }
 147 send "y\r"
 148 expect -nocase timeout {exit 1} "username"
 149 send "$user\r"
 150 expect -nocase timeout {exit 1} "create*y/n"
 151 send "y\r"
 152 expect -nocase timeout {exit 1} "name"
 153 send "$name\r"
 154 expect -nocase timeout {exit 1} "email"
 155 send "$email\r"
 156 expect -nocase timeout {exit 1} "password"
 157 send "$pass\r"
 158 expect -nocase timeout {exit 1} "bot"
 159 send "n\r"
 160 expect -nocase timeout {exit 1} "admin"
 161 send "y\r"
 162 expect -nocase timeout {exit 1} "save"
 163 send "y\r"
 164 expect eof
 165 exit
 166 EOF
 167
 168
 169
 170 # this tipped me over to using a debian package
 171 # https://secure.phabricator.com/T4181
 172
 173 fsetd auth.require-approval false
 174
 175 # phabricator recommends going from 16 to at least 32
 176 sudo sed -ri 's/(^\s*max_allowed_packet)[[:space:]=].*/\1 = 100M/' /etc/mysql/my.cnf
 177
 178
 179 setini() {
 180     key="$1" value="$2" section="$3" file="$4"
 181     sudo sed -ri "/ *\[$section\]/,/^ *\[[^]]+\]/{/^\s*$key[[:space:]=]/d};/ *\[$section\]/a $key = $value" "$file"
 182 }
 183
 184 setd() { setini "$@" mysqld /etc/mysql/my.cnf; }
 185
 186 # error instead of data corruption:
 187 setd sql_mode STRICT_ALL_TABLES
 188 setd ft_stopword_file /usr/share/phabricator/resources/sql/stopwords.txt
 189 setd ft_min_word_len 3
 190 # mysql full text search for word1 word2 will and them instead of or them:
 191 setd ft_boolean_syntax "' |-><()~*:\"\"&^'"
 192 # default is 128M. recommended starting point is 40% of ram.
 193 setd innodb_buffer_pool_size 1600M
 194
 195 # this files stopwork, and min_word_len
 196 mysql -u root -p$dbpass <<'EOF'
 197 REPAIR TABLE phabricator_search.search_documentfield;
 198 EOF
 199
 200 fsetd pygments.enabled true
 201 fbin config set security.alternate-file-domain https://$alt_domain
 202
 203 setini opcache.validate_timestamps '"0"' opcache /etc/php5/apache2/php.ini
 204 setini post_max_size 100M PHP /etc/php5/apache2/php.ini
 205
 206 fsetd metamta.default-address phabricator@$domain
 207 fsetd metamta.domain $domain
 208
 209
 210 ser restart mysql
 211
 212 # Not sure if this is needed. while developing this script, mysql went down
 213 # for a bit and the daemons died.
 214
 215
 216 # todo, setup inbound email:
 217 # https://secure.phabricator.com/book/phabricator/article/configuring_inbound_email/
 218
 219
 220 # https://secure.phabricator.com/book/phabricator/article/diffusion_hosting/
 221 # unmatchable password, allows login only via ssh, sudo, etc.
 222 # this is standard.
 223 # I tried having no home dir, (-d /nonexistent),
 224 # but I got an error message on test sshing,
 225 sudo useradd -p '*' -m --system -s /bin/sh vcs ||  [[ $? == 9 ]]
 226
 227 # you'd think the debian package would set this. todo: check on a fresh
 228 # machine
 229 fbin config set phd.user phabricator
 230 fbin config set diffusion.ssh-user vcs
 231
 232 option="ALL=(phabricator) SETENV: NOPASSWD:"
 233 www_files=$(which git hg|sed ':a;N;s/\n/, /;ta')
 234 vcs_files=$(which git git-upload-pack git-receive-pack hg|sed ':a;N;s/\n/, /;ta')
 235 [[ $www_files && $vcs_files ]] || exit 1
 236 www_files="$www_files, /usr/lib/git-core/git-http-backend"
 237 sudo dd of=/etc/sudoers.d/phabricator <<EOF
 238 www-data $option $www_files
 239 vcs $option $vcs_files
 240 EOF
 241
 242 # Found this due to red x in the ui after setting up a test repo.
