CHG-2025-XX-XX migrate wiki to hetzner3 - Revision history

Maltfield: update LocalSettings to enable the new extensions SmiteSpam & DeleteBatch

2025-03-17T21:57:30Z

update LocalSettings to enable the new extensions SmiteSpam & DeleteBatch

← Older revision		Revision as of 21:57, 17 March 2025
Line 277:		Line 277:
	fi		fi
	done		done

			# enable new extensions: SmiteSpam & DeleteBatch
			grep 'SmiteSpam' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%wfLoadExtension$ 'Nuke' $;%wfLoadExtension( 'Nuke' );\nwfLoadExtension( 'SmiteSpam' );\nwfLoadExtension( 'DeleteBatch' );%igs" ${vhostDir}/LocalSettings.php

	# add skins (with wfLoadSkin() instead of require_once)		# add skins (with wfLoadSkin() instead of require_once)

Maltfield: adding a couple new spam-cleanup-related plugins per discussion with Marcin

2025-03-17T21:37:38Z

adding a couple new spam-cleanup-related plugins per discussion with Marcin

← Older revision		Revision as of 21:37, 17 March 2025
Line 266:		Line 266:
	# UPDATE EXTENSIONS		# UPDATE EXTENSIONS

	extensions="ConfirmAccount UserMerge Widgets"		extensions="ConfirmAccount UserMerge Widgets DeleteBatch SmiteSpam"

	for extension in ${extensions}; do		for extension in ${extensions}; do

Maltfield: add bogus chmod command

2025-02-13T23:06:52Z

add bogus chmod command

← Older revision		Revision as of 23:06, 13 February 2025
Line 201:		Line 201:

	# fix MediaWiki bugs		# fix MediaWiki bugs
	grep 'ini_set' ${vhostDir}/LocalSettings.php \|\| sed -i 's%^<?php%<?php\n# fix mediawiki bugs\n# * https://phabricator.wikimedia.org/T385965\nif( ! function_exists("ini_set") ){\n\tfunction ini_set(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("putenv") ){\n\tfunction putenv(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("php_uname") ){\n\tfunction php_uname(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("set_time_limit") ){\n\tfunction set_time_limit(){\n\t\treturn;\n\t}\n}\n%' ${vhostDir}/LocalSettings.php		grep 'ini_set' ${vhostDir}/LocalSettings.php \|\| sed -i 's%^<?php%<?php\n# fix mediawiki bugs\n# * https://phabricator.wikimedia.org/T385965\nif( ! function_exists("ini_set") ){\n\tfunction ini_set(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("putenv") ){\n\tfunction putenv(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("php_uname") ){\n\tfunction php_uname(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("set_time_limit") ){\n\tfunction set_time_limit(){\n\t\treturn;\n\t}\n}\nif( ! function_exists("chmod") ){\n\tfunction chmod(){\n\t\treturn;\n\t}\n}\n%' ${vhostDir}/LocalSettings.php

	# FIX PERMISSIONS		# FIX PERMISSIONS

Maltfield: missing semicolons

2025-02-13T22:59:56Z

missing semicolons

← Older revision		Revision as of 22:59, 13 February 2025
Line 285:		Line 285:

	# re-enable ConfirmEdit and switch to FancyCaption		# re-enable ConfirmEdit and switch to FancyCaption
	grep 'FancyCaptcha' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%\\\$wgCaptchaClass = 'SimpleCaptcha';%\#\\\$wgCaptchaClass = 'SimpleCaptcha';\n\nwfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/FancyCaptcha' ]);\n\\\$wgCaptchaDirectory = '/var/www/html/wiki.opensourceecology.org/htdocs/images/captcha/'\n\\\$wgCaptchaSecret = '$wgCaptchaSecret'\n%igs" ${vhostDir}/LocalSettings.php		grep 'FancyCaptcha' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%\\\$wgCaptchaClass = 'SimpleCaptcha';%\#\\\$wgCaptchaClass = 'SimpleCaptcha';\n\nwfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/FancyCaptcha' ]);\n\\\$wgCaptchaDirectory = '/var/www/html/wiki.opensourceecology.org/htdocs/images/captcha/';\n\\\$wgCaptchaSecret = '$wgCaptchaSecret';\n%igs" ${vhostDir}/LocalSettings.php

	# update cron script to use new secret		# update cron script to use new secret

Maltfield: make backup of mediawiki_generate_captchas.sh first

2025-02-13T22:48:02Z

make backup of mediawiki_generate_captchas.sh first

← Older revision		Revision as of 22:48, 13 February 2025
Line 288:		Line 288:

