fix compilation error in PlaqueBase + config for a given domain name

api.ipsocloud.com/math-plaque/imt/PlaqueBase.cpp

@@ -35,6 +35,7 @@ Historique :
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
+#include <algorithm>
 
 #define sqr(a) ((a) * (a))
 
@@ -433,10 +434,10 @@ int CPlaqueBase::TraiterPoint (int x, int y)
 	assert(PointInBufferResult(x, y) && (m_type != typeUndefined));
 
 	SetPixelResult(x, y);  
-	xMin = max(0, x - 1);
-	xMax = min(x + 1, GetWidth() - 1);
-	yMin = max(0, y - 1);
-	yMax = min(y + 1, GetHeight() - 1);
+	xMin = std::max(0, x - 1);
+	xMax = std::min(x + 1, GetWidth() - 1);
+	yMin = std::max(0, y - 1);
+	yMax = std::min(y + 1, GetHeight() - 1);
    
 	i = 0;
 	for (xx = xMin; xx <= xMax; xx++)
@@ -748,10 +749,10 @@ bool CPlaqueBase::IsBorder(int x, int y)
 	// L'aspect static de ces 7 variables est purement dans un but d'économie de mémoire...
 	static int Xmin, Xmax, xx, Ymin, Ymax, yy, NbPoints;
 
-	Xmin = max(0, x-1);
-	Xmax = min(x+1, GetWidth() - 1);
-	Ymin = max(0, y-1);
-	Ymax = min(y+1, GetHeight() - 1);
+	Xmin = std::max(0, x-1);
+	Xmax = std::min(x+1, GetWidth() - 1);
+	Ymin = std::max(0, y-1);
+	Ymax = std::min(y+1, GetHeight() - 1);
 
 	// On compte le nombre de points en-plaque autour du point étudié
 	NbPoints = 0;
@@ -856,7 +857,7 @@ bool CPlaqueBase::SuiviContourLocal(int x, int y, double Xd, double Yd, bool Ini
 
 		if (Vbest != 0.25*(4 - dimension))
 		{
-			M = max(abs(Xbest), abs(Ybest));
+			M = std::max(abs(Xbest), abs(Ybest));
 			XdNew = Xbest * M + Xd * 3 * dimension;
 			YdNew = Ybest * M + Yd * 3 * dimension;
 			PScal = sqrt(XdNew * XdNew + YdNew * YdNew);
@@ -968,10 +969,10 @@ void CPlaqueBase::SuiviContourRemplis(int x, int y)
 	// On dessine en vert le point hors-plaque étudié
 	SetPixelResult(x, y);
 
-	Xmin = max(0, x-2);
-	Xmax = min(x+2, GetWidth() - 1);
-	Ymin = max(0, y-2);
-	Ymax = min(y+2, GetHeight() - 1);
+	Xmin = std::max(0, x-2);
+	Xmax = std::min(x+2, GetWidth() - 1);
+	Ymin = std::max(0, y-2);
+	Ymax = std::min(y+2, GetHeight() - 1);
 
 	// On compte le nombre de points frontière autour du point étudié
 	double NbPoints = 0;
@@ -991,10 +992,10 @@ void CPlaqueBase::SuiviContourRemplis(int x, int y)
 	//										appartenant à la frontières à coté de lui
 	if (NbPoints > 0) return;
 
-	Xmin = max(0, x-1);
-	Xmax = min(x+1, GetWidth() - 1);
-	Ymin = max(0, y-1);
-	Ymax = min(y+1, GetHeight() - 1);
+	Xmin = std::max(0, x-1);
+	Xmax = std::min(x+1, GetWidth() - 1);
+	Ymin = std::max(0, y-1);
+	Ymax = std::min(y+1, GetHeight() - 1);
 
 	for (xx = Xmin; xx <= Xmax; xx++)
 	{
@@ -1629,11 +1630,11 @@ unsigned char CPlaqueBase::GetIntensityTache(Point& ptCentre, int nRayonTache)
 	int nIntensiteTache = 0;
 
