Documenting setup to enable HTTPS support

- New file INSTALL.https.md with instructions to setup Noosfero over HTTPS - Cosmetic changes in INSTALL.varnish.md file - Ejabberd configurations moved out of INSTALL.chat.md file - Fixing a small bug with the Noosfero chat client

Documenting setup to enable HTTPS support
- New file INSTALL.https.md with instructions to setup Noosfero over HTTPS - Cosmetic changes in INSTALL.varnish.md file - Ejabberd configurations moved out of INSTALL.chat.md file - Fixing a small bug with the Noosfero chat client
Joenio Costa
1 parent abdf6fab
Showing 8 changed files with 344 additions and 156 deletions Show diff stats
INSTALL.chat.md
INSTALL.https.md
INSTALL.varnish.md
etc/pound.cfg
public/javascripts/chat.js
util/chat/ejabberd.cfg
util/chat/odbc.ini
util/chat/odbcinst.ini
-XMPP/Chat Client Setup
-======================
+XMPP/Chat Setup
+===============
-To configure XMPP/BOSH in Noosfero you need:
+The samples of config file to configure a XMPP/BOSH server with ejabberd,
+postgresql and apache2 can be found at util/chat directory.
-* REST Client - http://github.com/archiloque/rest-client
-* SystemTimer - http://ph7spot.com/musings/system-timer
-* Pidgin data files - http://www.pidgin.im/
+This setup supposes that you are using Noosfero installed via Debian package
+in a production environment.
-If you use Debian 6.0 (squeeze):
-
-    # apt-get install librestclient-ruby pidgin-data ruby1.8-dev
-    # gem install SystemTimer
-
-The samples of config file to configure a XMPP/BOSH server with ejabberd, postgresql and apache2 can be found at util/chat directory.
-
-XMPP/Chat Server Setup
-======================
+Steps
+=====
 This is a step-by-step guide to get a XMPP service working, in a Debian system.
 ## 1. Install the required packages
-    # apt-get install ejabberd odbc-postgresql
+    # apt-get install ejabberd odbc-postgresql librestclient-ruby pidgin-data ruby1.8-dev
+    # gem install SystemTimer
 ## 2. Ejabberd configuration
-All the following changes must be done in config file: `/etc/ejabberd/ejabberd.cfg`
-
-### 2.1. Set the default admin user
-
-    { acl, admin, { user, "john", "www.example.com" } }.
-    { acl, admin, { user, "bart", "www.example.com" } }.
-
-### 2.2. Set the default host
-
-    { hosts, [ "www.example.com" ] }.
-
-### 2.3. Http-Bind activation
-
-    { 5280, ejabberd_http, [
-          http_bind,
-          web_admin
-       ]
-    }
-
-    (...)
-
-    { modules, [
-       {mod_http_bind, []},
-       ...
-    ] }.
-
-Ejabberd creates semi-anonymous rooms by default, but Noosfero's Jabber client needs non-anonymous room, then we need to change default params of creation rooms in ejabberd to create non-anonymous rooms.
-
-In non-anonymous rooms the jabber service sends the new occupant's full JID to all occupants in the room [[1]].
+    # cp /usr/share/noosfero/util/chat/ejabberd.cfg /etc/ejabberd/
-Add option "`{default_room_options, [{anonymous, false}]}`" to `/etc/ejabberd/ejabberd.cfg` in mod_muc session. See below:
+Edit the /etc/ejabberd/ejabberd.cfg file and set your domain on the first 2 lines.
-    { mod_muc, [
-       %%{host, "conference.@HOST@"},
-       {access, muc},
-       {access_create, muc},
-       {access_persistent, muc},
-       {access_admin, muc_admin},
-       {max_users, 500},
-       {default_room_options, [{anonymous, false}]}
-    ]},
-
-[1]: http://xmpp.org/extensions/xep-0045.html#enter-nonanon
-
-
-### 2.4. Authentication method
-
-To use Postgresql through ODBC, the following modifications must be done:
-
- * Disable the default method:
-   `{auth_method, internal}.`
-
- * Enable autheticantion through ODBC:
-   `{auth_method, odbc}.`
+## 3. Configuring Postgresql
- * Set database server name
-   `{odbc_server, "DSN=PostgreSQLEjabberdNoosfero"}.`
+Give permission to noosfero user create new roles, login as
+postgres user and execute:
+    $ psql
+    postgres=# GRANT CREATE ON DATABASE noosfero TO noosfero;
-### 2.5. Increase the shaper traffic limit
+Change the postgresql authentication method to md5 instead of ident,
+add the following line to the file /etc/postgresql/8.4/main/pg_hba.conf:
-    { shaper, normal, { maxrate, 10000000 } }.
