Install a new server

Install a new server Organic Design procedure

Download and install Debian

If the server has no OS then download and install Debian first. Depending on the kind of access you have to the server and the kind of media it can accept, the following links may be of interest.

• Debian Conversion - Change an existing Linux distro into Debian using only SSH access
• Debian installation from memory stick - This is actually one of the most convenient means of installation even when DVD/CD are available

Dell Servers

Dell servers may require the bnx2 non-free firmware for Broadcom LAN cards.

Setting up the software environment

Ensure that you're using the same package repository for your Debian installation as we are, your /etc/apt/sources.list file should contain the following:

deb http://ftp.us.debian.org/debian stable main contrib non-free deb http://security.debian.org stable/updates main contrib non-free

Bring the system up to date and install the organicdesign-server package:

echo "deb http://packages.organicdesign.co.nz main/" >> /etc/apt/sources.list apt-get update apt-get upgrade apt-get install organicdesign-server

If you would like math markup support, also install the following, and see Enabling math markup for more details.

apt-get install dvipng tetex-extra cjk-latex ocaml

You will have a functioning server and LAMP environment.

Post install checklist

• /etc/hostname, hostname -F /etc/hostname, /etc/hosts
• tzselect, tzconfig
• DB info for wikia, webmail, crm
• /etc/ssh/sshd_config
• /etc/crontab
• /var/www/backup.pl
• /var/www and /home structures (should be automatically maintained by adding new server as a peer)
• Exim4 (this will need to be configured even for sending mail, see Configure mail server)
• Import spamassassin bayesian rules

Setting up the Wikia & Bot framework

If you are making a replica of or rebuilding a specific system, then unpack a recent www-yyyy-mm-dd.tgz backup into /var/www and remove specific wiki content.

7za x www-yyyy-mm-dd-tgz tar -xf www.tar /var

If starting a new server from scratch, then the main two things required are /var/www/tools and /var/www/extensions, the other procedures for installing codebases and wikis will add everything else necessary.

Extensions and Tools

You can obtain the scripts and extensions from the OD subversion repository, and then add any additional extensions you need. Note that there are also a number of extensions we use which are in the Wikimedia repository, so it may be easiest to unpack our od-extensions.tgz extensions snapshot instead.

cd /var/www svn co svn+od://svn.organicdesign.co.nz/svn/extensions svn co svn+od://svn.organicdesign.co.nz/svn/tools

Snapshots are also available as gzipped tar files, od-extensions.tgz and od-tools.tgz. After you have a wiki daemon running, the extensions and tools will be automatically synchronised to Organic Design's current tgz snapshots. The wiki daemon executes update-extensions.sh and update-tools.sh in /var/www/tools, and these can be called manually from root at any time. Any content that exists in the local extensions or tools but not in the OD version will be left alone during updates.

Next create the wikia global configuration in /var/www/tools/wikid.conf used by both the wikia and robot framework. Start with the wikid.conf.sample file.

Starting a bot

Now the the config is in place, try running the bot with the --install directive so that it starts up automatically when the system boots. If not running on a GNU/Linux machine, you may be best installing ActivePERL which comes with all the necessary libraries and is available for most platforms.

/var/www/tools/wikid.pl --install

Testing the bot

Check if the bot is running with pgrep wikid, and check the log in /var/www/tools/wikid.log. If you're running an IRC channel, check that your bot is in there and notifying the channel when articles change properly etc.

LAMP configuration

The easiest way to configure this is to copy the vhosts file which originated from the backup file over the default Apache configuration file, and then make the vhosts file a symlink pointing at the default configuration as usual. Then adjust the file to the wikia's specific needs.

mv /var/www/vhosts /etc/apache2/sites-available/default ln /etc/apache2/sites-available/default vhosts a2enmod ssl a2enmod rewrite

To activate the slow query log for mysqld, and ensure that it's optimised for low memory (innodb is not necessary for our scale of work and disabling it frees over 100MB of RAM), add the following to the [mysqld] section of the /etc/mysql/my.cnf file:

skip-innodb log_slow_queries = /var/log/mysql/mysql-slow.log

The differences to the default php.ini file in our servers are as follows:

max_execution_time = 300 memory_limit = 64M log_errors = On error_log = syslog post_max_size = 100M upload_max_filesize = 100M extension = domxml extension = fileinfo.so

In our typical Apache configuration we have a simple single virtual-host container (see sample.vhost in our tools repo) containing any site-specific domain rules, and includes common.vhost which is rules that apply across all servers, and wiki.vhost which is the rewrite rules for friendly URL's. Outside the single container, other SSL virtual-host definitions can be included which follow the format defined in ssl-sample.vhost and are named by domain and put in /var/www/ssl (more about SSL configuration below).

• sample.vhost - same Apache virtual-host definition file
• common.vhost - common rules used by all non-SSL sites and domains
• ssl-common.vhost - common rules used by all SSL sites and domains
• ssl-sample.vhost - sample SSL virtual-host definition to be included from the main file
• wiki.vhost - the rewrite rules for friendly URL's

Domain names

Adjust the names of the symlinks in the /var/www/domains directory to local domain names and ensure that those names are added to the /etc/hosts file.