 	// Quelle est l'intensité monochrome de la tache autour de ce pt ?
-	for (int iX = min (GetWidth()-1, max (0, ptCentre.x - nRayonTache)); 
-         iX <= min (GetWidth()-1, ptCentre.x + nRayonTache); iX++)
+	for (int iX = std::min (GetWidth()-1, std::max (0, ptCentre.x - nRayonTache)); 
+         iX <= std::min (GetWidth()-1, ptCentre.x + nRayonTache); iX++)
 	{
-		for (int iY = min (GetHeight()-1, max (0, ptCentre.y - nRayonTache)); 
-			iY <= min (GetHeight()-1, ptCentre.y + nRayonTache); iY++)
+		for (int iY = std::min (GetHeight()-1, std::max (0, ptCentre.y - nRayonTache)); 
+			iY <= std::min (GetHeight()-1, ptCentre.y + nRayonTache); iY++)
         {
 			nIntensiteTache += GetIntensityResult(iX, iY);
         }
@@ -1658,7 +1659,7 @@ unsigned char CPlaqueBase::Density()
 
 	if (m_nPointsDansPlaque != 0) 
 	{
-		res = max(m_iSommeIntensitesPlaque, 0) / m_nPointsDansPlaque;
+		res = std::max(m_iSommeIntensitesPlaque, 0) / m_nPointsDansPlaque;
 	}
 	else 
 	{

api.ipsocloud.com/math-plaque/imt/PlaqueBase.h

@@ -28,6 +28,7 @@ class QImage;
 const short NBVECTEURSMAX = 8184;
 const short NBPTSLONGEANTMAX = 512;
 
+/*
 #ifndef max
 #define max(a,b)            (((a) > (b)) ? (a) : (b))
 #endif
@@ -35,6 +36,7 @@ const short NBPTSLONGEANTMAX = 512;
 #ifndef min
 #define min(a,b)            (((a) < (b)) ? (a) : (b))
 #endif
+*/
 
 /*----------------------------------------------------------\
                        Classes

build-MAth-Cloud.sh

@@ -4,6 +4,32 @@
 curDir=`pwd`
 
 
+# Ask for the domain name to use
+
+echo -e "\033[92m*** Web site domain name ***\033[0m"
+currentDomain=`grep "hostname=='" ${curDir}/admin.ipsocloud.com/webapp_webpack/src/app.js |awk -F"'" '{ print $2 }' |sed 's/www.//'`
+echo "The current domain name is : ${currentDomain}"
+read -p "New domain name [${currentDomain}] : " domainName
+domainName=${domainName:-${currentDomain}}
+
+
+# Change the domain name if needed
+
+if [ ${domainName} != ${currentDomain} ];
+then
+  echo "The domain name will be set to : ${domainName}"
+  sed -i "s/$currentDomain/$domainName/g" ${curDir}/admin.ipsocloud.com/webapp_webpack/src/pages/customer.f7.html
+  for i in admin cro www;  
+  do
+    sed -i "s/$currentDomain/$domainName/g" ${curDir}/${i}.ipsocloud.com/webapp_webpack/src/app.js
+  done
+  for i in api cro www;  
+  do
+    sed -i "s/$currentDomain/$domainName/g" ${curDir}/debian/Math-Cloud-server/etc/apache2/sites-available/${i}.conf
+  done
+fi
+
+
 # Build MAth DLLs
 
 for i in math-imt math-plaque;

debian/Math-Cloud-devel/DEBIAN/control

@@ -5,5 +5,6 @@ Priority: optional
 Version: 3.0.0
 Description: Development environment for MAth-Cloud
 Depends: curl, dcmtk, ffmpeg, git-all, libdcmtk-dev, mariadb-server, npm, 
-         php-gd, phpmyadmin, qt5-default, unzip, wget, zip
+         php-gd, phpmyadmin, qtbase5-dev, qtchooser, qt5-qmake, qtbase5-dev-tools, 
+         unzip, wget, zip, firefox, build-essential, gitg
 

debian/Math-Cloud-devel/DEBIAN/postinst

@@ -31,15 +31,18 @@ a2ensite api.conf
 
 # Configuration PHP
 
-if [ -f /etc/php/7.4/apache2/php.ini ];
-then
-  ed -s /etc/php/7.4/apache2/php.ini <<EOF
+for i in /etc/php/*/apache2/php.ini;
+do
+  if [ -f ${i} ];
+  then
+    ed -s ${i} <<EOF
 /upload_max_filesize
 s/2M/30M
 .
 w
 EOF
-fi
+  fi
+done
 
