890
edits
Difference between revisions of "MediaWiki Debian Installation"
Jump to navigation
Jump to search
→SSL Virtual Default Host
| (7 intermediate revisions by the same user not shown) | |||
|
=== My Experience Installing MediaWiki 1.31 on Debian/GNU Linux Bullseye (Buster) ===▼
<seo title="MediaWiki Debian Installation" metak="Buster,Bullseye,Url,Firewall,SSL,letsencryt" metad="Challenges installing Mediawiki on Debian" google-site-verification="google00ccddbcda3bce82.html" />
February 2020
These are no complete installation instructions, but a description of some of the challenges and the possible solutions to set up mediawiki with the following goals:
</syntaxhighlight>
Between my homemachine or an outside visitor and the targetserver is the firewall, built into my router. So I have to allow port sharing with my target server. Debian's default for ssh is port 22. (For further serving http, https and parsoid and mathoid extensions I also allowed ports 80, 443, 8143 and 10043 each for IPv4 and IPv6 to be shared.)
[https://fit-iot.com/web/products/fitlet2/fitlet2-specifications/ fitlet2] comes with LinuxMint preinstalled, but I prefer Debian. The choice of a desktop environment and an Internet server on the targetserver allow remote browsing via ssh. [https://wiki.debian.org/WebServers Debian recommends]<syntaxhighlight lang="shell">
sudo tasksel
</syntaxhighlight>installs, as I recall, all that is needed to run mediawiki on localhost.
Short story: place two aliases into the apache2 conf-file that defines the mediawiki host and define the $wgArticlePath:<syntaxhighlight lang="text">
/etc/apache2/conf-enabled/mediawiki.conf:
</syntaxhighlight>Longer story: to get this right one has to know or guess how apache2 loads its modules, whether there is cumulation or overriding and in what order apache2 loads the modules etc. And also what the Debian defaults are. As I played too long with the configuration files, I can't tell anymore what the original state was. I suppose that /etc/mediawiki/mediawiki.conf was a link to /etc/apache2/conf-enabled/mediawiki.conf and that the above aliases could have been added there.
I used [https://letsencrypt.org/getting-started/ Let's Encrypt], respectively [https://certbot.eff.org/instructions Certbot], to get a certifcate for my site and had certbot change my configuration files in /etc/apache2.
sudo apt install certbot testssl.sh▼
(April 2020: see installation instructions for [https://certbot.eff.org/lets-encrypt/debiantesting-apache.html Debian testing].)
Testing with testssl showed vulnerabilities, i.e. TLSv1 and TLSv1.1 as accepted protocols.<syntaxhighlight lang="shell">
▲sudo apt install certbot python3-certbot-apache testssl.sh
testssl www.example.com
ServerName www.example.com
# ServerAlias
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
SSLCertificateFile /etc/letsencrypt/live/www.example.com-0001/fullchain.pem
</syntaxhighlight>testssl www.example.com now runs flawlessly, warning only about two or three cyphers that should not be offered.
I added the Extension:Math in the beginning of February 2020. Additionally, I added Parsoid and Mathoid, not being really sure whether this was needed. In any case, on the Parsoid site it is stated:<blockquote>Parsoid (the PHP version) is planned to come natively bundled with MediaWiki by June 2020. At that time, the setup instructions on this page will be updated. Until then, for non-Wikimedia installations, Parsoid/JS is the supported version of Parsoid. </blockquote>Parsoid and Mathoid are now services on my host. To access them via ports 8143 and 10043, respectively, I installed stunnel4<syntaxhighlight lang="shell">
sudo apt install stunnel4
</syntaxhighlight>with the conf-file:<syntaxhighlight lang="text">
/etc/stunnel/parsoid-mathoid.conf:
cert = /etc/letsencrypt/live/www.example.com/fullchain.pem
key = /etc/letsencrypt/live/www.example.com/privkey.pem
[parsoid]
accept = :::8143
connect = :::8142
[mathoid]
accept = :::10043
connect = :::10042
</syntaxhighlight>
| |||