#!/bin/bash # # seafile-server-installer/seafile-pro_debian-jessie-amd64 # # Copyright 2015, Alexander Jackson # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . # # #set -x # ------------------------------------------- # Vars # ------------------------------------------- SEAFILE_ADMIN=admin@seafile.lan SEAFILE_USER=seafile SEAFILE_SERVER_NAME=$(hostname -s | cut -c -16) SEAFILE_DNS=$(hostname -i) HOSTNAME=$(hostname -i) FILESERVER_PORT=8082 SERVER_PORT=10001 SEAFILE_SERVER_PORT=12001 # Don't touch the following variable, unless you know what you are doing SEAFILE_VERSION=4.1.2 SEAFILE_EDITION=pro-server SEAFILE_SOURCE=/usr/src/seafile/seafile-${SEAFILE_EDITION}_${SEAFILE_VERSION}_x86-64.tar.gz # ------------------------------------------- # Seafile Server Professional Edition on Debian Jessie (64bit) # ------------------------------------------- clear cat < /dev/null 2>&1 ; then echo " Aborting because user ${SEAFILE_USER} already exist" ; exit 1 fi # ------------------------------------------- # Abort if directory /opt/seafile/ exists # ------------------------------------------- if [[ -d "/opt/seafile/" ]] ; then echo " Aborting because directory /opt/seafile/ already exist" ; exit 1 fi # ------------------------------------------- # Update System # ------------------------------------------- apt-get update apt-get dist-upgrade -y # ------------------------------------------- # Additional requirements # ------------------------------------------- apt-get install sudo ntp htop pwgen curl openssl unattended-upgrades -y # ------------------------------------------- # ensure correct time is set # ------------------------------------------- ntpd -gq # ------------------------------------------- # Security programs # ------------------------------------------- apt-get install ufw fail2ban -y # ------------------------------------------- # Activate firewall # ------------------------------------------- for i in ssh http https ; do ufw allow $i; done yes | ufw enable # ------------------------------------------- # Seafile requirements # ------------------------------------------- apt-get install python-setuptools python-simplejson python-imaging python-mysqldb \ openjdk-7-jre memcached python-memcache libreoffice python-uno poppler-utils -y # ------------------------------------------- # NGINX # ------------------------------------------- cat > /etc/apt/sources.list.d/nginx.list < /etc/nginx/conf.d/seafile.conf <<'EOF' server { listen 80; server_name ""; return 301 https://$http_host$request_uri?; } server { listen 443 spdy; server_name ""; ssl on; ssl_certificate /etc/nginx/ssl/seafile.crt; ssl_certificate_key /etc/nginx/ssl/seafile.key; location / { fastcgi_pass 127.0.0.1:8000; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_script_name; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; fastcgi_param HTTPS on; fastcgi_param HTTP_SCHEME https; access_log /var/log/nginx/seahub.access.log; error_log /var/log/nginx/seahub.error.log; } location /seafhttp { rewrite ^/seafhttp(.*)$ $1 break; proxy_pass http://127.0.0.1:8082; client_max_body_size 0; proxy_connect_timeout 36000s; proxy_read_timeout 36000s; } location /media { root /opt/seafile/seafile-server-latest/seahub; } location /seafdav { fastcgi_pass 127.0.0.1:8080; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_script_name; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; fastcgi_param HTTPS on; client_max_body_size 0; access_log /var/log/nginx/seafdav.access.log; error_log /var/log/nginx/seafdav.error.log; } } EOF mkdir /etc/nginx/ssl openssl genrsa -out /etc/nginx/ssl/seafile.key 4096 openssl req -new -x509 -key /etc/nginx/ssl/seafile.key -out /etc/nginx/ssl/seafile.crt -days 10950 -batch # ------------------------------------------- # Create optimized nginx.conf # ------------------------------------------- cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.backup cat > /etc/nginx/nginx.conf <<'ENDOFFILE' user nginx nginx; worker_processes 4; events { worker_connections 8096; multi_accept on; use epoll; } pid /var/run/nginx.pid; worker_rlimit_nofile 40000; http { server_tokens off; server_names_hash_bucket_size 128; client_max_body_size 50M; include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log warn; sendfile on; tcp_nopush on; tcp_nodelay on; client_body_timeout 12; client_header_timeout 12; keepalive_timeout 15; send_timeout 10; gzip on; gzip_vary on; gzip_proxied expired no-cache no-store private auth any; gzip_comp_level 9; gzip_min_length 10240; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css text/xml text/javascript application/javascript application/x-javascript application/xml font/woff2; gzip_disable "MSIE [1-6]."; include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; map $scheme $php_https { default off; https on; } include perfect-forward-secrecy.conf; } ENDOFFILE # ------------------------------------------- # Setup perfect forward secrecy # ------------------------------------------- openssl dhparam -dsaparam -out /etc/nginx/dh4096.pem 4096 cat > /etc/nginx/perfect-forward-secrecy.conf <<'EOF' ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA"; ssl_dhparam dh4096.pem; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; EOF # ------------------------------------------- # Fix NGINX worker_processes to number of CPU cores # ------------------------------------------- CPUS=$(cat /proc/cpuinfo | grep processor | wc | awk '{ print $1 }') eval "sed -i 's/worker_processes.