From afe8d0c9d505cb437490cf1c47c57e61141efa07 Mon Sep 17 00:00:00 2001
From: jeroenlaylo <jeroen@laylo.io>
Date: Wed, 5 Dec 2018 22:31:27 +0100
Subject: [PATCH] Switched some bits in the installer

---
 install | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/install b/install
index c95ca42..dd41517 100644
--- a/install
+++ b/install
@@ -117,6 +117,42 @@ function wo_install_dep()
     fi
 
     locale-gen en &>> /dev/null
+
+    # Support PFS
+    if [ -f /etc/nginx/nginx.conf ]; then
+        # Replace the default ciphers
+        sed -i 's/HIGH:!aNULL:!MD5:!kEDH;/ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;/' /etc/nginx/nginx.conf
+        # Replace the EasyEngine ciphers
+        sed -i 's/ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;/ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;/' /etc/nginx/nginx.conf
+        # Change the TLS protocols
+        if [ "$wo_distro_version" == "bionic" ]; then
+            # Bionic supports TLSv1.3, so let's enable that
+            sed -i 's/TLSv1 TLSv1.1 TLSv1.2;/TLSv1.2 TLSv1.3;/g' /etc/nginx/nginx.conf
+        else
+            # If != Bionic then enable only TLSv1.2
+            sed -i 's/TLSv1 TLSv1.1 TLSv1.2;/TLSv1.2;/g' /etc/nginx/nginx.conf
+        fi
+    fi
+
+    if [ "$wo_linux_distro" == "Ubuntu" ]; then
+        add-apt-repository -y 'ppa:ondrej/php'
+        wo_lib_echo "Updating the PHP repository for some neat PHP 7.2 support"
+        apt-get update &>> /dev/null
+        apt-get -y install php7.2-fpm php7.2-curl php7.2-gd php7.2-imap php-sodium php7.2-common php7.2-readline php7.2-redis php7.2-mysql php7.2-cli php7.2-memcache php7.2-imagick php7.2-mbstring php7.2-recode php7.2-bcmath php7.2-opcache php7.2-zip php7.2-xml php7.2-soap php7.2-msgpack memcached graphviz php-pear php7.2-xdebug || wo_lib_error "Not all PHP packages could be installed. " 1
+        mkdir -p /var/log/php/7.2/
+        touch /var/log/php/7.2/slow.log /var/log/php/7.2/fpm.log
+        systemctl php7.2-fpm restart &>> /dev/null
+
+    elif [ "$wo_linux_distro" == "Debian" ]; then
+        apt-get install apt-transport-https lsb-release ca-certificates locales locales-all -y
+        export LC_ALL=en_US.UTF-8
+        export LANG=en_US.UTF-8
+        wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
+        echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list
+        apt-get update &>> /dev/null
+        apt-get -y install php7.2-fpm php7.2-curl php7.2-gd php7.2-imap php-sodium php7.2-common php7.2-readline php7.2-redis php7.2-mysql php7.2-cli php7.2-memcache php7.2-imagick php7.2-mbstring php7.2-recode php7.2-bcmath php7.2-opcache php7.2-zip php7.2-xml php7.2-soap php7.2-msgpack memcached graphviz php-pear php7.2-xdebug || wo_lib_error "Not all PHP packages could be installed." 1
+        systemctl php7.2-fpm restart &>> /dev/null 
+    fi
 }
 
 ###