MediaWiki

De Wiki Castanedo.es
Ir a la navegación Ir a la búsqueda

Instalación MediaWiki en Docker

Instalación de dhi.io/mediawiki en Docker. Vamos a usar una imagen "Docker Hardened Image" (imágenes seguras, mínimas y listas para producción).

Requisitos

Para poder realizar esta configuración se necesita:

  • Servidor GNU Linux (ver Securizar Ubuntu Server)
    • Cortafuegos FirewallD (UFW tiene problemas con Docker)
  • Docker Engine (ver Docker Engine)
    • Módulo: Docker Compose (para PRO)
  • MariaDB > 10.3.0 (ver MariaDB)
  • Nginx (ver LEMP)
  • Cuenta en Docker Hub
    • Necesario para acceder a Docker Hardened Image.

Entorno de DEV

Como entorno de DEV se va a usar Docker Desktop.

Login en catálogo DHI

docker login dhi.io

Descargar imagen

Vamos a usar la imagen versión 1.46. 

docker pull dhi.io/mediawiki:1.46-debian-php-fpm

Esta imagen contiene ya los prerrequisitos de MediaWiki:

  • PHP 8.3
  • SQLLite 3.46.1
    • No lo usaremos y se configurará para usar una MariaDB.

Crear base de datos para MariaDB

Ver MariaDB para instalar MariaDB.

Conectar a la base de datos

Conectamos como root: 

docker exec -it mariadb-11.8 mariadb --host localhost --user root --password

Crear base de datos

En este ejemplo creamos una BD para mediawiki: 

CREATE DATABASE castanedo_wiki;

Crear usuario

En este ejemplo creamos una BD para mediawiki: 

CREATE USER castanedowiki IDENTIFIED BY 'castanedowiki';

Dar permisos a usuario en BD

En este ejemplo creamos una BD para mediawiki: 

GRANT ALL PRIVILEGES ON castanedo_wiki.* TO 'castanedowiki' WITH GRANT OPTION;
FLUSH PRIVILEGES;

Comprobar permisos

SHOW GRANTS FOR 'castanedowiki';

+--------------------------------------------------------------------------------------------------------------+
| Grants for castanedowiki@%                                                                                   |
+--------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `castanedowiki`@`%` IDENTIFIED BY PASSWORD '*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' |
| GRANT ALL PRIVILEGES ON `castanedo_wiki`.* TO `castanedowiki`@`%` WITH GRANT OPTION                           |
+--------------------------------------------------------------------------------------------------------------+

Pruebas conexión BBDD

Probaremos a conectar a la BBDD mediante el cliente SquirrelSQL.

Instalar MediaWiki en Docker Desktop (DEV)

  • Crear el fichero "compose.yaml"
services:
   mediawiki:
      container_name: wikidev
      hostname: wikidev.castanedo.es
      restart: unless-stopped
      volumes:
         - document-root:/var/www/html
         - data:/var/www/data
      image: dhi.io/mediawiki:1.46-debian-php-fpm

   nginx:
      container_name: wikidev-nginx
      hostname: wikidev.castanedo.es
      restart: unless-stopped
      ports:
         - "127.0.0.1:8080:80"
      depends_on:
         - mediawiki
      volumes:
         - document-root:/var/www/html:ro
         - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      image: dhi.io/nginx:1-debian13

volumes:
   document-root:
   data:
  • Crear el fichero "nginx.conf"
server {
    listen 80;

    # this config assumes that MediaWiki is installed into /var/www/html,
    # so LocalSettings.php would be located at /var/www/html/LocalSettings.php
    root /var/www/html;
    index index.php;

    # allow larger file uploads and longer script runtimes
    client_max_body_size 100m;
    client_body_timeout 60;

    # Uncomment the following code if you wish to use the installer/updater
    # installer/updater
    location /mw-config/ {
        # Do this inside of a location so it can be negated
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass mediawiki:9000;
            fastcgi_index index.php;
        }
    }

    # Location for wiki's entry points
    location ~ ^/(index|load|api|thumb|opensearch_desc|rest|img_auth)\.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass mediawiki:9000;
        fastcgi_index index.php;
    }

