Skip to content

Commit 3d59b87

Browse files
nmlsdevnmlsdev
authored
add rhel8 installation script (mediacms-io#792)
* add rhel8 installation script
1 parent 5dee41d commit 3d59b87

File tree

2 files changed

+336
-0
lines changed

2 files changed

+336
-0
lines changed

‎deploy/local_install/selinux-mediacms.te

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
module selinux-mediacms 1.0;
2+
3+
require {
4+
type init_t;
5+
type var_t;
6+
type redis_port_t;
7+
type postgresql_port_t;
8+
type httpd_t;
9+
type httpd_sys_content_t;
10+
type httpd_sys_rw_content_t;
11+
class file { append create execute execute_no_trans getattr ioctl lock open read rename setattr unlink write };
12+
class dir { add_name remove_name rmdir };
13+
class tcp_socket name_connect;
14+
class lnk_file read;
15+
}
16+
17+
#============= httpd_t ==============
18+
19+
allow httpd_t var_t:file { getattr open read };
20+
21+
#============= init_t ==============
22+
allow init_t postgresql_port_t:tcp_socket name_connect;
23+
24+
allow init_t redis_port_t:tcp_socket name_connect;
25+
26+
allow init_t httpd_sys_content_t:dir rmdir;
27+
28+
allow init_t httpd_sys_content_t:file { append create execute execute_no_trans ioctl lock open read rename setattr unlink write };
29+
30+
allow init_t httpd_sys_content_t:lnk_file read;
31+
32+
allow init_t httpd_sys_rw_content_t:dir { add_name remove_name rmdir };
33+
34+
allow init_t httpd_sys_rw_content_t:file { create ioctl lock open read setattr unlink write };

