Changes

This page describes the configuration of the new research computing machines: '''Father''' (Windows Server 2019) and '''Mother''' (Ubuntu Server 20.04). Note that the [[RDP Software Configuration]] describes the software installed on Father.

=====Other Config=====

=====MathML=====

I tried various methods to get MathML to work and always failed. It looks like the community bet on Mathoid working out, but there's been no development on it for 5 months now, and it looks dead. The good news, if is that MathJax works just fine right out of the box:

Note: the last line lets you demark math with LaTeX-like syntax. I disabled it, as I use $ signs way to too much in other contexts.

=====PDFEmbed=====

====SemanticACL=====

<nowiki>{{#set: Visible to=whitelist|Visible to group::=team}}</nowiki>

I tried to 'rename' the dbase, creating a dedicated dbase user that has access to just the wiki's dbase, and resetting its password.

=====PostGIS Issues===== 

Remove redundant user accountsI tried updating the extension (I'm pretty sure that I'm running 2.4.3): cat /etc/passwd userdel -r usernameALTER EXTENSION postgis UPDATE TO "2.4.3";

But that didn't fix anything. I need to get Xwindows set up againchecked the versions: select version(); PostgreSQL 10.14 (Ubuntu 10.14-0ubuntu0. My best guess as to the cause of this issue is leftover Nvidia drivers from my attempts to install the GPUs 18.04.1) on this box went bad in an earlier aptx86_64-pc-linux-gnu, compiled by gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0, 64-bit -get upgrade but -So somehow I can't see them listedm still running version 10! select PostGIS_full_version(); ERROR: could not access file "$libdir/postgis-2.4":No such file or directory CONTEXT: dpkg -l | grep nvidia-driverSQL statement "SELECT public.postgis_lib_version()" PL/pgSQL function postgis_full_version() line 25 at SQL statement

There is a .Xauthority file, and an .ICEauthority file, in /home/ed and both are owned by edSo I backed off the data from the two dbases that I'd used since the upgrade:ed pg_dump -Fc stockmarket > stockmarket_Fc_20201023. The former is empty (0 bytes) and the latter has some nondump pg_dump -UTF8 (I think?) characters in it. I'm not sure if either is an issueFc vcdb4 > vcdb4_Fc_20201023.dump #FAILED!

I didn't see xserverThe second backoff failed: pg_dump: [archiver (db)] query failed: ERROR: could not access file "$libdir/postgis-xorg-video-nouvea in the package list 2.4": No such file or any video driver moduledirectory pg_dump: [archiver (db)] query was: SELECT a.attnum, a.attname, a.atttypmod, a.attstattarget, a.attstorage, t.typstorage, a.attnotnull, a.atthasdef, a.attisdropped, a.attlen, a.attalign, a.attislocal, pg_catalog.format_type(t.oid,a.atttypmod) AS atttypname, array_to_string(a.attoptions, ', ') AS attoptions, so I installed nouveau: dpkg -lCASE WHEN a.attcollation <> t.typcollation THEN a.attcollation ELSE 0 END AS attcollation, a.attidentity, pg_catalog.array_to_string(ARRAY(SELECT lsmod pg_catalog.quote_ident(option_name) || ' ' | more| pg_catalog.quote_literal(option_value) FROM pg_catalog.pg_options_to_table(attfdwoptions) ORDER BY option_name), apt install xserver-xorg-video-nouveauE', I 'm not sure if I should be fixing my boot image or not) AS attfdwoptions FROM pg_catalog.pg_attribute a LEFT JOIN pg_catalog.pg_type t ON a.atttypid = t.oid WHERE a.attrelid = '19998614'::pg_catalog.oid AND shutdown -r now lsmod | morea.attnum > 0::pg_catalog.int2 ORDER BY a.attnum

My changes weren't substantial, so I proceeded with an upgrade. First I checked to see if I had postgres12 installed and listening on another port or not: locate postgres ls /usr/bin/postgres dpkg --get-selections | grep postgres pg_lsclusters Ver Cluster Port Status Owner Data directory Log file 10 main 5432 online postgres /data/postgres /var/log/postgresql/postgresql-10-main.log 12 main 5433 online postgres /var/lib/postgresql/12/main /var/log/postgresql/postgresql-12-main.log pg_upgradecluster 10 main #This failed: pg_dump: error: query failed: ERROR: could not access file "$libdir/postgis-2.4": No such file or directory So... I can't automatically upgrade without first fixing the issue with v10 and postgis. add-apt-repository http://apt.postgresql.org/pub/repos/apt But that just put me back where I wasthe following into /etc/apt/sources-list: deb http://apt.postgresql.org/pub/repos/apt focal main vi it to (see https://wiki.postgresql.org/wiki/Apt): deb http://apt.postgresql.org/pub/repos/apt focal-pgdg wget --quiet -O - http: with //apt.postgresql.org/pub/repos/apt/ACCC4CF8.asc | sudo apt-key add - apt-get update #Throws a login loop problemwarning: N: Skipping acquire of configured file 'main/binary-i386/Packages' as repository 'http://apt.postgresql. So I tried switching org/pub/repos/apt focal-pgdg InRelease' doesn't support architecture 'i386' But the wretched thing still doesn't seem to lightdmbe available: apt-get install lightdmpostgresql-10-postgis-2.4 Package postgresql-10-postgis-2.4 is not available, but is referred to by another package.