    # Images
    location ~ ^/(mw-config)?/images/ {
        # Separate location for images/ so .php execution won't apply
        add_header X-Content-Type-Options "nosniff";
    }
	# Disable php in /images/ (security)
	location ^~ /images/ {
		#Served like static files
	}
    location /images/deleted {
        # Deny access to deleted images folder
        deny all;
    }
    # MediaWiki assets (usually images)
    location ~ ^/resources/(assets|lib|src) {
        try_files $uri 404;
        add_header Cache-Control "public";
        expires 7d;
    }
    # Assets, scripts and styles from skins and extensions
    location ~ ^/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg|wasm)$ {
        try_files $uri 404;
        add_header Cache-Control "public";
        expires 7d;
    }
    # License and credits files
    location ~ ^/(COPYING|CREDITS) {
        default_type text/plain;
    }

    # Handling for Mediawiki REST API, see [[mw:API:REST_API]]
    location /rest.php/ {
        try_files $uri $uri/ /rest.php?$query_string;
    }

    # Uncomment the following code for handling image authentication
    # Also add "deny all;" in the location for /images above
    #location /img_auth.php/ {
    #    try_files $uri $uri/ /img_auth.php?$query_string;
    #}

    # Handling for the article path (pretty URLs)
    location /wiki/ {
        rewrite ^/wiki/(?<pagename>.*)$ /index.php;
    }

    # Allow robots.txt in case you have one
    location = /robots.txt {
    }
    # Explicit access to the root website, redirect to main page (adapt as needed)
    location = / {
        return 301 /wiki/P%C3%A1gina_principal;
    }

    # Every other entry point will be disallowed.
    # Add specific rules for other entry points/images as needed above this
    location / {
        return 404;
    }
}
  • Arrancar MediaWiki
docker compose up -d
  • Completar la configuración según necesidad.
  • IMPORTANTE: en este momento será se definirá que se quiere usar una base de datos MariaDB.
    • Hostname o IP
    • Usuario/contraseña
    • Se generará la estructura vacía.
  • Descargar fichero LocalSettings.php
  • Editar el fichero "compose.yaml"
services:
   mediawiki:
      container_name: wikidev
      hostname: wikidev.castanedo.es
      restart: unless-stopped
      volumes:
         - document-root:/var/www/html
         - data:/var/www/data
         - ./LocalSettings.php:/var/www/html/LocalSettings.php:ro
      image: dhi.io/mediawiki:1.46-debian-php-fpm

   nginx:
      container_name: wikidev-nginx
      hostname: wikidev.castanedo.es
      restart: unless-stopped
      ports:
         - "127.0.0.1:80:80"
      depends_on:
         - mediawiki
      volumes:
         - document-root:/var/www/html:ro
         - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      image: dhi.io/nginx:1-debian13

volumes:
   document-root:
   data:
  • Reiniciar contenedores
docker compose dow
docker compose up -d

Pruebas

Accedemos con un navegador web http://127.0.0.1:8080.

Upgrade en DEV

Se va a realizar una prueba de actualización desde MediaWiki 1.39.8 a 1.46.

Conectar a la base de datos

Conectamos como root: 

docker exec -it mariadb-11.8 mariadb --host localhost --user root --password

Borrar BBDD original

DROP DATABASE castanedo_wiki;

Crear base de datos

En este ejemplo creamos una BD para mediawiki: 

CREATE DATABASE castanedo_wiki;

Crear usuario

En este ejemplo creamos una BD para mediawiki: 

CREATE USER castanedowiki IDENTIFIED BY 'castanedowiki';

Dar permisos a usuario en BD

En este ejemplo creamos una BD para mediawiki: 

GRANT ALL PRIVILEGES ON castanedo_wiki.* TO 'castanedowiki' WITH GRANT OPTION;
FLUSH PRIVILEGES;

Comprobar permisos

SHOW GRANTS FOR 'castanedowiki';

+--------------------------------------------------------------------------------------------------------------+
| Grants for castanedowiki@%                                                                                   |
+--------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `castanedowiki`@`%` IDENTIFIED BY PASSWORD '*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' |
| GRANT ALL PRIVILEGES ON `castanedo_wiki`.* TO `castanedowiki`@`%` WITH GRANT OPTION                           |
+--------------------------------------------------------------------------------------------------------------+

Importar BBDD original

  • Copiar backup en BBDD
docker cp castanedo_wiki.sql mariadb-11.8:/var/backups/mariadb/castanedo_wiki.sql
  • Importar backup
docker exec -it mariadb-11.8 bash
mariadb -u castanedowiki -p castanedo_wiki < /var/backups/mariadb/castanedo_wiki.sql
exit

Copiar ficheros originales de configuracion

  • Copiar Fichero LocalSettings.php
  • Copiar directory images
docker cp images wikidev:/var/www/html/
  • Copiar directorio extensions

Nota: sólo copiar extensiones añadidas manualmente.