*/worker_processes $CPUS;/g' /etc/nginx/nginx.conf" systemctl restart nginx # ------------------------------------------- # MariaDB # ------------------------------------------- DEBIAN_FRONTEND=noninteractive apt-get install mariadb-server -y SQLROOTPW=$(pwgen) mysqladmin -u root password $SQLROOTPW cat > /root/.my.cnf < /etc/init.d/seafile-server <<'EOF' #!/bin/bash ### BEGIN INIT INFO # Provides: seafile-server # Required-Start: $remote_fs $syslog mysql # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Seafile server # Description: Start Seafile server ### END INIT INFO # Author: Alexander Jackson # # Change the value of "user" to your linux user name USER=seafile # Change the value of "SEAFILE_DIR" to your path of seafile installation SEAFILE_DIR=/opt/seafile SCRIPT_PATH=${SEAFILE_DIR}/seafile-server-latest SEAFILE_INIT_LOG=${SEAFILE_DIR}/logs/seafile.init.log SEAHUB_INIT_LOG=${SEAFILE_DIR}/logs/seahub.init.log # Change the value of fastcgi to true if fastcgi is to be used fastcgi=true # Set the port of fastcgi, default is 8000. Change it if you need different. fastcgi_port=8000 case "$1" in start) sudo -u ${USER} ${SCRIPT_PATH}/seafile.sh start >> ${SEAFILE_INIT_LOG} if [ $fastcgi = true ]; then sudo -u ${USER} ${SCRIPT_PATH}/seahub.sh start-fastcgi ${fastcgi_port} >> ${SEAHUB_INIT_LOG} else sudo -u ${USER} ${SCRIPT_PATH}/seahub.sh start >> ${SEAHUB_INIT_LOG} fi ;; restart) sudo -u ${USER} ${SCRIPT_PATH}/seafile.sh restart >> ${SEAFILE_INIT_LOG} if [ $fastcgi = true ]; then sudo -u ${USER} ${SCRIPT_PATH}/seahub.sh restart-fastcgi ${fastcgi_port} >> ${SEAHUB_INIT_LOG} else sudo -u ${USER} ${SCRIPT_PATH}/seahub.sh restart >> ${SEAHUB_INIT_LOG} fi ;; stop) sudo -u ${USER} ${SCRIPT_PATH}/seafile.sh $1 >> ${SEAFILE_INIT_LOG} sudo -u ${USER} ${SCRIPT_PATH}/seahub.sh $1 >> ${SEAHUB_INIT_LOG} ;; *) echo "Usage: /etc/init.d/seafile-server {start|stop|restart}" exit 1 ;; esac EOF chmod +x /etc/init.d/seafile-server systemctl enable seafile-server # ------------------------------------------- # Install seafile-server-change-address script # ------------------------------------------- cat > /usr/local/sbin/seafile-server-change-address <<'ENDOFFILE' #/bin/bash #set -x # ------------------------------------------- # Vars # ------------------------------------------- HOSTNAME=$(hostname -f) SEAFILE_DIR=/opt/seafile # ------------------------------------------- # Intro # ------------------------------------------- clear cat < /opt/seafile/.my.cnf < "${DEFAULT_CCNET_CONF_DIR}/seafile.ini" # ------------------------------------------- # Configure Seafile WebDAV Server(SeafDAV) # ------------------------------------------- mkdir -p ${DEFAULT_CONF_DIR} cat > ${DEFAULT_CONF_DIR}/seafdav.conf < "${DEST_SETTINGS_PY}" # ------------------------------------------- # prepare avatar directory # ------------------------------------------- mkdir -p "${TOPDIR}/seahub-data" mv "${ORIG_AVATAR_DIR}" "${DEST_AVATAR_DIR}" ln -s ../../../seahub-data/avatars ${MEDIA_DIR} # ------------------------------------------- # create logs directory # ------------------------------------------- mkdir -p "${TOPDIR}/logs" # ------------------------------------------- # Create symlink for current server version # ------------------------------------------- ln -s $(basename ${INSTALLPATH}) ${SEAFILE_SERVER_SYMLINK} # Fix permissions chmod 0600 "$DEST_SETTINGS_PY" chmod 0700 "$DEFAULT_CCNET_CONF_DIR" chmod 0700 "$SEAFILE_DATA_DIR" chmod 0700 "$DEFAULT_CONF_DIR" # ------------------------------------------- # copy user manuals to library template # ------------------------------------------- mkdir -p ${LIBRARY_TEMPLATE_DIR} cp -f ${SRC_DOCS_DIR}/*.doc ${LIBRARY_TEMPLATE_DIR} # ------------------------------------------- # Setup professional features # ------------------------------------------- PRO_PY=${INSTALLPATH}/pro/pro.py $PYTHON ${PRO_PY} setup # ------------------------------------------- # Configuring ccnet.conf # ------------------------------------------- SEAFILESQLPW=$(grep password /opt/seafile/.my.cnf | awk -F'=' {'print $2'}) cat >> ${DEFAULT_CCNET_CONF_DIR}/ccnet.conf <> ${DEST_SETTINGS_PY} < ${SEAFILE_DIR}/seafile-pro-installer.log<