And it worked even before Trying a rebootmanual approach. After a reboot, I had a different login screen but the actual desktop looked the same[https://packages. The ubuntu.Xauthority file is now 51 bytes big and I suddenly have a .xsessioncom/bionic/i386/postgresql-10-postgis-errors, which contains a list of environment settings taking place2... However4/download Get the file], the machine then silently crashed that night put it in /bulk/temp and again the following morningcd there. I couldn't find a specific cause in the logs but there did seem to be a number X and GNOME problemsThen: journalctl apt-get install ./postgresql-b 10-1postgis-2.4_2.4.3+dfsg-4_i386.deb journalctl #This failed too --since "1 hour ago"there are unmet dependencies and they are 'not installable'.

I ran an update from ======Switching over the GUI, which may have helped. However, there was a warning about an issue with a screensaver the first time that I loaded lightdm, and the crashes seemed to happen sometime after a clean boot. So I uninstalled lightdm, and installed gdm (which failed as installed already) and rebooted but got no GUI. Then I uninstalled and reinstalled gdm and everything seems fine now. apt-get remove lightdm apt-get remove gdm3 apt-get install gdm3installations======

IncidentallySo, I left a clock running in a terminal so that I could see when took the alternative approach of changing the box went down if it crashed againdata folders [https://www.tutorialspoint. The clock code is: while [ 1 com/how-to-change-postgresql-data-folder-location-on-ubuntu-16-04] ; do echo -en "$(date +%T)\r" ; sleep 1; done.

I kept the old versions of mediawiki and wordpress and moved them to /bulk/retired (using yyymmdd dates)Shut it down: pg_ctlcluster 12 master start pg_lsclusters #The cluster Ver Cluster Port Status Owner Data directory Log file 10 mv main 5432 online postgres /vardata/libpostgres /mediawiki26082020 var/bulklog/retiredpostgresql/postgresql-10-main.log 12 master mv 5433 online postgres /bulkvar/retired/mediawiki26082020 lib/bulkpostgresql/retired12/mediawiki20200826 mv master /var/wwwlog/html/blog20200809 /bulk/retiredpostgresql/postgresql-12-master.logg systemctl stop postgresql systemctl status postgresql

Edit the config files: vi /etc/postgresql/10/main/postgresql.conf data_directory ='/var/lib/postgresql/10/main' port =5433 vi /etc/postgresql/12/master/postgresql.conf data_directory =Wordpress Redux'/data/postgres' port =5432 listen_addresses ='*' #While we are here do some performance tuning: shared_buffers =512MB huge_pages = try temp_buffers = 8G work_mem = 4GB maintenance_work_mem = 64 effective_cache_size = 384GB #Note that I didn't reduce the number of connections (and the max_wal_senders, which must be < max connections), or change max_stack_depth (which gives an error if you set it too high) vi /etc/postgresql/12/master/pg_hba.conf Copy over the config to allow access from inside the network

First, move Do the old folder to a new name, so that it is there installs for backup and then get the new install and unpack it. cd /bulk/installs wget httpssome extensions://wordpress.org/latest.tar.gz mv /var/www/html/blog /var/www/html/blog20200809apt-get install postgresql-12-plr tar apt-get install postgresql-xzf latest.tar.gz plperl-C /var/www/html/12 cd /var/www/html/ mv wordpress/ blog/ chown postgresql-R www-data:wwwplpython3-data blog12

Put an .htaccess file in that folder to restrict access while we workCheck it all works: vi blog/.htaccesspsql postgres CREATE EXTENSION postgis; CREATE EXTENSION plr; CREATE EXTENSION plperl; CREATE EXTENSION plpython3u; \dx List of installed extensions <RequireAny>Name | Version | Schema | Description---------+---------+------------+--------------------------------------------------------------------- Require ip 192 plpgsql | 1.1680 | pg_catalog | PL/pgSQL procedural language postgis | 3.20.10 | public | PostGIS geometry, geography, and raster spatial types and functions </RequireAny> (2 rows)

Then set up restore the dbase by editing wp-config.php databases (it's easiest to modify the sampleas researcher in /bulk/backup).: createdb stockmarket cp blog/wppg_restore -configFc -sampled stockmarket stockmarket_Fc_20201023.php blog/wp-config.phpdump createdb vcdb4 vi blog/wppg_restore -config.php Note get some keys from: https://api.wordpress.org/secretFc -key/1d vcdb4 vcdb4_Fc.1/salt/dump

