h.ear.t | tobias - tobias@hubzilla.rocks

somewhere between the lines, Tue, 10 Apr 2018 22:26:36 +0200 last edited: Tue, 10 Apr 2018 22:32:32 +0200

When you register at Hubzilla you are presented with a choice of channel roles. There are

social channels with varying privacy settings
forums with varying privacy settings
feed channels
a soap box function for announcement only channels
group repositories

The docs explain the basics about what is what, but I was always missing a tabled overview. So I created one.

https://hubzilla.rocks/articles/tobias/hubzilla%252bchannel%252broles+an+overview

channel roles howto Hubzilla

show all 5 comments

Andrew Manning

Wed, 11 Apr 2018 11:46:21 +0200

This will be handy. I'd share it but somehow the Link to Source is buggered.

This will be refined over time, this graphic is just a first quick and dirty draft done in LibreOffice Calc and will be updated into a native table.

That is going to be one crazy block of BBcode! And if history is any guide, it will become outdated rapidly. This is something we could probably generate automatically in the code. It could be accessible when people are selecting a permission role and would naturally stay up-to-date.

@Zachary Dunn
#developertraining

h.ear.t | tobias

Wed, 11 Apr 2018 18:04:00 +0200 last edited: Wed, 11 Apr 2018 18:14:14 +0200

@Mike Macgirvin
You are right, I made a mistake. Social does not have perms_auto, which I understand as autoconnect.

What I have not yet managed to find a meaning for is $ret['limits']. Any hint? :)

And "Default Collection" ... I believe that means connections are sorted into a default privacy group, the new name for collection? Yet that is - unfortunately - only configurable if I chose custom mode. Which for me is a huuuge reason to chose custom mode but ... ... ... maybe that should be moved to general access?
Or does that mean "Default permission group", which then is not reflected if I change the channel role.
(Note to self: Need to describe these default permission group roles as "follower, contributor, publisher", have never really looked into that before.)

    case 'forum_private':
                $ret['perms_auto'] = false;
                $ret['default_collection'] = true;
                $ret['directory_publish'] = false;
                $ret['online'] = false;
                $ret['perms_connect'] = [
                    'view_stream', 'view_profile', 'view_contacts', 'view_storage',
                    'view_pages', 'view_wiki', 'post_wall', 'post_comments',
                    'post_mail', 'post_like' , 'chat'
                ];
                $ret['limits'] = PermissionLimits::Std_Limits();
                $ret['limits']['view_profile']  = PERMS_SPECIFIC;
                $ret['limits']['view_contacts'] = PERMS_SPECIFIC;
                $ret['limits']['view_storage']  = PERMS_SPECIFIC;
                $ret['limits']['view_pages']    = PERMS_SPECIFIC;
                $ret['limits']['view_wiki']     = PERMS_SPECIFIC;

                break;

h.ear.t | tobias

Wed, 11 Apr 2018 18:16:49 +0200

Corrected the image.

Install Hubzilla in 7 easy steps

h.ear.t | tobias

somewhere between the lines, Thu, 20 Apr 2017 18:00:54 +0200 last edited: Mon, 09 Apr 2018 19:17:15 +0200

Edit: This howto was moved to
https://hubzilla.rocks/articles/tobias

where it is being maintained and updated.

Installing my favorite web suite aka Hubzilla on the forthcoming Debian 9 "Stretch" is a joy. Quick, straightforward and easy. I will show you how to do it in about 10 minutes or less.
Currently I am preparing for the switch to Debian 9 "Stretch". So far I am quite happy with the update and I am pretty happy to finally welcome back to my favourite distro the pacemaker clustering suite. But that is another story and shall be told at another time. :)
(This is just a quick cheatsheet, I will later write a longer howto for later. Promised.)
I am starting with a basic Debian installation. The only additional feature chosen during installation is ssh-server.

The Basics: Install the required dependencies:
apt-get install vim git apache2 mariadb-server php certbot python-certbot-apache php-curl php-gd php-mbstring php-xml php-mysql php-zip

Webserver apache: Create vhost file /etc/apache2/sites-available/hubzilla.conf and enable vhost, enable the required apache module rewrite

<VirtualHost *:80> 
    ServerAdmin webmaster@localhost
    ServerName my-hubzilla.site
    DocumentRoot /var/www/hubzilla
    <Directory />
        Options FollowSymLinks
        AllowOverride All
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    </Directory>
    ErrorLog ${APACHE_LOG_DIR}/hubzilla_error.log
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/hubzilla_access.log combined
</VirtualHost>

Enable the new vhost
enable /etc/apache2/sites-available/hubzilla.conf
Enable apache modules rewrite
a2enmod rewrite
Restart apache2 in order to activate all these changes
systemctl restart apache2

Download Hubzilla: clone the Hubzilla Git repository and chown everything to be writable to the webserver account www-data
cd /var/www/ ; git clone https://github.com/redmatrix/hubzilla ; chown -R www-data. hubzilla;

create the database

mysql -u root 
create database hubzilla ; CREATE USER 'hubzilla'@'localhost' IDENTIFIED BY 'totally-secret-password'; GRANT ALL PRIVILEGES ON hubzilla.* to 'hubzilla'@'localhost';

SSL Encryption: create the letscencrypt certificates in order to use SSL and have certbot automatically configure your apache vhost to use SSL. Just follow the instructions. Let certbot configure your vhost to use SSL.
certbot
setup a cronjob
echo "*/10 * * * * cd /var/www/hubzilla; /usr/bin/php Zotlabs/Daemon/Master.php Cron" >> /etc/crontab
Finally: open your browser and follow the instructions.
https://my-hubzilla.site

Hubzilla Installation Debian Howto Howto Debian Hubzilla

show all 20 comments

Mike Macgirvin

Thu, 20 Apr 2017 21:51:32 +0200

*please* copy to the hubzilla docs (no not some channel wiki we won't be able to find next week when we want to link to it, the actual hubzilla docs in the repository, followed by pull request).

h.ear.t | tobias

Fri, 21 Apr 2017 04:20:44 +0200

Ok, will do. Was not sure whether this was too specific to Debian.

mrjive

Fri, 21 Apr 2017 11:36:37 +0200

Is a VirtualHost *:443 needed or *:80 is enough?

