nginx php bash debian
This script install a chrooted nginx and php environment on a specific folder of the system. Is has been developped and tested on Debian Squeeze 64 bits. It requires that the nginx, php5-cgi, spawn-fcgi packages are installed. In addition, if you want mysql support, install php5-mysql before launching the script.
If you need help, want to report bug or submit improvements, please post a comment at the bottom of the page.
#! /bin/bash
set -e
####
# Isolated Nginx & PHP Installation script
# Julien Vehent - 20110418
# http://wiki.linuxwall.info
# Distributed under GPL V2 licence
####
# The main container. change it to match your configuration.
chroot_container=/var/www/
# this function copies shared libraries from a binary to the chroot
# stolen from nixcraft and then improved a bit ;)
libs_to_chroot(){
local d="$1" # JAIL ROOT
local pFILE="$2" # copy bin file libs
local files=""
local _cp="/bin/cp"
# get rid of blanks and (0x00007fff0117f000)
files="$(ldd $pFILE | awk '{ print $3 }' | sed -e '/^$/d' -e '/(*)$/d')"
for i in $files
do
dcc="${i%/*}" # get dirname only
[ ! -d ${d}${dcc} ] && mkdir -p ${d}${dcc} # create missing dirs
[ ! -e ${d}${dcc}${i} ] && ${_cp} -f $i ${d}${dcc} # copy missing only
# recursively get shared libraries of shared library
libs_to_chroot "${d}" "${i}"
done
# Works with 32 and 64 bit ld-linux
sldl="$(ldd $pFILE | grep 'ld-linux' | awk '{ print $1}')"
sldlsubdir="${sldl%/*}"
#[ ! -f ${d}${sldl} ] && ${_cp} -f ${sldl} ${d}${sldlsubdir}
if [ ! -f ${d}${sldl} ];
then
${_cp} -f ${sldl} ${d}${sldlsubdir}
fi
}
install_env() {
local target="$1"
mkdir -p $chroot_container$target/{etc/init.d,dev,var/log/nginx,var/run,var/www,var/tmp,var/lib/nginx,usr/sbin,usr/bin,usr/share,bin,sbin,tmp,lib/lsb,lib64,usr/lib}
chmod 1777 $chroot_container$target/var/tmp/
mknod -m 0666 $chroot_container$target/dev/null c 1 3
mknod -m 0666 $chroot_container$target/dev/random c 1 8
mknod -m 0666 $chroot_container$target/dev/urandom c 1 9
mknod -m 0666 $chroot_container$target/dev/zero c 1 5
# create a user and a group that have the same name as target
groupadd $target
useradd -d $chroot_container$target/var/www -g $target -M -N -s /bin/false $target
# copy startup program
#cp -f /sbin/start-stop-daemon $chroot_container$target/sbin/
#cp -f /lib/lsb/init-functions $chroot_container$target/lib/lsb/
# copy ln to recreate symbolic links inside the chroot
cp -f /bin/ln $chroot_container$target/bin/
}
install_nginx(){
local target="$1"
local nginx_bin=`which nginx`
cp -f $nginx_bin $chroot_container$target$nginx_bin
cp -fr /etc/nginx $chroot_container$target/etc/
#copy shared libs to target
libs_to_chroot "${chroot_container}${target}" "${nginx_bin}"
cp -f /lib/libnss_compat.so.2 $chroot_container$target/lib/
cp -f /lib/libnsl.so.1 $chroot_container$target/lib/
cp -f /lib/libnss_nis.so.2 $chroot_container$target/lib/
cp -f /lib/libnss_files.so.2 $chroot_container$target/lib/
cp -fr /etc/{nsswitch.conf,services,hosts*,localtime,protocols,ld.so.cache,ld.so.conf,ld.so.conf.d,host.conf} $chroot_container$target/etc/
#we just give the chroot the user it needs, that is root and its own
head -n 1 /etc/passwd > $chroot_container$target/etc/passwd
tail -n 1 /etc/passwd >> $chroot_container$target/etc/passwd
head -n 1 /etc/group > $chroot_container$target/etc/group
tail -n 1 /etc/group >> $chroot_container$target/etc/group
# change user ownership
chown -R $target:$target $chroot_container$target/var/www/
# install basic configuration
echo "user $target $target;
worker_processes 1;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
access_log /var/log/nginx/access.log;
sendfile on;
keepalive_timeout 65;
tcp_nodelay on;
gzip on;
gzip_disable \"MSIE [1-6]\.(?!.*SV1)\";
