From 34803deedc3bd982d868aadf151bfc50db0625c7 Mon Sep 17 00:00:00 2001
From: Gabriel Arakaki Giovanini <mail@gabrielgio.me>
Date: Mon, 18 Jul 2022 23:05:59 +0200
Subject: ref: Add more content

Add how to set up debug page and set up properlly the permission for the
process.
---
 content/posts/2022-07-18-firefly-install.md | 84 ++++++++++++++++++++++++++---
 1 file changed, 76 insertions(+), 8 deletions(-)

diff --git a/content/posts/2022-07-18-firefly-install.md b/content/posts/2022-07-18-firefly-install.md
index 4dfd008..6c7a649 100644
--- a/content/posts/2022-07-18-firefly-install.md
+++ b/content/posts/2022-07-18-firefly-install.md
@@ -8,11 +8,11 @@ tags: ['alpine', 'linux', 'php', 'nginx']
 deep knowledge in security. This is me reporting the steps I did as a learning
 experiment, so take this tutorial as your own risk.
 
-I have a pretty decent knowledge in container tecnology, I maintain several
-container on my local server for many applications. However I've decided to
-take a step back and learn a bit more how those applications are really
-deployed and kept without containers, and first candidate being firefly3[^1]. I
-have it currently running on container but let's install in a disctributions.
+I have a pretty decent knowledge in container technology, I maintain several
+container on my local server for many applications. However I've decided to take
+a step back and learn a bit more how those applications are really deployed and
+kept without containers, and first candidate being Firefly[^1]. I have it
+currently running on container but let's install in a distribution.
 
 For the distro of choice I'll pick alpine, for its small footprint and the use
 of OpenRC (nothing against systemd though).
@@ -71,9 +71,9 @@ apk add \
     php8-pgsql
 ```
 
-But that is not everything, I don't If I lack knowledge in the PHP stack but
-the applicatoin will later complain about a lot of missing dependencies, those
-being:
+But that is not everything, I don't know if I lack knowledge in the PHP stack
+but the application will later complain about a lot of missing dependencies,
+those being:
 
 ```shell
 apk add \
@@ -98,6 +98,7 @@ run the project:
 ```shell
 apk add nginx php8-fpm
 ```
+
 Nginx will act as reverse proxy and php8-fpm will actually run the project. You
 can use lighttpd as well as some others.
 
@@ -171,6 +172,53 @@ php artisan firefly-iii:upgrade-database
 
 To bootstrap the database.
 
+### Permission
+
+Now comes the part where we should be careful. So far we (or at least I) have
+been setting up everything as root but that is not ideal. We want to restrict as
+much as possibly permission to the processes, it should only see do what it
+meant to. So to minimize the effect of the process we will make it run as a user
+with almost no permission, and for purpose we will create a `www-data` user.
+Quite often that user is already create if not run the following command:
+
+```shell
+adduser www-data --disabled-password
+```
+
+Add `--ingroup www-data` if it complains if the groups exists.
+`--disabled-password` so we don't allow login with password, because it is not
+meant to be logged with.
+
+Once the user is created we need to change the which user the process runs one.
+By default it uses a `nobody` which is a user with no permission except those
+which every other user has. Update the user given in the
+`/etc/php8/php-fpm.d/www.conf` file.
+
+From:
+```shell
+user = nobody
+group = nobody
+```
+
+To:
+```shell
+user = www-data
+group = www-data
+```
+
+If the `php-fpm8` is running restart it:
+
+```shell
+rc-service php-fpm8 restart
+```
+
+At last we need to recursively update the permission of www folder because
+probably it is owned by root.
+
+```shell
+chown -R www-data:www-data /var/www/
+```
+
 ### Nginx
 
 We will need to edit the nginx config file to find and run the project, add
@@ -181,6 +229,7 @@ server.
 
 ```shell
 # /etc/nginx/http.d/firefly.conf
+
 server {
     listen 8080;
     server_name localhost;
@@ -215,6 +264,25 @@ rc-service nginx start
 
 `http://localhot:8080/` (or your server's hostname) should be up and running.
 
+And to make autostart:
+```shell
+rc-update add php-fpm8 default
+rc-update add nginx default
+```
+
+## Debugging
+
+In case of error you can add debugging setting to your env file so it will
+nicely return the error.
+
+```ini
+# /var/wwww/firefly/.env
+# ...
+
+APP_DEBUG=true
+APP_LOG_LEVEL=debug
+```
+
 [^1]: https://www.firefly-iii.org/
 [^2]: https://docs.firefly-iii.org/firefly-iii/installation/self_hosted/?mtm_campaign=docu-internal&mtm_kwd=self_hosted
 [^3]: https://dev.azure.com/Firefly-III/_git/MainImage
-- 
cgit v1.2.3