ICT:MW Installation procedure 1.43 LTS - Revision history

Mngr at 15:50, 3 April 2026

2026-04-03T15:50:58Z

← Older revision		Revision as of 15:50, 3 April 2026
Line 293:		Line 293:
	This staged approach avoids dependency on the reverse‑proxy during installation		This staged approach avoids dependency on the reverse‑proxy during installation
	and allows controlled, low‑risk rollout.		and allows controlled, low‑risk rollout.


			= Addendum =

			== Adding a New Domain + Certificate on VM3 (nginx + Certbot) ==
			This procedure is used when onboarding a new subdomain to the reverse‑proxy layer on VM3.
			It avoids the nginx/Certbot “missing certificate” failure by always starting with a minimal HTTP‑only configuration, issuing the certificate, and then enabling HTTPS.

			=== 1. Create a minimal HTTP‑only reverse‑proxy config ===
			Create <code>/etc/nginx/conf.d/<domain>.conf</code> with:

			<syntaxhighlight lang="nginx">
			# ============================================
			# Reverse proxy (HTTP only)
			# <domain>
			# ============================================

			server {
			listen 80;
			listen [::]:80;
			server_name <domain>;

			# ACME challenge (Certbot uses this)
			location /.well-known/acme-challenge/ {
			root /usr/share/nginx/html;
			}

			# Temporary: no HTTPS redirect until certificate exists
			location / {
			proxy_pass http://<backend-ip>:<backend-port>;

			proxy_set_header Host <domain>;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto http;
			}
			}
			</syntaxhighlight>

			Reload nginx:

			<syntaxhighlight lang="bash">
			sudo nginx -t
			sudo systemctl reload nginx
			</syntaxhighlight>

			At this point the domain resolves over HTTP and Certbot can validate it.

			=== 2. Issue the certificate using the nginx plugin ===
			Run:

			<syntaxhighlight lang="bash">
			sudo certbot --nginx -d <domain>
			</syntaxhighlight>

			Certbot will:
			* inject a temporary ACME location
			* validate the domain
			* obtain the certificate
			* install it
			* register it for automatic renewal

			This step only works if nginx is running without SSL errors.

			=== 3. Replace the config with the full HTTPS reverse‑proxy ===
			After the certificate exists, replace the file with:

			<syntaxhighlight lang="nginx">
			# ============================================
			# Reverse proxy (HTTPS)
			# <domain>
			# ============================================

			# --- HTTP (redirect + ACME) ---
			server {
			listen 80;
			listen [::]:80;
			server_name <domain>;

			location /.well-known/acme-challenge/ {
			root /usr/share/nginx/html;
			}

			return 301 https://$host$request_uri;
			}

			# --- HTTPS ---
			server {
			listen 443 ssl;
			listen [::]:443 ssl;
			http2 on;

			server_name <domain>;

			ssl_certificate /etc/letsencrypt/live/<domain>/fullchain.pem;
			ssl_certificate_key /etc/letsencrypt/live/<domain>/privkey.pem;

			ssl_protocols TLSv1.2 TLSv1.3;
			ssl_prefer_server_ciphers on;

			location /.well-known/acme-challenge/ {
			root /usr/share/nginx/html;
			}

			location / {
			proxy_pass http://<backend-ip>:<backend-port>;

			proxy_set_header Host <domain>;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto https;

			proxy_buffering on;
			proxy_buffers 16 16k;
			proxy_buffer_size 16k;

			proxy_connect_timeout 60s;
			proxy_send_timeout 60s;
			proxy_read_timeout 60s;
			}
			}
			</syntaxhighlight>

			Reload nginx again:

			<syntaxhighlight lang="bash">
			sudo nginx -t
			sudo systemctl reload nginx
			</syntaxhighlight>

			=== 4. Verification checklist ===
			* <code>curl -I https://<domain></code> returns <code>200</code> or <code>301</code>
			* Browser loads the site over HTTPS
			* Login works
			* File uploads work
			* Optional: <code>certbot renew --dry-run</code>

Mngr at 14:38, 3 April 2026

2026-04-03T14:38:58Z

@@ Line 130: / Line 130: @@
 </pre>
-== 7. Local‑Only Apache Virtual Host (VM1) ==
+== 7. Enable Apache to Listen on Port 8080 (VM1) & Virtual Host file ==
 This vhost allows installation and testing without involving the reverse‑proxy.

