diff options
Diffstat (limited to 'doc/INSTALL.md')
| -rw-r--r-- | doc/INSTALL.md | 108 |
1 files changed, 58 insertions, 50 deletions
diff --git a/doc/INSTALL.md b/doc/INSTALL.md index 3a911cbc8..b356208a4 100644 --- a/doc/INSTALL.md +++ b/doc/INSTALL.md @@ -14,7 +14,7 @@ with all these steps configured. It is *not* production-ready. To start with, you may need to install git, e.g. with `sudo apt-get install git-core` -Next, get hold of the Alaveteli source code from github: +Next, get hold of the Alaveteli source code from github: git clone https://github.com/mysociety/alaveteli.git cd alaveteli @@ -27,7 +27,7 @@ master branch (which always contains the latest stable release): # Package pinning -You need to configure [apt-pinning](http://wiki.debian.org/AptPreferences#Pinning-1) preferences in order to prevent packages being pulled from the debian testing distribution in preference to the stable distribution once you have added the testing repository as described below. +You need to configure [apt-pinning](http://wiki.debian.org/AptPreferences#Pinning-1) preferences in order to prevent packages being pulled from the debian testing distribution in preference to the stable distribution once you have added the testing repository as described below. In order to configure apt-pinning and to keep most packages coming from the Debian stable repository while installing the ones required from testing and the mySociety repository you need to run the following commands: @@ -36,7 +36,7 @@ In order to configure apt-pinning and to keep most packages coming from the Debi echo "Pin-Priority: 50" >> /tmp/preferences sudo cp /tmp/preferences /etc/apt/ rm /tmp/preferences - + # Install system dependencies These are packages that the software depends on: third-party software @@ -67,21 +67,13 @@ Some of the files also have a version number listed in config/packages # Install Ruby dependencies -Install rubygems 1.6.2 (we're not using the Debian package because we -need an older version; see "Troubleshooting" below for an -explanation): - - wget http://rubyforge.org/frs/download.php/74445/rubygems-1.6.2.tgz -O /tmp/rubygems-1.6.2.tgz - tar zxvf /tmp/rubygems-1.6.2.tgz -C /tmp/ - sudo ruby1.8 /tmp/rubygems-1.6.2/setup.rb - -To install Alaveteli's Ruby dependencies, we also need to install +To install Alaveteli's Ruby dependencies, we need to install bundler. In Debian, this is provided as a package (installed as part of the package install process above). You could also install it as a gem: sudo gem1.8 install bundler - + # Install mySociety libraries You will also want to install mySociety's common ruby libraries and the Rails @@ -118,7 +110,7 @@ use the Debian package compiled by mySociety (see link in [issue 305](https://github.com/mysociety/alaveteli/issues/305)) -# Configure Database +# Configure Database There has been a little work done in trying to make the code work with other databases (e.g. SQLite), but the currently supported database is @@ -138,13 +130,14 @@ username and password of your postgres database. Make sure that the user specified in database.yml exists, and has full permissions on these databases. As they need the ability to turn off constraints whilst running the tests they also need to be a superuser. -(See http://dev.rubyonrails.org/ticket/9981) - +If you don't want your database user to be a superuser, you can add a line +`disable_constraints: false` to the test config in database.yml, as seen in database.yml-example + You can create a `foi` user from the command line, thus: # su - postgres $ createuser -s -P foi - + And you can create a database thus: $ createdb -T template0 -E SQL_ASCII -O foi foi_production @@ -157,15 +150,15 @@ data that may not be valid UTF (for example, data originating from various broken email clients that's not 8-bit clean), it's safer to be able to store *anything*, than reject data at runtime. -# Configure email +# Configure email You will need to set up an email server (MTA) to send and receive emails. Full configuration for an MTA is beyond the scope of this document, though we describe an example configuration for Exim in `INSTALL-exim4.md`. -Note that in development mode, mail is handled by default by mailcatcher -so that you can see the mails in a browser - see http://mailcatcher.me/ +Note that in development mode, mail is handled by default by mailcatcher +so that you can see the mails in a browser - see http://mailcatcher.me/ for more details. ## Minimal @@ -230,7 +223,7 @@ for instructions on switching on local and remote performance analysis. In the 'alaveteli' directory, run: - ./script/rails-post-deploy + script/rails-post-deploy (This will need execute privs so `chmod 755` if necessary.) This sets up directory structures, creates logs, installs/updates themes, runs @@ -245,11 +238,11 @@ If you want some dummy data to play with, you can try loading the fixtures that the test suite uses into your development database. You can do this with: - ./script/load-sample-data + script/load-sample-data Next we need to create the index for the search engine (Xapian): - ./script/rebuild-xapian-index + script/rebuild-xapian-index If this fails, the site should still mostly run, but it's a core component so you should really try to get this working. @@ -281,7 +274,7 @@ tests to pass by setting `export LD_PRELOAD=/lib/libuuid.so.1`. Run the following to get the server running: - ./script/server --environment=development + script/server --environment=development By default the server listens on all interfaces. You can restrict it to the localhost interface by adding ` --binding=127.0.0.1` @@ -301,7 +294,7 @@ There is an emergency user account which can be accessed via `/admin?emergency=1`, using the credentials `ADMIN_USERNAME` and `ADMIN_PASSWORD`, which are set in `general.yml`. To bootstrap the first `super` level accounts, you will need to log in as the emergency -user. +user. You can disable the emergency user account by setting `DISABLE_EMERGENCY_USER` to `true` in `general.yml`. Users with the superuser role also have extra privileges in the website frontend, such as being able to categorise any request, being @@ -314,9 +307,9 @@ by setting `SKIP_ADMIN_AUTH` to `true` in `general.yml`. # Cron jobs and init scripts -`config/crontab.ugly` contains the cronjobs run on WhatDoTheyKnow. +`config/crontab-example` contains the cronjobs run on WhatDoTheyKnow. It's in a strange templating format they use in mySociety. mySociety -render the "ugly" file to reference absolute paths, and then drop it +render the example file to reference absolute paths, and then drop it in `/etc/cron.d/` on the server. The `ugly` format uses simple variable substitution. A variable looks @@ -328,7 +321,7 @@ like `!!