Then the backend works - go The restore threw some errors related to not having extension plpythonu, but otherwise seemed fine. The issue seems to httpbe that pythonu is python2[https://www.edeganpostgresql.comorg/blogdocs/wp12/plpython-admin! However the health check shows a missing required module python23.html], and two missing recommended modulespython2 is not available for postgres 12 (it might be here: https://wiki. Fix thatpostgresql.org/wiki/Apt): apt-get install php7cache search ".3-gd apt-get install php7.3-curl apt-get install php7*plpython*.3-imagick apachectl restart*"

See [[Wordpress Blog Site (Tool)]] for I need to get Xwindows set up again. My best guess as to the McNair Centercause of this issue is leftover Nvidia drivers from my attempts to install the GPUs on this box went bad in an earlier apt-get upgrade but I can's build.t see them listed: dpkg -l | grep nvidia-driver

Using wwwThere is a .edeganXauthority file, and an .comICEauthority file, in /bloghome/wp-admin I configured the blog as followsed and both are owned by ed:*Select Twenty Twenty as the theme*Add the permalink code to the ed.htaccess file, so that the URLs will work with postnames*Copy over images to wp-content/uploads The former is empty (use cp -a to maintain permissions0 bytes)*Change and the site name to https latter has some non-UTF8 (after fixing the https setup, see belowI think?)characters in it. I'm not sure if either is an issue.

Install pluginsI didn't see xserver-xorg-video-nouvea in the package list or any video driver module, so I installed nouveau:*Yoast SEO dpkg -l*Wordfence Security lsmod | more*Disable Comments apt install xserver-xorg-video-nouveau*Site Kit by Google (set up once live!) I'm not sure if I should be fixing my boot image or not...*Pixabay shutdown -r now lsmod | more

After doing this the login would give a local desktop but neither the keyboard nor mouse worked. I also added:tried uninstalling and reinstalled the keyboard-configuration again.*CoBlocks (free) apt-get remove keyboard-configuration*Advanced Gutenberg (free) apt-get install keyboard-configuration *Otter shutdown -r now

But that just put me back where I didn't add Co-Authors Plus (httpswas://wordpresswith a login loop problem.org/plugins/coSo I tried switching to lightdm: apt-authors-plus/) as it hasn't been tested on the latest version of wordpress. There are other plugins that offer equivalent functionality if I need one later.get install lightdm

Other plugins And it worked even before a reboot. After a reboot, I might want arehad a different login screen but the actual desktop looked the same. The .Xauthority file is now 51 bytes big and I suddenly have a .xsession-errors, which contains a list of environment settings taking place... However, the machine then silently crashed that night and again the following morning. I couldn't find a specific cause in the logs but there did seem to be a number X and GNOME problems:*Revive Old Post (share with twitter)*Optimole (optimize images) journalctl -b -1*WP Rocket (implement cache) journalctl --since "1 hour ago"

Notes:*Twitter embedding: https://wwwI ran an update from the GUI, which may have helped. However, there was a warning about an issue with a screensaver the first time that I loaded lightdm, and the crashes seemed to happen sometime after a clean boot. So I uninstalled lightdm, and installed gdm (which failed as installed already) and rebooted but got no GUI.wpbeginnerThen I uninstalled and reinstalled gdm and everything seems fine now.com/wp apt-tutorials/howget remove lightdm apt-to-display-recent-tweets-in-wordpress-with-twitterget remove gdm3 apt-widgets/get install gdm3

This included:*Fixing file ownership: For fully hardened, change ownership I kept the old versions of everything to root, except wflogs, uploads mediawiki and wordpress and themes in wp-content, which should be owned by www-data. However, then you won't be able moved them to install plugins etc. A compromise is -R root:root for blog and then www-data:www-data for wp-content./bulk/retired (using yyymmdd dates)*Check file permissions: Everything is 644, except wp-content which is 755 mv /var/lib/mediawiki26082020 /bulk/retired/*Checking dbase rights and setting new passwords. mv /bulk/retired/mediawiki26082020 /bulk/retired/mediawiki20200826*Changing passwords on old accounts (with posts, so the accounts shouldn't be deleted) to random strong strings.*Fixing up .htaccess file to impose restrictions mv /var/www/html/blog20200809 /bulk/retired/*Install Sucuri *Enable more logging===Wordpress Redux===

Checking user rights in the dbase and changing their password: mysql -user=root -p use wordpress SELECT User FROM mysql.user; SHOW GRANTS FOR 'username'@'localhost'; SET PASSWORD FOR 'username'@'localhost'='newpassword'; (Note that this shouldn't be logged in clear on the server, but might be on a client. Delete .mysql_history at the end of your session.)==Install====

First, move the old folder to a new name, so that it is there for backup and then get the new install and unpack it.htaccess in wp-includes: # Block the include-only files.cd /bulk/installs <IfModule mod_rewritewget https://wordpress.c>org/latest.tar.gz RewriteEngine On RewriteBase mv /var/www/html/blog / RewriteRule ^wp-adminvar/includeswww/ - [F,L] RewriteRule !^wp-includeshtml/ - [S=3]blog20200809 RewriteRule ^wptar -includes/[^/]+\xzf latest.tar.php$ gz - [F,L] RewriteRule ^wp-includesC /jsvar/tinymcewww/langshtml/.+\.php - [F,L] RewriteRule ^wp-includescd /var/www/theme-compathtml/ - [F,L] <mv wordpress/ blog/IfModule> # BEGIN WordPresschown -R www-data:www-data blog