+   # Noosfero user
+   local   noosfero    noosfero                          md5
+(add this line before the following line)
-### 2.6. Disable unused modules
+   # "local" is for Unix domain socket connections only
+   local   all         all                               ident
-Unused modules can be disabled, for example:
+Restart postgresql server:
- * s2s
- * web_admin
- * mod_pubsub
- * mod_irc
- * mod_offline
- * mod_admin_extra
- * mod_register
+    # service postgresql restart
+Login as noosfero user, and execute:
-### 2.7. Enable ODBC modules
+    $ psql -U noosfero -W noosfero < /usr/share/noosfero/util/chat/postgresql/ejabberd.sql
- * mod_privacy -> mod_privacy_odbc
- * mod_private -> mod_private_odbc
- * mod_roster  -> mod_roster_odbc
+(see database password in the /etc/noosfero/database.yml file)
-## 3. Configuring Postgresql
+This will create a new schema inside the noosfero database, called `ejabberd`.
-Login as noosfero user, and execute:
+Note that there should be at least one domain with `is_default = true` in
+`domains` table, otherwise people won't be able to see their friends online.
-    $ psql noosfero < /path/to/noosfero/util/chat/postgresql/ejabberd.sql
+## 4. ODBC configuration
-Where `noosfero` may need to be replace by the name of the database used for Noosfero.
+Create the following files:
-This will create a new schema inside the noosfero database, called `ejabberd`.
+    # cp /usr/share/noosfero/util/chat/odbc.ini /etc/
+    # cp /usr/share/noosfero/util/chat/odbcinst.ini /etc/
-Note `noosfero` user should have permission to create Postgresql schemas. Also, there should be at least one domain with `is_default = true` in `domains` table, otherwise people won't be able to see their friends online.
+Edit the odbc.ini file and set the password for the database user, see
+the file /etc/noosfero/database.yml to get the password.
-## 4. ODBC configuration
+Adjust premissions:
-The following files must be created:
-
-`/etc/odbc.ini`:
-
-    [PostgreSQLEjabberdNoosfero]
-    Description      = PostgreSQL Noosfero ejabberd database
-    Driver           = PostgreSQL Unicode
-    Trace            = No
-    TraceFile        = /tmp/psqlodbc.log
-    Database         = noosfero
-    Servername       = localhost
-    UserName         = <DBUSER>
-    Password         = <DBPASS>
-    Port             =
-    ReadOnly         = No
-    RowVersioning    = No
-    ShowSystemTables = No
-    ShowOidColumn    = No
-    FakeOidIndex     = No
-    ConnSettings     = SET search_path TO ejabberd
-
-`/etc/odbcinst.ini`:
-
-    [PostgreSQL Unicode]
-    Description = PostgreSQL ODBC driver (Unicode version)
-    Driver      = /usr/lib/odbc/psqlodbcw.so
-    Setup       = /usr/lib/odbc/libodbcpsqlS.so
-    Debug       = 0
-    CommLog     = 1
-    UsageCount  = 3
+    # chmod 640 /etc/odbc.ini
+    # chown ejabberd /etc/odbc.ini
 ## 4.1 testing all:
@@ -159,7 +78,6 @@ The following files must be created:
 If the configuration was done right, the message "Connected!" will be displayed.
-
 ## 5. Enabling kernel polling and SMP in `/etc/default/ejabberd`
     POLL=true
@@ -205,32 +123,45 @@ Note: module proxy_http must be enabled:
     # a2enmod proxy_http
-## 8. DNS configuration
+Restart services:
-For this point, we assume you are using BIND as your DNS server. You need to add the following entries to the DNS zone file corresponding to the domain of your noosfero site:
+    # service ejabberd restart
+    # service noosfero restart
+    # service apache2 restart
-    _xmpp-client._tcp   SRV   5 100 5222 master
-    conference   CNAME master
-    _xmpp-client._tcp.conference   SRV   5 100 5222 master
+## 8. Test Apache Configuration
-If you are running a DNS server other than BIND, you will have to figure out how to create equivalente rules for your zone file. Patches to this documentation are welcome.
