Page History

...

Once again i found more reasonable not to copy (or symlink) webapps to tomcat appBase dir as suggests dspace official documentation. Instead i'm changin tomcat appBase to point to dspace webapps. Also put tomcat logs with other www/apache logs. Original lines are commented out and my lines marked bold.

...

Some lines are omitted from output. Also configure "apache22/extra/httpd-mpm.conf" and "httpd-default.conf" to suit You. Also don't forget apache certificates.

*tcsh# egrep \-v "#\|"^$ /usr/local/etc/apache22/httpd.conf*
/*/
LoadModule rewrite_module libexec/apache22/mod_rewrite.so
LoadModule jk_module          libexec/apache22/mod_jk.so
/*/
ErrorLog "/var/log/apache2/httpd-error.log"
/*/
    CustomLog "\|/usr/local/sbin/rotatelogs \-l /var/log/apache2/httpd-access_%Y-%m-%d.log 86400" combined
/*/
Include etc/apache22/extra/httpd-mpm.conf
Include etc/apache22/extra/httpd-default.conf
Include etc/apache22/extra/httpd-ssl.conf
/*/
Include etc/apache22/Includes/*.conf
NameVirtualHost \*:80
<IfModule jk_module>
&nbsp;&nbsp; &nbsp;# relative path to /usr/local
&nbsp;&nbsp; &nbsp;JkWorkersFile etc/apache22/workers.properties
&nbsp;&nbsp; &nbsp;JkShmFile&nbsp; /var/run/jk-runtime-status
&nbsp;&nbsp; &nbsp;JkLogLevel error
&nbsp;&nbsp; &nbsp;JkLogFile&nbsp; /var/log/apache2/mod_jk.log
</IfModule>
<VirtualHost \*:80>
ServerName dspace.example.com
&nbsp;&nbsp; &nbsp;DocumentRoot /usr/local/www/apache22/data
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <IfModule jk_module>
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;JkMount /xmlui localhost-worker
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;JkMount /xmlui/\* localhost-worker
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;JkMount /solr localhost-worker
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;JkMount /solr/\* localhost-worker
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;JkMount /oai localhost-worker
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;JkMount /oai/\* localhost-worker
&nbsp;&nbsp; &nbsp;</IfModule>
&nbsp;&nbsp; &nbsp;RewriteEngine On
&nbsp;&nbsp; &nbsp;RewriteRule \^/$ /xmlui/ \[PT\]
&nbsp;&nbsp; &nbsp;RewriteRule \^/$ /solr/ \[PT\]
&nbsp;&nbsp; &nbsp;RewriteRule \^/$ /oai/ \[PT\]
&nbsp;&nbsp; &nbsp;RewriteCond [http://%]

\{HTTP_HOST\}%\{REQUEST_URI\} (.*)-login(.*) \[OR\]
    RewriteCond [http://%]

\{HTTP_HOST\}%\{REQUEST_URI\} (.*)/register(.*) \[OR\]
    RewriteCond [http://%]

*tcsh# egrep \-v "#\|"^$ /usr/local/etc/apache22/extra/httpd-ssl.conf*
Listen 443
/*/
<VirtualHost \_default_:443>
ServerName dspace.example.com:443
ServerAdmin hostmaster@example.com
DocumentRoot "/usr/local/www/apache22/data"
<IfModule jk_module>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /xmlui localhost-worker
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /xmlui/\* localhost-worker
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /solr localhost-worker
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /solr/\* localhost-worker
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /oai localhost-worker
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /oai/\* localhost-worker
&nbsp;&nbsp; &nbsp;RewriteEngine On
&nbsp;&nbsp; &nbsp;RewriteRule \^/$ /xmlui/ \[PT\]
&nbsp;&nbsp; &nbsp;RewriteRule \^/$ /solr/ \[PT\]
&nbsp;&nbsp; &nbsp;RewriteRule \^/$ /oai/ \[PT\]
</IfModule>
ErrorLog "\|/usr/local/sbin/rotatelogs /var/log/apache2/https-error-%Y-%m-%d.log 5M"
TransferLog "\|/usr/local/sbin/rotatelogs /var/log/apache2/https-access-%Y-%m-%d.log 86400"
/*/
SSLCertificateFile "/usr/local/etc/apache22/certs/dspace.example.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/certs/dspace.example.com.key"
SSLCertificateChainFile "/usr/local/etc/apache22/certs/dspace-bundle.example.com.crt"
/*/
<Directory "/data/dspace/webapps/xmlui">
&nbsp;&nbsp;&nbsp; SSLOptions \+StdEnvVars \+ExportCertData
</Directory>

4 Install Dspace

...