 243 # todo: debian package should do this for us. see also:
 244 # https://phab.iank.bid/config/edit/environment.append-paths/
 245 sudo lnf /usr/lib/git-core/git-http-backend /usr/share/phabricator/support/bin
 246
 247 fbin config set diffusion.allow-http-auth true
 248
 249 # couldn't find a really appropriate place for it. It needs parent dir
 250 # permissions to be root:root.
 251 file=/usr/share/phabricator-local-ssh-hook.sh
 252 # from /usr/share/phabricator/resources/sshd/phabricator-ssh-hook.sh
 253 sudo dd of=$file <<'EOF'
 254 #!/bin/sh
 255 # For debugging, you can temporarily do:
 256 # exec >/tmp/plog 2>&1
 257 # This script executes as the vcs user
 258 if [ "$1" != vcs ]; then exit 1; fi
 259 exec "/usr/share/phabricator/bin/ssh-auth" $@
 260 EOF
 261 sudo chmod 755 $file
 262
 263 sudo dd of=/etc/ssh/sshd_config.phabricator <<EOF
 264 AuthorizedKeysCommand $file
 265 AuthorizedKeysCommandUser vcs
 266 AllowUsers vcs
 267
 268 Port $ssh_port
 269 Protocol 2
 270 PermitRootLogin no
 271 AllowAgentForwarding no
 272 AllowTcpForwarding no
 273 PrintMotd no
 274 PrintLastLog no
 275 PasswordAuthentication no
 276 AuthorizedKeysFile none
 277
 278 PidFile /var/run/sshd-phabricator.pid
 279 EOF
 280
 281 sudo dd of=/etc/systemd/system/phabricator-ssh.service <<'EOF'
 282 [Unit]
 283 Description=OpenBSD Secure Shell server for phabricator repos
 284 After=network.target auditd.service
 285 ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
 286
 287 [Service]
 288 ExecStart=/usr/sbin/sshd -f /etc/ssh/sshd_config.phabricator
 289 ExecReload=/bin/kill -HUP $MAINPID
 290 KillMode=process
 291 Restart=on-failure
 292
 293 [Install]
 294 WantedBy=multi-user.target
 295 EOF
 296
 297 sudo systemctl daemon-reload
 298
 299 # got this error upon ssh, figured out a solution.
 300 # [2016-06-10 06:40:15] EXCEPTION: (AphrontInvalidCredentialsQueryException) #1045: Access denied for user 'root'@'localhost' (using password: NO) at [<phutil>/src/aphront/storage/connection/mysql/AphrontBaseMySQLDatabaseConnection.php:306]
 301 # arcanist(), phabricator(), phutil()
 302
 303 s usermod -a -G vcs www-data
 304 s usermod -a -G vcs iank
 305 s usermod -a -G vcs phabricator
 306 s chown root:vcs /usr/share/phabricator/conf/local/local.json
 307 fbin config set diffusion.ssh-port $ssh_port
 308
 309 fsetd policy.allow-public true
 310
 311 sgo phabricator-ssh
 312
 313 ser restart apache2
 314 sgo phabricator
 315
 316
 317 # todo, finish next steps here:
 318 # notably, backup/restore
 319 # https://secure.phabricator.com/book/phabricator/article/configuration_guide/
 320
 321
 322 fbin auth recover iank
 323
 324 cat <<EOF
 325 # go to link above, then
 326 # https://$domain/auth/config/new/
 327 # and add username/pass auth provider.
 328 EOF
 329
 330
 331
 332 # beginnings of automating those last manual steps:
 333
 334
 335 # for setting the auto provider, we can use the api.
 336 #arc set-config default https://$domain
 337 #
 338 # but first we have to generate an api key by getting
 339 # https://phab.iank.bid/conduit/login/
 340 # to do that, we've got to login to the url login.
 341 # We've got to post to a url on the login page,
 342 # then record 2 cookies: phuser and phsid
 343 # It also does a 302 for us to do 2 more pages related to auth/login.
 344
 345 # we need to post to the right url (didn't record it, with these params)
 346 #allowLogin:"1"
 347 #allowRegistration:"1"
 348 #allowLink:"1"
 349 #allowUnlink:"1"
 350
 351
 352 #Serve over HTTP
 353 #
 354 #
 355 # phabricator/ $ ./bin/repository edit rT --as iank --local-path ...
 356
 357 #