+Open in your browser the address:
-## 9. Testing this Setup
+    http://<yout domain>/http-bind
-Adjust shell limits to proceed with some benchmarks and load tests: 
+You should see a page with a message like that:
-    # ulimit −s 256
-    # ulimit −n 8192
-    # echo 10 > /proc/sys/net/ipv4/tcp_syn_retries
+   ejabberd mod_http_bind
+   An implementation of XMPP over BOSH (XEP-0206)
+   This web page is only informative. To use HTTP-Bind you need a Jabber/XMPP
+   client that supports it.
-To measure the bandwidth between server and client:
+## 9. Test chat session
- * at server side:
-   `# iperf −s`
+Open Noosfero console and execute:
- * at client side:
-   `# iperf −c server_ip`
+>> environment = Environment.default
+>> user = Person['guest']
+>> password = user.user.crypted_password
+>> login = user.jid
+>> RubyBOSH.initialize_session(login, password, "http://#{environment.default_hostname}/http-bind", :wait => 30, :hold => 1, :window => 5
-For heavy load tests, clone and use this software:
+If you have luck, should see something like that:
-    $ git clone http://git.holoscopio.com/git/metal/tester.git
+Ruby-BOSH - SEND
+<body window="5" rid="60265" xmlns="http://jabber.org/protocol/httpbind" xmlns:xmpp="urn:xmpp:xbosh" to="vagrant-debian-squeeze.vagrantup.com" wait="30" xmpp:version="1.0" hold="1"/>
+Ruby-BOSH - SEND
+<body rid="60266" xmlns="http://jabber.org/protocol/httpbind" sid="24cdfc43646a2af1059a7060b677c2e11b26f34f" xmlns:xmpp="urn:xmpp:xbosh" xmpp:version="1.0"><auth mechanism="PLAIN" xmlns="urn:ietf:params:xml:ns:xmpp-sasl">Z3Vlc3RAdmFncmFudC1kZWJpYW4tc3F1ZWV6ZS52YWdyYW50dXAuY29tAGd1ZXN0ADEzZTFhYWVlYjRhYjZlMTA0MmRkNWI1YWY0MzM4MjA1OGJiOWZmNzk=</auth></body>
+Ruby-BOSH - SEND
+<body xmpp:restart="true" rid="60267" xmlns="http://jabber.org/protocol/httpbind" sid="24cdfc43646a2af1059a7060b677c2e11b26f34f" xmlns:xmpp="urn:xmpp:xbosh" xmpp:version="1.0"/>
+Ruby-BOSH - SEND
+<body rid="60268" xmlns="http://jabber.org/protocol/httpbind" sid="24cdfc43646a2af1059a7060b677c2e11b26f34f" xmlns:xmpp="urn:xmpp:xbosh" xmpp:version="1.0"><iq type="set" xmlns="jabber:client" id="bind_29330"><bind xmlns="urn:ietf:params:xml:ns:xmpp-bind"><resource>bosh_9631</resource></bind></iq></body>
+Ruby-BOSH - SEND
+<body rid="60269" xmlns="http://jabber.org/protocol/httpbind" sid="24cdfc43646a2af1059a7060b677c2e11b26f34f" xmlns:xmpp="urn:xmpp:xbosh" xmpp:version="1.0"><iq type="set" xmlns="jabber:client" id="sess_21557"><session xmlns="urn:ietf:params:xml:ns:xmpp-session"/></iq></body>
+=> ["guest@vagrant-debian-squeeze.vagrantup.com", "24cdfc43646a2af1059a7060b677c2e11b26f34f", 60270]
@@ -0,0 +1,115 @@
+Setup Noosfero to use HTTPS
+===========================
+
+This document assumes that you have a fully and clean Noosfero
+installation as explained at the `INSTALL.md` file.
+
+SSL certificate
++++++++++++++++
+
+You should get a valid SSL certificate, but if you want to test
+your setup before, you could generate a self-signed certificate
+as below:
+
+    # mkdir /etc/noosfero/ssl
+    # cd /etc/noosfero/ssl
+	  # openssl genrsa 1024 > noosfero.key
+    # openssl req -new -x509 -nodes -sha1 -days $[10*365] -key noosfero.key > noosfero.cert
+    # cat noosfero.key noosfero.cert > noosfero.pem
+
+There are two ways of using SSL with Noosfero: 1) If you are not using
+Varnish; and 2) If you are using Varnish.