Open /data/dspace-1.8.1-src-release/dspace/config/dspace.cfg and make Your changes:

dspace.dir = /data/dspace
dspace.hostname = dspace.example.com
dspace.baseUrl = [http://dspace.example.com]
dspace.url = ${dspace.baseUrl}/xmlui
dspace.name = Dspace at Example.Com
db.name = postgres
db.url = jdbc:postgresql://localhost:5432/dspacedb
db.driver = org.postgresql.Driver
db.username = dspace
db.password = s0mepw
db.maxconnections = 30
db.maxwait = 5000
db.maxidle = \-1
db.statementpool = true
mail.server = smtp.example.com
mail.server.port = 25
mail.from.address = dspace-noreply@example.com
feedback.recipient = dspace-help@example.com
mail.admin = dspace-help@example.com
alert.recipient = postmaster@example.com
registration.notify = dspace-help@example.com
mail.charset = UTF-8
mail.allowed.referrers = localhost,dspace.example.com
mail.server.disabled = false
default.language = en_US
assetstore.dir = ${dspace.dir}/assetstore
log.init.config = ${dspace.dir}/config/log4j.properties
log.dir = /var/log/apache2/
search.dir = ${dspace.dir}/search
/*/
handle.canonical.prefix = [http://hdl.handle.net/]
handle.prefix = 12345
handle.dir = ${dspace.dir}/handle-server
/*/
upload.max = 536870912
default.locale = en
xmlui.supported.locales = en
xmlui.force.ssl = true
xmlui.user.registration=false

Configure LDAP module. As i'm writing its not possible to configure multiple ldap servers in order to achieve failover (eg. ldap://ldapserver1 ldapserver2/?blah?blah).

*tcsh# egrep \-v "#\|"^$ modules/authentication-ldap.cfg

*
enable = true

autoregister = true

provider_url = ldaps://myldap.example.com/

id_field = uid

object_context = ou=people,dc=example,dc=com

search_context = ou=people,dc=example,dc=com

email_field = mail

surname_field = sn

givenname_field = givenName

phone_field = telephoneNumber

search_scope = 2

search.user = cn=ldap-bind,cn=Users,dc=example,dc=com

search.password = s0mepw2

netid_email_domain = @example.com

As You can see, i'm using LDAPS. We'll be back to it later on.

Following command fetches software from internet in order to build dspace. This soft will be placed under $HOME/.m2/ directory. In my case /root/.m2/. If You want to, You can build dspace as "www" user. I'm doing it as root.

*tcsh# /data/dspace-1.8.1-src-release

*
*tcsh# mvn package

*
*tcsh# cd /data/dspace-1.8.1-src-release/dspace/target/dspace-1.8.1-build/

*
*tcsh# ant fresh_install*

As looking from my notes there was an issue with creating PostgreSQL database (PL/pgSQL related). Seems that following helped out. However - i can't verify or confirm it at the moment.

_tcsh# dropdb \-U pgsql dspacedb

_
_tcsh# createdb \-U pgsql \-O dspace \-E UNICODE dspacedb

_
_tcsh# psql \-h localhost \-U dspace \-f /data/dspace-1.8.1-src-release/dspace/etc/postgres/database_schema.sql dspacedb_

And finally set proper permissons:

*tcsh# chown \-R www:www /data/dspace*

Just in case verify /data/dspace/config/log4j.properties doesn't bug You.  Remove unneeded "/" There may be 3 erratic lines like this one:

/var/log/apache2/*/*cocoon.log

Also verify that /data/dspace/config/modules/authentication.cfg and authentication-ldap.cfg are correct.