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
" > $chroot_container$target/etc/nginx/nginx.conf
# install basic virtual host
echo "Nginx can be configured to accept requests from 127.0.0.1 only (coming from a proxy or load balancer)"
echo -n "Do you want to allow 127.0.0.1 only and deny all (can be changed in site config) ? y/n > "
read response
if [ $response == "y" ]
then
echo "server {
listen 127.0.0.1:$nginxport;"> $chroot_container$target/etc/nginx/sites-available/default
else
echo "server {
listen $nginxport;"> $chroot_container$target/etc/nginx/sites-available/default
fi
echo "
server_name $fqdn;
access_log /var/log/nginx/$fqdn.access.log;
root /var/www;
index index.cgi index.php index.html index.htm;">>$chroot_container$target/etc/nginx/sites-available/default
if [ $phpsupport -eq 1 ]
then
echo "
location ~ \.php$ {
include fastcgi_params;
fastcgi_pass 127.0.0.1:$phpport;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
}">> $chroot_container$target/etc/nginx/sites-available/default
fi
if [ $fcgiwrapsupport -eq 1 ]
then
echo "
location ~ \.cgi {
include fastcgi_params;
fastcgi_pass unix:/var/run/fcgiwrap.sock;
fastcgi_index index.cgi;
fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
}">>$chroot_container$target/etc/nginx/sites-available/default
fi
echo "
}" >> $chroot_container$target/etc/nginx/sites-available/default
# test the setup
chroot $chroot_container$target/ $nginx_bin -t
echo "nginx setup finished."
}
install_php(){
aptitude install php5-cgi spawn-fcgi
local spawnfcgibin=`which spawn-fcgi`
local php_bin=`which php5-cgi`
if [ ! -x $chroot_container$target$spawnfcgibin ]
then
cp -f $spawnfcgibin $chroot_container$target$spawnfcgibin
libs_to_chroot "${chroot_container}${target}" "$spawnfcgibin"
fi
cp -f $php_bin $chroot_container$target$php_bin
cp -fr /etc/php5 $chroot_container$target/etc/
cp -fr /usr/lib/php5 $chroot_container$target/usr/lib/
cp -fr /usr/share/zoneinfo $chroot_container$target/usr/share/
libs_to_chroot "${chroot_container}${target}" "${php_bin}"
echo "php setup finished."
}
install_mysql(){
aptitude update 1>/dev/null
aptitude install php5-mysql
cp -fr /etc/php5 $chroot_container$target/etc/
cp -fr /usr/lib/php5 $chroot_container$target/usr/lib/
local mysql_lib=`find /usr/lib/php5/ -iname mysql.so`
libs_to_chroot "${chroot_container}${target}" "${mysql_lib}"
find /lib -iname libgcc_s.so* -exec cp -f {} $chroot_container$target/lib/ \;
echo "php5-mysql setup finished."
}
install_fcgiwrap(){
aptitude update 1>/dev/null
aptitude install fcgiwrap spawn-fcgi
fcgiwrap_bin=`which fcgiwrap`
cp -f $fcgiwrap_bin $chroot_container$target$fcgiwrap_bin
libs_to_chroot "${chroot_container}${target}" "${fcgiwrap_bin}"
spawnfcgibin=`which spawn-fcgi`
if [ ! -x $chroot_container$target$spawnfcgibin ]
then
cp -f $spawnfcgibin $chroot_container$target$spawnfcgibin
libs_to_chroot "${chroot_container}${target}" "$spawnfcgibin"
fi
}
install_perl(){
local perl_bin=`which perl`
#copy perl binary
cp -f $perl_bin $chroot_container$target$perl_bin
echo "copying all included perl modules from @INC, be patient (~5/10min)"
for INC in $(perl -e 'foreach(@INC){print "$_\n";}')
do
if [ "$INC" != "." ]
then
if [ -h "$INC" ]
then
DESTLINK=$(readlink -f $INC)
mkdir -p $chroot_container$target$DESTLINK
cp -fr $DESTLINK/* $chroot_container$target$DESTLINK/
chroot $chroot_container$target ln -s $DESTLINK $INC
else
if [ -d "$INC" ]
then
mkdir -p $chroot_container$target$INC
cp -fr $INC $chroot_container$target$INC
for perl_lib in $(find $INC -iname '*.so' -exec ls {} \;)
do
libs_to_chroot "${chroot_container}${target}" "${perl_lib}"
done
fi
fi
fi
done
#copy dynamic libs
libs_to_chroot "${chroot_container}${target}" "${perl_bin}"
echo "perl setup finished."