+
+1) If you are are not using Varnish
++++++++++++++++++++++++++++++++++++
+
+Simply do a redirect in apache to force all connections with SSL:
+
+  <VirtualHost *:8080>
+    ServerName test.stoa.usp.br
+   
+    Redirect / https://example.com/
+  </VirtualHost>
+
+And set a vhost to receive then:
+
+  <VirtualHost *:443>
+    ServerName example.com
+   
+    SSLEngine On
+    SSLCertificateFile    /etc/ssl/certs/cert.pem
+    SSLCertificateKeyFile /etc/ssl/private/cert.key
+   
+    Include /etc/noosfero/apache/virtualhost.conf
+  </VirtualHost>
+
+Be aware that if you had configured varnish, the requests won't reach
+it with this configuration.
+
+2) If you are using Varnish
++++++++++++++++++++++++++++
+
+Varnish isn't able to communicate with the SSL protocol, so we will
+need some one who do this and Pound[1] can do the job. In order to
+install it in Debian based systems:
+
+  $ sudo apt-get install pound
+
+Set Varnish to listen in other port than 80:
+
+/etc/defaults/varnish
+---------------------
+
+  DAEMON_OPTS="-a localhost:6081 \
+               -T localhost:6082 \ 
+               -f /etc/varnish/default.vcl \ 
+               -S /etc/varnish/secret \ 
+               -s file,/var/lib/varnish/$INSTANCE/varnish_storage.bin,1G"
+
+Configure Pound:
+
+    # cp /usr/share/noosfero/etc/pound.cfg /etc/pound/
+
+Edit /etc/pound.cfg and set the IP and domain of your server.
+
+Configure Pound to start at system initialization:
+
+/etc/default/pound
+------------------
+
+  startup=1
+
+Set Apache to only listen to localhost:
+
+/etc/apache2/ports.conf
+-----------------------
+
+  Listen 127.0.0.1:8080
+
+Restart the services:
+
+  $ sudo service apache2 restart
+  $ sudo service varnish restart
+
+Start pound:
+
+  $ sudo service pound start
+
+[1] http://www.apsis.ch/pound
+
+Noosfero XMPP chat
+++++++++++++++++++
+
+If you want to use chat over HTTPS, then you should add the domain
+and IP of your server in the /etc/hosts file, example:
+
+/etc/hosts
+----------
+
+  192.168.1.86	mydomain.example.com
+
+Also, it's recomended that you remove lines above from the file
+`/etc/apache2/sites-enabled/noosfero`:
+
+    RewriteEngine On
+    Include /usr/share/noosfero/util/chat/apache/xmpp.conf
@@ -24,10 +24,6 @@ Install the RPAF apache module (or skip this step if not using apache):
 3b) Edit `/etc/apache2/sites-enabled/*`, and change `<VirtualHost *:80>` to `<VirtualHost *:8080>`
-3c) Restart apache
-
-    # invoke-rc.d apache2 restart
-
 4) Varnish configuration
 4a) Edit `/etc/default/varnish`
@@ -44,10 +40,6 @@ On manual installations, change `/etc/noosfero/*` to `{Rails.root}/etc/noosfero/
 **NOTE**: it is very important that the `*.vcl` files are included in that order, i.e. *first* include `varnish-noosfero.vcl`, and *after* `noosfero-accept-language.cvl`.
-4c) Restart Varnish
-
-    # invoke-rc.d varnish restart
-
 5) Enable varnish logging:
 5a) Edit `/etc/default/varnishncsa` and uncomment the line that contains:
@@ -56,8 +48,10 @@ On manual installations, change `/etc/noosfero/*` to `{Rails.root}/etc/noosfero/
 The varnish log will be written to `/var/log/varnish/varnishncsa.log` in an apache-compatible format. You should change your statistics generation software (e.g. awstats) to use that instead of apache logs.
-5b) Restart Varnish Logging service
+Thanks to Cosimo Streppone for varnish-accept-language. See http://github.com/cosimo/varnish-accept-language for more information.
