| @@ -10,2 +10,2 @@ |
| Webstack consolidates all configuration into a single directory tree under git version control.
|
|
|
| Webstack consolidates all configuration into a single directory tree under git version control. |
|
|
|
| @@ -13 +13 @@ |
Structure - What Goes Where
|
Structure - What Goes Where |
|
|
|
| @@ -17,9 +17,9 @@ |
| ├── systemd/ ← service files (real files, linked FROM /etc/systemd/system/)
|
| ├── nginx/ ← entire nginx directory (real files, /etc/nginx linked here)
|
| ├── php8/ ← php config (real files, /etc/php8 linked here)
|
| ├── firebird/ ← firebird config (real files, linked FROM /opt/firebird5/)
|
| ├── radicale/ ← radicale config (real files, linked FROM /etc/radicale)
|
| ├── acme/ ← acme.sh domain configs and dhparams.pem
|
| ├── cron.daily/ ← cron scripts (real files, linked FROM /etc/cron.daily/)
|
| ├── scripts/ ← admin utilities
|
| └── site-config/ ← machine specific site configs
|
| ├── systemd/ > service files (real files, linked FROM /etc/systemd/system/) |
| ├── nginx/ > entire nginx directory (real files, /etc/nginx linked here) |
| ├── php8/ > php config (real files, /etc/php8 linked here) |
| ├── firebird/ > firebird config (real files, linked FROM /opt/firebird5/) |
| ├── radicale/ > radicale config (real files, linked FROM /etc/radicale) |
| ├── acme/ > acme.sh domain configs and dhparams.pem |
| ├── cron.daily/ > cron scripts (real files, linked FROM /etc/cron.daily/) |
| ├── scripts/ > admin utilities |
| └── site-config/ > machine specific site configs |
|
|
| @@ -30 +29,0 @@ |
| Key principle: Real files live in webstack, symlinks point back to where services expect them.
|
|
|
| @@ -32,2 +31 @@ |
The Symlink Pattern
|
| Direction matters — symlinks go FROM the service location TO webstack, not the other way:
|
Key principle: Real files live in webstack, symlinks point back to where services expect them. |
|
|
| @@ -35 +33,5 @@ |
|
The Symlink Pattern |
|
Direction matters — symlinks go FROM the service location TO webstack, not the other way: |
|
|
|
|
| @@ -43 +44,0 @@ |
| Moving an existing directory:
|
|
|
| @@ -45 +46,3 @@ |
|
Moving an existing directory: |
|
|
|
|
| @@ -48 +51 @@ |
| nginx -t && systemctl restart nginx
|
| nginx -t && systemctl restart nginx |
|
|
| @@ -51 +54 @@ |
Setting Up Git
|
Setting Up Git |
|
|
|
| @@ -57,2 +60,2 @@ |
| git config --global user.name "srv10 admin"
|
| git config --global user.email "root@srv10.rdm1.uk"
|
| git config --global user.name "srv10 admin" |
| git config --global user.email "root@srv10.rdm1.uk" |
|
|
| @@ -66 +69 @@ |
.gitignore - What To Exclude
|
.gitignore - What To Exclude |
|
|
|
| @@ -80 +82,0 @@ |
| Add placeholder files so directory structure is preserved:
|
|
|
| @@ -82 +84,3 @@ |
|
Add placeholder files so directory structure is preserved: |
|
|
|
|
| @@ -84 +87,0 @@ |
| And allow them despite the ignore rules:
|
|
|
| @@ -86 +89,3 @@ |
|
And allow them despite the ignore rules: |
|
|
|
|
| @@ -89,2 +94,3 @@ |
Committing In Logical Sections
|
| Commit each section separately for clean history:
|
Committing In Logical Sections |
|
Commit each section separately for clean history: |
|
|
|
| @@ -94 +100 @@ |
| git commit -m "systemd service files - moved from /usr/lib to allow version control"
|
| git commit -m "systemd service files - moved from /usr/lib to allow version control" |
|
|
| @@ -97 +103 @@ |
| git commit -m "nginx config - full config including ssl and vhosts"
|
| git commit -m "nginx config - full config including ssl and vhosts" |
|
|
| @@ -100 +106 @@ |
| git commit -m "php8 config - clean baseline, opcache isolation settings"
|
| git commit -m "php8 config - clean baseline, opcache isolation settings" |
|
|
| @@ -103 +109 @@ |
| git commit -m "firebird config - RuntimeDirectory fix for modern systemd"
|
| git commit -m "firebird config - RuntimeDirectory fix for modern systemd" |
|
|
| @@ -106 +112 @@ |
| git commit -m "radicale CalDAV server - replacing nextcloud calendar/contacts"
|
| git commit -m "radicale CalDAV server - replacing nextcloud calendar/contacts" |
|
|
| @@ -108,2 +114 @@ |
The Bare Repo - Mirroring Between Machines
|
| The bare repo acts as a hub — like a local github but private:
|
The Bare Repo - Mirroring Between Machines |
|
|
| @@ -111 +116,3 @@ |
|
The bare repo acts as a hub — like a local github but private: |
|
|
|
|
| @@ -122 +129 @@ |
Daily Workflow
|
Daily Workflow |
|
|
|
| @@ -133 +140 @@ |
| git commit -m "what changed and why"
|
| git commit -m "what changed and why" |
|
|
| @@ -135 +141,0 @@ |
| Renaming files (disabled configs):
|
|
|
| @@ -137 +143,3 @@ |
|
Renaming files (disabled configs): |
|
|
|
|
| @@ -140 +148 @@ |
| git commit -m "site disabled - reason why"
|
| git commit -m "site disabled - reason why" |
|
|
| @@ -142,2 +150 @@ |
Service File Management
|
| Never edit files in /usr/lib/systemd/system/ — they get overwritten by package updates. Copy to webstack and symlink:
|
Service File Management |
|
|
| @@ -145 +152,3 @@ |
|
Never edit files in /usr/lib/systemd/system/ — they get overwritten by package updates. Copy to webstack and symlink: |
|
|
|
|
| @@ -149 +157,0 @@ |
| Always run systemctl daemon-reload after adding or modifying service files!