	# update cron script to use new secret		# update cron script to use new secret
	sed -e "s%CAPTCHA_SECRET='$[^']*$'%\CAPTCHA_SECRET='$wgCaptchaSecret'%" /usr/local/bin/mediawiki_generate_captchas.sh		cp /usr/local/bin/mediawiki_generate_captchas.sh /usr/local/bin/mediawiki_generate_captchas.sh.$(date "+%Y%m%d_%H%M%S")
			sed -ie "s%CAPTCHA_SECRET='$[^']*$'%\CAPTCHA_SECRET='$wgCaptchaSecret'%" /usr/local/bin/mediawiki_generate_captchas.sh

	# re-enable ConfirmAccount extension		# re-enable ConfirmAccount extension

Maltfield: update CAPTCHA salt secret in /usr/local/bin/mediawiki_generate_captchas.sh to match MediaWiki LocalSettings.php file

2025-02-13T22:46:26Z

update CAPTCHA salt secret in /usr/local/bin/mediawiki_generate_captchas.sh to match MediaWiki LocalSettings.php file

← Older revision		Revision as of 22:46, 13 February 2025
Line 286:		Line 286:
	# re-enable ConfirmEdit and switch to FancyCaption		# re-enable ConfirmEdit and switch to FancyCaption
	grep 'FancyCaptcha' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%\\\$wgCaptchaClass = 'SimpleCaptcha';%\#\\\$wgCaptchaClass = 'SimpleCaptcha';\n\nwfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/FancyCaptcha' ]);\n\\\$wgCaptchaDirectory = '/var/www/html/wiki.opensourceecology.org/htdocs/images/captcha/'\n\\\$wgCaptchaSecret = '$wgCaptchaSecret'\n%igs" ${vhostDir}/LocalSettings.php		grep 'FancyCaptcha' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%\\\$wgCaptchaClass = 'SimpleCaptcha';%\#\\\$wgCaptchaClass = 'SimpleCaptcha';\n\nwfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/FancyCaptcha' ]);\n\\\$wgCaptchaDirectory = '/var/www/html/wiki.opensourceecology.org/htdocs/images/captcha/'\n\\\$wgCaptchaSecret = '$wgCaptchaSecret'\n%igs" ${vhostDir}/LocalSettings.php

			# update cron script to use new secret
			sed -e "s%CAPTCHA_SECRET='$[^']*$'%\CAPTCHA_SECRET='$wgCaptchaSecret'%" /usr/local/bin/mediawiki_generate_captchas.sh

	# re-enable ConfirmAccount extension		# re-enable ConfirmAccount extension

Maltfield: wgCaptchaSecret needs to be set on hetzner3, not hetzner2

2025-02-13T22:39:52Z

wgCaptchaSecret needs to be set on hetzner3, not hetzner2

← Older revision		Revision as of 22:39, 13 February 2025
Line 90:		Line 90:
	source /root/backups/backup.settings		source /root/backups/backup.settings
	stamp=`date +%Y%m%d`		stamp=`date +%Y%m%d`
	~~wgCaptchaSecret=$(cat /dev/random \| strings \| grep -oE '[A-Za-z0-9]' \| perl -p -e 's/\n//g' \| head -c 64)~~
	backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner2/${vhost_name}_${stamp}"
	backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"
Line 126:		Line 125:
	source /root/backups/backup.settings		source /root/backups/backup.settings
	stamp=`date +%Y%m%d`		stamp=`date +%Y%m%d`
			wgCaptchaSecret=$(cat /dev/random \| strings \| grep -oE '[A-Za-z0-9]' \| perl -p -e 's/\n//g' \| head -c 64)
	backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner3/${vhost_name}_${stamp}"		backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner3/${vhost_name}_${stamp}"
	backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"

Maltfield: update admins after install

2025-02-13T22:16:11Z

update admins after install

← Older revision		Revision as of 22:16, 13 February 2025
Line 312:		Line 312:

	# log into the new MediaWiki site, and update settings:		# log into the new MediaWiki site, and update settings:

			# Create a new account (Called 'CatarinaAdmin') and add it to sysop group

			# Remove the following accounts from the sysop group
			## Audrey Rampone
			## Elifarley
			## Hart
			## Will

	# TODO: Enforce 2FA for all admin accounts		# TODO: Enforce 2FA for all admin accounts

Maltfield: s/hCaptcha/FancyCaptcha/

2025-02-13T21:46:03Z

s/hCaptcha/FancyCaptcha/

← Older revision		Revision as of 21:46, 13 February 2025
Line 284:		Line 284:
	grep 'wfLoadExtension.*CategoryTree' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e 's%#require_once$"{\$IP}/extensions/CategoryTree/CategoryTree.php"$;%#require_once("{$IP}/extensions/CategoryTree/CategoryTree.php");\n\nwfLoadExtension( "CategoryTree" );\n%igs' ${vhostDir}/LocalSettings.php		grep 'wfLoadExtension.*CategoryTree' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e 's%#require_once$"{\$IP}/extensions/CategoryTree/CategoryTree.php"$;%#require_once("{$IP}/extensions/CategoryTree/CategoryTree.php");\n\nwfLoadExtension( "CategoryTree" );\n%igs' ${vhostDir}/LocalSettings.php