-    # invoke-rc.d varnishncsa restart
+6) Restart services
-Thanks to Cosimo Streppone for varnish-accept-language. See http://github.com/cosimo/varnish-accept-language for more information.
+    # service apache2 restart
+    # service varnish restart
+    # service varnishncsa restart
@@ -0,0 +1,44 @@
+LogLevel 1
+Alive    10
+Client   120
+TimeOut  300
+Control  "/var/run/pound/poundctl.socket"
+
+ListenHTTP
+  Address  192.168.1.86
+  Port     80
+  xHTTP    1
+  # uncomment code above if you are using chat
+  #Service
+  #  URL      "/http-bind.*"
+  #  Backend
+  #    Address  127.0.0.1
+  #    Port     5280
+  #  End
+  #End
+  Service
+    Redirect "https://mydomain.example.com"
+  End
+End
+
+ListenHTTPS
+  Address    192.168.1.86
+  Port       443
+  Cert       "/etc/noosfero/ssl/noosfero.pem"
+  Ciphers    "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
+  xHTTP      1
+  # uncomment code above if you are using chat
+  #Service
+  #  URL      "/http-bind.*"
+  #  Backend
+  #    Address  127.0.0.1
+  #    Port     5280
+  #  End
+  #End
+  Service
+    BackEnd
+      Address  127.0.0.1
+      Port     6081
+    End
+  End
+End
@@ -99,7 +99,7 @@ jQuery(function($) {
      },
      render_body_message: function(body) {
-        body = body.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\r?\n/g, '<br>');
+        body = body.replace(/\r?\n/g, '<br>');
         body = $().emoticon(body);
         body = linkify(body, {
            callback: function(text, href) {
@@ -320,7 +320,7 @@ jQuery(function($) {
         var jid_id = Jabber.jid_to_id(jid);
         var name = Jabber.name_of(jid_id);
         create_conversation_tab(name, jid_id);
-        Jabber.show_message(jid, name, message.body, 'other', Strophe.getNodeFromJid(jid));
+        Jabber.show_message(jid, name, escape_html(message.body), 'other', Strophe.getNodeFromJid(jid));
         $.sound.play('/sounds/receive.wav');
         return true;
      },
@@ -336,7 +336,7 @@ jQuery(function($) {
         // is a message from another user, not mine
         else if ($own_name != name) {
            var jid = Jabber.rooms[Jabber.jid_to_id(message.from)][name];
-           Jabber.show_message(message.from, name, message.body, name, Strophe.getNodeFromJid(jid));
+           Jabber.show_message(message.from, name, escape_html(message.body), name, Strophe.getNodeFromJid(jid));
            $.sound.play('/sounds/receive.wav');
         }
         return true;
@@ -432,7 +432,7 @@ jQuery(function($) {
             .c('body').t(body).up()
             .c('active', {xmlns: Strophe.NS.CHAT_STATES});
         Jabber.connection.send(message);
-        Jabber.show_message(jid, $own_name, body, 'self', Strophe.getNodeFromJid(Jabber.connection.jid));
+        Jabber.show_message(jid, $own_name, escape_html(body), 'self', Strophe.getNodeFromJid(Jabber.connection.jid));
      },
      is_a_room: function(jid_id) {
@@ -632,6 +632,13 @@ jQuery(function($) {
       }
    }
+   function escape_html(body) {
+      return body
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+   }
+
 });
 function checkTime(i) {
@@ -0,0 +1,74 @@
+%%%
+%%%     Noosfero ejabberd configuration file
+%%%     This config must be in UTF-8 encoding
+%%%
+
+{acl, admin, {user, "admin", "mydomain.example.com"}}.
+{hosts, ["mydomain.example.com"]}.
+
+{loglevel, 4}.
+{listen,
+ [
+  {5222, ejabberd_c2s, [
+			{access, c2s},
+			{shaper, c2s_shaper},
+			{max_stanza_size, 65536},
+			starttls, {certfile, "/etc/ejabberd/ejabberd.pem"}
+		       ]},
+  {5280, ejabberd_http, [
+			 http_bind,
+			 http_poll
+			]}
+ ]}.
+{max_fsm_queue, 1000}.
+{auth_method, odbc}.
+{odbc_server, "DSN=PostgreSQLEjabberdNoosfero"}.
+{shaper, normal, {maxrate, 10000000}}.