 
 # Redemarrage du serveur Apache2
@@ -79,6 +82,13 @@ fi
 systemctl restart mysql
 
 
+# Installation de nvm
+
+cd /home/${SUDO_USER}
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh |bash
+chown -R ${SUDO_USER}:${SUDO_USER} .nvm
+
+
 # Copie des cles SSH
 
 cp /tmp/sshFabrice.zip /home/${SUDO_USER}/.ssh/

debian/Math-Cloud-server/DEBIAN/control

@@ -4,6 +4,6 @@ Maintainer: Fabrice Poupon <fabrice.poupon@free.fr>
 Priority: optional
 Version: 3.0.0
 Description: Production server configuration for MAth-Cloud
-Depends: curl, dcmtk, ffmpeg, libdcmtk14, mariadb-server, php-gd, phpmyadmin, 
-         qt5-default, unzip, wget, zip
-
+Depends: curl, dcmtk, ffmpeg, libdcmtk-dev, mariadb-server, php-gd, phpmyadmin, 
+         qtbase5-dev, qtchooser, qt5-qmake, qtbase5-dev-tools, unzip, wget, zip,
+         libapache2-mod-php

debian/Math-Cloud-server/DEBIAN/postinst

@@ -1,5 +1,10 @@
 #!/bin/bash
 
+# Installation de certbot (client ACME de Let's Encrypt pour les certificats)
+
+snap install --classic certbot
+
+
 # Configuration Apache2
 
 [ -z "$(grep \/var\/www\/www /etc/apache2/apache2.conf)" ] && ed -s /etc/apache2/apache2.conf <<EOF
@@ -26,15 +31,18 @@ a2ensite cro.conf
 
 # Configuration PHP
 
-if [ -f /etc/php/7.4/apache2/php.ini ];
-then
-  ed -s /etc/php/7.4/apache2/php.ini <<EOF
+for i in /etc/php/*/apache2/php.ini;
+do
+  if [ -f ${i} ];
+  then
+    ed -s ${i} <<EOF
 /upload_max_filesize
 s/2M/30M
 .
 w
 EOF
-fi
+  fi
+done
 
 
 # Redemarrage du serveur Apache2

debian/Math-Cloud-server/etc/apache2/sites-available/api.conf

@@ -5,29 +5,142 @@
 
 		DocumentRoot /var/www/api
 
+		# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
+		# error, crit, alert, emerg.
+		# It is also possible to configure the loglevel for particular
+		# modules, e.g.
+		#LogLevel info ssl:warn
+
 		ErrorLog ${APACHE_LOG_DIR}/error.log
 		CustomLog ${APACHE_LOG_DIR}/access.log combined
 
+		# For most configuration files from conf-available/, which are
+		# enabled or disabled at a global level, it is possible to
+		# include a line for only one particular virtual host. For example the
+		# following line enables the CGI configuration for this host only
+		# after it has been globally disabled with "a2disconf".
+		#Include conf-available/serve-cgi-bin.conf
+
+		#   SSL Engine Switch:
+		#   Enable/Disable SSL for this virtual host.
 		SSLEngine on
-		SSLCertificateFile	/etc/ssl/ipsocloud.crt
-		SSLCertificateKeyFile	/etc/ssl/ipsocloud.key
-		SSLCACertificateFile /etc/ssl/ipsocloud.ca
 
