diff --git a/README.md b/README.md index 8c603a5..1a242d6 100644 --- a/README.md +++ b/README.md @@ -35,9 +35,10 @@ run and to maintain. sudo mkdir static media sudo chown www-data:www-data -R static media sudo chmod g+rwx -R static media + sudo chmod +x maintenance_tool.sh sudo cp docs/uwsgi_photos.ini /etc/uwsgi/apps-available/uwsgi_photos.ini sudo ln -s /etc/uwsgi/apps-available/uwsgi_photos.ini /etc/uwsgi/apps-enabled/ - sudo cp docs/nginx_photos /etc/nginx/sites-available/photos.crans.org + sudo cp docs/nginx_photos_maintenance /etc/nginx/sites-available/photos.crans.org sudo ln -s /etc/nginx/sites-available/photos.crans.org /etc/nginx/sites-enabled/ sudo cp docs/letsencrypt_photos.crans.org /etc/letsencrypt/conf.d/photos.crans.org sudo cp docs/renewal-hooks_post_nginx /etc/letsencrypt/renewal-hooks/post/nginx @@ -70,6 +71,12 @@ run and to maintain. # change DEBUG to True in photo21/settings.py ``` +6. **Maintenance Mode.**, + In production to toggle the server mainteance mode + + ```./maintenance_tool.sh``` + + 6. *Enjoy \o/* In production, the NGINX site should now work. diff --git a/docs/maintenance.html b/docs/maintenance.html new file mode 100644 index 0000000..c95d9a7 --- /dev/null +++ b/docs/maintenance.html @@ -0,0 +1,27 @@ + + + + + + Photo Server | Maintenance + + +
+
+

Maintenance Mode | Serveur Photo en maintance

+
+ +
+
+

The server will be back soon | Le serveur photo reviendra au plus vite, soyez patient

+
+
+
+

Contact Us | Pour nous contacter

+ photos@crans.org +
+
+ + + + \ No newline at end of file diff --git a/docs/nginx_photo_maintenance b/docs/nginx_photo_maintenance new file mode 100644 index 0000000..53db000 --- /dev/null +++ b/docs/nginx_photo_maintenance @@ -0,0 +1,80 @@ +# This file is part of photo21 +# Copyright (C) 2022 Amicale des élèves de l'ENS Paris-Saclay +# SPDX-License-Identifier: GPL-3.0-or-later** + +server { + listen 80; + listen [::]:80; + server_name photos.crans.org; + location / { + return 302 https://$host$request_uri; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name photos.crans.org; + + # Keep the TCP connection open a bit for faster browsing + keepalive_timeout 70; + + ssl_certificate /etc/letsencrypt/live/photos.crans.org/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/photos.crans.org/privkey.pem; + ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; + ssl_session_tickets off; + ssl_dhparam /etc/letsencrypt/dhparam; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + + # Enable OCSP Stapling, point to certificate chain + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/letsencrypt/live/photos.crans.org/chain.pem; + + error_log /var/log/nginx/photos.crans.org_error.log; + access_log /var/log/nginx/photos.crans.org_access.log; + + # Allow 2Go upload at once + client_max_body_size 2G; + + add_header "X-XSS-Protection" "1; mode=block"; + + # Django statics and media + # Do not directly serve media, it must be authorized + # by a Django view to check permissions + location /protected/media { + internal; + alias /var/www/photos/photo21/media; + } + + location /static { + alias /var/www/photos/photo21/static; + } + + error_page 503 /maintenance.html ; + + location /maintenance.html { + try_files /var/www/photos/photo21/docs/maintenance.html =404; + } + + location / { + set $maintenance 0; + if (-f /var/www/photos/photo21/docs/maintenance.flag){ + return 503; + } + + + uwsgi_pass unix:///var/run/uwsgi/app/uwsgi_photos/socket; + include /etc/nginx/uwsgi_params; + proxy_connect_timeout 600; + proxy_send_timeout 600; + proxy_read_timeout 600; + send_timeout 600; + } + + +} diff --git a/maintenance_tool.sh b/maintenance_tool.sh new file mode 100644 index 0000000..5ce6f4e --- /dev/null +++ b/maintenance_tool.sh @@ -0,0 +1,69 @@ +#!/bin/bash + +# Title: Site Maintenance Mode Toggle Script +# Description: Activates or deactivates site maintenance mode by toggling the presence of a flag file. +# Activation: Creating $FLAG_FILE +# Deactivation: Deleting $FLAG_FILE + +# --- CONFIGURATION --- +# IMPORTANT: Change this path to the root directory of your website. +# The script MUST have write permissions to this directory. +SITE_ROOT="/var/www/photos/photo21/" +FLAG_FILE="$SITE_ROOTdocs/maintenance.flag" +# --------------------- + +# Function to display current status +function display_status() { + echo "=================================================" + echo " SITE MAINTENANCE MODE TOOL" + echo "=================================================" + echo "Target Directory: $SITE_ROOT" + + if [ -f "$FLAG_FILE" ]; then + echo -e "\033[31mCURRENT STATUS: ACTIVE (Site is DOWN for Maintenance)\033[0m" + echo "Flag file present at: $FLAG_FILE" + else + echo -e "\033[32mCURRENT STATUS: INACTIVE (Site is UP and Running)\033[0m" + echo "Flag file is missing." + fi + echo "-------------------------------------------------" +} + +# Function to toggle mode based on current status +function toggle_mode() { + if [ -f "$FLAG_FILE" ]; then + # Maintenance is ON, offer to turn it OFF + read -r -p "Maintenance mode is ACTIVE. DEACTIVATE it? (y/N): " response + if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]]; then + rm -f "$FLAG_FILE" + if [ $? -eq 0 ]; then + echo -e "\n\033[32mSUCCESS:\033[0m Maintenance mode DEACTIVATED. Site should be live." + else + echo -e "\n\033[31mERROR:\033[0m Failed to remove '$FLAG_FILE'. Check script and directory permissions." + fi + else + echo "Action cancelled. Maintenance mode remains ACTIVE." + fi + else + # Maintenance is OFF, offer to turn it ON + read -r -p "Maintenance mode is INACTIVE. ACTIVATE it? (y/N): " response + if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]]; then + touch "$FLAG_FILE" + if [ $? -eq 0 ]; then + echo -e "\n\033[31mSUCCESS:\033[0m Maintenance mode ACTIVATED. Site should now show the maintenance page." + else + echo -e "\n\033[31mERROR:\033[0m Failed to create '$FLAG_FILE'. Check script and directory permissions." + fi + else + echo "Action cancelled. Maintenance mode remains INACTIVE." + fi + fi +} + +# Main execution +display_status +toggle_mode + +echo "=================================================" +echo "Script finished." +echo "=================================================" \ No newline at end of file