(*= $this *)!!`. The variables are: port with a path to the directory where your Alaveteli software installation lives, e.g. `/var/www/` * `vhost_dir`: the entire path to the directory where the software is - served from. -- you should replace this with a path to the + served from. -- you should replace this with a path to the directory where your Alaveteli software installation lives, e.g. `/var/www/` * `vcspath`: the name of the alaveteli checkout, e.g. `alaveteli`. @@ -367,8 +360,8 @@ It is not recommended to run the website using the default Rails web server. There are various recommendations here: http://rubyonrails.org/deploy -We usually use Passenger / mod_rails. The file at `conf/httpd.conf` -contains the WhatDoTheyKnow settings. At a minimum, you should +We usually use Passenger / mod_rails. The file at `conf/httpd.conf-example` +gives you an example config file for WhatDoTheyKnow. At a minimum, you should include the following in an Apache configuration file: PassengerResolveSymlinksInDocumentRoot on @@ -378,6 +371,34 @@ Under all but light loads, it is strongly recommended to run the server behind an http accelerator like Varnish. A sample varnish VCL is supplied in `../conf/varnish-alaveteli.vcl`. +It's strongly recommended that you run the site over SSL. (Set FORCE_SSL to true in +config/general.yml). For this you will need an SSL certificate for your domain and you will +need to configure an SSL terminator to sit in front of Varnish. If you're already using Apache +as a web server you could simply use Apache as the SSL terminator. A minimal configuration +would look something like this: + +<VirtualHost *:443> + ServerName www.yourdomain + + ProxyRequests Off + ProxyPreserveHost On + ProxyPass / http://localhost:80/ + ProxyPassReverse / http://localhost:80/ + RequestHeader set X-Forwarded-Proto 'https' + + SSLEngine on + SSLProtocol all -SSLv2 + SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM + + SSLCertificateFile /etc/apache2/ssl/ssl.crt + SSLCertificateKeyFile /etc/apache2/ssl/ssl.key + SSLCertificateChainFile /etc/apache2/ssl/sub.class2.server.ca.pem + SSLCACertificateFile /etc/apache2/ssl/ca.pem + SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown +</VirtualHost> + +Notice the line "RequestHeader" that sets the X-Forwarded-Proto header. This is important. This ultimately tells Rails that it's serving a page over https and so it knows to include that in any absolute urls it serves. + Some [production server best practice notes](https://github.com/mysociety/alaveteli/wiki/Production-Server-Best-Practices) are evolving on the wiki. @@ -413,14 +434,14 @@ various other things that can be automated for deployment. # Troubleshooting * **Incoming emails aren't appearing in my Alaveteli install** - + First, you need to check that your MTA is delivering relevant incoming emails to the `script/mailin` command. There are various ways of setting your MTA up to do this; we have documented one way of doing it in Exim at `doc/INSTALL-exim4.conf`, including a command you can use to check that the email routing is set up correctly. - + Second, you need to test that the mailin script itself is working correctly, by running it from the command line, First, find a valid "To" address for a request in your system. You can do this @@ -431,7 +452,7 @@ various other things that can be automated for deployment. Loading development environment (Rails 2.3.14) >> InfoRequest.find_by_url_title("why_do_you_have_such_a_fancy_dog").incoming_email => "request-101-50929748@localhost" - + Now take the source of a valid email (there are some sample emails in `spec/fixtures/files/`); edit the `To:` header to match this address; and then pipe it through the mailin script. A non-zero exit code @@ -447,7 +468,7 @@ various other things that can be automated for deployment. `CONTACT_EMAIL` (from your `general.yml` file). A common problem is for the user that the MTA runs as not to have write access to `files/raw_emails/`. - + * **Various tests fail with "*Your PostgreSQL connection does not support unescape_bytea. Try upgrading to pg 0.9.0 or later.*"** @@ -470,29 +491,16 @@ various other things that can be automated for deployment. Normally, the encoding should just work, but under some circumstances it appears that `elinks` ignores the parameters passed to it from Alaveteli. - + To force `elinks` always to treat input as UTF8, add the following to `/etc/elinks/elinks.conf`: - + set document.codepage.assume = "utf-8" set document.codepage.force_assumed = 1 - You should also check that your locale is set up correctly. See + You should also check that your locale is set up correctly. See [https://github.com/mysociety/alaveteli/issues/128#issuecomment-1814845](this issue followup) for further discussion. - -* **I'm getting lots of `SourceIndex.new(hash) is deprecated` errors when running the tests** - - The latest versions of rubygems contain a large number of noisy - deprecation warnings that you can't turn off individually. Rails - 2.x isn't under active development so isn't going to get fixed (in - the sense of using a non-deprecated API). So the only vaguely - sensible way to avoid this noisy output is to downgrade rubygems. - - For example, you might do this by uninstalling your - system-packaged rubygems, and then installing the latest rubygems - from source, and finally executing `sudo gem update --system - 1.6.2`. * **I'm seeing `rake: command not found` when running the post install script |