The #BEGIN WordPress tag is redundant as the Put an .htaccess file is 644 rootin that folder to restrict access while we work: vi blog/.htaccess <RequireAny> Require ip 192.168.2.1 </RequireAny>

If there are plugin installation issues then add Then set up the dbase by editing wp-config.php (it's easiest to modify the sample). cp blog/wp-config-sample.php blog/wp-config.php define('FS_METHOD','direct');vi blog/wp-config.php Note get some keys from: https://api.wordpress.org/secret-key/1.1/salt/

Once I'm all done with Then the theme etcbackend works - go to http://www., I can uncomment edegan.com/blog/wp-admin! However the following from wphealth check shows a missing required module and two missing recommended modules. Fix that: apt-get install php7.3-gd apt-get install php7.3-curl apt-configget install php7.php3-imagick define('DISALLOW_FILE_EDIT', true);apachectl restart

I changed See [[Wordpress Blog Site (Tool)]] for the site colors, added the logo and the tag line, and made other config changesMcNair Center's build.

Then, Using www.edegan.com/blog/wp-admin I added custom CSS configured the blog as follows:*Select Twenty Twenty as the theme*Add the permalink code to the .htaccess file, so that the URLs will work with postnames*Copy over images to wp-content/uploads (use cp -a to maintain permissions)*Change the site name to https (after fixing the https setup, see below)

To reduce the header spacingInstall plugins: .header-inner {*Yoast SEO padding: 1.5rem 0;*Wordfence Security*Disable Comments*Site Kit by Google (set up once live!) }*Pixabay

To remove the title from the landing pageI also added: .page-id-2169 .entry-title{*CoBlocks (free) display:none !important; } .page-id-2169 .entry-header { padding: 0;*Advanced Gutenberg (free) }*Otter

To do:*I need to didn't add social media icons! That might be as easy as adding the social media menu [Co-Authors Plus (https://wordpress.org/supportplugins/article/twentyco-authors-twentyplus/#add-social-icons].*Get a '''related posts widget'''? There's Yet Another Related Posts Plugin, Contextual Related Posts, and Inline Related Posts... I went with YARPP, ) as it is hasn't been tested on the most popularlatest version of wordpress. It is apparently resource-heavyThere are other plugins that offer equivalent functionality if I need one later.

Other plugins I tried the following blocks pluginsmight want are:*'''Ultimate Addons for Guttenberg'''*It's free and adds some nice basic functionality**Revive Old Post blocks include: Post Carousel, Post Grid, Post Masonry, Post Timeline, Advanced Columns -- but customization is limited and I can't do one post(share with twitter)*'''Getwid''':Optimole (optimize images)**Pretty highly customizable. **Can specify which posts to show in 3 blocks WP Rocket (Custom Post Type, Post Carousel, and Post Sliderimplement cache) and can build custom templates to arrange how they are displayed**Post blocksNotes: Recent Posts, Custom Post Type, Post Carousel, and Post Slider*'''Redux''' Twitter embedding: https://www.wpbeginner.com/wp-tutorials/how- It's a templates library. You get 5 for free and they upsell hard.*'''ZeGuten''' to- Couldn't find it*'''Advanced Gutenberg''' display- It's free and widely used... *'''CoBlocks''' recent-tweets- Does the basics**Posts in-wordpress- Can't specify specific posts. Can do category.**Post Carousel with-twitter- Likewise.widgets/ ====Hardening Wordpress====*'''Stackable''':**It requested opt-in, which I didn't like, and it wants you to 'Go Premium'hardened the wordpress installation: https://wordpress. org/support/article/hardening-wordpress/**It has settings for everything! By far the most detailed configuration.**Useful blocksThis included:***Posts Fixing file ownership: For fully hardened, change ownership of everything to root, except wflogs, uploads and themes in wp-content, which should be owned by www- candata. However, then you won't seem be able to specify a specific post***Advanced Columns install plugins etc. A compromise is -R root:root for blog and Grids then www-data:www- data for layout***Card wp-- could make posts links with buttonscontent.***Feature/Feature Grid Check file permissions: Everything is 644, except wp-- likewisecontent which is 755***Container? Might be helpfulChecking dbase rights and setting new passwords.*Changing passwords on old accounts (with posts, so the accounts shouldn'''Gutenberg Post Blocks'''**Untested with my version. Seems t be deleted) to workrandom strong strings. **Has lots of options but does full-page things. Can limit to a post using include but has next page linksFixing up ...**Tried htaccess file to push for an update to pro.impose restrictions*'''Magical Posts Display''' -- I dumped it for being too weird.*'''Otter Blocks'''Install Sucuri **Google maps block and other useful things... I just don't need it right now.Enable more logging

Built-Checking user rights inthe dbase and changing their password:*Latest Posts (widget) mysql -user=root -p use wordpressChosen block plugins: SELECT User FROM mysql.user;*'''Getwid SHOW GRANTS FOR 'username'@' -- Itlocalhost's outstanding and embraces templates for serious bespoke customization;* SET PASSWORD FOR 'username'@'Stackablelocalhost'='newpassword' -- For its option-based customization;*I might add back '''coblocks'' (Note that this shouldn't be logged in clear on the server, '''Advanced Gutenberg''' and '''Ultimate Addons for Gutenberg'''but might be on a client. Delete .mysql_history at the end of your session.)