Mngr at 13:36, 3 April 2026

2026-04-03T13:36:33Z

Show changes

Mngr at 13:31, 3 April 2026

2026-04-03T13:31:41Z

← Older revision		Revision as of 13:31, 3 April 2026
Line 2:		Line 2:
	This document describes the clean, reproducible installation workflow for		This document describes the clean, reproducible installation workflow for
	deploying a new MediaWiki instance (newMW) on the existing 3‑VM infrastructure.		deploying a new MediaWiki instance (newMW) on the existing 3‑VM infrastructure.
	It includes directory preparation, file extraction, permissions, and the		It includes directory preparation, file extraction, permissions, database
	preferred ownership model for VS Code access.		creation, and the preferred ownership model for VS Code access.

	== 1. ~~Preparation~~ ==		== 1. Create the newwiki Database (VM2 – Database Layer) ==
	All commands are executed on ~~VM1 (Web Layer)~~.		All commands in this section are executed on VM2.

	=== 1.1 Create the target directory ===		=== 1.1 Connect to MariaDB ===
			<pre>
			mysql -u root -p
			</pre>

			=== 1.2 Create the database ===
			<pre>
			CREATE DATABASE newwiki
			CHARACTER SET utf8mb4
			COLLATE utf8mb4_unicode_ci;
			</pre>

			=== 1.3 Create the database user ===
			Replace <code>VM1-IP</code> with the internal Hyper‑V IP of the web server.

			<pre>
			CREATE USER 'newwikiuser'@'VM1-IP' IDENTIFIED BY 'strongpassword';
			</pre>

			=== 1.4 Grant privileges ===
			<pre>
			GRANT ALL PRIVILEGES ON newwiki.* TO 'newwikiuser'@'VM1-IP';
			FLUSH PRIVILEGES;
			</pre>

			=== 1.5 Exit MariaDB ===
			<pre>
			EXIT;
			</pre>

			== 2. Prepare the Installation Directory (VM1 – Web Layer) ==
			All commands below are executed on VM1.

			=== 2.1 Create the target directory ===
	<pre>		<pre>
	mkdir /var/www/newMW		mkdir /var/www/newMW
	</pre>		</pre>

	=== 1.2 Move into the working directory ===		=== 2.2 Move into the working directory ===
	<pre>		<pre>
	cd /var/www		cd /var/www
	</pre>		</pre>

	== 2. Download MediaWiki ==		== 3. Download MediaWiki ==
	Download the latest LTS tarball (example: 1.43.8):		Download the latest LTS tarball (example: 1.43.8):

Line 25:		Line 58:
	</pre>		</pre>

	== 3. Extract MediaWiki ==		== 4. Extract MediaWiki ==
	Extract the archive. This creates a directory such as <code>mediawiki-1.43.8/</code>.		Extract the archive. This creates a directory such as <code>mediawiki-1.43.8/</code>.

Line 32:		Line 65:
	</pre>		</pre>

	== 4. Move Extracted Files into newMW ==		== 5. Move Extracted Files into newMW ==
	Move normal files:		Move normal files:

Line 57:		Line 90:
	</pre>		</pre>

	== 5. Ownership and Permissions ==		== 6. Ownership and Permissions ==
	Use the preferred ownership model to allow editing via VS Code while keeping		Use the preferred ownership model to allow editing via VS Code while keeping
	Apache fully functional.		Apache fully functional.

