1
0
mirror of https://github.com/tommytran732/Linux-Setup-Scripts synced 2024-11-08 03:01:34 -05:00

Bug fixes & instructions for Drupal

Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
Tommy 2024-06-26 15:27:01 -07:00
parent 87c18d4de2
commit 6c5b398620
Signed by: Tomster
GPG Key ID: 555C902A34EC968F
2 changed files with 122 additions and 6 deletions

View File

@ -0,0 +1,114 @@
# Ubuntu 24.04 LEMP Drupal
First you need to run the following scripts:
- https://github.com/TommyTran732/Linux-Setup-Scripts/blob/main/Ubuntu-24.04-Server.sh
- https://github.com/TommyTran732/Linux-Setup-Scripts/blob/main/sample-scripts-Ubuntu-24.04-LEMP.sh
## Install composer
```
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
php -r "unlink('composer-setup.php');"
sudo chown root:root composer.phar
sudo mv composer.phar /usr/local/bin
```
## Setup Directory Structure
```
# Add unprivileged user for drupal
sudo useradd -U -m -s /bin/bash drupal
# Make drupal directory
sudo mkdir -p /srv/drupal
sudo chmod 755 /srv/drupal
sudo chown drupal:drupal /srv/drupal
# Setup ACL
sudo apt install -y acl
sudo setfacl -Rdm u:nginx:rwx /srv/drupal
```
## Install Drupal
Switch to the `drupal` user:
```
sudo su - drupal
```
As the drupal user, run:
```
cd /srv/drupal
composer create-project drupal/recommended-project drupal.yourdomain.tld
```
## Generate an SSL certificate
```
certbot certonly --nginx --no-eff-email \
--key-type ecdsa --must-staple \
--deploy-hook "certbot-ocsp-fetcher -o /var/cache/certbot-ocsp-fetcher" \
--cert-name drupal.yourdomain.tld \
-d drupal.yourdomain.tld
```
## NGINX configuration file
Put the following file in `/etc/nginx/conf.d/sites_drupal.conf`:
```
server {
listen 443 quic reuseport;
listen 443 ssl;
listen [::]:443 quic reuseport;
listen [::]:443 ssl;
server_name drupal.yourdomain.tld;
ssl_certificate /etc/letsencrypt/live/drupal.yourdomain.tld/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/drupal.yourdomain.tld/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/drupal.yourdomain.tld/chain.pem;
ssl_stapling_file /var/cache/certbot-ocsp-fetcher/drupal.yourdomain.tld.der;
include snippets/hsts.conf;
include snippets/security.conf;
include snippets/cross-origin-security.conf;
include snippets/quic.conf;
index index.php;
client_max_body_size 100M;
root /srv/drupal/drupal.yourdomain.tld/web;
location / {
try_files $uri $uri/ /index.php$is_args$args;
}
location @rewrite {
rewrite ^/(.*)$ /index.php?q=$1;
}
location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
try_files $uri @rewrite;
expires max;
log_not_found off;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
client_max_body_size 100M;
}
}
```