|
|
|
| @@ -151,2 +159,5 @@ |
PHP-FPM Isolation
|
| Running multiple sites from one PHP-FPM pool risks APCu cache contamination between applications. Isolate heavyweight applications:
|
Always run systemctl daemon-reload after adding or modifying service files! |
|
PHP-FPM Isolation |
|
Running multiple sites from one PHP-FPM pool risks APCu cache contamination between applications. Isolate heavyweight applications: |
|
|
|
| @@ -161 +171,0 @@ |
| Each pool has its own APCu memory space — applications cannot contaminate each other.
|
|
|
| @@ -163,2 +173 @@ |
Scripts
|
| /etc/webstack/scripts/restart-stack.sh — restart all services in correct order:
|
Each pool has its own APCu memory space — applications cannot contaminate each other. |
|
|
| @@ -166 +175,5 @@ |
|
Scripts |
|
/etc/webstack/scripts/restart-stack.sh — restart all services in correct order: |
|
|
|
|
| @@ -168 +181 @@ |
| echo "Restarting full web stack..."
|
| echo "Restarting full web stack..." |
|
|
| @@ -173 +186 @@ |
| echo "Done - checking status..."
|
| echo "Done - checking status..." |
|
|
| @@ -176 +188,0 @@ |
| /etc/webstack/scripts/check-crontabs.sh — audit all scheduled tasks:
|
|
|
| @@ -178 +190,3 @@ |
|
/etc/webstack/scripts/check-crontabs.sh — audit all scheduled tasks: |
|
|
|
|
| @@ -182,4 +196,4 @@ |
| CRON=$(crontab -u $user -l 2>/dev/null)
|
| if [ ! -z "$CRON" ]; then
|
| echo "=== $user ==="
|
| echo "$CRON"
|
| CRON=$(crontab -u $user -l 2>/dev/null) |
| if [ ! -z "$CRON" ]; then |
| echo "=== $user ===" |
| echo "$CRON" |
|
|
| @@ -190 +203,0 @@ |
| Note: crontab -l only shows root's crontab. Applications like Nextcloud add entries under their own service user — always check all users!
|
|
|
| @@ -192,2 +205 @@ |
Site-Specific Configuration
|
| Files like config_inc.php contain machine-specific database connection strings and passwords. Keep them in webstack but excluded from git, deployed by script:
|
Note: crontab -l only shows root's crontab. Applications like Nextcloud add entries under their own service user — always check all users! |
|
|
| @@ -195 +207,5 @@ |
|
Site-Specific Configuration |
|
Files like config_inc.php contain machine-specific database connection strings and passwords. Keep them in webstack but excluded from git, deployed by script: |
|
|
|
|
|
|
| @@ -212 +229 @@ |
Rsync Between Machines
|
Rsync Between Machines |
|
|
| @@ -214,2 +231,2 @@ |
|
| # Full mirror srv10 → srv9 (delete enabled - true mirror)
|
|
| # Full mirror srv10 > srv9 (delete enabled - true mirror) |
|
|
| @@ -218 +235 @@ |
| # Additive sync srv10 → desktop (no delete - preserves local extras)
|
| # Additive sync srv10 > desktop (no delete - preserves local extras) |
|
|
| @@ -222 +239 @@ |
| rsync -avz --exclude='config_inc.php' srv10:/srv/website/ /srv/website/
|
| rsync -avz --exclude="config_inc.php" srv10:/srv/website/ /srv/website/ |
|
|
|
| @@ -235 +255 @@ |
|
Developed with Claude AI assistance - Anthropic - April 2026 |
|
|