+{shaper, fast, {maxrate, 50000}}.
+{acl, local, {user_regexp, ""}}.
+{access, max_user_sessions, [{10, all}]}.
+{access, local, [{allow, local}]}.
+{access, c2s, [{deny, blocked},
+	       {allow, all}]}.
+{access, c2s_shaper, [{none, admin},
+		      {normal, all}]}.
+{access, announce, [{allow, admin}]}.
+{access, configure, [{allow, admin}]}.
+{access, muc_admin, [{allow, admin}]}.
+{access, muc, [{allow, all}]}.
+{access, pubsub_createnode, [{allow, all}]}.
+{language, "pt"}.
+{modules,
+ [
+  {mod_adhoc,    []},
+  {mod_announce, [{access, announce}]}, % requires mod_adhoc
+  {mod_caps,     []},
+  {mod_configure,[]}, % requires mod_adhoc
+  {mod_disco,    []},
+  {mod_last,     []},
+  {mod_muc,      [
+		  {access, muc},
+		  {access_create, muc},
+		  {access_persistent, muc},
+		  {access_admin, muc_admin},
+		  {max_users, 500},
+		  {default_room_options, [{anonymous, false}]}
+		 ]},
+  {mod_privacy_odbc,  []},
+  {mod_private_odbc,  []},
+  {mod_proxy65,  [
+		  {access, local},
+		  {shaper, c2s_shaper}
+		 ]},
+  {mod_roster_odbc,   []},
+  {mod_stats,    []},
+  {mod_time,     []},
+  {mod_vcard,    []},
+  {mod_http_bind,    []},
+  {mod_version,  []}
+ ]}.
+
+%%% Local Variables:
+%%% mode: erlang
+%%% End:
+%%% vim: set filetype=erlang tabstop=8:
@@ -0,0 +1,16 @@
+[PostgreSQLEjabberdNoosfero]
+Description      = PostgreSQL Noosfero ejabberd database
+Driver           = PostgreSQL Unicode
+Trace            = No
+TraceFile        = /tmp/psqlodbc.log
+Database         = noosfero
+Servername       = localhost
+UserName         = noosfero
+Password         = <copy the password present in the database.yml file>
+Port             =
+ReadOnly         = No
+RowVersioning    = No
+ShowSystemTables = No
+ShowOidColumn    = No
+FakeOidIndex     = No
+ConnSettings     = SET search_path TO ejabberd
@@ -0,0 +1,7 @@
+[PostgreSQL Unicode]
+Description = PostgreSQL ODBC driver (Unicode version)
+Driver      = /usr/lib/odbc/psqlodbcw.so
+Setup       = /usr/lib/odbc/libodbcpsqlS.so
+Debug       = 0
+CommLog     = 1
+UsageCount  = 3
@@ -0,0 +1,115 @@		@@ -0,0 +1,115 @@
	1	+Setup Noosfero to use HTTPS
	2	+===========================
	3	+
	4	+This document assumes that you have a fully and clean Noosfero
	5	+installation as explained at the `INSTALL.md` file.
	6	+
	7	+SSL certificate
	8	++++++++++++++++
	9	+
	10	+You should get a valid SSL certificate, but if you want to test
	11	+your setup before, you could generate a self-signed certificate
	12	+as below:
	13	+
	14	+ # mkdir /etc/noosfero/ssl
	15	+ # cd /etc/noosfero/ssl
	16	+ # openssl genrsa 1024 > noosfero.key
	17	+ # openssl req -new -x509 -nodes -sha1 -days $[10*365] -key noosfero.key > noosfero.cert
	18	+ # cat noosfero.key noosfero.cert > noosfero.pem
	19	+
	20	+There are two ways of using SSL with Noosfero: 1) If you are not using
	21	+Varnish; and 2) If you are using Varnish.
	22	+
	23	+1) If you are are not using Varnish
	24	++++++++++++++++++++++++++++++++++++
	25	+
	26	+Simply do a redirect in apache to force all connections with SSL:
	27	+
	28	+ <VirtualHost *:8080>
	29	+ ServerName test.stoa.usp.br
	30	+
	31	+ Redirect / https://example.com/
	32	+ </VirtualHost>
	33	+
	34	+And set a vhost to receive then:
	35	+
	36	+ <VirtualHost *:443>
	37	+ ServerName example.com
	38	+
	39	+ SSLEngine On
	40	+ SSLCertificateFile /etc/ssl/certs/cert.pem
	41	+ SSLCertificateKeyFile /etc/ssl/private/cert.key
	42	+
	43	+ Include /etc/noosfero/apache/virtualhost.conf
	44	+ </VirtualHost>
	45	+
	46	+Be aware that if you had configured varnish, the requests won't reach
	47	+it with this configuration.
