Skip to main content

ATUALIZANDO PARA O PHP 8.5

Esse procedimento foi feito usando o Rocky 9, mas funciona em outras distribuições. 

Baixando o novo código

wget https://github.com/scieloorg/Web/archive/refs/heads/codex/php8-rocky9-migration-pushable.zip
unzip php8-rocky9-migration-pushable.zip

No nosso exemplo eu vou configurar o site da Bolivia onde eu tenho o conteúdo antigo em /var/www/homolog_scielo_org_bo-bkp

cd /var/www
mv Web-codex-php8-rocky9-migration-pushable homolog_scielo_org_bo
cd homolog_scielo_org_bo
rm -f bases
rm -Rf htdocs/img/

Agora vou copiar o conteúdo de /var/www/homolog_scielo_org_bo-bkp para /var/www/homolog_scielo_org_bo

cd /var/www/homolog_scielo_org_bo
mv ../homolog_scielo_org_bo-bkp/bases .
mv ../homolog_scielo_org_bo-bkp/htdocs/img htdocs/
cp ../homolog_scielo_org_bo-bkp/htdocs/scielo.def.php htdocs/
cp ../homolog_scielo_org_bo-bkp/htdocs/iah/article.def htdocs/iah/
cp ../homolog_scielo_org_bo-bkp/htdocs/iah/iah.def htdocs/iah/
cp ../homolog_scielo_org_bo-bkp/htdocs/iah/title.def htdocs/iah/
cp ../homolog_scielo_org_bo-bkp/cgi-bin/wxis.exe cgi-bin/
cp -a ../homolog_scielo_org_bo-bkp/proc/cisis proc/

No nosso exemplo ele é o site de homologação onde é executado o GeraPadrao.bat. Portanto, precisamos copiar as pastas bases-work e serial. Se for o site de produção não precisa:

cd /var/www/homolog_scielo_org_bo
mv ../homolog_scielo_org_bo-bkp/bases-work .
mv ../homolog_scielo_org_bo-bkp/serial .

Instalando o docker

sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl --now enable docker
sudo systemctl is-active docker

Configurar o systemd para iniciar a instância, vamos chamado o systemd de /etc/systemd/system/hml-scielo.service

[Unit]
Description=SciELO container
After=docker.service
Requires=docker.service

[Service]
TimeoutStartSec=0
Restart=always
RestartSec=5

# Limpeza de containers antigos
ExecStartPre=-/usr/bin/docker stop %p
ExecStartPre=-/usr/bin/docker rm %p

# Execução do container
ExecStart=/usr/bin/docker run \
  --name %p \
  -e SERVER_SCIELO=hml.scielo.org.bo \
  -p 8089:80 \
  -v /var/www/homolog_scielo_org_bo:/var/www/html \
  -v /var/www/apache:/var/www/apache \
  infrascielo/metodologia:v7.4-qa

# Parada limpa
ExecStop=/usr/bin/docker stop -t 10 %p

[Install]
WantedBy=multi-user.target

Itens que precisam ser ajustado:

  • A variável SERVER_SCIELO corresponde ao nome do site sem http://
  • O volume declarado antes dos dois pontos deve ser o caminho da pasta de origem. Exemplo:  /var/www/scielo:/var/www/html. Veja que /var/www/scielo é o caminho da pasta de origem

Execute para iniciar o container:

systemctl daemon-reload
systemctl enable --now hml-scielo

Para ver ele rodando execute:

docker ps

Agora faremos a reparação da base:

docker exec -ti hml-scielo bash
scielo-instance-check.sh --root /var/www/html --fix

Esse procedimento pode levar alguns minutos. Resultado esperado:

SciELO Rocky9 instance fix
Root: /var/www/html

== Binaries ==
OK    CISIS mx exists and is executable: /var/www/html/proc/cisis/mx
OK    CISIS mxcp exists and is executable: /var/www/html/proc/cisis/mxcp
OK    CISIS ifkeys exists and is executable: /var/www/html/proc/cisis/ifkeys
OK    CGI WXIS exists and is executable: /var/www/html/cgi-bin/wxis.exe
OK    CGI WXIS responds as WXIS
OK    IAH aux WXIS executable bit enabled: /var/www/html/cgi-bin/iah/auxs/wxis.exe
WARN  IAH aux WXIS did not return the expected WXIS probe output
OK    temporary WXIS exists and is executable: /var/www/html/cgi-bin/temp/wxis
WARN  temporary WXIS did not return the expected WXIS probe output