+		#   A self-signed (snakeoil) certificate can be created by installing
+		#   the ssl-cert package. See
+		#   /usr/share/doc/apache2/README.Debian.gz for more info.
+		#   If both key and certificate are stored in the same file, only the
+		#   SSLCertificateFile directive is needed.
+		#SSLCertificateFile	/etc/ssl/certs/apache-selfsigned.crt
+		#SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
+		#SSLCACertificateFile	/etc/ssl/ipsocloud.ca
+
+		#   Server Certificate Chain:
+		#   Point SSLCertificateChainFile at a file containing the
+		#   concatenation of PEM encoded CA certificates which form the
+		#   certificate chain for the server certificate. Alternatively
+		#   the referenced file can be the same as SSLCertificateFile
+		#   when the CA certificates are directly appended to the server
+		#   certificate for convinience.
+		#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
+
+		#   Certificate Authority (CA):
+		#   Set the CA certificate verification path where to find CA
+		#   certificates for client authentication or alternatively one
+		#   huge file containing all of them (file must be PEM encoded)
+		#   Note: Inside SSLCACertificatePath you need hash symlinks
+		#		 to point to the certificate files. Use the provided
+		#		 Makefile to update the hash symlinks after changes.
+		#SSLCACertificatePath /etc/ssl/certs/
+		#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+
+		#   Certificate Revocation Lists (CRL):
+		#   Set the CA revocation path where to find CA CRLs for client
+		#   authentication or alternatively one huge file containing all
+		#   of them (file must be PEM encoded)
+		#   Note: Inside SSLCARevocationPath you need hash symlinks
+		#		 to point to the certificate files. Use the provided
+		#		 Makefile to update the hash symlinks after changes.
+		#SSLCARevocationPath /etc/apache2/ssl.crl/
+		#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
+
+		#   Client Authentication (Type):
+		#   Client certificate verification type and depth.  Types are
+		#   none, optional, require and optional_no_ca.  Depth is a
+		#   number which specifies how deeply to verify the certificate
+		#   issuer chain before deciding the certificate is not valid.
+		#SSLVerifyClient require
+		#SSLVerifyDepth  10
+
+		#   SSL Engine Options:
+		#   Set various options for the SSL engine.
+		#   o FakeBasicAuth:
+		#	 Translate the client X.509 into a Basic Authorisation.  This means that
+		#	 the standard Auth/DBMAuth methods can be used for access control.  The
+		#	 user name is the `one line' version of the client's X.509 certificate.
+		#	 Note that no password is obtained from the user. Every entry in the user
+		#	 file needs this password: `xxj31ZMTZzkVA'.
+		#   o ExportCertData:
+		#	 This exports two additional environment variables: SSL_CLIENT_CERT and
+		#	 SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+		#	 server (always existing) and the client (only existing when client
+		#	 authentication is used). This can be used to import the certificates
+		#	 into CGI scripts.
+		#   o StdEnvVars:
+		#	 This exports the standard SSL/TLS related `SSL_*' environment variables.
+		#	 Per default this exportation is switched off for performance reasons,
+		#	 because the extraction step is an expensive operation and is usually
+		#	 useless for serving static content. So one usually enables the
+		#	 exportation for CGI and SSI requests only.
+		#   o OptRenegotiate:
+		#	 This enables optimized SSL connection renegotiation handling when SSL
+		#	 directives are used in per-directory context.
+		#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
 		<FilesMatch "\.(cgi|shtml|phtml|php)$">
-			SSLOptions +StdEnvVars
+				SSLOptions +StdEnvVars
 		</FilesMatch>
-		
 		<Directory /usr/lib/cgi-bin>
-			SSLOptions +StdEnvVars
+				SSLOptions +StdEnvVars
 		</Directory>
-		
 		<Directory /var/www/api/>
-			Options Indexes FollowSymLinks
-			AllowOverride All
-			SSLOptions +StdEnvVars
-			Require all granted
+		    Options Indexes FollowSymLinks
+		    AllowOverride All
+		    SSLOptions +StdEnvVars
+		    Require all granted
 			Header set Access-Control-Allow-Origin "*"
 		</Directory>
+
+		#   SSL Protocol Adjustments:
+		#   The safe and default but still SSL/TLS standard compliant shutdown
+		#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+		#   the close notify alert from client. When you need a different shutdown
+		#   approach you can use one of the following variables:
+		#   o ssl-unclean-shutdown:
+		#	 This forces an unclean shutdown when the connection is closed, i.e. no
+		#	 SSL close notify alert is send or allowed to received.  This violates
+		#	 the SSL/TLS standard but is needed for some brain-dead browsers. Use
+		#	 this when you receive I/O errors because of the standard approach where
+		#	 mod_ssl sends the close notify alert.
+		#   o ssl-accurate-shutdown:
+		#	 This forces an accurate shutdown when the connection is closed, i.e. a
+		#	 SSL close notify alert is send and mod_ssl waits for the close notify
+		#	 alert of the client. This is 100% SSL/TLS standard compliant, but in
+		#	 practice often causes hanging connections with brain-dead browsers. Use
+		#	 this only for browsers where you know that their SSL implementation
+		#	 works correctly.
+		#   Notice: Most problems of broken clients are also related to the HTTP
+		#   keep-alive facility, so you usually additionally want to disable
+		#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+		#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+		#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+		#   "force-response-1.0" for this.
+		# BrowserMatch "MSIE [2-6]" \
+		#		nokeepalive ssl-unclean-shutdown \
+		#		downgrade-1.0 force-response-1.0
+
+		SSLCertificateFile	/etc/letsencrypt/live/api.ipsocloud.com/fullchain.pem
+		SSLCertificateKeyFile	/etc/letsencrypt/live/api.ipsocloud.com/privkey.pem
+Include /etc/letsencrypt/options-ssl-apache.conf
 	</VirtualHost>
 </IfModule>
 