View File

@ -63,19 +63,17 @@ sudo mariadb-secure-installation
sudo rm -rf /etc/nginx/conf.d/default.conf sudo rm -rf /etc/nginx/conf.d/default.conf
## Setup webroot for NGINX
sudo mkdir -p /srv/nginx
sudo mkdir -p /srv/nginx/.well-known/acme-challenge
## NGINX hardening ## NGINX hardening
sudo mkdir -p /etc/systemd/system/nginx.service.d sudo mkdir -p /etc/systemd/system/nginx.service.d
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/nginx.service.d/local.conf | sudo tee /etc/systemd/system/nginx.service.d/override.conf unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/nginx.service.d/local.conf | sudo tee /etc/systemd/system/nginx.service.d/override.conf
sudo chmod 644 /etc/systemd/system/nginx.service.d/override.conf
sudo systemctl daemon-reload sudo systemctl daemon-reload
## Setup certbot-ocsp-fetcher ## Setup certbot-ocsp-fetcher
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/certbot-ocsp-fetcher | sudo tee /usr/local/bin/certbot-ocsp-fetcher unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/certbot-ocsp-fetcher | sudo tee /usr/local/bin/certbot-ocsp-fetcher
sudo chmod u+x /usr/local/bin/certbot-ocsp-fetcher sudo chmod u+x /usr/local/bin/certbot-ocsp-fetcher
sudo mkdir -p /var/cache/certbot-ocsp-fetcher/ sudo mkdir -p /var/cache/certbot-ocsp-fetcher/
sudo chmod 755 /var/cache/certbot-ocsp-fetcher/
## Setup nginx-create-session-ticket-keys ## Setup nginx-create-session-ticket-keys
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/nginx-create-session-ticket-keys | sudo tee /usr/local/bin/nginx-create-session-ticket-keys unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/nginx-create-session-ticket-keys | sudo tee /usr/local/bin/nginx-create-session-ticket-keys
@ -95,6 +93,7 @@ unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/sys
## Systemd Hardening ## Systemd Hardening
sudo mkdir -p /etc/systemd/system/nginx.service.d sudo mkdir -p /etc/systemd/system/nginx.service.d
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/systemd/system/nginx.service.d/override.conf | sudo tee /etc/systemd/system/nginx.service.d/override.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/systemd/system/nginx.service.d/override.conf | sudo tee /etc/systemd/system/nginx.service.d/override.conf
sudo chmod 644 /etc/systemd/system/nginx.service.d/override.conf
sudo systemctl daemon-reload sudo systemctl daemon-reload
## Enable the units ## Enable the units
@ -106,15 +105,18 @@ sudo systemctl enable --now nginx-rotate-session-ticket-keys.timer
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/http2.conf | sudo tee /etc/nginx/conf.d/http2.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/http2.conf | sudo tee /etc/nginx/conf.d/http2.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/sites_default.conf | sudo tee /etc/nginx/conf.d/sites_default.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/sites_default.conf | sudo tee /etc/nginx/conf.d/sites_default.conf
sudo sed -i 's/include snippets/universal_paths.conf;//g' /etc/nginx/conf.d/sites_default.conf
sudo sed -i 's/ipv4_1://g' /etc/nginx/conf.d/sites_default.conf sudo sed -i 's/ipv4_1://g' /etc/nginx/conf.d/sites_default.conf
sudo sed -i 's/ipv6_1/::/g' /etc/nginx/conf.d/sites_default.conf sudo sed -i 's/ipv6_1/::/g' /etc/nginx/conf.d/sites_default.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/tls.conf | sudo tee /etc/nginx/conf.d/tls.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/tls.conf | sudo tee /etc/nginx/conf.d/tls.conf
sudo mkdir -p /etc/nginx/snippets sudo mkdir -p /etc/nginx/snippets
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/tls.conf | sudo tee /etc/nginx/snippets/tls.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/hsts.conf | sudo tee /etc/nginx/snippets/hsts.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/proxy.conf | sudo tee /etc/nginx/snippets/proxy.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/proxy.conf | sudo tee /etc/nginx/snippets/proxy.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/quic.conf | sudo tee /etc/nginx/snippets/quic.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/quic.conf | sudo tee /etc/nginx/snippets/quic.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/security.conf | sudo tee /etc/nginx/snippets/security.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/security.conf | sudo tee /etc/nginx/snippets/security.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/cross-origin-security.conf | sudo tee /etc/nginx/snippets/cross-origin-security.conf unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/cross-origin-security.conf | sudo tee /etc/nginx/snippets/cross-origin-security.conf
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/universal_paths.conf | sudo tee /etc/nginx/snippets/universal_paths.conf
# Fix PHP permission
sudo sed -i 's/www-data/nginx/g' /etc/php/8.3/fpm/pool.d/www.sock
sudo systemctl restart php8.3-fpm