== Definition files ==
OK    found /var/www/html/htdocs/scielo.def.php
OK    found /var/www/html/htdocs/iah/iah.def
OK    found /var/www/html/htdocs/iah/title.def
OK    found /var/www/html/htdocs/iah/article.def
OK    SERVER_SCIELO points to hml.scielo.org.bo

== ISIS indexes ==
OK    title reindexed from /var/www/html/proc/fst/title.fst
OK    logo reindexed from /var/www/html/proc/fst/logo.fst
OK    newissue reindexed from /var/www/html/proc/fst/newissue.fst
OK    artigo reindexed from /var/www/html/proc/fst/artigo.fst
OK    issue reindexed from /var/www/html/proc/fst/issue.fst
OK    facic reindexed from /var/www/html/proc/fst/facic.fst
OK    faccount reindexed from /var/www/html/proc/fst/faccount.fst
OK    cited reindexed by PID field 880
OK    related reindexed by PID field 880

== Remaining legacy .iy0 files ==
OK    no active .iy0 files found under /var/www/html/bases

Agora é necessário configurar o nginx para fazer proxy reverso. Vamos inicialmente instalar o nginx

sudo dnf update -y
sudo dnf install nginx -y
sudo systemctl enable --now nginx
sudo systemctl status nginx

Caso seu site não tenha certificado:

server {
        listen 80 http2;
        server_name hml.scielo.org.bo;
        keepalive_timeout 150s;

        location /{
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-Port $server_port;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_pass http://127.0.0.1:8089;
          proxy_http_version 1.1;
          proxy_read_timeout 900s;
          proxy_redirect      off;
          allow all;
       }
       gzip on;
       		access_log /var/log/nginx/hml-scielo-org-bo.log;
        	error_log /var/log/nginx/hml-scielo-org-bo-error.log warn;
}

Agora se tiver certificado configurar o vhost. Exemplo: vim /etc/nginx/conf.d/scielo.conf 

server {
        listen 443 ssl http2;
        server_name ve.scielo.org;
        ssl_certificate /certificados/scielo.org/fullchain.pem;
        ssl_certificate_key /certificados/scielo.org/privkey.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;
        keepalive_timeout 150s;

        location /{
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-Port $server_port;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_pass http://127.0.0.1:8089;
          proxy_http_version 1.1;
          proxy_read_timeout 900s;
          proxy_redirect      off;
          allow all;
       }
       gzip on;
       		access_log /var/log/nginx/ve-scielo-org/ve-scielo-org.log;
        	error_log /var/log/nginx/ve-scielo-org/ve-scielo-org-error.log warn;
}
server {
    listen 80;
    server_name ve.scielo.org;
    return 301 https://$server_name$request_uri;
}

Obs.: Esse vhost está considerando que o seu site tem certificado digital e ele é apenas ilustrativo, pois está considerando a instância da Venezuela. Não esqueça de ajustar para o seu site.

Execute o comando abaixo para validar a configuração:

nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Se o resultado for ok.

systemctl restart nginx
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload

CONFIGURANDO O LETSENCRYPT

dnf install epel-release -y
dnf install certbot python3-certbot-nginx -y
nginx -t
resultado:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

systemctl reload nginx

Solicitando o certificado

certbot --nginx -d www.scielo.org.bo

certbot --nginx -d www.scielo.org.bo
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): scielo.org.bo@gmail.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf. You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Account registered.
Requesting a certificate for www.scielo.org.bo

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.scielo.org.bo/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/www.scielo.org.bo/privkey.pem
This certificate expires on 2026-11-25.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for www.scielo.org.bo to /etc/nginx/conf.d/prd-scielo-org-bo.conf
Congratulations! You have successfully enabled HTTPS on https://www.scielo.org.bo

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 

Back to top