	# re-enable ConfirmEdit and switch to ~~hCaptcha~~		# re-enable ConfirmEdit and switch to FancyCaption
	grep '~~hCaptcha~~' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%\\\$wgCaptchaClass = 'SimpleCaptcha';%\#\\\$wgCaptchaClass = 'SimpleCaptcha';\n\nwfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/~~hCaptcha~~' ]);\n\\\$~~wgHCaptchaSiteKey~~ = '~~your public~~/~~site key here~~';\n\\\$~~wgHCaptchaSecretKey~~ = '~~your private key here~~';\n%igs" ${vhostDir}/LocalSettings.php		grep 'FancyCaptcha' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%\\\$wgCaptchaClass = 'SimpleCaptcha';%\#\\\$wgCaptchaClass = 'SimpleCaptcha';\n\nwfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/FancyCaptcha' ]);\n\\\$wgCaptchaDirectory = '/var/www/html/wiki.opensourceecology.org/htdocs/images/captcha/'\n\\\$wgCaptchaSecret = '$wgCaptchaSecret'\n%igs" ${vhostDir}/LocalSettings.php

	# re-enable ConfirmAccount extension		# re-enable ConfirmAccount extension
Line 304:		Line 304:
	# configure OATH (2FA) requirements		# configure OATH (2FA) requirements
	grep 'wgOATHAuthWindowRadius' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%wfLoadExtension$ 'OATHAuth' $;%wfLoadExtension( 'OATHAuth' );\n\n# Relaxed mode with +/- 4 minutes time drift tolerance. This is important or users will complain and/or disable 2FA entirely\n# The security consequences are small. The usability benefits are huge.\n\\\$wgOATHAuthWindowRadius = 8;\n\n# make admins require 2FA\n\\\$wgOATHRequiredForGroups = ['sysop', 'interface-admin', 'bureaucrat', 'suppress', 'widgeteditor' ];\n\n# make 'powerful' rights require 2FA\n\\\$wgOATHExclusiveRights = [ 'apihighlimits', 'applychangetags', 'autoconfirmed', 'autopatrol', 'bigdelete', 'block', 'blockemail', 'bot', 'changetags', 'createaccount', 'createtalk', 'delete', 'deletechangetags', 'deletedhistory', 'deletedtext', 'deletelogentry', 'deleterevision', 'editcontentmodel', 'editinterface', 'editprotected', 'editsemiprotected', 'editsitecss', 'editsitejs', 'editsitejson', 'editusercss', 'edituserjs', 'edituserjson', 'hideuser', 'import', 'importupload', 'ipblock-exempt', 'managechangetags', 'markbotedits', 'mergehistory', 'move-categorypages', 'move-rootuserpages', 'move-subpages', 'nominornewtalk', 'noratelimit', 'patrol', 'protect', 'renameuser', 'reupload-shared', 'sendemail', 'suppressionlog', 'suppressredirect', 'suppressrevision', 'unblockself', 'unwatchedpages', 'userrights', ];\n\n# full list for reference (taken from htdocs/includes/MainConfigSchema.php) https://www.mediawiki.org/wiki/Extension:OATHAuth#Configuration\n#\\\$wgOATHExclusiveRights = [ 'apihighlimits', 'applychangetags', 'autoconfirmed', 'autopatrol', 'bigdelete', 'block', 'blockemail', 'bot', 'browsearchive', 'changetags', 'createaccount', 'createpage', 'createtalk', 'delete', 'deletechangetags', 'deletedhistory', 'deletedtext', 'deletelogentry', 'deleterevision', 'edit', 'editcontentmodel', 'editinterface', 'editmyoptions', 'editmyprivateinfo', 'editmyusercss', 'editmyuserjs', 'editmyuserjson', 'editmyuserjsredirect', 'editmywatchlist', 'editprotected', 'editsemiprotected', 'editsitecss', 'editsitejs', 'editsitejson', 'editusercss', 'edituserjs', 'edituserjson', 'hideuser', 'import', 'importupload', 'ipblock-exempt', 'managechangetags', 'markbotedits', 'mergehistory', 'minoredit', 'move', 'move-categorypages', 'movefile', 'move-rootuserpages', 'move-subpages', 'nominornewtalk', 'noratelimit', 'patrol', 'protect', 'read', 'renameuser', 'reupload', 'reupload-shared', 'rollback', 'sendemail', 'suppressionlog', 'suppressredirect', 'suppressrevision', 'unblockself', 'undelete', 'unwatchedpages', 'upload', 'userrights', 'viewmyprivateinfo', 'viewmywatchlist', 'viewsuppressed' ];\n%igs" ${vhostDir}/LocalSettings.php		grep 'wgOATHAuthWindowRadius' ${vhostDir}/LocalSettings.php \|\| perl -0777 -pi -e "s%wfLoadExtension$ 'OATHAuth' $;%wfLoadExtension( 'OATHAuth' );\n\n# Relaxed mode with +/- 4 minutes time drift tolerance. This is important or users will complain and/or disable 2FA entirely\n# The security consequences are small. The usability benefits are huge.