From bdfb967ca2f9d75791a2da2bb189d63df33638cc Mon Sep 17 00:00:00 2001 From: nodiscc Date: Fri, 20 Apr 2018 23:16:59 +0200 Subject: Improve documentation (#598, #1105) * rework/simplify server configuration/requirements pages (consolidate/simplify SSL/TLS/apache configuration) * update index.md introduction * remove external images (badges) * Fix COPYING link and documentation links * Update features list * dedpulicate information * remove server-requirements.md and move relevant doc to other files * TODO: rework nginx configuration (single configuration example, with commented out blocks for special cases) * TODO: consolidate download/install/configuration pages * remove blank lighttpd configuration section * remove Required? column for composer packages, all libraries are mandatory * php 7.2 compatibilty * clarify that certbot binary and paths may vary depending on install method --- doc/md/Server-configuration.md | 211 +++++++++++++++++++++++------------------ 1 file changed, 119 insertions(+), 92 deletions(-) (limited to 'doc/md/Server-configuration.md') diff --git a/doc/md/Server-configuration.md b/doc/md/Server-configuration.md index 25dd49fe..ca82b2ec 100644 --- a/doc/md/Server-configuration.md +++ b/doc/md/Server-configuration.md @@ -1,139 +1,130 @@ -*Example virtual host configurations for popular web servers* +- [Prerequisites](#prerequisistes) - [Apache](#apache) - [Nginx](#nginx) +- [Proxies](#proxies) +- [See also](#see-also) ## Prerequisites ### Shaarli -- Shaarli is installed in a directory readable/writeable by the user -- the correct read/write permissions have been granted to the web server _user and/or group_ -- for HTTPS / SSL: - - a key pair (public, private) and a certificate have been generated - - the appropriate server SSL extension is installed and active -### HTTPS, TLS and self-signed certificates -Related guides: +- A web server and PHP interpreter module/service have been installed. +- You have write access to the Shaarli installation directory. +- The correct read/write permissions have been granted to the web server user and group. +- Your PHP interpreter is compatible with supported PHP versions: -- [How to Create Self-Signed SSL Certificates with OpenSSL](http://www.xenocafe.com/tutorials/linux/centos/openssl/self_signed_certificates/index.php) -- [How do I create my own Certificate Authority?](https://workaround.org/certificate-authority) -- Generate a self-signed certificate (will trigger browser warnings) with apache2: - `make-ssl-cert generate-default-snakeoil --force-overwrite` will create `/etc/ssl/certs/ssl-cert-snakeoil.pem` and `/etc/ssl/private/ssl-cert-snakeoil.key` +Version | Status | Shaarli compatibility +:---:|:---:|:---: +7.2 | Supported | Yes +7.1 | Supported | Yes +7.0 | Supported | Yes +5.6 | Supported | Yes +5.5 | EOL: 2016-07-10 | Yes +5.4 | EOL: 2015-09-14 | Yes (up to Shaarli 0.8.x) +5.3 | EOL: 2014-08-14 | Yes (up to Shaarli 0.8.x) -### Proxies -If Shaarli is served behind a proxy (i.e. there is a proxy server between clients and the web server hosting Shaarli), please refer to the proxy server documentation for proper configuration. In particular, you have to ensure that the following server variables are properly set: +- The following PHP extensions are installed on the server: -- `X-Forwarded-Proto` -- `X-Forwarded-Host` -- `X-Forwarded-For` +Extension | Required? | Usage +---|:---:|--- +[`openssl`](http://php.net/manual/en/book.openssl.php) | All | OpenSSL, HTTPS +[`php-mbstring`](http://php.net/manual/en/book.mbstring.php) | CentOS, Fedora, RHEL, Windows, some hosting providers | multibyte (Unicode) string support +[`php-gd`](http://php.net/manual/en/book.image.php) | optional | thumbnail resizing +[`php-intl`](http://php.net/manual/en/book.intl.php) | optional | localized text sorting (e.g. `e->è->f`) +[`php-curl`](http://php.net/manual/en/book.curl.php) | optional | using cURL for fetching webpages and thumbnails in a more robust way +[`php-gettext`](http://php.net/manual/en/book.gettext.php) | optional | Use the translation system in gettext mode (faster) -See also [proxy-related](https://github.com/shaarli/Shaarli/issues?utf8=%E2%9C%93&q=label%3Aproxy+) issues. +-------------------------------------------------------------------------------- -## Apache -### Minimal -```apache - - ServerName shaarli.my-domain.org - DocumentRoot /absolute/path/to/shaarli/ - -``` -### Debug - Log all the things! -This configuration will log both Apache and PHP errors, which may prove useful to identify server configuration errors. +### SSL/TLS configuration -See: +To setup HTTPS / SSL on your webserver (recommended), you must generate a public/private **key pair** and a **certificate**, and install, configure and activate the appropriate **webserver SSL extension**. -- [Apache/PHP - error log per VirtualHost](http://stackoverflow.com/q/176) (StackOverflow) -- [PHP: php_value vs php_admin_value and the use of php_flag explained](https://ma.ttias.be/php-php_value-vs-php_admin_value-and-the-use-of-php_flag-explained/) +#### Let's Encrypt -```apache - - ServerName shaarli.my-domain.org - DocumentRoot /absolute/path/to/shaarli/ +[Let's Encrypt](https://en.wikipedia.org/wiki/Let%27s_Encrypt) is a certificate authority that provides free TLS/X.509 certificates via an automated process. - LogLevel warn - ErrorLog /var/log/apache2/shaarli-error.log - CustomLog /var/log/apache2/shaarli-access.log combined + * Install `certbot` using the appropriate method described on https://certbot.eff.org/. + +Location of the `certbot` program and template configuration files may vary depending on which installation method was used. Change the file paths below accordingly. Here is an easy way to create a signed certificate using `certbot`, it assumes `certbot` was installed through APT on a Debian-based distribution: - php_flag log_errors on - php_flag display_errors on - php_value error_reporting 2147483647 - php_value error_log /var/log/apache2/shaarli-php-error.log - -``` + * Stop the apache2/nginx service. + * Run `certbot --agree-tos --standalone --preferred-challenges tls-sni --email "youremail@example.com" --domain yourdomain.example.com` + * For the Apache webserver, copy `/usr/lib/python2.7/dist-packages/certbot_apache/options-ssl-apache.conf` to `/etc/letsencrypt/options-ssl-apache.conf` (paths may vary depending on installation method) + * For Nginx: TODO + * Setup your webserver as described below + * Restart the apache2/nginx service. + +#### Self-signed certificates + +If you don't want to request a certificate from Let's Encrypt, or are unable to (for example, webserver on a LAN, or domain name not registered in the public DNS system), you can generate a self-signed certificate. This certificate will trigger security warnings in web browsers, unless you add it to the browser's SSL store manually. + +* Apache: run `make-ssl-cert generate-default-snakeoil --force-overwrite` +* Nginx: TODO + +-------------------------------------------------------------------------------- + +## Apache + +Here is a basic configuration example for the Apache web server with `mod_php`. + +In `/etc/apache2/sites-available/shaarli.conf`: -### Standard - Keep access and error logs ```apache - + ServerName shaarli.my-domain.org DocumentRoot /absolute/path/to/shaarli/ + # Logging + # Possible values include: debug, info, notice, warn, error, crit, alert, emerg. LogLevel warn ErrorLog /var/log/apache2/shaarli-error.log CustomLog /var/log/apache2/shaarli-access.log combined - -``` -### Paranoid - Redirect HTTP (:80) to HTTPS (:443) -See [Server-side TLS](https://wiki.mozilla.org/Security/Server_Side_TLS#Apache) (Mozilla). + # Let's Encrypt SSL configuration (recommended) + SSLEngine on + SSLCertificateFile /etc/letsencrypt/live/yourdomain.example.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.example.com/privkey.pem + Include /etc/letsencrypt/options-ssl-apache.conf -```apache - - ServerName shaarli.my-domain.org - DocumentRoot /absolute/path/to/shaarli/ + # Self-signed SSL cert configuration + #SSLEngine on + #SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem + #SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key - SSLEngine on - SSLCertificateFile /absolute/path/to/the/website/certificate.pem - SSLCertificateKeyFile /absolute/path/to/the/website/key.key + # Optional, log PHP errors, useful for debugging + #php_flag log_errors on + #php_flag display_errors on + #php_value error_reporting 2147483647 + #php_value error_log /var/log/apache2/shaarli-php-error.log + #Required for .htaccess support AllowOverride All - Options Indexes FollowSymLinks MultiViews Order allow,deny - allow from all - + Allow from all - LogLevel warn - ErrorLog /var/log/apache2/shaarli-error.log - CustomLog /var/log/apache2/shaarli-access.log combined - - - ServerName shaarli.my-domain.org - Redirect 301 / https://shaarli.my-domain.org + Options Indexes FollowSymLinks MultiViews #TODO is Indexes/Multiviews required? + + # Optional - required for playvideos plugin + #Header set Content-Security-Policy "script-src 'self' 'unsafe-inline' https://www.youtube.com https://s.ytimg.com 'unsafe-eval'" + - LogLevel warn - ErrorLog /var/log/apache2/shaarli-error.log - CustomLog /var/log/apache2/shaarli-access.log combined ``` -### .htaccess +Enable this configuration with `sudo a2ensite shaarli` -Shaarli use `.htaccess` Apache files to deny access to files that shouldn't be directly accessed (datastore, config, etc.). You need the directive `AllowOverride All` in your virtual host configuration for them to work. +_Note: If you use Apache 2.2 or lower, you need [mod_version](https://httpd.apache.org/docs/current/mod/mod_version.html) to be installed and enabled._ -**Warning**: If you use Apache 2.2 or lower, you need [mod_version](https://httpd.apache.org/docs/current/mod/mod_version.html) to be installed and enabled. - -Apache module `mod_rewrite` **must** be enabled to use the REST API. URL rewriting rules for the Slim microframework are stated in the root `.htaccess` file. +_Note: Apache module `mod_rewrite` must be enabled to use the REST API._ -## LightHttpd ## Nginx -### Foreword -Nginx does not natively interpret PHP scripts; to this effect, we will run a [FastCGI](https://en.wikipedia.org/wiki/FastCGI) service, to which Nginx's FastCGI module will proxy all requests to PHP resources. - -Required packages: -- [nginx](http://nginx.org) -- [php-fpm](http://php-fpm.org) - PHP FastCGI Process Manager +Here is a basic configuration example for the Nginx web server, using the [php-fpm](http://php-fpm.org) PHP FastCGI Process Manager, and Nginx's [FastCGI](https://en.wikipedia.org/wiki/FastCGI) module. -Official documentation: - -- [Beginner's guide](http://nginx.org/en/docs/beginners_guide.html) -- [ngx_http_fastcgi_module](http://nginx.org/en/docs/http/ngx_http_fastcgi_module.html) -- [Pitfalls](http://wiki.nginx.org/Pitfalls) - -Community resources: - -- [Server-side TLS (Nginx)](https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx) (Mozilla) -- [PHP configuration examples](http://kbeezie.com/nginx-configuration-examples/) (Karl Blessing) + ### Common setup Once Nginx and PHP-FPM are installed, we need to ensure: @@ -404,3 +395,39 @@ http { } } ``` + +## Proxies +If Shaarli is served behind a proxy (i.e. there is a proxy server between clients and the web server hosting Shaarli), please refer to the proxy server documentation for proper configuration. In particular, you have to ensure that the following server variables are properly set: + +- `X-Forwarded-Proto` +- `X-Forwarded-Host` +- `X-Forwarded-For` + +See also [proxy-related](https://github.com/shaarli/Shaarli/issues?utf8=%E2%9C%93&q=label%3Aproxy+) issues. + + +## See also + + * [Server security](Server-security.md) + +#### Webservers + +- [Apache/PHP - error log per VirtualHost](http://stackoverflow.com/q/176) (StackOverflow) +- [Apache - PHP: php_value vs php_admin_value and the use of php_flag explained](https://ma.ttias.be/php-php_value-vs-php_admin_value-and-the-use-of-php_flag-explained/) +- [Server-side TLS (Apache)](https://wiki.mozilla.org/Security/Server_Side_TLS#Apache) (Mozilla) +- [Nginx Beginner's guide](http://nginx.org/en/docs/beginners_guide.html) +- [Nginx ngx_http_fastcgi_module](http://nginx.org/en/docs/http/ngx_http_fastcgi_module.html) +- [Nginx Pitfalls](http://wiki.nginx.org/Pitfalls) +- [Nginx PHP configuration examples](http://kbeezie.com/nginx-configuration-examples/) (Karl Blessing) +- [Server-side TLS (Nginx)](https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx) (Mozilla) +- [How to Create Self-Signed SSL Certificates with OpenSSL](http://www.xenocafe.com/tutorials/linux/centos/openssl/self_signed_certificates/index.php) +- [How do I create my own Certificate Authority?](https://workaround.org/certificate-authority) + +#### PHP + +- [Travis configuration](https://github.com/shaarli/Shaarli/blob/master/.travis.yml) +- [PHP: Supported versions](http://php.net/supported-versions.php) +- [PHP: Unsupported versions](http://php.net/eol.php) _(EOL - End Of Life)_ +- [PHP 7 Changelog](http://php.net/ChangeLog-7.php) +- [PHP 5 Changelog](http://php.net/ChangeLog-5.php) +- [PHP: Bugs](https://bugs.php.net/) -- cgit v1.2.3 From 787faa42f3a2bcbf83a7853f23f3667a6febf9da Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Fri, 6 Apr 2018 18:21:47 +0200 Subject: Take code review into account Upgrade web-thumbnailer and display thumbs right after download --- doc/md/Server-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'doc/md/Server-configuration.md') diff --git a/doc/md/Server-configuration.md b/doc/md/Server-configuration.md index ca82b2ec..e281dc85 100644 --- a/doc/md/Server-configuration.md +++ b/doc/md/Server-configuration.md @@ -29,7 +29,7 @@ Extension | Required? | Usage ---|:---:|--- [`openssl`](http://php.net/manual/en/book.openssl.php) | All | OpenSSL, HTTPS [`php-mbstring`](http://php.net/manual/en/book.mbstring.php) | CentOS, Fedora, RHEL, Windows, some hosting providers | multibyte (Unicode) string support -[`php-gd`](http://php.net/manual/en/book.image.php) | optional | thumbnail resizing +[`php-gd`](http://php.net/manual/en/book.image.php) | optional | required to use thumbnails [`php-intl`](http://php.net/manual/en/book.intl.php) | optional | localized text sorting (e.g. `e->è->f`) [`php-curl`](http://php.net/manual/en/book.curl.php) | optional | using cURL for fetching webpages and thumbnails in a more robust way [`php-gettext`](http://php.net/manual/en/book.gettext.php) | optional | Use the translation system in gettext mode (faster) -- cgit v1.2.3 From 6c44d604a1ee0360a2eaf24b9cac18ca95edcb5f Mon Sep 17 00:00:00 2001 From: nodiscc Date: Thu, 30 Aug 2018 20:03:00 +0200 Subject: doc: server config: basic usage of robots.txt/HTML robots meta-tag/crawler control mechanisms --- doc/md/Server-configuration.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'doc/md/Server-configuration.md') diff --git a/doc/md/Server-configuration.md b/doc/md/Server-configuration.md index e281dc85..cf44ecf5 100644 --- a/doc/md/Server-configuration.md +++ b/doc/md/Server-configuration.md @@ -397,6 +397,7 @@ http { ``` ## Proxies + If Shaarli is served behind a proxy (i.e. there is a proxy server between clients and the web server hosting Shaarli), please refer to the proxy server documentation for proper configuration. In particular, you have to ensure that the following server variables are properly set: - `X-Forwarded-Proto` @@ -405,6 +406,12 @@ If Shaarli is served behind a proxy (i.e. there is a proxy server between client See also [proxy-related](https://github.com/shaarli/Shaarli/issues?utf8=%E2%9C%93&q=label%3Aproxy+) issues. +## Robots and crawlers + +Shaarli disallows indexing and crawling of your local documentation pages by search engines, using `` HTML tags. +Your Shaarli instance and other pages you host may still be indexed by various robots on the public Internet. +You may want to setup a robots.txt file or other crawler control mechanism on your server. +See [[1]](https://en.wikipedia.org/wiki/Robots_exclusion_standard), [[2]](https://support.google.com/webmasters/answer/6062608?hl=en) and [[3]](https://developers.google.com/search/reference/robots_meta_tag) ## See also -- cgit v1.2.3 From 7062ef4ddd1864f0d5eaff7146de54ea1fd9fe1e Mon Sep 17 00:00:00 2001 From: nodiscc Date: Sun, 9 Dec 2018 14:40:04 +0000 Subject: doc: update PHP compatibility table Ref https://github.com/shaarli/Shaarli/issues/1249 --- doc/md/Server-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'doc/md/Server-configuration.md') diff --git a/doc/md/Server-configuration.md b/doc/md/Server-configuration.md index cf44ecf5..78083a46 100644 --- a/doc/md/Server-configuration.md +++ b/doc/md/Server-configuration.md @@ -18,7 +18,7 @@ Version | Status | Shaarli compatibility 7.2 | Supported | Yes 7.1 | Supported | Yes 7.0 | Supported | Yes -5.6 | Supported | Yes +5.6 | EOL: 2018-12-31 | Yes (up to Shaarli 0.10.x) 5.5 | EOL: 2016-07-10 | Yes 5.4 | EOL: 2015-09-14 | Yes (up to Shaarli 0.8.x) 5.3 | EOL: 2014-08-14 | Yes (up to Shaarli 0.8.x) -- cgit v1.2.3