	=== 5.1 Set owner and group ===		=== 6.1 Set owner and group ===
	<pre>		<pre>
	chown -R mngr:apache /var/www/newMW		chown -R mngr:apache /var/www/newMW
	</pre>		</pre>

	=== 5.2 Ensure group write permissions ===		=== 6.2 Ensure group write permissions ===
	<pre>		<pre>
	chmod -R g+w /var/www/newMW		chmod -R g+w /var/www/newMW
	</pre>		</pre>

	=== 5.3 Apply clean directory/file permissions ===		=== 6.3 Apply clean directory/file permissions ===
	Directories:		Directories:

Line 84:		Line 117:
	</pre>		</pre>

	=== 5.4 Enable group inheritance (setgid) ===		=== 6.4 Enable group inheritance (setgid) ===
	Ensures new files created inside inherit the <code>apache</code> group.		Ensures new files created inside inherit the <code>apache</code> group.

Line 91:		Line 124:
	</pre>		</pre>

	== 6. Apache Virtual Host ==		== 7. Apache Virtual Host (VM1) ==
	Create a vhost ~~on VM1~~:		Create a vhost:

	<pre>		<pre>
Line 115:		Line 148:
	</pre>		</pre>

	== 7. nginx Reverse‑Proxy (VM3) ==		== 8. nginx Reverse‑Proxy (VM3) ==
	Add a server block:		Add a server block:

Line 137:		Line 170:
	</pre>		</pre>

	== 8. Run the MediaWiki Installer ==		== 9. Run the MediaWiki Installer ==
	Navigate to:		Navigate to:

Line 157:		Line 190:
	</pre>		</pre>

	== 9. Minimal Post‑Install Configuration ==		== 10. Minimal Post‑Install Configuration ==
	Add or verify:		Add or verify:

Line 179:		Line 212:
	</pre>		</pre>

	== 10. Verification Checklist ==		== 11. Verification Checklist ==
	* Site loads correctly		* Site loads correctly
	* <code>/wiki/Main_Page</code> resolves		* <code>/wiki/Main_Page</code> resolves
Line 188:		Line 221:
	* MariaDB connections succeed		* MariaDB connections succeed

	== 11. Summary ==		== 12. Summary ==
	This procedure provides a clean, repeatable installation workflow for MediaWiki		This procedure provides a clean, repeatable installation workflow for MediaWiki
	1.43 LTS using the preferred ownership model (<code>mngr:apache</code>) and the		1.43 LTS using the preferred ownership model (<code>mngr:apache</code>) and the
	existing 3‑VM architecture. It ensures clarity, maintainability, and		existing 3‑VM architecture. It ensures clarity, maintainability, and
	successor‑friendly operation.		successor‑friendly operation.

Mngr: Created page with "= Installation Procedure for newMW (MediaWiki 1.43 LTS) = This document describes the clean, reproducible installation workflow for deploying a new MediaWiki instance (newMW) on the existing 3‑VM infrastructure. It includes directory preparation, file extraction, permissions, and the preferred ownership model for VS Code access. == 1. Preparation == All commands are executed on VM1 (Web Layer). === 1.1 Create the target directory ===

 mkdir /var/www/newMW

..."

2026-04-03T13:29:43Z

Created page with "= Installation Procedure for newMW (MediaWiki 1.43 LTS) = This document describes the clean, reproducible installation workflow for deploying a new MediaWiki instance (newMW) on the existing 3‑VM infrastructure. It includes directory preparation, file extraction, permissions, and the preferred ownership model for VS Code access. == 1. Preparation == All commands are executed on VM1 (Web Layer). === 1.1 Create the target directory === <pre> mkdir /var/www/newMW </pre>..."

New page

= Installation Procedure for newMW (MediaWiki 1.43 LTS) =
This document describes the clean, reproducible installation workflow for
deploying a new MediaWiki instance (newMW) on the existing 3‑VM infrastructure.
It includes directory preparation, file extraction, permissions, and the
preferred ownership model for VS Code access.

== 1. Preparation ==
All commands are executed on VM1 (Web Layer).

