3 if [ "$1" = "-h" -o "$1" = "--help" -o $# -ne 1 ]; then
4 echo "Usage $0 <dirname>"
5 echo "<dirname> is the full path to the site, such as /var/www/example.nl"
6 echo "which is created if it does not exist yet. If it exists, it's"
7 echo "permissions are reset".
12 # The primary group of the created user
14 # The template to copy
15 TEMPLATE_DIR=/data/www/template
16 # The bases to create users under
17 USERBASE="ou=Httpd Users,ou=Users,dc=drsnuggles,dc=stderr,dc=nl"
18 GROUPBASE="ou=Domain Groups,ou=Groups,dc=drsnuggles,dc=stderr,dc=nl"
19 # PHP config to change the error_log setting in
20 PHP_CONFIG=conf/php.ini.override
21 # PHP error logfile to set error_log to
22 PHP_ERRORLOG=logs/php.log
27 if [ -e "$DIR" ]; then
28 if [ ! -d "$DIR" ]; then
29 echo "$DIR" must be a directory, or not exist yet.
32 echo "Skipping creation of $DIR, it already exists";
34 # Create $DIR from $TEMPLATE_DIR, if it does not exist yet
35 echo "Creating $DIR from $TEMPLATE_DIR"
36 cp -R "$TEMPLATE_DIR" "$DIR"
47 GROUP=`echo $SITE | sed s/\\\\./-/g`
48 SCRIPT_USER="httpd-$GROUP"
50 if getent passwd | grep $SCRIPT_USER &> /dev/null && getent group | grep $GROUP &> /dev/null; then
51 echo "$SCRIPT_USER and/or $GROUP already exists, skipping account creation"
55 while getent passwd | cut -f 3 -d: | grep "^$ID\$" &>/dev/null && getent group | cut -f 3 -d: | grep "^$ID\$" &> /dev/null; do
59 echo Found uid/gid $ID for $SCRIPT_USER/$GROUP
61 # Create a user for scripts to run as, and a group to give write permissions to
63 ldapvi --profile bind --add --in --ldapvi <<EOF || exit
64 add cn=$GROUP,$GROUPBASE
67 objectClass: posixGroup
70 add cn=$SITE,$USERBASE
73 gidNumber: $HTTPD_USERS_GID
75 objectClass: posixAccount
82 if getent passwd | grep $SCRIPT_USER &> /dev/null && getent group | grep $GROUP &> /dev/null; then
83 echo "$SCRIPT_USER and $GROUP created succesfully"
85 echo "User or group creation failed"
89 echo "Setting up permissions"
91 sudo chown -R 0:$GROUP "$DIR"
93 # By default, let the owner have write access, the group have read access
94 sudo setfacl -R --set d:u::rwX,d:g::rX,d:o::-,u::rwX,g::rX,o::- "$DIR"
96 # Give the group write access to htdocs, applications, conf and data
97 sudo setfacl -R -m g::rwX,d:g::rwX "$DIR/htdocs" "$DIR/applications" "$DIR/conf" "$DIR/data"
99 # Give lighttpd read access to the dir itself
100 sudo setfacl -m u:$HTTPD_USER:rx "$DIR"
102 # Allow lighttpd to read anything in htdocs, applications, conf and data
103 sudo setfacl -R -m d:u:$HTTPD_USER:rX,u:$HTTPD_USER:rX "$DIR/htdocs" "$DIR/applications" "$DIR/conf" "$DIR/data"
105 # Allow lighttpd to write new files in logs (but not touch existing or those created by lighttpd)
106 sudo setfacl -m u:$HTTPD_USER:rwX "$DIR/logs"
108 # Give scripts read access to the dir itself
109 sudo setfacl -m u:$SCRIPT_USER:rx "$DIR"
111 # Allow scripts to read anything in applications, htdocs and conf
112 sudo setfacl -R -m d:u:$SCRIPT_USER:rX,u:$SCRIPT_USER:rX "$DIR/applications" "$DIR/htdocs" "$DIR/conf"
114 # Allow scripts to create new files in logs and data (but not touch existing or those created by lighttpd)
115 sudo setfacl -m u:$SCRIPT_USER:rwX "$DIR/logs" "$DIR/data"
117 # Temp, chown existing log files
118 sudo sh -c "chown -R $SCRIPT_USER \"$DIR\"/logs/php.log* \"$DIR\"/logs/wipi.log*"
119 sudo sh -c "chown -R $HTTPD_USER \"$DIR\"/logs/access.log*"
121 # Now, set the error_log setting in php.ini
123 echo Updating `basename $PHP_CONFIG`
125 sudo sed -i "s#^error_log *=.*#error_log = $DIR/$PHP_ERRORLOG#" "$DIR/$PHP_CONFIG"
130 echo "Now add human users to $GROUP."
131 echo "Also add this site to /usr/local/sbin/spawn-fcgi.sh and enable"
132 echo "fcgi in lighttpd if dynamic content is required."