|
|
# Configure Framadate
|
|
|
|
|
|
## Form
|
|
|
|
|
|
Browse to `https://mywebsite.tld/framadate`. You should arrive on a screen checking the state of the install that will allow you, if every requirement is met, to proceed to the settings install form.
|
|
|
|
|
|
On the next screen, you need to fill the form with the following fields:
|
... | ... | @@ -25,14 +23,14 @@ The migration page handles: |
|
|
|
|
|
> Warning: loading the migration page can take a while because it's applying all required database upgrades !
|
|
|
|
|
|
## Advanced settings
|
|
|
|
|
|
|
|
|
Advanced settings, like the SMTP credentials or the default poll duration, must be manually filled inside the file `app/inc/config.php` on the webserver.
|
|
|
|
|
|
### Apache
|
|
|
# Server configuration (Only for sysadmin)
|
|
|
|
|
|
## Apache
|
|
|
|
|
|
#### Clean URL
|
|
|
### Clean URL
|
|
|
To have fancy URLs, activate URL rewriting by activating the provided `.htaccess` file, by renaming it from `htaccess.txt` to `.htaccess`:
|
|
|
|
|
|
```bash
|
... | ... | @@ -49,7 +47,7 @@ Then reload or restart the Apache server. |
|
|
|
|
|
You can also put everything that's into the `.htaccess` file directly into your VirtualHost file.
|
|
|
|
|
|
#### Secure admin section
|
|
|
### Secure admin section
|
|
|
|
|
|
The `/admin` folder shouldn't be open to anyone but the admin of the Framadate instance, you should secure it with `.htaccess` and `.htpasswd` files.
|
|
|
|
... | ... | @@ -67,7 +65,7 @@ Then create the `.htpasswd` file with the following command (you may need to ins |
|
|
sudo -u www-data htpasswd -bc /var/www/framadate/admin/.htpasswd user password
|
|
|
```
|
|
|
|
|
|
#### Secure htaccess and htpassword
|
|
|
### Secure htaccess and htpassword
|
|
|
|
|
|
In order to disallow read access to the `.htaccess` and `.htpasswd` files, you can add this section to the `.htaccess` file:
|
|
|
```apache
|
... | ... | @@ -78,12 +76,12 @@ ErrorDocument 403 "Forbidden" |
|
|
</FilesMatch>
|
|
|
```
|
|
|
|
|
|
#### Secure server
|
|
|
##### HTTPS
|
|
|
### Secure server
|
|
|
#### HTTPS
|
|
|
|
|
|
It is really advided to use HTTPS and make HTTP redirect to it. Use Let's Encrypt to obtain free certificates.
|
|
|
|
|
|
##### Content Security Policy
|
|
|
#### Content Security Policy
|
|
|
|
|
|
If you have access to the configuration of your Framadate web server, it is [a good practice](https://wiki.mozilla.org/Security/Guidelines/Web_Security#Content_Security_Policy) to return a `Content-Security-Policy` header as it prevents different types of XSS attacks.
|
|
|
|
... | ... | @@ -93,7 +91,7 @@ If you have access to the configuration of your Framadate web server, it is [a g |
|
|
</IfModule>
|
|
|
```
|
|
|
|
|
|
##### Referrer-Policy
|
|
|
#### Referrer-Policy
|
|
|
|
|
|
If someone clicks on an external link inside a survey, the website that link points to will get the survey address in the `Referer` HTTP header. With the `Referrer-Policy`, we can tweak which information is sent.
|
|
|
|
... | ... | @@ -103,10 +101,9 @@ If someone clicks on an external link inside a survey, the website that link poi |
|
|
</IfModule>
|
|
|
```
|
|
|
|
|
|
## Nginx
|
|
|
|
|
|
### Nginx
|
|
|
|
|
|
#### Generate authentication file for administration folder
|
|
|
### Generate authentication file for administration folder
|
|
|
|
|
|
Create the `.htpasswd` file with the following command (you may need to install the package `apache2-utils`) where you change the values for user and password to your convenience:
|
|
|
|
... | ... | @@ -116,8 +113,13 @@ sudo -u www-data htpasswd -bc /path/to/framadate/admin/.htpasswd user password |
|
|
|
|
|
Note that the path or name of the .htpasswd does not matter for nginx. put it outside of a web accessible could be a great idea.
|
|
|
|
|
|
### HTTPS
|
|
|
|
|
|
You can use LetsEncrypt to get certificates
|
|
|
|
|
|
https://certbot.eff.org/lets-encrypt/debianstretch-nginx
|
|
|
|
|
|
#### A working example with HTTPS
|
|
|
### A working example with HTTPS
|
|
|
|
|
|
```nginx
|
|
|
server {
|
... | ... | @@ -136,8 +138,8 @@ server { |
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'";
|
|
|
add_header Referrer-Policy "strict-origin";
|
|
|
|
|
|
# Those ssl certificats is generated by letsencrypt, to create an certificat
|
|
|
# through lets encrypt information are available here https://certbot.eff.org/lets-encrypt/debianstretch-nginx
|
|
|
# Those ssl certificates is generated by letsencrypt, to create an certificates
|
|
|
# through letsencrypt information are available here https://certbot.eff.org/lets-encrypt/debianstretch-nginx
|
|
|
# For secure ssl configuration, look also at https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
|
ssl_certificate /etc/letsencrypt/live/scoodle.latoilescoute.net/fullchain.pem;
|
... | ... | @@ -201,18 +203,18 @@ server { |
|
|
|
|
|
|
|
|
|
|
|
#### Secure server
|
|
|
##### Content Security Policy
|
|
|
### Secure server
|
|
|
#### Content Security Policy
|
|
|
```nginx
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'";
|
|
|
```
|
|
|
|
|
|
##### Referrer-Policy
|
|
|
#### Referrer-Policy
|
|
|
```nginx
|
|
|
add_header Referrer-Policy "strict-origin";
|
|
|
```
|
|
|
|
|
|
##### Various headers
|
|
|
#### Various headers
|
|
|
|
|
|
In the same way that we added the `Content-Security-Policy` and `Referrer-Policy`, we can have :
|
|
|
* `X-Content-Type-Options: nosniff` to avoid XSS attacks through incorrect MIME types
|
... | ... | |