• Note: If you're installing your wikia structure on a local machine, then you must ensure that your domains such as foo.localhost are set in /etc/hosts as aliases for 127.0.0.1
• DNS: if you need to set up a DNS server or Dymamic DNS system, see Configure DNS

Extracting Databases from a Backup

Extract the most recent database backup (this may overwrite existing databases of the same names)

7za x all-yyyy-mm-dd.sql.7z mysql -u root -p < all.sql mysqladmin -u root -p flush-privileges

Setting up FTP access

Some clients may require standard FTP access which although not very secure, can have some restrictions put on it to make it a little safer such as restricting users to their home directories and using a non standard port. We use the GPL proFTPD server in standalone mode.

apt-get install proftpd

Edit the /etc/proftpd/proftpd.conf file and change the port to something other than 21 and add the following directive to restrict users to their home directories (or set it to a shared FTP directory).

DefaultRoot ~

Following Symlinks

Note that following symlinks is not supported if the DefaultRoot directive is used because the directive creates a "jail" preventing access to any directories outside of it. Some administrators have said that mount --bind can be used to achieve this but it hasn't worked for us as that seems to just create a normal symlink as well.

Setting up SSL for Apache

• Generate a self signed certificate
• Generate a certificate request for a commercial Certificate Authority

Create a file in the same dir called organicdesign.co.nz with this content.

<VirtualHost organicdesign.co.nz:443> DocumentRoot /var/www/domains ServerAlias private.organicdesign.co.nz ServerAlias www.organicdesign.co.nz LogFormat "%h %l %u %t \"%r\" %>s %b" common CustomLog /var/log/apache2/access.log common RewriteEngine On SSLEngine on SSLCertificateFile /var/www/ssl/organicdesign.co.nz.crt SSLCertificateKeyFile /var/www/ssl/organicdesign.co.nz.key RewriteCond %{HTTP_HOST} ^webmail\. RewriteRule (.*) /webmail$1 [L] RewriteCond %{REQUEST_URI} ^/$ RewriteCond %{HTTP_HOST} ^(www\.|wiki\.)?(.+)$ RewriteRule ^ /%2/wiki/index.php/Main_Page [L] RewriteCond %{REQUEST_URI} ^/files/thumb/./../.+?/[0-9]+px- RewriteCond %{HTTP_HOST} ^(www\.|wiki\.)?(.+)$ RewriteRule ^.+/(.+?)/([0-9]+)px- /%2/wiki/thumb.php?w=$2&f=$1 [L] RewriteCond %{REQUEST_URI} ^/(wiki/|html|files/|common/|blogs|[fF]avicon.ico|[rR]obots.txt) RewriteCond %{HTTP_HOST} ^(www\.|wiki\.)?(.+)$ RewriteRule (.*) /%2$1 [L] RewriteCond %{HTTP_HOST} ^(www\.|wiki\.)?(.+)$ RewriteRule (.*) /%2/wiki/index.php$1 [L] </VirtualHost>

Run this line

echo 'Include /var/www/ssl/organicdesign.co.nz' >> /var/www/vhosts

Check the apache config before reloading

apachectl -t

Check the cert with this command:

cd /var/www/ssl openssl s_server -cert organicdesign.co.nz.crt -key organicdesign.co.nz.key

The following output indicates the cert is working correctly

Using default temp DH parameters Using default temp ECDH parameters ACCEPT

If everything is ok reload the server

/etc/init.d/apache2 reload

Check the error log for problems.

tail -f /var/log/apache2/error.log

If you see a message like this everything is ok.

[Sat Mar 14 11:32:18 2009] [notice] Apache/2.2.9 (Debian) DAV/2 SVN/1.4.2 PHP/5.2.0-8+etch13 mod_ssl/2.2.9 OpenSSL/0.9.8g configured -- resuming normal operations

If you see something like this you have problems:

[Fri Mar 13 21:46:54 2009] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag [Fri Mar 13 21:46:54 2009] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error Check permissions and paths of certs and keys. The server will be down now. Comment the last ''Include'' from ''vhosts'' and ''/etc/init.d/apache2 start''. Server will be up now with no ssl.

Install vim (not required)

apt-get -y install vim cat >> ~/.vimrc syntax on <Press Ctrl-D> cat >> ~/.bashrc Alias vi='vim' <Press Ctrl-D>

Next steps

• Configure LAN - DHCP server and firewall
• Configure DNS - LAN/Server based DNS and dynamic DNS solutions
• Configure SMB - Samba file shares
• Configure VPN - Remote access to file shares and other LAN resources
• Configure IRC - Run a chat channel, your bot can publish notifications to the channel
• Configure mail server
• Install a MediaWiki code-base

See also

• Debian Post Install
• Add an IP address to a server