MediaWiki Debian Installation

My Experience Installing MediaWiki 1.31 on Debian/GNU Linux Bullseye (Buster)

February 2020

These are no complete installation instructions, but a description of some of the challenges and the possible solutions to set up mediawiki with the following goals:

1. As secure as possible, inclusive forward security,
2. Short URLs and VisualEditor + Math extension.

My server is separate, i.e. not on my home workstation, and plugged to the router. It's a fanless small machine, consuming between 5 and 15 Watts according to the product description. (Not being paid for advertising, I can recommend it at any time: fitlet2. See also the description at Phoronix.)

I am neither following a logical nor chronological path, but rather choose the various issues from the end with the solutions found. As I have full access to all parts of my network, ssh access is possible. To easily download extensions to the target server from the mediawiki site, I access the target server with

homeuser@homemachine:~$ ssh -Y serveruser@targetserver

and then start firefox on the targetserver

serveruser@targetserver:~$ firefox&

Firewall

Between my homemachine or an outside visitor and the targetserver is the firewall, built into my router. So I have to allow port sharing with my target server. Debian's default for ssh is port 22. (For further serving http, https and parsoid and mathoid extensions I also allowed ports 80, 443, 8143 and 10043 each for IPv4 and IPv6 to be shared.)

Debian on targetserver

fitlet2 comes with LinuxMint preinstalled, but I prefer Debian. The choice of a desktop environment and an Internet server on the targetserver allow remote browsing via ssh. Debian recommends

sudo tasksel

and then select Debian desktop environment (plus the choice of desktop) and web server. This installs apache2 and whatever else it needs as the default Web Server.

sudo apt update 
sudo apt full-upgrade 
sudo apt install mediawiki

installs, as I recall, all that is needed to run mediawiki on localhost.

Short URLs

Short story: place two aliases into the apache2 conf-file that defines the mediawiki host and define the $wgArticlePath:

/etc/apache2/conf-enabled/mediawiki.conf:

Alias /mediawiki /var/lib/mediawiki
Alias /wiki /var/lib/mediawiki/index.php

/etc/mediawiki/Localhost.php:

$wgArticlePath = '/wiki/$1';

Longer story: to get this right one has to know or guess how apache2 loads its modules, whether there is cumulation or overriding and in what order apache2 loads the modules etc. And also what the Debian defaults are. As I played too long with the configuration files, I can't tell anymore what the original state was. I suppose that /etc/mediawiki/mediawiki.conf was a link to /etc/apache2/conf-enabled/mediawiki.conf and that the above aliases could have been added there.

SSL Virtual Default Host

I used Let's Encrypt, respectively Certbot, to get a certifcate for my site and had certbot change my configuration files in /etc/apache2.

(April 2020: see installation instructions for Debian testing.)

Testing with testssl showed vulnerabilities, i.e. TLSv1 and TLSv1.1 as accepted protocols.

sudo apt install certbot python3-certbot-apache testssl.sh

testssl www.example.com

certbot changed the default virtual host file:

serveruser@targetserver:/etc/apache2/sites-enabled$ sudo nano 000-default-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>

        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        ServerName www.example.com

        # ServerAlias
        ServerAlias example.com *.example.com

        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

        ServerAdmin admin@localhost
        
        DocumentRoot /var/www/html

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf

        SSLCertificateFile /etc/letsencrypt/live/www.example.com-0001/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/www.example.com-0001/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>
</IfModule>

To be noted is the line: 'Include /etc/letsencrypt/options-ssl-apache.conf'. The protocols not to be offered are to be indicated there:

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:...

SSLOptions +StrictRequire

testssl www.example.com now runs flawlessly, warning only about two or three cyphers that should not be offered.

Math extension, including Parsoid and Mathoid

I added the Extension:Math in the beginning of February 2020. Additionally, I added Parsoid and Mathoid, not being really sure whether this was needed. In any case, on the Parsoid site it is stated:

Parsoid (the PHP version) is planned to come natively bundled with MediaWiki by June 2020. At that time, the setup instructions on this page will be updated. Until then, for non-Wikimedia installations, Parsoid/JS is the supported version of Parsoid.

Parsoid and Mathoid are now services on my host. To access them via ports 8143 and 10043, respectively, I installed stunnel4

sudo apt install stunnel4

with the conf-file:

/etc/stunnel/parsoid-mathoid.conf:

cert = /etc/letsencrypt/live/www.example.com/fullchain.pem
key = /etc/letsencrypt/live/www.example.com/privkey.pem

[parsoid]
accept  = :::8143
connect = :::8142

[mathoid]
accept  = :::10043
connect = :::10042