Andrew Manning

Fri, 21 Apr 2017 13:21:43 +0200

I believe you need both. Typically I have the port 80 VirtualHost apply a rewrite rule that forces all requests to https so that the port 443 VirtualHost takes control.

Andrew Manning

Fri, 21 Apr 2017 13:22:39 +0200

Perhaps he did not include it because in step #5 the certbot utility will create one for you automatically when it installs the signed SSL certificate.

h.ear.t | tobias

Fri, 21 Apr 2017 13:33:32 +0200

@Andrew Manning Your guess is 100% correct.

Einer von Vielen

Fri, 21 Apr 2017 13:50:23 +0200

@tobias Thank your for providing this docu.

Have you thought about to replace certbot by a simple script like dehydrated. I have no real good feeling when I read this fefe blog posting. And I made a similar experience with an early version of the official client of letsencrypt that did not work for me. So I switched to one of the minimal solutions with the shell script of dehydrated. I can confirm that dehydrated works well. Of course you have to tell Apache, where to find the certificate. Just some thoughts.

Beni Grind

Fri, 21 Apr 2017 13:50:38 +0200

IMHO it would be good to have tutorials for some major Linux distros in the Hubzilla documentation.

One question: Wouldn't it be considered bad security practice to have everything owned by www-data, shouldn't only the directory and files Hubzilla actually need to change or to write to be owned by www-data and everything else by root and read only for [color]www-data[/color]?

Beni Grind

Fri, 21 Apr 2017 13:54:56 +0200

@Einer von Vielen I'm using dehydrated for my Hubzilla instance, too. It works quite well. I had one or two glitches when they renamed it from letsencrypt.sh to dehydrated, but since then it does it's job.

Einer von Vielen

Fri, 21 Apr 2017 14:05:22 +0200

Wouldn't it be considered bad security practice to have everything owned by www-data, shouldn't only the directory and files Hubzilla actually need to change or to write to be owned by www-data and everything else by root and read only for [color]www-data[/color]?

I think a good practice to avoid the worst errors is to use a standard installation as tried with .homeinstall/hubzilla-setup.sh This script installed my hub and updates it every night, makes backups, renews the certificate of letsencrypt and so on. My hub has run and run and run since August last year.

h.ear.t | tobias

Fri, 21 Apr 2017 20:48:08 +0200

I had a look at the script and it does also chown everything to www-data. But I just tried

chown -R nobody. * ; chown -R nobody. .h* ; chown -R nobody. .g* ; chown -R www-data. store/ ; chown www-data. hubzilla.log

and everything still appears to be fine. So this might be a nice idea.
Though an even better idea might be for example to add SELinux to your server, which I am testing right now and will add at a later date to the description.

I must admit I had not used the script .homeinstall/hubzilla-setup.sh before. I just had a quick look at it. It is clearly geared towards home use. On a cloud server I do not require a dynamic IP but letsencrypt, which is not implemented yet (would be not much of a problem to add, thogh). I also do not use phpmyadmin anywhere as of now.
But maybe we should improve the script to be more flexible, not just for home use. I guess there will be a pull request anytime soon. :)

h.ear.t | tobias

Fri, 21 Apr 2017 21:55:04 +0200

I nust noticed I have forgotten cron. Updating post.

Klaus

Fri, 21 Apr 2017 22:00:04 +0200

I think on CentOS I used something like this for SELinux:

setsebool -P httpd_can_sendmail on
semanage fcontext -a -t httpd_sys_content_t "/var/www/hubzilla(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/hubzilla/store(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/hubzilla/.htconfig.php"
restorecon -Rv /var/www/hubzilla/

h.ear.t | tobias

Fri, 21 Apr 2017 22:10:49 +0200 last edited: Fri, 21 Apr 2017 22:11:08 +0200

Yes, that should be right. :)
Though I left CentOS because I had _very_ strange issues with Hubzilla refusing to embed links and the likes. Very strange, but once I moved the site back to Debian everything was fine again. Should have got some logs somewhere.

Einer von Vielen

Sat, 22 Apr 2017 16:19:35 +0200

But maybe we should improve the script to be more flexible, not just for home use.

Agreed!

h.ear.t | tobias

Sun, 30 Apr 2017 17:03:23 +0200

Changelog: added php-zip to the installed dependencies.

Erik

Wed, 04 Oct 2017 11:42:48 +0200

Erik hat hEARt | tobiass Beitrag mit ⋕Hubzilla verschlagwortet

Erik

Wed, 04 Oct 2017 11:43:01 +0200

Erik hat hEARt | tobiass Beitrag mit ⋕Installation verschlagwortet

Erik

Wed, 04 Oct 2017 11:43:18 +0200

Erik hat hEARt | tobiass Beitrag mit ⋕Debian verschlagwortet

Erik

Wed, 04 Oct 2017 11:43:40 +0200

Erik hat hEARt | tobiass Beitrag mit ⋕Howto verschlagwortet

Impressum