\n\\\$wgOATHAuthWindowRadius = 8;\n\n# make admins require 2FA\n\\\$wgOATHRequiredForGroups = ['sysop', 'interface-admin', 'bureaucrat', 'suppress', 'widgeteditor' ];\n\n# make 'powerful' rights require 2FA\n\\\$wgOATHExclusiveRights = [ 'apihighlimits', 'applychangetags', 'autoconfirmed', 'autopatrol', 'bigdelete', 'block', 'blockemail', 'bot', 'changetags', 'createaccount', 'createtalk', 'delete', 'deletechangetags', 'deletedhistory', 'deletedtext', 'deletelogentry', 'deleterevision', 'editcontentmodel', 'editinterface', 'editprotected', 'editsemiprotected', 'editsitecss', 'editsitejs', 'editsitejson', 'editusercss', 'edituserjs', 'edituserjson', 'hideuser', 'import', 'importupload', 'ipblock-exempt', 'managechangetags', 'markbotedits', 'mergehistory', 'move-categorypages', 'move-rootuserpages', 'move-subpages', 'nominornewtalk', 'noratelimit', 'patrol', 'protect', 'renameuser', 'reupload-shared', 'sendemail', 'suppressionlog', 'suppressredirect', 'suppressrevision', 'unblockself', 'unwatchedpages', 'userrights', ];\n\n# full list for reference (taken from htdocs/includes/MainConfigSchema.php) https://www.mediawiki.org/wiki/Extension:OATHAuth#Configuration\n#\\\$wgOATHExclusiveRights = [ 'apihighlimits', 'applychangetags', 'autoconfirmed', 'autopatrol', 'bigdelete', 'block', 'blockemail', 'bot', 'browsearchive', 'changetags', 'createaccount', 'createpage', 'createtalk', 'delete', 'deletechangetags', 'deletedhistory', 'deletedtext', 'deletelogentry', 'deleterevision', 'edit', 'editcontentmodel', 'editinterface', 'editmyoptions', 'editmyprivateinfo', 'editmyusercss', 'editmyuserjs', 'editmyuserjson', 'editmyuserjsredirect', 'editmywatchlist', 'editprotected', 'editsemiprotected', 'editsitecss', 'editsitejs', 'editsitejson', 'editusercss', 'edituserjs', 'edituserjson', 'hideuser', 'import', 'importupload', 'ipblock-exempt', 'managechangetags', 'markbotedits', 'mergehistory', 'minoredit', 'move', 'move-categorypages', 'movefile', 'move-rootuserpages', 'move-subpages', 'nominornewtalk', 'noratelimit', 'patrol', 'protect', 'read', 'renameuser', 'reupload', 'reupload-shared', 'rollback', 'sendemail', 'suppressionlog', 'suppressredirect', 'suppressrevision', 'unblockself', 'undelete', 'unwatchedpages', 'upload', 'userrights', 'viewmyprivateinfo', 'viewmywatchlist', 'viewsuppressed' ];\n%igs" ${vhostDir}/LocalSettings.php

	~~# add hCAPTCHA keys~~
	~~vim ${vhostDir}/LocalSettings.php~~

	# FIX PERMISSIONS		# FIX PERMISSIONS

Maltfield: randomly generate wgCaptchaSecret (for MediaWiki ConfirmEdit/ConfirmAccount FancyCaptcha)

2025-02-13T21:35:21Z

randomly generate wgCaptchaSecret (for MediaWiki ConfirmEdit/ConfirmAccount FancyCaptcha)

← Older revision		Revision as of 21:35, 13 February 2025
Line 90:		Line 90:
	source /root/backups/backup.settings		source /root/backups/backup.settings
	stamp=`date +%Y%m%d`		stamp=`date +%Y%m%d`
			wgCaptchaSecret=$(cat /dev/random \| strings \| grep -oE '[A-Za-z0-9]' \| perl -p -e 's/\n//g' \| head -c 64)
	backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner2="/var/tmp/backups_for_migration_to_hetzner2/${vhost_name}_${stamp}"
	backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"		backupDir_hetzner3="/var/tmp/backups_for_migration_from_hetzner2/${vhost_name}_${stamp}"