ATUALIZANDO PARA O PHP 8.5
Esse procedimento foi feito usando o Rocky 9, mas funciona em outras distribuições.
Baixando o novo código
wget https://github.com/scieloorg/Web/archive/refs/heads/codex/php8-rocky9-migration-pushable.zip
unzip php8-rocky9-migration-pushable.zipNo nosso exemplo eu vou configurar o site da Bolivia onde eu tenho o conteúdo antigo em /var/www/homolog_scielo_org_bo-bkp
cd /var/www
mv Web-codex-php8-rocky9-migration-pushable homolog_scielo_org_bo
cd homolog_scielo_org_bo
rm -f bases
rm -Rf htdocs/img/Agora vou copiar o conteúdo de /var/www/homolog_scielo_org_bo-bkp para /var/www/homolog_scielo_org_bo
cd /var/www/homolog_scielo_org_bo
mv ../homolog_scielo_org_bo-bkp/bases .
mv ../homolog_scielo_org_bo-bkp/htdocs/img htdocs/
cp ../homolog_scielo_org_bo-bkp/htdocs/scielo.def.php htdocs/
cp ../homolog_scielo_org_bo-bkp/htdocs/iah/article.def htdocs/iah/
cp ../homolog_scielo_org_bo-bkp/htdocs/iah/iah.def htdocs/iah/
cp ../homolog_scielo_org_bo-bkp/htdocs/iah/title.def htdocs/iah/
cp ../homolog_scielo_org_bo-bkp/cgi-bin/wxis.exe cgi-bin/
cp -a ../homolog_scielo_org_bo-bkp/proc/cisis proc/No nosso exemplo ele é o site de homologação onde é executado o GeraPadrao.bat. Portanto, precisamos copiar as pastas bases-work e serial. Se for o site de produção não precisa:
cd /var/www/homolog_scielo_org_bo
mv ../homolog_scielo_org_bo-bkp/bases-work .
mv ../homolog_scielo_org_bo-bkp/serial .Instalando o docker
sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl --now enable docker
sudo systemctl is-active dockerConfigurar o systemd para iniciar a instância, vamos chamado o systemd de /etc/systemd/system/hml-scielo.service
[Unit]
Description=SciELO container
After=docker.service
Requires=docker.service
[Service]
TimeoutStartSec=0
Restart=always
RestartSec=5
# Limpeza de containers antigos
ExecStartPre=-/usr/bin/docker stop %p
ExecStartPre=-/usr/bin/docker rm %p
# Execução do container
ExecStart=/usr/bin/docker run \
--name %p \
-e SERVER_SCIELO=hml.scielo.org.bo \
-p 8089:80 \
-v /var/www/homolog_scielo_org_bo:/var/www/html \
-v /var/www/apache:/var/www/apache \
infrascielo/metodologia:v7.4-qa
# Parada limpa
ExecStop=/usr/bin/docker stop -t 10 %p
[Install]
WantedBy=multi-user.targetItens que precisam ser ajustado:
- A variável SERVER_SCIELO corresponde ao nome do site sem http://
- O volume declarado antes dos dois pontos deve ser o caminho da pasta de origem. Exemplo: /var/www/scielo:/var/www/html. Veja que /var/www/scielo é o caminho da pasta de origem
Execute para iniciar o container:
systemctl daemon-reload
systemctl enable --now hml-scieloPara ver ele rodando execute:
docker psAgora faremos a reparação da base:
docker exec -ti hml-scielo bash
scielo-instance-check.sh --root /var/www/html --fixEsse procedimento pode levar alguns minutos. Resultado esperado:
SciELO Rocky9 instance fix
Root: /var/www/html
== Binaries ==
OK CISIS mx exists and is executable: /var/www/html/proc/cisis/mx
OK CISIS mxcp exists and is executable: /var/www/html/proc/cisis/mxcp
OK CISIS ifkeys exists and is executable: /var/www/html/proc/cisis/ifkeys
OK CGI WXIS exists and is executable: /var/www/html/cgi-bin/wxis.exe
OK CGI WXIS responds as WXIS
OK IAH aux WXIS executable bit enabled: /var/www/html/cgi-bin/iah/auxs/wxis.exe
WARN IAH aux WXIS did not return the expected WXIS probe output
OK temporary WXIS exists and is executable: /var/www/html/cgi-bin/temp/wxis
WARN temporary WXIS did not return the expected WXIS probe output
== Definition files ==
OK found /var/www/html/htdocs/scielo.def.php
OK found /var/www/html/htdocs/iah/iah.def
OK found /var/www/html/htdocs/iah/title.def
OK found /var/www/html/htdocs/iah/article.def
OK SERVER_SCIELO points to hml.scielo.org.bo
== ISIS indexes ==
OK title reindexed from /var/www/html/proc/fst/title.fst
OK logo reindexed from /var/www/html/proc/fst/logo.fst
OK newissue reindexed from /var/www/html/proc/fst/newissue.fst
OK artigo reindexed from /var/www/html/proc/fst/artigo.fst
OK issue reindexed from /var/www/html/proc/fst/issue.fst
OK facic reindexed from /var/www/html/proc/fst/facic.fst
OK faccount reindexed from /var/www/html/proc/fst/faccount.fst
OK cited reindexed by PID field 880
OK related reindexed by PID field 880
== Remaining legacy .iy0 files ==