‎install-rhel.sh

+302
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,302 @@
1+
#!/bin/bash
2+
# should be run as root on a rhel8-like system
3+
4+
function update_permissions
5+
{
6+
# fix permissions of /srv/mediacms directory
7+
chown -R nginx:root $1
8+
}
9+
10+
echo "Welcome to the MediacMS installation!";
11+
12+
if [ `id -u` -ne 0 ]; then
13+
echo "Please run as root user"
14+
exit
15+
fi
16+
17+
18+
while true; do
19+
read -p "
20+
This script will attempt to perform a system update, install required dependencies, and configure PostgreSQL, NGINX, Redis and a few other utilities.
21+
It is expected to run on a new system **with no running instances of any these services**. Make sure you check the script before you continue. Then enter y or n
22+
" yn
23+
case $yn in
24+
[Yy]* ) echo "OK!"; break;;
25+
[Nn]* ) echo "Have a great day"; exit;;
26+
* ) echo "Please answer y or n.";;
27+
esac
28+
done
29+
30+
# update configuration files
31+
32+
sed -i 's/\/home\/mediacms\.io\/mediacms\/Bento4-SDK-1-6-0-637\.x86_64-unknown-linux\/bin\/mp4hls/\/srv\/mediacms\/bento4\/bin\/mp4hls/g' cms/settings.py
33+
sed -i 's/www-data/nginx/g;s/\/home\/mediacms\.io\/mediacms\/logs/\/var\/log\/mediacms/g;s/\/home\/mediacms\.io\/mediacms/\/srv\/mediacms/g;s/\/home\/mediacms\.io\/bin/\/srv\/mediacms\/virtualenv\/bin/g' deploy/local_install/celery_*.service
34+
sed -i 's/\/home\/mediacms\.io\/mediacms/\/srv\/mediacms/g' deploy/local_install/mediacms.io
35+
sed -i 's/\/home\/mediacms\.io\/bin/\/srv\/mediacms\/virtualenv\/bin/g;s/\/home\/mediacms\.io\/mediacms/\/srv\/mediacms/g' deploy/local_install/mediacms.service
36+
sed -i 's/\/home\/mediacms\.io\/mediacms/\/var\/log\/mediacms/g' deploy/local_install/mediacms_logrorate
37+
sed -i 's/www-data/nginx/g' deploy/local_install/nginx.conf
38+
sed -i 's/www-data/nginx/g;s/\/home\/mediacms\.io\/mediacms\/logs/\/var\/log\/mediacms/g;s/\/home\/mediacms\.io\/mediacms/\/srv\/mediacms/g;s/\/home\/mediacms\.io/\/srv\/mediacms\/virtualenv/g' deploy/local_install/uwsgi.ini
39+
40+
osVersion=
41+
42+
if [[ -f /etc/os-release ]]; then
43+
osVersion=$(grep ^ID /etc/os-release)
44+
fi
45+
46+
if [[ $osVersion == *"fedora"* ]] || [[ $osVersion == *"rhel"* ]] || [[ $osVersion == *"centos"* ]] || [[ *"rocky"* ]]; then
47+
dnf install -y epel-release https://mirrors.rpmfusion.org/free/el/rpmfusion-free-release-8.noarch.rpm yum-utils
48+
yum-config-manager --enable powertools
49+
dnf install -y python3-virtualenv python39-devel redis postgresql postgresql-server nginx git gcc vim unzip ImageMagick python3-certbot-nginx certbot wget xz ffmpeg policycoreutils-devel cmake gcc gcc-c++ wget git bsdtar
50+
else
51+
echo "unsupported or unknown os"
52+
exit -1
53+
fi
54+
55+
# fix permissions of /srv/mediacms directory
56+
update_permissions /srv/mediacms/
57+
58+
read -p "Enter portal URL, or press enter for localhost : " FRONTEND_HOST
59+
read -p "Enter portal name, or press enter for 'MediaCMS : " PORTAL_NAME
60+
61+
[ -z "$PORTAL_NAME" ] && PORTAL_NAME='MediaCMS'
62+
[ -z "$FRONTEND_HOST" ] && FRONTEND_HOST='localhost'
63+
64+
echo "Configuring postgres"
65+
if [ ! command -v postgresql-setup > /dev/null 2>&1 ]; then
66+
echo "Something went wrong, the command 'postgresql-setup' was not found in the system path."
67+
exit -1
68+
fi
69+
70+
postgresql-setup --initdb
71+
72+
# set authentication method for mediacms user to scram-sha-256
73+
sed -i 's/.*password_encryption.*/password_encryption = scram-sha-256/' /var/lib/pgsql/data/postgresql.conf
74+
sed -i '/# IPv4 local connections:/a host\tmediacms\tmediacms\t127.0.0.1/32\tscram-sha-256' /var/lib/pgsql/data/pg_hba.conf
75+
76+
systemctl enable postgresql.service --now
77+
78+
su -c "psql -c \"CREATE DATABASE mediacms\"" postgres
79+
su -c "psql -c \"CREATE USER mediacms WITH ENCRYPTED PASSWORD 'mediacms'\"" postgres
80+