}
install_mojolicious(){
# install chroot env, then move there and issue mojolicious install
cp $(which bash) ${chroot_container}${target}$(which bash)
libs_to_chroot "${chroot_container}${target}" $(which bash)
cp $(which env) ${chroot_container}${target}$(which env)
libs_to_chroot "${chroot_container}${target}" $(which env)
cp $(which curl) ${chroot_container}${target}$(which curl)
libs_to_chroot "${chroot_container}${target}" $(which curl)
curl -s -L cpanmin.us | perl - Mojolicious --local-lib=/tmp-${target}-mojolicious/
cp -r /tmp/${target}-mojolicious/lib/perl5/* ${chroot_container}${target}/usr/lib/perl5/
cp -r /tmp/${target}-mojolicious/bin/* ${chroot_container}${target}/usr/bin/
rm -rf /tmp/${target}-mojolicious/
echo "mojolicious setup finished."
}
create_supervised_config(){
aptitude update 1>/dev/null
aptitude install daemontools daemontools-run
mkdir -p /etc/sv/spawn-fcgi-$target
echo "#! /bin/bash
CHROOTBIN=/usr/sbin/chroot
CHROOTPATH=$chroot_container$target
SPAWNBIN=`which spawn-fcgi`
PHP5BIN=`which php5-cgi`
PHP5PORT=$phpport
PHP5ADDR=127.0.0.1
USER=$target
exec \$CHROOTBIN \$CHROOTPATH \$SPAWNBIN -n -a \$PHP5ADDR -p \$PHP5PORT -u \$USER -g \$USER -C 3 \$PHP5BIN
" > /etc/sv/spawn-fcgi-$target/run
chmod +x /etc/sv/spawn-fcgi-$target/run
update-service --add /etc/sv/spawn-fcgi-$target spawn-fcgi-$target
}
create_control(){
echo "#! /bin/sh
#
### BEGIN INIT INFO
# Provides: control-$target
# Required-Start: $syslog
# Required-Stop: $syslog
# Should-Start: $local_fs
# Should-Stop: $local_fs
# Default-Start: 2
# Default-Stop: 0 1 6
# Short-Description: starts/stops $target
# Description: starts and stops $target
# a webserver chroot for $fqdn
#
### END INIT INFO
CHROOTBIN=/usr/sbin/chroot
CHROOTPATH=$chroot_container$target
NGINXDAEMON=`which nginx`
NAME=nginx
PHP5SUPPORT=$phpsupport
SPAWNBIN=`which spawn-fcgi`
PHP5BIN=`which php5-cgi`
PHP5PORT=$phpport
PHP5ADDR=127.0.0.1
PHPSUPERVISE=$phpsupervise
FCGIWRAPSUPPORT=$fcgiwrapsupport
FCGIWRAPSOCK=/var/run/fcgiwrap.sock
FCGIWRAPBIN=`which fcgiwrap`
USER=$target
DESC='chroot webserver (nginx/php) for $fqdn'
set -e
. /lib/lsb/init-functions
test_nginx_config() {
if \$CHROOTBIN \$CHROOTPATH -t \$NGINXDAEMON_OPTS >/dev/null 2>&1
then
return 0
else
\$CHROOTBIN \$CHROOTPATH \$NGINXDAEMON -t \$NGINXDAEMON_OPTS
return \$?