.htaccess in wp-includes: # Block the include-only files. <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S===HTTPS===3] RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L] </IfModule> # BEGIN WordPress

To set up HTTPS using Let's Encrypt, see https://linuxizeThe #BEGIN WordPress tag is redundant as the file is 644 root.com/post/secure-apache-with-let-s-encrypt-on-ubuntu-20-04/

Install it and make some directories.Add the following to .htaccess in the wordpress dir: <files wp-config.php> apt updateorder allow,deny apt install certbotdeny from all openssl dhparam -out /etc/ssl/certs</dhparam.pem 2048files> takes ~20 secs mkdir If there are plugin installation issues then add to wp-p /var/lib/letsencrypt/config.well-knownphp chgrp wwwdefine('FS_METHOD','direct'); Once I'm all done with the theme etc., I can uncomment the following from wp-data /var/lib/letsencryptconfig.php chmod g+s /var/lib/letsencryptdefine('DISALLOW_FILE_EDIT', true);

vi /etc/apache2/conf-available/ssl-paramsI built a [[Branding]] palette, to standardize the colors.conf SSLProtocol all -SSLv3 -TLSv1 -TLSv1And I installed the Twentig plugin, to give extra configuration options.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA- CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 SSLHonorCipherOrder off SSLSessionTickets off SSLUseStapling On SSLStaplingCache "shmcb:logs/ssl_stapling(32768)" SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem" Header always set Strict-Transport-Security "max-age=63072000"

Run certbot! certbot certonly --agree-tos --email ed@edegan.com --webroot -w /var/lib/letsencrypt/ -d edegan.com -d www.edegan.com Note that Then, I needed an @ entry in my A record for edegan.com pointed to my IP address to get the main challenge to succeedadded custom CSS as follows.

Then set up a new apache2 config file (in /etc/apache)To reduce the header spacing: mv sites-available/000-default.conf sitesheader-available/000-default.conf.bakinner { vi sites-available/edegan.com.conf <VirtualHost * padding:80> ServerName www.edegan.com ServerAdmin ed@edegan.com Redirect permanent / https://www1.edegan.com/5rem 0; </VirtualHost> <VirtualHost *:443> ServerName www.edegan.com Protocols h2 http/1.1 DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined SSLEngine On SSLCertificateFile /etc/letsencrypt/live/edegan.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/edegan.com/privkey.pem # Other Apache Configuration Alias /wiki /var/www/html/mediawiki/index.php RewriteEngine On RewriteRule ^/*$ %{DOCUMENT_ROOT}/mediawiki/index.php [L] </VirtualHost> ln -s sites-available/edegan.com.conf sites-enabled/edegan.com.conf systemctl reload apache2

Test it by going to https://www.ssllabs.com/ssltest/ Finally, edit /etc/cron.d/certbot and append To remove the following to title from the last line (after -renew)landing page: .page-id-renew2169 .entry-hook "systemctl reload apache2"title{ display:none !important; certbot renew } .page-id-dry2169 .entry-runheader { padding: 0; Tests the renewal! }

Enabling I tried the following blocks plugins:*'''Ultimate Addons for Guttenberg'''*It's free and requiring HTTPS causes an issue with PDFEmbed on mediawikiadds some nice basic functionality**Post blocks include: Post Carousel, Post Grid, where you get a blank frame. The PDF is still therePost Masonry, other images load finePost Timeline, Advanced Columns -- but the PDF frame woncustomization is limited and I can't render the PDFdo one post*'''Getwid''':**Pretty highly customizable. The problem is actually that the PDF is served with HTTP **Can specify which posts to show in 3 blocks (Custom Post Type, Post Carousel, and Post Slider) and the rest of the page is served with HTTPScan build custom templates to arrange how they are displayed**Post blocks: Recent Posts, Custom Post Type, Post Carousel, and Chrome (and perhaps other browsers) donPost Slider*'''Redux''' -- It't render the insecure content as s a consequence (see [https://wwwtemplates library.mediawiki.org/wiki/Topic:Uhgnq0wbmzfurbj0] You get 5 for a description of the symptoms, but not the solution.)free and they upsell hard.*'''ZeGuten''' - Couldn't find itThe solution is to edit mediawiki/extensions/PDFEmbed/PDFEmbed*'''Advanced Gutenberg''' - It's free and widely used.hooks.php. For me it was line 103 that previously said: *'''CoBlocks'''src-- Does the basics**Posts -- Can' => $filet specify specific posts. Can do category.**Post Carousel ->getFullUrl()- Likewise.*'''Stackable''#page='.$page:**It requested opt-in,which I changed this line didn't like, and it wants you to'Go Premium'. **It has settings for everything! By far the most detailed configuration.**Useful blocks: ***Posts -- can'src' => preg_replace("t seem to specify a specific post***Advanced Columns and Grids -- for layout***Card -- could make posts links with buttons***Feature/^http:/i", "https:", $fileFeature Grid -->getFullUrl()).likewise***Container? Might be helpful*'''Gutenberg Post Blocks''#page='**Untested with my version.$Seems to work. **Has lots of options but does full-page, This is mentioned in things. Can limit to a comment on a topic post using include but has next page, though presumably links...**Tried to push for an earlier version: https://wwwupdate to pro.*'''Magical Posts Display''' -- I dumped it for being too weird.*'''Otter Blocks'''**Google maps block and other useful things...mediawikiI just don't need it right now.org/wiki/Topic:Syxow0why4c0cvvm