Since i like to keep all dspace related things in one place and i have pretty small /usr/local:

*tcsh# mkdir \-p /data/dspace/tc-webinf/work/upload-dir

*
*tcsh# mkdir \-p /data/dspace/tc-webinf/work/cache-dir

*
*tcsh# chown \-R www:www /data/dspace/tc-webinf

*

*tcsh# grep dspace /data/dspace/webapps/xmlui/WEB-INF/cocoon/properties/core.properties

*
org.apache.cocoon.uploads.directory=/data/dspace/tc-webinf/work/upload-dir

org.apache.cocoon.cache.directory=/data/dspace/tc-webinf/work/cache-dir

org.apache.cocoon.work.directory=/data/dspace/tc-webinf/work/

Don't forget thisone if You upgraded Your dspace - cocoon may fill /usr/local.

If needed, configure OAI also: /data/dspace/config/oaicat.properties:

/*/

Crosswalks.mods=org.dspace.app.oai.PluginCrosswalk

Crosswalks.mets=org.dspace.app.oai.PluginCrosswalk

Crosswalks.qdc=org.dspace.app.oai.PluginCrosswalk

Set up crontabs. PATH is required.

...

Now install certificates required to use LDAPS. Make sure that You have JAVA_HOME set:

*tcsh# set JAVA_HOME=/usr/local/openjdk6*
*tcsh# echo $JAVA_HOME*
/usr/local/openjdk6
*tcsh# keytool \-import \-file /tmp/myldap-clients.example.com.crt \-alias myldap.example.com \-keystore $JAVA_HOME/jre/lib/security/cacerts*
Enter keystore password:&nbsp; 'changeit'&nbsp;&nbsp; <\- by default without '-es\!
/*/
Trust this certificate? \[no\]:&nbsp; *yes*
Certificate was added to keystore
*tcsh# keytool \-list \-keystore $JAVA_HOME/jre/lib/security/cacerts*
*tcsh# rm \-f /tmp/olp-wild-clients.example.com.crt*

5 Handle

If You are using "handle" also, then:

...

Create /usr/local/etc/rc.d/handle with following content. This script runs handle service as "www" user.

handle_server_start()
{
        if \[ \-x $\{command\} \]; then
        pid="`ps \-axuwww \| grep \-v grep \| grep handle-server \| nawk '\{ print $2 \}'`"
                if \[ "$\{pid\}"X = "X" \]; then
                        su - www \-c $\{command\}
                else
                        echo "Handle server is already running."
                fi
        fi
}
handle_server_stop()
{
        pid="`ps \-axuwww \| grep \-v grep \| grep handle-server \| nawk '\{ print $2 \}'`"
        if \[ "$\{pid\}"X \!= "X" \]; then
                pid_owner="`ps \-axu \|grep \-v grep \| grep \-w $pid \|nawk '\{ print $1 \}'`"
                if \[ "$\{pid_owner\}" = "www" \]; then
                        kill \-15 $\{pid\}
                        sleep 1
                fi
        else
                echo "Handle server is not running?"
        fi
}
\# set defaults

6 Clean up and daemons startup

*tcsh# cd /data/dspace-1.8.1-src-release

*
*tcsh# mvn clean

*
*tcsh# rm \-r /root/.m2*

Enable all required services at startup - /etc/rc.conf. Once again pay attention to UTF and make sure that "-Xmx" and "-Xms" are at least 512M and both do have same values!

apache22_enable="YES"

tomcat7_enable="YES"

tomcat7_java_opts="-Xmx512M \-Xms512M \-XX:MaxPermSize=128M \-Dfile.encoding=UTF-8"

tomcat7_catalina_log=">> /var/log/apache2/-`date \+%Y-%m-%d`.log 2>&1"

tomcat7_catalina_tmpdir="/tmp"

handle_server_enable="YES"

postgresql_enable="YES"

postgresql_data="/data/pgsql"

*tcsh# sync; sync; reboot*

7 Final notes

• If You should later on upgrade "openjdk", then You need to import LDAP certificate again - you'll lose it!
• If You should upgrade mod_jk port, then dont forget to uncomment "#LoadModule jk_module.... " line!
• Implement backups and monitoring!
• Implement firewall. If using pf:

WEB_PORTS="{

80,

443

}"

HANDLE_PORTS="{

2641,

8000

}"

#

www

pass

in

log

quick

on

$EXT_IF

proto

tcp

from

any

to

port

$WEB_PORTS

#

dspace

handle

service

pass

in

log

quick

on

$EXT_IF

proto

tcp

from

any

to

port

$HANDLE_PORTS

Maybe You need SSH too, but in general keep blocking.

• Please read carefully dspace documentation.