	48	+
	49	+2) If you are using Varnish
	50	++++++++++++++++++++++++++++
	51	+
	52	+Varnish isn't able to communicate with the SSL protocol, so we will
	53	+need some one who do this and Pound[1] can do the job. In order to
	54	+install it in Debian based systems:
	55	+
	56	+ $ sudo apt-get install pound
	57	+
	58	+Set Varnish to listen in other port than 80:
	59	+
	60	+/etc/defaults/varnish
	61	+---------------------
	62	+
	63	+ DAEMON_OPTS="-a localhost:6081 \
	64	+ -T localhost:6082 \
	65	+ -f /etc/varnish/default.vcl \
	66	+ -S /etc/varnish/secret \
	67	+ -s file,/var/lib/varnish/$INSTANCE/varnish_storage.bin,1G"
	68	+
	69	+Configure Pound:
	70	+
	71	+ # cp /usr/share/noosfero/etc/pound.cfg /etc/pound/
	72	+
	73	+Edit /etc/pound.cfg and set the IP and domain of your server.
	74	+
	75	+Configure Pound to start at system initialization:
	76	+
	77	+/etc/default/pound
	78	+------------------
	79	+
	80	+ startup=1
	81	+
	82	+Set Apache to only listen to localhost:
	83	+
	84	+/etc/apache2/ports.conf
	85	+-----------------------
	86	+
	87	+ Listen 127.0.0.1:8080
	88	+
	89	+Restart the services:
	90	+
	91	+ $ sudo service apache2 restart
	92	+ $ sudo service varnish restart
	93	+
	94	+Start pound:
	95	+
	96	+ $ sudo service pound start
	97	+
	98	+[1] http://www.apsis.ch/pound
	99	+
	100	+Noosfero XMPP chat
	101	+++++++++++++++++++
	102	+
	103	+If you want to use chat over HTTPS, then you should add the domain
	104	+and IP of your server in the /etc/hosts file, example:
	105	+
	106	+/etc/hosts
	107	+----------
	108	+
	109	+ 192.168.1.86 mydomain.example.com
	110	+
	111	+Also, it's recomended that you remove lines above from the file
	112	+`/etc/apache2/sites-enabled/noosfero`:
	113	+
	114	+ RewriteEngine On
	115	+ Include /usr/share/noosfero/util/chat/apache/xmpp.conf
@@ -0,0 +1,44 @@		@@ -0,0 +1,44 @@
	1	+LogLevel 1
	2	+Alive 10
	3	+Client 120
	4	+TimeOut 300
	5	+Control "/var/run/pound/poundctl.socket"
	6	+
	7	+ListenHTTP
	8	+ Address 192.168.1.86
	9	+ Port 80
	10	+ xHTTP 1
	11	+ # uncomment code above if you are using chat
	12	+ #Service
	13	+ # URL "/http-bind.*"
	14	+ # Backend
	15	+ # Address 127.0.0.1
	16	+ # Port 5280
	17	+ # End
	18	+ #End
	19	+ Service
	20	+ Redirect "https://mydomain.example.com"
	21	+ End
	22	+End
	23	+
	24	+ListenHTTPS
	25	+ Address 192.168.1.86
	26	+ Port 443
	27	+ Cert "/etc/noosfero/ssl/noosfero.pem"
	28	+ Ciphers "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
	29	+ xHTTP 1
	30	+ # uncomment code above if you are using chat
	31	+ #Service
	32	+ # URL "/http-bind.*"
	33	+ # Backend
	34	+ # Address 127.0.0.1
	35	+ # Port 5280
	36	+ # End
	37	+ #End
	38	+ Service
	39	+ BackEnd
	40	+ Address 127.0.0.1
	41	+ Port 6081
	42	+ End
	43	+ End
	44	+End
@@ -0,0 +1,74 @@		@@ -0,0 +1,74 @@
	1	+%%%
	2	+%%% Noosfero ejabberd configuration file
	3	+%%% This config must be in UTF-8 encoding
	4	+%%%
	5	+
	6	+{acl, admin, {user, "admin", "mydomain.example.com"}}.