With the security restrictions on wordpress, I now need an FTP server to get files for themes, Chosen block plugins, etc. I like VSFTPD, as its simple, secure, and has a nice standalone config. Old documentation on an earlier install on the old [[Wordpress Blog Site (Tool)]] page. Instructions are here: https://linuxconfig.org/how*'''Getwid''' -to-setupIt's outstanding and embraces templates for serious bespoke customization*'''Stackable''' -ftp-serverFor its option-on-ubuntu-20-04-focal-fossa-linuxbased customization*I might add back '''coblocks''', '''Advanced Gutenberg''' and '''Ultimate Addons for Gutenberg''' ====Email====

apt-get install vsftpd cp /etc/vsftpdI installed WP Mail SMTP Lite.conf /etc/vsftpd.conf_orig vi /etc/vsftpd.conf #Change the following write_enable=YES local_umask=022 ssl_enable=YES #Add the following (forces ssl) allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=YES ssl_sslv3=YES /etc/init.d/vsftpd restart

Then add a user I first set it up to use Google. Essentially you need to sign in to Google and set it upan API in the console: https: useradd -m blog passwd blog usermod -a -G www-data blog usermod -d /var/wwwconsole.developers.google.com/htmlflows/blog blogenableapi?apiid=gmail&pli=1. However, this seemed to introduce a massive security hole unless you have G Suite, so I abandoned this approach.