su -c "psql -c \"GRANT ALL PRIVILEGES ON DATABASE mediacms TO mediacms\"" postgres
81+
82+
echo 'Creating python virtualenv on /srv/mediacms/virtualenv/'
83+
84+
mkdir /srv/mediacms/virtualenv/
85+
cd /srv/mediacms/virtualenv/
86+
virtualenv . --python=python3
87+
source /srv/mediacms/virtualenv/bin/activate
88+
cd /srv/mediacms/
89+
pip install -r requirements.txt
90+
91+
systemctl enable redis.service --now
92+
93+
SECRET_KEY=`python -c 'from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())'`
94+
95+
# remove http or https prefix
96+
FRONTEND_HOST=`echo "$FRONTEND_HOST" | sed -r 's/http:\/\///g'`
97+
FRONTEND_HOST=`echo "$FRONTEND_HOST" | sed -r 's/https:\/\///g'`
98+
99+
FRONTEND_HOST_HTTP_PREFIX='http://'$FRONTEND_HOST
100+
101+
echo 'FRONTEND_HOST='\'"$FRONTEND_HOST_HTTP_PREFIX"\' >> cms/local_settings.py
102+
echo 'PORTAL_NAME='\'"$PORTAL_NAME"\' >> cms/local_settings.py
103+
echo "SSL_FRONTEND_HOST = FRONTEND_HOST.replace('http', 'https')" >> cms/local_settings.py
104+
105+
echo 'SECRET_KEY='\'"$SECRET_KEY"\' >> cms/local_settings.py
106+
echo "LOCAL_INSTALL = True" >> cms/local_settings.py
107+
108+
mkdir /var/log/mediacms/
109+
mkdir pids
110+
111+
update_permissions /var/log/mediacms/
112+
113+
python manage.py migrate
114+
python manage.py loaddata fixtures/encoding_profiles.json
115+
python manage.py loaddata fixtures/categories.json
116+
python manage.py collectstatic --noinput
117+
118+
ADMIN_PASS=`python -c "import secrets;chars = 'abcdefghijklmnopqrstuvwxyz0123456789';print(''.join(secrets.choice(chars) for i in range(10)))"`
119+
echo "from users.models import User; User.objects.create_superuser('admin', '[email protected]', '$ADMIN_PASS')" | python manage.py shell
120+
121+
echo "from django.contrib.sites.models import Site; Site.objects.update(name='$FRONTEND_HOST', domain='$FRONTEND_HOST')" | python manage.py shell
122+
123+
update_permissions /srv/mediacms/
124+
125+
cp deploy/local_install/celery_long.service /etc/systemd/system/celery_long.service
126+
cp deploy/local_install/celery_short.service /etc/systemd/system/celery_short.service
127+
cp deploy/local_install/celery_beat.service /etc/systemd/system/celery_beat.service
128+
cp deploy/local_install/mediacms.service /etc/systemd/system/mediacms.service
129+
130+
mkdir -p /etc/letsencrypt/live/$FRONTEND_HOST
131+
mkdir -p /etc/nginx/sites-enabled
132+
mkdir -p /etc/nginx/sites-available
133+
mkdir -p /etc/nginx/dhparams/
134+
rm -rf /etc/nginx/conf.d/default.conf
135+
rm -rf /etc/nginx/sites-enabled/default
136+
cp deploy/local_install/mediacms.io_fullchain.pem /etc/letsencrypt/live/$FRONTEND_HOST/fullchain.pem
137+
cp deploy/local_install/mediacms.io_privkey.pem /etc/letsencrypt/live/$FRONTEND_HOST/privkey.pem
138+
cp deploy/local_install/mediacms.io /etc/nginx/sites-available/mediacms.io
139+
ln -s /etc/nginx/sites-available/mediacms.io /etc/nginx/sites-enabled/mediacms.io
140+
cp deploy/local_install/uwsgi_params /etc/nginx/sites-enabled/uwsgi_params
141+
cp deploy/local_install/nginx.conf /etc/nginx/
142+
143+
# attempt to get a valid certificate for specified domain
144+
while true ; do
145+
echo "Would you like to run [c]ertbot, or [s]kip?"
146+
read -p " : " certbotConfig
147+
148+
case $certbotConfig in
149+
[cC*] )
150+
if [ "$FRONTEND_HOST" != "localhost" ]; then
151+
systemctl start
152+
echo 'attempt to get a valid certificate for specified url $FRONTEND_HOST'
153+
certbot --nginx -n --agree-tos --register-unsafely-without-email -d $FRONTEND_HOST
154+
certbot --nginx -n --agree-tos --register-unsafely-without-email -d $FRONTEND_HOST
155+
# unfortunately for some reason it needs to be run two times in order to create the entries
156+
# and directory structure!!!
157+
systemctl stop nginx
158+
159+
# Generate individual DH params
160+
openssl dhparam -out /etc/nginx/dhparams/dhparams.pem 4096
161+
fi
162+
163+
break
164+
;;
165+
[sS*] )
166+
