100 lines
3.7 KiB
Bash
100 lines
3.7 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update
|
|
apt-get install -y nginx php5-fpm php5-cli php5-curl git php5-dev libleveldb-dev
|
|
cd /usr/local/src
|
|
git clone https://github.com/reeze/php-leveldb.git
|
|
cd php-leveldb
|
|
phpize
|
|
./configure
|
|
make
|
|
make install
|
|
cp /opt/app/leveldb.ini /etc/php5/mods-available
|
|
php5enmod leveldb
|
|
unlink /etc/nginx/sites-enabled/default
|
|
cat > /etc/nginx/sites-available/sandstorm-php <<EOF
|
|
server {
|
|
listen 8000 default_server;
|
|
listen [::]:8000 default_server ipv6only=on;
|
|
|
|
# Allow arbitrarily large bodies - Sandstorm can handle them, and requests
|
|
# are authenticated already, so there's no reason for apps to add additional
|
|
# limits by default.
|
|
client_max_body_size 0;
|
|
|
|
server_name localhost;
|
|
root /opt/app/dokuwiki;
|
|
index doku.php;
|
|
location ~ /(data/|conf/|bin/|inc/|install.php) { deny all; }
|
|
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
|
|
expires 31536000s;
|
|
add_header Pragma "public";
|
|
add_header Cache-Control "max-age=31536000, public, must-revalidate, proxy-revalidate";
|
|
log_not_found off;
|
|
}
|
|
location / {
|
|
try_files \$uri \$uri/ @dokuwiki;
|
|
}
|
|
location @dokuwiki {
|
|
rewrite ^/_media/(.*) /lib/exe/fetch.php?media=\$1 last;
|
|
rewrite ^/_detail/(.*) /lib/exe/detail.php?media=\$1 last;
|
|
rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_\$1&id=\$2 last;
|
|
rewrite ^/(.*) /doku.php?id=\$1&\$args last;
|
|
}
|
|
location ~ \\.php\$ {
|
|
if (!-f \$request_filename) { return 404; }
|
|
include fastcgi_params;
|
|
fastcgi_pass unix:/var/run/php5-fpm.sock;
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
|
|
}
|
|
}
|
|
EOF
|
|
ln -s /etc/nginx/sites-available/sandstorm-php /etc/nginx/sites-enabled/sandstorm-php
|
|
service nginx stop
|
|
service php5-fpm stop
|
|
systemctl disable nginx
|
|
systemctl disable php5-fpm
|
|
# patch /etc/php5/fpm/pool.d/www.conf to not change uid/gid to www-data
|
|
sed --in-place='' \
|
|
--expression='s/^listen.owner = www-data/#listen.owner = www-data/' \
|
|
--expression='s/^listen.group = www-data/#listen.group = www-data/' \
|
|
--expression='s/^user = www-data/#user = www-data/' \
|
|
--expression='s/^group = www-data/#group = www-data/' \
|
|
/etc/php5/fpm/pool.d/www.conf
|
|
# patch /etc/php5/fpm/php-fpm.conf to not have a pidfile
|
|
sed --in-place='' \
|
|
--expression='s/^pid =/#pid =/' \
|
|
/etc/php5/fpm/php-fpm.conf
|
|
# patch /etc/php5/fpm/pool.d/www.conf to no clear environment variables
|
|
# so we can pass in SANDSTORM=1 to apps
|
|
sed --in-place='' \
|
|
--expression='s/^;clear_env = no/clear_env=no/' \
|
|
/etc/php5/fpm/pool.d/www.conf
|
|
# patch nginx conf to not bother trying to setuid, since we're not root
|
|
# also patch errors to go to stderr, and logs nowhere.
|
|
sed --in-place='' \
|
|
--expression 's/^user www-data/#user www-data/' \
|
|
--expression 's#^pid /run/nginx.pid#pid /var/run/nginx.pid#' \
|
|
--expression 's/^\s*error_log.*/error_log stderr;/' \
|
|
--expression 's/^\s*access_log.*/access_log off;/' \
|
|
/etc/nginx/nginx.conf
|
|
# Add a conf snippet providing what sandstorm-http-bridge says the protocol is as var fe_https
|
|
cat > /etc/nginx/conf.d/50sandstorm.conf << EOF
|
|
# Trust the sandstorm-http-bridge's X-Forwarded-Proto.
|
|
map \$http_x_forwarded_proto \$fe_https {
|
|
default "";
|
|
https on;
|
|
}
|
|
EOF
|
|
# Adjust fastcgi_params to use the patched fe_https
|
|
sed --in-place='' \
|
|
--expression 's/^fastcgi_param *HTTPS.*$/fastcgi_param HTTPS \$fe_https if_not_empty;/' \
|
|
/etc/nginx/fastcgi_params
|
|
|
|
mkdir -p /var/lib/dokuwiki/{conf,data,lib/plugins,lib/tpl}
|
|
chown -R vagrant.vagrant /var/lib/dokuwiki
|