fi
}
case \"\$1\" in
start)
echo \"Starting \$DESC ---\"
# launching nginx
test_nginx_config
start-stop-daemon --chroot \$CHROOTPATH --start --pidfile /var/run/nginx.pid \
--exec \$NGINXDAEMON -- \$NGINXDAEMON_OPTS || true
echo -n \"nginx started with pid \"; cat \$CHROOTPATH/var/run/nginx.pid ; echo
if [ \$PHP5SUPPORT -eq 1 ]
then
if [ \$PHPSUPERVISE -eq 1 ]
then
svc -u /etc/service/spawn-fcgi-$target
echo \"spawn-fcgi and php5 started under supervise\"
else
start-stop-daemon --chroot \$CHROOTPATH --start \
--exec \$SPAWNBIN -- -a \$PHP5ADDR -p \$PHP5PORT \
-u \$USER -g \$USER -P /var/run/php5-cgi.pid \$PHP5BIN || true
echo -n \"php5-cgi started with pid \"; cat \$CHROOTPATH/var/run/php5-cgi.pid ; echo
fi
fi
if [ \$FCGIWRAPSUPPORT -eq 1 ]
then
start-stop-daemon --chroot \$CHROOTPATH --start \
--exec \$SPAWNBIN -- -s \$FCGIWRAPSOCK \
-u \$USER -g \$USER -P /var/run/fcgiwrap.pid \$FCGIWRAPBIN || true
echo -n \"fcgiwrap started with pid \"; cat \$CHROOTPATH/var/run/fcgiwrap.pid ; echo
fi
;;
stop)
echo \"Stopping \$DESC ---\"
if [ -e \$CHROOTPATH/var/run/nginx.pid ]
then
kill \`cat \$CHROOTPATH/var/run/nginx.pid\`
if [ \$? -ne 0 ]
then
echo -n \"couldn't kill nginx - found running pid \" ; \`cat \$CHROOTPATH/var/run/nginx.pid\`;echo
else
echo \"stopping nginx\"
fi
else
echo \"nginx is not running, no pid file in /var/run/\"
fi
if [ \$PHP5SUPPORT -eq 1 ]
then
if [ \$PHPSUPERVISE -eq 1 ]
then
svc -d /etc/service/spawn-fcgi-$target
echo \"spawn-fcgi and php5 stopped under supervise\"
else
if [ -e \$CHROOTPATH/var/run/php5-cgi.pid ]
then
ps -p \`cat \$CHROOTPATH/var/run/php5-cgi.pid\` 2>&1 1>/dev/null
if [ $? -ne 0 ]
then
echo \"php5-cgi process not running\"
else
kill \`cat \$CHROOTPATH/var/run/php5-cgi.pid\`
if [ \$? -ne 0 ]
then
echo -n \"couldn't kill php5-cgi - pid=\";\`cat \$CHROOTPATH/var/run/php5-cgi.pid\`;echo
else
echo \"php5-cgi has been stopped\"
fi
fi
else
echo \"no php5-cgi pid file in /var/run/\"
fi
fi
fi
if [ \$FCGIWRAPSUPPORT -eq 1 ]
then
if [ -e \$CHROOTPATH/var/run/fcgiwrap.pid ]
then
ps -p \`cat \$CHROOTPATH/var/run/fcgiwrap.pid\` 2>&1 1>/dev/null
if [ $? -ne 0 ]
then
echo \"fcgiwrap process not running\"
else
kill \`cat \$CHROOTPATH/var/run/fcgiwrap.pid\`
if [ $? -ne 0 ]
then
echo -n \"couldn't kill fcgiwrap - pid=\";\`cat \$CHROOTPATH/var/run/fcgiwrap.pid\`;echo
else
echo \"fcgiwrap has been stopped\"
fi
fi
else
echo \"no fcgiwrap.pid file in /var/run/\"
fi
fi
;;
restart)
echo -n \"Restarting \$DESC: \"
\$0 stop
sleep 1
\$0 start
;;
configtest)
echo -n \"Testing \$DESC configuration: \"
if test_nginx_config
then
echo \"\$NAME.\"
else
exit \$?
fi
;;
status)
status_of_proc -p \$CHROOTPATH/var/run/nginx.pid \"\$NGINXDAEMON\" nginx && exit 0 || exit $?