Reiniciar contenedores

docker compose dow
docker compose up -d

Ejecutar script de update

docker exec -it wikidev bash
cd /var/www/html
php maintenance/run.php update
exit

Entorno de PRO

En el entorno de PRO se va a usar un servidor real.

Configurar Virtual Host para MediaWiki

  • Añadir Virtual Host:
sudo -i

vi /etc/nginx/sites-available/wiki.castanedo.es

####################################
# WIKI.CASTANEDO.ES REVERSER PROXY #
####################################
server {
	listen 80;
	listen [::]:80;
	server_name wiki.castanedo.es;
	# Redirect HTTP to HTTPS
	return 301 https://$host$request_uri;
}

server {
	# SSL configuration
	#
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	ssl_certificate /etc/ssl/certs/selfsigned.crt;
	ssl_certificate_key /etc/ssl/private/selfsigned.key;
	
	# Root directory
	root /var/www/wiki.castanedo.es;

	# Add index.php to the list if you are using PHP
	index index.php index.html index.htm;

	server_name wiki.castanedo.es;

	access_log /var/log/nginx/wiki.castanedo.es-access.log;
	error_log /var/log/nginx/wiki.castanedo.es-error.log;

	# Activate HSTS (HTTP Strict Transport Security)
	# Note: reinclude if in a location a header is set
	include snippets/hsts.conf;

	# Allow favicon.ico, robots.txt, .well-known/
	# Deny *.txt, *.log, .*/*.php, .*, *.json, .lock, *.ht
	#include snippets/allowed.conf;
	#include snippets/denied.conf;

	location / {
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		#try_files $uri $uri/ =404;
		proxy_pass http://127.0.0.1:9081;
		#proxy_pass https://127.0.0.1:9444;
		# Set IP redirrect
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;

	}

	location = /robots.txt {
		allow all;
	}

	location ~* ^/.well-known/ {
		allow all;
	}
}
  • Crear carpeta para VirtualHost:
mkdir /var/www/wiki.castanedo.es
  • Activar Virtual Host:
ln -s /etc/nginx/sites-available/wiki.castanedo.es /etc/nginx/sites-enabled/wiki.castanedo.es

systemctl reload nginx

Generar certificados Let's Encrypt

certbot --nginx

Conectar a la base de datos

Conectamos como root: 

mariadb --host localhost --user root --password

Crear base de datos (MariaDB)

En este ejemplo creamos una BD para mediawiki: 

CREATE DATABASE castanedo_wiki;

Crear usuario

En este ejemplo creamos una BD para mediawiki: 

CREATE USER castanedowiki IDENTIFIED BY 'castanedowiki';

Dar permisos a usuario en BD

En este ejemplo creamos una BD para mediawiki: 

GRANT ALL PRIVILEGES ON castanedo_wiki.* TO 'castanedowiki' WITH GRANT OPTION;
FLUSH PRIVILEGES;

Comprobar permisos

SHOW GRANTS FOR 'castanedowiki';

+--------------------------------------------------------------------------------------------------------------+
| Grants for castanedowiki@%                                                                                   |
+--------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `castanedowiki`@`%` IDENTIFIED BY PASSWORD '*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' |
| GRANT ALL PRIVILEGES ON `castanedo_wiki`.* TO `castanedowiki`@`%` WITH GRANT OPTION                           |
+--------------------------------------------------------------------------------------------------------------+

Habilitar conexiones remotas

El necesario que la BD tenga configurada conexiones remotas (no sólo desde localhost). Ver documento Configuración MariaDB.

Nota: se recomienda NO exponer la base de datos a Internet. Es decir, sí habilitar las conexiones remotas, pero no abrir el puerto en los firewalls.