	7	+{hosts, ["mydomain.example.com"]}.
	8	+
	9	+{loglevel, 4}.
	10	+{listen,
	11	+ [
	12	+ {5222, ejabberd_c2s, [
	13	+ {access, c2s},
	14	+ {shaper, c2s_shaper},
	15	+ {max_stanza_size, 65536},
	16	+ starttls, {certfile, "/etc/ejabberd/ejabberd.pem"}
	17	+ ]},
	18	+ {5280, ejabberd_http, [
	19	+ http_bind,
	20	+ http_poll
	21	+ ]}
	22	+ ]}.
	23	+{max_fsm_queue, 1000}.
	24	+{auth_method, odbc}.
	25	+{odbc_server, "DSN=PostgreSQLEjabberdNoosfero"}.
	26	+{shaper, normal, {maxrate, 10000000}}.
	27	+{shaper, fast, {maxrate, 50000}}.
	28	+{acl, local, {user_regexp, ""}}.
	29	+{access, max_user_sessions, [{10, all}]}.
	30	+{access, local, [{allow, local}]}.
	31	+{access, c2s, [{deny, blocked},
	32	+ {allow, all}]}.
	33	+{access, c2s_shaper, [{none, admin},
	34	+ {normal, all}]}.
	35	+{access, announce, [{allow, admin}]}.
	36	+{access, configure, [{allow, admin}]}.
	37	+{access, muc_admin, [{allow, admin}]}.
	38	+{access, muc, [{allow, all}]}.
	39	+{access, pubsub_createnode, [{allow, all}]}.
	40	+{language, "pt"}.
	41	+{modules,
	42	+ [
	43	+ {mod_adhoc, []},
	44	+ {mod_announce, [{access, announce}]}, % requires mod_adhoc
	45	+ {mod_caps, []},
	46	+ {mod_configure,[]}, % requires mod_adhoc
	47	+ {mod_disco, []},
	48	+ {mod_last, []},
	49	+ {mod_muc, [
	50	+ {access, muc},
	51	+ {access_create, muc},
	52	+ {access_persistent, muc},
	53	+ {access_admin, muc_admin},
	54	+ {max_users, 500},
	55	+ {default_room_options, [{anonymous, false}]}
	56	+ ]},
	57	+ {mod_privacy_odbc, []},
	58	+ {mod_private_odbc, []},
	59	+ {mod_proxy65, [
	60	+ {access, local},
	61	+ {shaper, c2s_shaper}
	62	+ ]},
	63	+ {mod_roster_odbc, []},
	64	+ {mod_stats, []},
	65	+ {mod_time, []},
	66	+ {mod_vcard, []},
	67	+ {mod_http_bind, []},
	68	+ {mod_version, []}
	69	+ ]}.
	70	+
	71	+%%% Local Variables:
	72	+%%% mode: erlang
	73	+%%% End:
	74	+%%% vim: set filetype=erlang tabstop=8:
@@ -0,0 +1,16 @@		@@ -0,0 +1,16 @@
	1	+[PostgreSQLEjabberdNoosfero]
	2	+Description = PostgreSQL Noosfero ejabberd database
	3	+Driver = PostgreSQL Unicode
	4	+Trace = No
	5	+TraceFile = /tmp/psqlodbc.log
	6	+Database = noosfero
	7	+Servername = localhost
	8	+UserName = noosfero
	9	+Password = <copy the password present in the database.yml file>
	10	+Port =
	11	+ReadOnly = No
	12	+RowVersioning = No
	13	+ShowSystemTables = No
	14	+ShowOidColumn = No
	15	+FakeOidIndex = No
	16	+ConnSettings = SET search_path TO ejabberd
@@ -0,0 +1,7 @@		@@ -0,0 +1,7 @@
	1	+[PostgreSQL Unicode]
	2	+Description = PostgreSQL ODBC driver (Unicode version)
	3	+Driver = /usr/lib/odbc/psqlodbcw.so
	4	+Setup = /usr/lib/odbc/libodbcpsqlS.so
	5	+Debug = 0
	6	+CommLog = 1
	7	+UsageCount = 3