I had previously set up SMTP through Google for the wiki (See [[Research_Computing_Configuration#Confirm_Account]]). So, I used the same approach with Wordpress. In WP Mail SMTP Lite choose 'Other' (see the [https://www.wpbeginner.com/plugins/how-to-send-email-in-wordpress-using-the-gmail-smtp-server/ second method]). Then [https://wpmailsmtp.com/docs/how-to-secure-smtp-settings-by-using-constants/ edit wp-config.php to hardcode the values] (this ensures that the password, which is stored plain-text, is a little more secure.): define( 'WPMS_ON', true ); //You MUST set this if you want hardcoded values to work! define( 'WPMS_LICENSE_KEY', '' ); define( 'WPMS_MAIL_FROM', 'blog@edegan.com' ); define( 'WPMS_MAIL_FROM_FORCE', true ); define( 'WPMS_MAIL_FROM_NAME', 'The Blog at EdEgan.com' ); define( 'WPMS_MAIL_FROM_NAME_FORCE', true ); define( 'WPMS_MAILER', 'smtp' ); // Possible values: 'mail', 'gmail', 'mailgun', 'sendgrid', 'smtp'. define( 'WPMS_SET_RETURN_PATH', true ); define( 'WPMS_SMTP_HOST', 'ssl://smtp.gmail.com' ); define( 'WPMS_SMTP_PORT', 465 ); define( 'WPMS_SSL', 'ssl' ); // Possible values '', 'ssl', 'tls' - note TLS is not STARTTLS. define( 'WPMS_SMTP_AUTH', true ); define( 'WPMS_SMTP_USER', 'username@gmail.com' ); // SMTP authentication username, only used if WPMS_SMTP_AUTH is true. define( 'WPMS_SMTP_PASS', 'password generated by Google' ); define( 'WPMS_SMTP_AUTOTLS', true ); =====Author Comments===== The blog supports multiple authors and by default, Wordpress emails an author whenever one of their posts gets a comment. If you'd like to disable author comment emails but keep the moderator emails, there's a simple fix: '''Just go to wp-admin/options.php and set 'comments_notify' to 0.''' (See https://codex.wordpress.org/Option_Reference) More complicated methods involve writing your own plugin [https://wordpress.stackexchange.com/questions/150125/disabling-comment-notifications-for-post-author] to refine wp_new_comment_notify_postauthor[https://developer.wordpress.org/reference/functions/wp_new_comment_notify_postauthor/] or changing the hooks[https://developer.wordpress.org/reference/hooks/notify_post_author/] used in wp-includes/comment.php: $maybe_notify = apply_filters( 'notify_post_author', $maybe_notify, $comment_ID ); ====Social Media Integration==== Getting the social media icons on the menu and correctly linked up is very straight forward. Follow the [https://wordpress.org/support/article/twenty-fifteen/#add-social-icons guide for twenty-fifteen], which also works for 2020. Getting some share buttons was more problematic, particular as my planned social media usage is somewhat atypical (Twitter, LinkedIn, and Reddit, really in reverse order), and because I don't want to pay anything.  The free version of [https://revive.social/plugins/revive-old-post/ Revive Old Posts] lets you push content to Twitter and Facebook, but they want you pay to push to LinkedIn. The best free options seem to be:*[https://wordpress.org/plugins/add-to-any/ AddToAny Share Buttons] - Integrates with Google Analytics*[https://wordpress.org/plugins/simple-social-icons/ Simple Social Icons] - The simplest option*[https://wordpress.org/plugins/shared-counts/ Shared Counts] -- Counts hits (but using a 3rd party for data?)*[https://wordpress.org/plugins/wordpress-social-login/ WordPress Social Login] - if you want users to log in using their SM accounts (note: has a bimodal ratings distro)*[https://wordpress.org/plugins/jetpack/ JetPack] -- The plugin used by wordpress.com for this functionality. The free version should suffice, but this thing is a monster. It also uses an account on the wordpress.com cloud, which is a pain for those who are self-hosting. I went with AddToAny, as it had the most installations, is entirely open-source, and offers all the functionality I need. ====Avoiding JetPack==== I tried to add a profile picture, but by default, WordPress uses [https://en.gravatar.com/ Gravitar], which, surprise, surprise, links to your WordPress.com account... and to add a self-hosted site, you have to install JetPack. At this point, I felt harassed and doubly so because I didn't install JetPack and yet, some how, the profile picture correctly updated from the one I'd posted on Gravitar. What the hecK? ===SEO=== I used Site Kit plugin for wordpess, and for mediawiki I made a sitemap to submit to Google. See https://www.mediawiki.org/wiki/Manual:GenerateSitemap.php In mediawiki: mkdir sitemap php maintenance/generateSitemap.php --memory-limit=50M --fspath=/var/www/html/mediawiki/sitemap/ --identifier=edegancom --urlpath=/sitemap/ --server=https://www.edegan.com --compress=yes Then submit it to Google... I did this by making an alias in apache2.conf from sitemap to /var/www/html/mediawiki/sitemap/, then submitting https://www.edegan.com/sitemap/sitemap-index-edegancom.xml #in retrospect, I wish I'd used an identifier with 'wiki' in it but what the hey. And with that success behind you, install Google XML Sitemaps on Wordpress, chose some settings (on Settings -> XML-Sitemap), and then post the URL to Google: https://www.edegan.com/blog/sitemap.xml It seems Yoast already builds a sitemap, you just need to submit to it Google... (I uninstalled XML Sitemaps): https://www.edegan.com/blog/sitemap_index.xml ===HTTPS=== To set up HTTPS using Let's Encrypt, see https://linuxize.com/post/secure-apache-with-let-s-encrypt-on-ubuntu-20-04/ Install it and make some directories... apt update apt install certbot openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 takes ~20 secs mkdir -p /var/lib/letsencrypt/.well-known chgrp www-data /var/lib/letsencrypt chmod g+s /var/lib/letsencrypt Set up the config files vi /etc/apache2/conf-available/letsencrypt.conf Alias /.well-known/acme-challenge/ "/var/lib/letsencrypt/.well-known/acme-challenge/" <Directory "/var/lib/letsencrypt/"> AllowOverride None Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec Require method GET POST OPTIONS </Directory>  vi /etc/apache2/conf-available/ssl-params.conf SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA- CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 SSLHonorCipherOrder off SSLSessionTickets off SSLUseStapling On SSLStaplingCache "shmcb:logs/ssl_stapling(32768)" SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem" Header always set Strict-Transport-Security "max-age=63072000" Enable some apache2 mods! a2enmod ssl a2enmod headers a2enconf letsencrypt a2enconf ssl-params sudo a2enmod http2 systemctl reload apache2 Run certbot! certbot certonly --agree-tos --email ed@edegan.com --webroot -w /var/lib/letsencrypt/ -d edegan.com -d www.edegan.com Note that I needed an @ entry in my A record for edegan.com pointed to my IP address to get the main challenge to succeed. Then set up a new apache2 config file (in /etc/apache): mv sites-available/000-default.conf sites-available/000-default.conf.bak vi sites-available/edegan.com.conf <VirtualHost *:80> ServerName www.edegan.com ServerAdmin ed@edegan.com Redirect permanent / https://www.edegan.com/ </VirtualHost> <VirtualHost *:443> ServerName www.edegan.com Protocols h2 http/1.1 DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined SSLEngine On SSLCertificateFile /etc/letsencrypt/live/edegan.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/edegan.com/privkey.pem # Other Apache Configuration Alias /wiki /var/www/html/mediawiki/index.php RewriteEngine On RewriteRule ^/*$ %{DOCUMENT_ROOT}/mediawiki/index.php [L] </VirtualHost> ln -s sites-available/edegan.com.conf sites-enabled/edegan.com.conf systemctl reload apache2 Test it by going to https://www.ssllabs.com/ssltest/ Finally, edit /etc/cron.d/certbot and append the following to the last line (after -renew): --renew-hook "systemctl reload apache2" certbot renew --dry-run Tests the renewal! ====PDFEmbed Issue==== Enabling and requiring HTTPS causes an issue with PDFEmbed on mediawiki, where you get a blank frame. The PDF is still there, other images load fine, but the PDF frame won't render the PDF. The problem is actually that the PDF is served with HTTP and the rest of the page is served with HTTPS, and Chrome (and perhaps other browsers) don't render the insecure content as a consequence (see [https://www.mediawiki.org/wiki/Topic:Uhgnq0wbmzfurbj0] for a description of the symptoms, but not the solution.). The solution is to edit mediawiki/extensions/PDFEmbed/PDFEmbed.hooks.php. For me it was line 103 that previously said: 'src' => $file->getFullUrl().'#page='.$page,I changed this line to: 'src' => preg_replace("/^http:/i", "https:", $file->getFullUrl()).'#page='.$page, This is mentioned in a comment on a topic page, though presumably for an earlier version: https://www.mediawiki.org/wiki/Topic:Syxow0why4c0cvvm ===Install VSFTPD=== With the security restrictions on wordpress, I now need an FTP server to get files for themes, plugins, etc. I like VSFTPD, as its simple, secure, and has a nice standalone config. Old documentation on an earlier install on the old [[Wordpress Blog Site (Tool)]] page. Instructions are here: https://linuxconfig.org/how-to-setup-ftp-server-on-ubuntu-20-04-focal-fossa-linux  apt-get install vsftpd cp /etc/vsftpd.conf /etc/vsftpd.conf_orig vi /etc/vsftpd.conf #Change the following write_enable=YES local_umask=022 ssl_enable=YES #Add the following (forces ssl) allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=YES ssl_sslv3=YES /etc/init.d/vsftpd restart Then add a user and set it up: useradd -m blog passwd blog usermod -a -G www-data blog usermod -d /var/www/html/blog blog Test it: ftp 127.0.0.1