Crear carpetas para MediaWiki

mkdir -p /opt/wiki.castanedo.es/data
mkdir -p /opt/wiki.castanedo.es/data/images

Login en catálogo DHI

  • Generar nuevo token
Culturetas-access-token.png
  • Guardar token en lugar seguro
  • Acceder a Docker
docker login -u <user> dhi.io

Nota: las imágenes Hardened son libres pero bajo registro.

Descargar imagen

Vamos a usar la imagen versión 1.46. 

docker pull dhi.io/mediawiki:1.46-debian-php-fpm

Esta imagen contiene ya los prerrequisitos de MediaWiki:

  • PHP 8.3
  • SQLLite 3.46.1
    • No lo usaremos y se configurará para usar una MariaDB.

Instalar MediaWiki en Docker Desktop (PRO)

  • Crear el fichero "compose.yaml"
services:
   mediawiki:
      container_name: wiki
      hostname: wiki.castanedo.es
      restart: unless-stopped
      volumes:
         - document-root:/var/www/html
         - data:/var/www/data
      image: dhi.io/mediawiki:1.46-debian-php-fpm

   nginx:
      container_name: wiki-nginx
      hostname: wiki.castanedo.es
      restart: unless-stopped
      ports:
         - "127.0.0.1:9081:80"
      depends_on:
         - mediawiki
      volumes:
         - document-root:/var/www/html:ro
         - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      image: dhi.io/nginx:1-debian13

volumes:
   document-root:
   data:
  • Crear el fichero "/opt/wiki.castanedo.es/nginx.conf"
server {
    listen 80;

    # this config assumes that MediaWiki is installed into /var/www/html,
    # so LocalSettings.php would be located at /var/www/html/LocalSettings.php
    root /var/www/html;
    index index.php;

    # allow larger file uploads and longer script runtimes
    client_max_body_size 100m;
    client_body_timeout 60;

    # Uncomment the following code if you wish to use the installer/updater
    # installer/updater
    location /mw-config/ {
        # Do this inside of a location so it can be negated
        location ~ \.php$ {
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass mediawiki:9000;
            fastcgi_index index.php;
        }
    }

    # Location for wiki's entry points
    location ~ ^/(index|load|api|thumb|opensearch_desc|rest|img_auth)\.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass mediawiki:9000;
        fastcgi_index index.php;
    }

    # Images
    location ~ ^/(mw-config)?/images/ {
        # Separate location for images/ so .php execution won't apply
        add_header X-Content-Type-Options "nosniff";
    }
	# Disable php in /images/ (security)
	location ^~ /images/ {
		#Served like static files
	}
    location /images/deleted {
        # Deny access to deleted images folder
        deny all;
    }
    # MediaWiki assets (usually images)
    location ~ ^/resources/(assets|lib|src) {
        try_files $uri 404;
        add_header Cache-Control "public";
        expires 7d;
    }
    # Assets, scripts and styles from skins and extensions
    location ~ ^/(skins|extensions)/.+\.(css|js|gif|jpg|jpeg|png|svg|wasm)$ {
        try_files $uri 404;
        add_header Cache-Control "public";
        expires 7d;
    }
    # License and credits files
    location ~ ^/(COPYING|CREDITS) {
        default_type text/plain;
    }

    # Handling for Mediawiki REST API, see [[mw:API:REST_API]]
    location /rest.php/ {
        try_files $uri $uri/ /rest.php?$query_string;
    }

    # Uncomment the following code for handling image authentication
    # Also add "deny all;" in the location for /images above
    #location /img_auth.php/ {
    #    try_files $uri $uri/ /img_auth.php?$query_string;
    #}

    # Handling for the article path (pretty URLs)
    location /wiki/ {
        rewrite ^/wiki/(?<pagename>.*)$ /index.php;
    }

    # Allow robots.txt in case you have one
    location = /robots.txt {
    }
    # Explicit access to the root website, redirect to main page (adapt as needed)
    location = / {
        return 301 /wiki/P%C3%A1gina_principal;
    }