echo "will not call certbot utility to update ssl certificate for url 'localhost', using default ssl certificate"
167+
cp deploy/local_install/dhparams.pem /etc/nginx/dhparams/dhparams.pem
168+
169+
break
170+
;;
171+
* )
172+
echo "Unknown option: $certbotConfig"
173+
;;
174+
esac
175+
done
176+
177+
# configure bento4 utility installation, for HLS
178+
while true ; do
179+
echo "Configuring Bento4"
180+
echo "Would you like to [d]ownload a pre-compiled bento4 binary, or [b]uild it now?"
181+
read -p "b/d : " bentoConfig
182+
183+
case $bentoConfig in
184+
[bB*] )
185+
echo "Building bento4 from source"
186+
git clone -b v1.6.0-640 https://github.com/axiomatic-systems/Bento4 /srv/mediacms/bento4
187+
cd /srv/mediacms/bento4/
188+
mkdir bin
189+
cd /srv/mediacms/bento4/bin/
190+
cmake -DCMAKE_BUILD_TYPE=Release ..
191+
make -j$(nproc)
192+
193+
chmod +x ../Source/Python/utils/mp4-hls.py
194+
195+
echo -e '#!/bin/bash' >> mp4hls
196+
echo -e 'BASEDIR=$(pwd)' >> mp4hls
197+
echo -e 'exec python3 "$BASEDIR/../Source/Python/utils/mp4-hls.py"' >> mp4hls
198+
199+
chmod +x mp4hls
200+
201+
break
202+
;;
203+
[dD*] )
204+
cd /srv/mediacms/
205+
wget http://zebulon.bok.net/Bento4/binaries/Bento4-SDK-1-6-0-637.x86_64-unknown-linux.zip
206+
bsdtar -xf Bento4-SDK-1-6-0-637.x86_64-unknown-linux.zip -s '/Bento4-SDK-1-6-0-637.x86_64-unknown-linux/bento4/'
207+
208+
break
209+
;;
210+
* )
211+
echo "Unknown option: $bentoConfig"
212+
;;
213+
esac
214+
done
215+
216+
mkdir /srv/mediacms/media_files/hls
217+
218+
# update permissions
219+
220+
update_permissions /srv/mediacms/
221+
222+
# configure selinux
223+
224+
while true ; do
225+
echo "Configuring SELinux"
226+
echo "Would you like to [d]isable SELinux until next reboot, [c]onfigure our SELinux module, or [s]kip and not do any SELinux confgiguration?"
227+
read -p "d/c/s : " seConfig
228+
229+
case $seConfig in
230+
[Dd]* )
231+
echo "Disabling SELinux until next reboot"
232+
break
233+
;;
234+
[Cc]* )
235+
echo "Configuring custom mediacms selinux module"
236+
237+
semanage fcontext -a -t bin_t /srv/mediacms/virtualenv/bin/
238+
semanage fcontext -a -t httpd_sys_content_t "/srv/mediacms(/.*)?"
239+
restorecon -FRv /srv/mediacms/
240+
241+
sebools=(httpd_can_network_connect httpd_graceful_shutdown httpd_can_network_relay nis_enabled httpd_setrlimit domain_can_mmap_files)
242+
243+
for bool in "${sebools[@]}"
244+
do
245+
setsebool -P $bool 1
246+
done
247+
248+
cd /srv/mediacms/deploy/local_install/
249+
make -f /usr/share/selinux/devel/Makefile selinux-mediacms.pp
250+
semodule -i selinux-mediacms.pp
251+
252+
break
253+
;;
254+
[Ss]* )
255+
echo "Skipping SELinux configuration"
256+
break
257+
;;
258+
* )
259+
echo "Unknown option: $seConfig"
260+
;;
261+
esac
262+
done
263+
264+
# configure firewall
265+
if command -v firewall-cmd > /dev/null 2>&1 ; then
266+
while true ; do
267+
echo "Configuring firewall"
268+
echo "Would you like to configure http, https, or skip and not do any firewall configuration?"
269+
read -p "http/https/skip : " fwConfig
270+
271+
case $fwConfig in
272+
http )
273+
echo "Opening port 80 until next reboot"
274+
firewall-cmd --add-port=80/tcp
275+
break
276+
;;
277+
https )
278+
echo "Opening port 443 permanently"
279+
firewall-cmd --add-port=443/tcp --permanent
280+
firewall-cmd --reload
281+
break
282+
;;
283+
skip )
284+
echo "Skipping firewall configuration"
285+
break
286+
;;
287+
* )
288+
echo "Unknown option: $fwConfig"
289+
;;
290+
esac
291+
done
292+
293+
fi
294+
295+
systemctl daemon-reload
296+
systemctl start celery_long.service
297+
systemctl start celery_short.service
298+
systemctl start celery_beat.service
299+
systemctl start mediacms.service
300+
systemctl start nginx.service
301+
302+
echo 'MediaCMS installation completed, open browser on http://'"$FRONTEND_HOST"' and login with user admin and password '"$ADMIN_PASS"''

0 commit comments

Comments
 (0)