See also: *http://praveen.kumar.in/2009/05/31/setting-up-ftps-using-vsftpd-for-wordpress-plugins-auto-upgrade/*https://askubuntu.com/questions/14371/how-to-setup-ftp-to-use-in-locally-hosted-wordpress To address some of the issues with the FTP server's file permissions in wordpress add to wp-config.php: define( 'WP_CONTENT_DIR', 'wp-content' ); define( 'FTP_BASE', '/var/www/html/blog/' ); If I chmod blog:blog /var/www/html/blog then everything seems to work find when I sftp but wordpress is unable to create a directory... I can't work out why this is happening. I expect it has to do with the need for another wordpress specific define() statement, but I'm spending too much time on it. So I'm going to use direct installation of plugins instead, and remove the FTP server as it is a point of vulnerability. apt-get remove vsftpd userdel blog ===Final Configuration Changes=== Lock down apache somewhat further (as now there are directories that shouldn't be listable, etc.) cd /etc/apache2 vi apache2.conf #Change the directory definitions. Notes that if -SomeOption is used then other options must have + or - in front of them: <Directory /var/www/html> Options -Indexes +FollowSymLinks AllowOverride All Require all granted </Directory> systemctl reload apache2 #To debug: systemctl status apache2.service ====Remove the debug setup==== In the wiki (LocalSettings.php), comment the debug lines (I can't see when I added them from the documentation, but if you want to see error messages during the config, you'd want them uncommented): #error_reporting( -1 ); #ini_set( 'display_errors',1 ); #$wgShowExceptionDetails = true; #$wgShowDBErrorBacktrace = true; #$wgShowSQLErrors = true; Check the permissions set using $wgGroupPermissions - see https://www.mediawiki.org/wiki/Manual:User_rights Run all the updates to the blog, etc., from the consol before locking it down. Then in wp-config.php, lock down the ability to install plugins, etc., by commenting: #define('FS_METHOD','direct'); Edit the .htaccess files in blog and mediawiki to allow access but with appropriate restrictions. Note that the rewrite rules for the blog are in its .htaccess file <IfModule mod_rewrite.c> RewriteEngine On RewriteBase /blog/ RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /blog/index.php [L] </IfModule> To make the blog the default, edit /etc/apache/sites-available-edegan.com.conf, add an alias (don't alias to index.php as it will cause design issues, the rewrite rule for that is already in the .htaccess file!): Alias /blog /var/www/html/blog/ And change: RewriteRule ^/*$ %{DOCUMENT_ROOT}/mediawiki/index.php [L] To: RewriteRule ^/*$ %{DOCUMENT_ROOT}/blog/index.php [L] Then: systemctl reload apache2 Note: Don't change the DocumentRoot to the blog, as this will destroy the design of the wiki. The last rewrite rule will decide the default site!