" >> /etc/init.d/control-$target
if [ $phpsupport -eq 1 ]
then
echo "
status_of_proc -p \$CHROOTPATH/var/run/php5-cgi.pid \"\$PHP5BIN\" php5-cgi && exit 0 || exit $?
" >> /etc/init.d/control-$target
fi
echo "
;;
*)
echo \"Usage: \$0 {start|stop|restart|status|configtest}\" >&2
exit 1
;;
esac
exit 0
" >> /etc/init.d/control-$target
if [ -e /etc/init.d/control-$target ]
then
chmod +x /etc/init.d/control-$target
else
echo "couldn't create control file /etc/init.d/control-$target"
exit 1
fi
}
usage(){
echo "Chroot installation script"
echo "Syntax: $0 <site name>"
echo "example: $0 chroot-example"
echo "this will initiate the creation of $chroot_container/chroot-example"
exit 1
}
[ $# -ne 1 ] && usage
[ $UID -ne 0 ] && echo "You need to be root to launch this program" && usage
target=$1
[ -d $chroot_container$target ] && echo "Target already exist !" && exit 1
echo -n "This is going to install a chroot environment in $chroot_container$target. Do you want to continue ? y/n > "
read response
if [ $response != "y" ]
then
exit 1
fi
# create the environment
install_env "${target}"
# get some information from the administrator before we start
port_available=$(netstat -taupen|grep :50|grep LISTEN|awk '{print $4}'|cut -d : -f 2|sort|tail -n 1)
port_available=$(( $port_available + 1 ))
echo -n "Nginx listening port ($port_available seems available) ? > "
read nginxport
echo -n "What will the FQDN of the server be ? (example.com) ? > "
read fqdn
echo -n "Do you want chrooted php support ? y/n > "
read response
if [ $response == "y" ]
then
phpsupport=1
echo -n "Which port should php cgi listen on ? > "
read phpport
echo -n "Would you like to install php5-mysql support in the chroot ? y/n > "
read response
if [ $response == "y" ]
then
install_mysql "${target}"
fi
else
phpsupport=0
fi
if [ $phpsupport -eq 1 ]
then
install_php "${target}"
echo -n "Would you like to add to supervise php using daemon-tools 'supervise' ? y/n > "
read response
if [ $response == "y" ]
then
phpsupervise=1
create_supervised_config "${target}"
else
phpsupervise=0
fi
fi
echo -n "Do you want chrooted fcgiwrap support ? y/n > "
read response
if [ $response == "y" ]
then
fcgiwrapsupport=1
install_fcgiwrap "${target}"
else
fcgiwrapsupport=0
fi
echo -n "Do you want perl support ? y/n > "
read response
if [ $response == "y" ]
then
install_perl "${target}"
echo -n "Also want Mojolicious ? y/n > "
read response
if [ $response == "y" ]
then
install_mojolicious "${target}"
fi
fi
# call installation functions
install_nginx "${target}"
create_control "${target}"
echo -n "Would you like to add this server to startup runlevel 2 ? y/n > "
read response
if [ $response == "y" ]
then
SAVEPWD=`pwd`
cd /etc/rc2.d
ln -s ../init.d/control-$target S17control-$target
cd /etc/rc6.d
ln -s ../init.d/control-$target K01control-$target
cd $SAVEPWD
fi
echo -n "Would you like to create a logrotate rule for this server ? y/n > "
read response
if [ $response == "y" ]
then
echo "$chroot_container$target/var/log/nginx/*.log {
daily
missingok
rotate 7
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
postrotate
[ ! -f $chroot_container$target/var/run/nginx.pid ] || kill -USR1 \`cat $chroot_container$target/var/run/nginx.pid\`
endscript
}" > /etc/logrotate.d/$target
fi
echo "The installation of the chroot environment is finished."
echo "To control the environement, use the script located at /etc/init.d/control-$target (outside the chroot)"
exit 0