    # Every other entry point will be disallowed.
    # Add specific rules for other entry points/images as needed above this
    location / {
        return 404;
    }
}
  • Arrancar MediaWiki
docker compose up -d
  • Completar la configuración según necesidad.
  • IMPORTANTE: en este momento será se definirá que se quiere usar una base de datos MariaDB.
    • Hostname o IP
    • Usuario/contraseña
    • Se generará la estructura vacía.
  • Descargar fichero LocalSettings.php
  • Copiar fichero en /opt/wiki.castanedo.es/LocalSettings.php
  • Editar el fichero "compose.yaml"
services:
   mediawiki:
      container_name: wiki
      hostname: wiki.castanedo.es
      restart: unless-stopped
      volumes:
         - document-root:/var/www/html
         - data:/var/www/data
         - ./LocalSettings.php:/var/www/html/LocalSettings.php:ro
         - /opt/wiki.castanedo.es/data/images:/var/www/data/images
      image: dhi.io/mediawiki:1.46-debian-php-fpm

   nginx:
      container_name: wiki-nginx
      hostname: wiki.castanedo.es
      restart: unless-stopped
      ports:
         - "127.0.0.1:9081:80"
      depends_on:
         - mediawiki
      volumes:
         - document-root:/var/www/html:ro
         - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      image: dhi.io/nginx:1-debian13

volumes:
   document-root:
   data:
  • Reiniciar contenedores
docker compose down
docker compose up -d

Upgrade en PRO

Se va a realizar una prueba de actualización desde MediaWiki 1.39.8 a 1.46.

Conectar a la base de datos

Conectamos como root: 

mariadb --host localhost --user root --password

Borrar BBDD original

DROP DATABASE castanedo_wiki;

Crear base de datos

En este ejemplo creamos una BD para mediawiki: 

CREATE DATABASE castanedo_wiki;

Crear usuario

En este ejemplo creamos una BD para mediawiki: 

CREATE USER castanedowiki IDENTIFIED BY 'castanedowiki';

Dar permisos a usuario en BD

En este ejemplo creamos una BD para mediawiki: 

GRANT ALL PRIVILEGES ON castanedo_wiki.* TO 'castanedowiki' WITH GRANT OPTION;
FLUSH PRIVILEGES;

Comprobar permisos

SHOW GRANTS FOR 'castanedowiki';

+--------------------------------------------------------------------------------------------------------------+
| Grants for castanedowiki@%                                                                                   |
+--------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `castanedowiki`@`%` IDENTIFIED BY PASSWORD '*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' |
| GRANT ALL PRIVILEGES ON `castanedo_wiki`.* TO `castanedowiki`@`%` WITH GRANT OPTION                           |
+--------------------------------------------------------------------------------------------------------------+

Importar BBDD original

  • Copiar backup en BBDD
sftp guzman@ejemplo.com
cd /tmp
put castanedo_wiki.sql
  • Importar backup
mariadb -u castanedowiki -p castanedo_wiki < /tmp/castanedo_wiki.sql
exit

Copiar ficheros originales de configuracion

  • Copiar Fichero LocalSettings.php
  • Copiar directory images
docker cp images wiki:/var/www/html/
  • Copiar directorio extensions

Nota: sólo copiar extensiones añadidas manualmente.

Reiniciar contenedores

docker compose down
docker compose up -d

Ejecutar script de update

docker exec -it wiki bash
cd /var/www/html
php maintenance/run.php update
exit

Arrancar OpenLDAP (con SystemD)

  • Crear fichero SystemD
vi /etc/systemd/system/wiki.castanedo.es.service

[Unit]
Description=wiki.castanedo.es (Docker Compose)
After=docker.service mariadb.service network-online.target
Requires=docker.service mariadb.service
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/opt/wiki.castanedo.es
ExecStart=/usr/bin/docker compose up --detach --remove-orphans --quiet-pull
ExecStop=/usr/bin/docker compose down --remove-orphans --volumes --timeout 30
TimeoutStartSec=180
TimeoutStopSec=120
Restart=on-failure
RestartSec=7

[Install]
WantedBy=multi-user.target
  • Arrancar y habilitar
systemctl daemon-reload

systemctl start wiki.castanedo.es

systemctl enable wiki.castanedo.es

Referencias

Obtenido de «https://wiki.castanedo.es/index.php?title=MediaWiki&oldid=221»