=== 1.1 Create the target directory ===
<pre>
mkdir /var/www/newMW
</pre>

=== 1.2 Move into the working directory ===
<pre>
cd /var/www
</pre>

== 2. Download MediaWiki ==
Download the latest LTS tarball (example: 1.43.8):

<pre>
wget https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.8.tar.gz
</pre>

== 3. Extract MediaWiki ==
Extract the archive. This creates a directory such as <code>mediawiki-1.43.8/</code>.

<pre>
tar -xvzf mediawiki-1.43.8.tar.gz
</pre>

== 4. Move Extracted Files into newMW ==
Move normal files:

<pre>
mv mediawiki-1.43.8/* newMW/
</pre>

Move hidden files (e.g. <code>.htaccess</code>):

<pre>
mv mediawiki-1.43.8/.* newMW/ 2>/dev/null
</pre>

Remove the now‑empty extraction directory:

<pre>
rmdir mediawiki-1.43.8
</pre>

Remove the tarball:

<pre>
rm mediawiki-1.43.8.tar.gz
</pre>

== 5. Ownership and Permissions ==
Use the preferred ownership model to allow editing via VS Code while keeping
Apache fully functional.

=== 5.1 Set owner and group ===
<pre>
chown -R mngr:apache /var/www/newMW
</pre>

=== 5.2 Ensure group write permissions ===
<pre>
chmod -R g+w /var/www/newMW
</pre>

=== 5.3 Apply clean directory/file permissions ===
Directories:

<pre>
find /var/www/newMW -type d -exec chmod 775 {} \;
</pre>

Files:

<pre>
find /var/www/newMW -type f -exec chmod 664 {} \;
</pre>

=== 5.4 Enable group inheritance (setgid) ===
Ensures new files created inside inherit the <code>apache</code> group.

<pre>
chmod g+s /var/www/newMW
</pre>

== 6. Apache Virtual Host ==
Create a vhost on VM1:

<pre>
<VirtualHost *:8080>
ServerName newwiki.example.com
DocumentRoot /var/www/newMW

<Directory /var/www/newMW>
AllowOverride All
Require all granted
</Directory>

ErrorLog /var/log/httpd/newwiki-error.log
CustomLog /var/log/httpd/newwiki-access.log combined
</VirtualHost>
</pre>

Restart Apache:

<pre>
systemctl restart httpd
</pre>

== 7. nginx Reverse‑Proxy (VM3) ==
Add a server block:

<pre>
server {
listen 80;
server_name newwiki.example.com;

location / {
proxy_pass http://VM1-IP:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
</pre>

Reload nginx:

<pre>
systemctl reload nginx
</pre>

== 8. Run the MediaWiki Installer ==
Navigate to:

<pre>
https://newwiki.example.com
</pre>

Provide:
* Database: <code>newwiki</code>
* User: <code>newwikiuser</code>
* Password: (as created on VM2)
* Site name
* Admin account

Download <code>LocalSettings.php</code> and place it in:

<pre>
/var/www/newMW/LocalSettings.php
</pre>

== 9. Minimal Post‑Install Configuration ==
Add or verify:

<pre>
$wgServer = "https://newwiki.example.com";
$wgScriptPath = "";
$wgArticlePath = "/wiki/$1";
$wgUsePathInfo = true;
</pre>

Enable uploads (optional):

<pre>
$wgEnableUploads = true;
</pre>

Enable SyntaxHighlight:

<pre>
wfLoadExtension( 'SyntaxHighlight_GeSHi' );
</pre>

== 10. Verification Checklist ==
* Site loads correctly
* <code>/wiki/Main_Page</code> resolves
* Editing works
* File uploads work (if enabled)
* No rewrite errors in Apache logs
* nginx proxies correctly
* MariaDB connections succeed

== 11. Summary ==
This procedure provides a clean, repeatable installation workflow for MediaWiki
1.43 LTS using the preferred ownership model (<code>mngr:apache</code>) and the
existing 3‑VM architecture. It ensures clarity, maintainability, and
successor‑friendly operation.