OK no active .iy0 files found under /var/www/html/bases
Agora é necessário configurar o nginx para fazer proxy reverso. Vamos inicialmente instalar o nginx
sudo dnf update -y
sudo dnf install nginx -y
sudo systemctl enable --now nginx
sudo systemctl status nginxCaso seu site não tenha certificado:
server {
listen 80 http2;
server_name hml.scielo.org.bo;
keepalive_timeout 150s;
location /{
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://127.0.0.1:8089;
proxy_http_version 1.1;
proxy_read_timeout 900s;
proxy_redirect off;
allow all;
}
gzip on;
access_log /var/log/nginx/hml-scielo-org-bo.log;
error_log /var/log/nginx/hml-scielo-org-bo-error.log warn;
}
Agora se tiver certificado configurar o vhost. Exemplo: vim /etc/nginx/conf.d/scielo.conf
server {
listen 443 ssl http2;
server_name ve.scielo.org;
ssl_certificate /certificados/scielo.org/fullchain.pem;
ssl_certificate_key /certificados/scielo.org/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
keepalive_timeout 150s;
location /{
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://127.0.0.1:8089;
proxy_http_version 1.1;
proxy_read_timeout 900s;
proxy_redirect off;
allow all;
}
gzip on;
access_log /var/log/nginx/ve-scielo-org/ve-scielo-org.log;
error_log /var/log/nginx/ve-scielo-org/ve-scielo-org-error.log warn;
}
server {
listen 80;
server_name ve.scielo.org;
return 301 https://$server_name$request_uri;
}Obs.: Esse vhost está considerando que o seu site tem certificado digital e ele é apenas ilustrativo, pois está considerando a instância da Venezuela. Não esqueça de ajustar para o seu site.
Execute o comando abaixo para validar a configuração:
nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successfulSe o resultado for ok.
systemctl restart nginxsudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reloadCONFIGURANDO O LETSENCRYPT
dnf install epel-release -y
dnf install certbot python3-certbot-nginx -y
nginx -t
resultado:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
systemctl reload nginxSolicitando o certificado
certbot --nginx -d www.scielo.org.bo
certbot --nginx -d www.scielo.org.bo
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
(Enter 'c' to cancel): scielo.org.bo@gmail.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf. You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Account registered.
Requesting a certificate for www.scielo.org.bo
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.scielo.org.bo/fullchain.pem
Key is saved at: /etc/letsencrypt/live/www.scielo.org.bo/privkey.pem
This certificate expires on 2026-11-25.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for www.scielo.org.bo to /etc/nginx/conf.d/prd-scielo-org-bo.conf
Congratulations! You have successfully enabled HTTPS on https://www.scielo.org.bo
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Ativando a renovação automática
Valide se a instalação já contemplou o timer
systemctl list-timers --all | grep -i certbote
systemctl status certbot-renew.timerSe existir, basta habilitá-lo:
systemctl enable --now certbot-renew.timerSe o timer não existir
Crie o service:
vi /etc/systemd/system/certbot-renew.servicecom:
[Unit]
Description=Renovacao automatica dos certificados Let's Encrypt
Documentation=https://certbot.eff.org/
[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet --deploy-hook "/usr/bin/systemctl reload nginx"O --deploy-hook é importante: ele executa o reload do Nginx somente quando um certificado tiver sido efetivamente renovado.
Agora crie:
vi /etc/systemd/system/certbot-renew.timercom:
[Unit]
Description=Verifica renovacao dos certificados Let's Encrypt duas vezes ao dia
[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=3600
Persistent=true
[Install]
WantedBy=timers.targetIsso faz a verificação aproximadamente duas vezes por dia, com um atraso aleatório de até uma hora. Não significa que o certificado será renovado duas vezes por dia: certbot renew só renova quando o certificado estiver próximo do vencimento.
Depois:
systemctl daemon-reload
systemctl enable --now certbot-renew.timerConfira:
systemctl status certbot-renew.timere:
systemctl list-timers certbot-renew.timerTROUBLESHOOTING
Problema na lista de periódicos e no encoding da busca: https://gist.