Webcontrat - Serveurs Web

Les serveurs Webs terminaux tournent sous Nginx / php-fpm

Nginx

/etc/nginx/nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
 

events {
   worker_connections  8096;
   multi_accept        on;
   use                 epoll;
}

http {

 ##
 # Basic Settings
 ##
 
sendfile off;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;

# server_names_hash_bucket_size 64;
# server_name_in_redirect off;


include /etc/nginx/mime.types;
default_type application/octet-stream;

client_max_body_size 500M; # allows file uploads up to 500 megabytes

# Accepter les underscore dans les headers    
underscores_in_headers on;

#        real_ip_header $HTTP_X_FORWARDED_FOR;
#        set_real_ip_from 0.0.0.0;

##
# SSL Settings
##

ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;

##
# Logging Settings
##

## This log format makes it so we can see real requester's IP address \
##    not just the reverse proxy server's IP address. Also note, that \
##    "specialLog" can be replaced with any name you would like to \
##    give to this log format.
log_format specialLog '$remote_addr forwarded for $HTTP_X_FORWARDED_FOR - $HTTP_EPPN [$time_local]  '
                  '"$request" $status $body_bytes_sent '
                  '"$http_referer" "$http_user_agent"';



## On log vers un syslog
access_log syslog:server=10.30.0.200,tag=nginx_access specialLog;
error_log syslog:server=10.30.0.200,tag=nginx_error;

## On ne log pas en local pour ameliorer les perfs
#access_log /var/log/nginx/access.log specialLog;
#error_log /var/log/nginx/error.log;

##
# Gzip Settings
##

gzip on;
gzip_disable "msie6";

gzip_vary on;
gzip_min_length 10240;
gzip_proxied expired no-cache no-store private auth;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
 gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

##
# nginx-naxsi config
##
# Uncomment it if you installed nginx-naxsi
##

#include /etc/nginx/naxsi_core.rules;

##
# Virtual Host Configs
##

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*; 
}

/etc/nginx/sites-available/site :

server {
listen 80;
listen [::]:80 ipv6only=on;

root /var/www/html/assiduNat;
       
server_name webcontrat;

location / {
index index.php;
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
# Uncomment to enable naxsi on this location
# include /etc/nginx/naxsi.rules;
proxy_read_timeout 300;
}

      location ~ \.php$ { 
       fastcgi_split_path_info ^(.+\.php)(/.+)$;
         # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

         # With php5-fpm:
         fastcgi_pass unix:/var/run/php5-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         include fastcgi_params;
         # nous sommes derriere un proxy :
         fastcgi_param REMOTE_ADDR             $HTTP_X_FORWARDED_FOR;

       }

# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
location ~ /\.ht {
	deny all;
}

       ##
       # Cache
       ##

       location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
        access_log        off;
        log_not_found     off;
        expires           30d;
       }


############################################################################
## Administration :
############################################################################ 

       location /nginx_status {
         stub_status on;
         access_log   off;
         allow 193.49.133.2;
         allow 193.49.133.28;
         allow 193.49.132.60;
         allow 10.21.70.0/24;
         deny all;
       }

       location ~ ^/(status|ping)$ {
          access_log off;
          allow 127.0.0.1;
          allow 193.49.132.60;
          allow 193.49.133.2;
          allow 193.49.133.28;
          allow 10.21.70.0/24;
          deny all;
          
          include fastcgi_params;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

       }

}

Symfony

Attention, il faut régler finement les droits des répertoires cache et logs et que acl soit activé sur la partition (par defaut en ext4). Se placer à la racine du site symfony:

setfacl -R -m u:www-data:rwX -m g:www-dev:rwX var/cache var/logs
setfacl -dR -m u:www-data:rwX -m g:www-dev:rwX var/cache var/logs

PhpDocx

Attention, Nelly a modifié la lib, il faut prendre en compte ses modifs

N'EST PLUS D'ACTUALITE

 /usr/share/php/phpdocx-corporate.3.5/classes/CreateDocx.inc

// ajout Nelly
   public function createDocxAndDownloadDelete()
   {   
       $args = func_get_args();

       try {
           if (isset($args[1])) {
               $this->createDocx($args[0], $args[1]);
           } else {
               $this->createDocx($args[0]);
           }
       }
       catch (Exception $e) {
           PhpdocxLogger::logger($e->getMessage(), 'fatal');
       }

       if (!empty($args[0])) {
           $fileName = $args[0];
           $completeName = explode("/",$args[0]);
           $fileNameDownload = array_pop($completeName);
       } else {
           $fileName = 'document';
           $fileNameDownload = 'document';
       }

       PhpdocxLogger::logger('Download file ' . $fileNameDownload . '.' . $this->_extension . '.', 'info');
       header(
           'Content-Type: application/vnd.openxmlformats-officedocument.' .
           'wordprocessingml.document'
       );
       header(
           'Content-Disposition: attachment; filename="' . $fileNameDownload .
           '.' . $this->_extension . '"'
       );
       header('Content-Transfer-Encoding: binary');
       header('Content-Length: ' . filesize($fileName . '.' . $this->_extension));
       // ajout nelly
       header("Pragma: public");
       ob_clean();
       flush();

       readfile($fileName . '.' . $this->_extension);

       // ajout nelly
       unlink($fileName . '.' . $this->_extension);
       exit;
   }

ENCORE D'ACTUALITE

La licence vérifie le domaine en fonction du nom donné au virtualhost, il faut donc des noms de virtualhosts terminant par .cnrs.fr

 Licence Corporate :
 Domain : cnrs.fr
 Key : 5042cdfff5928a6a7a43744f22475cfd

firewall machines

Utilisation de ufw

Install php

apt install php7.2 php7.2-bcmath php7.2-cli php7.2-common php7.2-curl php7.2-fpm php7.2-gd php7.2-intl php7.2-json php7.2-ldap php7.2-mbstring php7.2-mysql php7.2-opcache php7.2-readline php7.2-tidy php7.2-xml php7.2-xsl php7.2-zip php7.2-dev

Modules php via pecl

ATTENTION : maintenant il y a des paquets tout fait, verifier et les privilegier, sinon passer par la procédure manuelle :

mount -o remount, rw /tmp

update-alternatives --set php /usr/bin/php7.2
update-alternatives --set phar /usr/bin/phar7.2
update-alternatives --set phpize /usr/bin/phpize7.2
update-alternatives --set php-config /usr/bin/php-config7.2

copier les .so avant la MAJ pour les remettre a leur place par la suite

pecl uninstall apcu

pecl install apcu

echo extension=apcu.so >/etc/php/7.2/mods-available/apcu.ini

phpenmod  apcu

apt-get install libmcrypt-dev
pecl install mcrypt-1.0.1
echo extension=mcrypt.so >/etc/php/7.2/mods-available/mcrypt.ini
phpenmod  mcrypt 

service php7.2-fpm restart 

php -m

recopier les .so a leur emplacement d'origine

update-alternatives --set php /usr/bin/php7.0
update-alternatives --set phar /usr/bin/phar7.0
update-alternatives --set phpize /usr/bin/phpize7.0
update-alternatives --set php-config /usr/bin/php-config7.0

php -v

mount -o remount  /tmp 

/etc/iptables-start