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

debian/Math-Cloud-server/etc/apache2/sites-available/cro.conf

@@ -5,21 +5,135 @@
 
 		DocumentRoot /var/www/cro
 
+		# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
+		# error, crit, alert, emerg.
+		# It is also possible to configure the loglevel for particular
+		# modules, e.g.
+		#LogLevel info ssl:warn
+
 		ErrorLog ${APACHE_LOG_DIR}/error.log
 		CustomLog ${APACHE_LOG_DIR}/access.log combined
 
+		# For most configuration files from conf-available/, which are
+		# enabled or disabled at a global level, it is possible to
+		# include a line for only one particular virtual host. For example the
+		# following line enables the CGI configuration for this host only
+		# after it has been globally disabled with "a2disconf".
+		#Include conf-available/serve-cgi-bin.conf
+
+		#   SSL Engine Switch:
+		#   Enable/Disable SSL for this virtual host.
 		SSLEngine on
-		SSLCertificateFile	/etc/ssl/ipsocloud.crt
-		SSLCertificateKeyFile	/etc/ssl/ipsocloud.key
-		SSLCACertificateFile /etc/ssl/ipsocloud.ca
 
+		#   A self-signed (snakeoil) certificate can be created by installing
+		#   the ssl-cert package. See
+		#   /usr/share/doc/apache2/README.Debian.gz for more info.
+		#   If both key and certificate are stored in the same file, only the
+		#   SSLCertificateFile directive is needed.
+		#SSLCertificateFile	/etc/ssl/certs/apache-selfsigned.crt
+		#SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
+		SSLCACertificateFile	/etc/ssl/ipsocloud.ca
+
+		#   Server Certificate Chain:
+		#   Point SSLCertificateChainFile at a file containing the
+		#   concatenation of PEM encoded CA certificates which form the
+		#   certificate chain for the server certificate. Alternatively
+		#   the referenced file can be the same as SSLCertificateFile
+		#   when the CA certificates are directly appended to the server
+		#   certificate for convinience.
+		#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
+
+		#   Certificate Authority (CA):
+		#   Set the CA certificate verification path where to find CA
+		#   certificates for client authentication or alternatively one
+		#   huge file containing all of them (file must be PEM encoded)
+		#   Note: Inside SSLCACertificatePath you need hash symlinks
+		#		 to point to the certificate files. Use the provided
+		#		 Makefile to update the hash symlinks after changes.
+		#SSLCACertificatePath /etc/ssl/certs/
+		#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+
+		#   Certificate Revocation Lists (CRL):
+		#   Set the CA revocation path where to find CA CRLs for client
+		#   authentication or alternatively one huge file containing all
+		#   of them (file must be PEM encoded)
+		#   Note: Inside SSLCARevocationPath you need hash symlinks
+		#		 to point to the certificate files. Use the provided
+		#		 Makefile to update the hash symlinks after changes.
+		#SSLCARevocationPath /etc/apache2/ssl.crl/
+		#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
+
+		#   Client Authentication (Type):
+		#   Client certificate verification type and depth.  Types are
+		#   none, optional, require and optional_no_ca.  Depth is a
+		#   number which specifies how deeply to verify the certificate
+		#   issuer chain before deciding the certificate is not valid.
+		#SSLVerifyClient require
+		#SSLVerifyDepth  10
+
+		#   SSL Engine Options:
+		#   Set various options for the SSL engine.
+		#   o FakeBasicAuth:
+		#	 Translate the client X.509 into a Basic Authorisation.  This means that
+		#	 the standard Auth/DBMAuth methods can be used for access control.  The
+		#	 user name is the `one line' version of the client's X.509 certificate.
+		#	 Note that no password is obtained from the user. Every entry in the user
+		#	 file needs this password: `xxj31ZMTZzkVA'.
+		#   o ExportCertData:
+		#	 This exports two additional environment variables: SSL_CLIENT_CERT and
+		#	 SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+		#	 server (always existing) and the client (only existing when client
+		#	 authentication is used). This can be used to import the certificates
+		#	 into CGI scripts.
+		#   o StdEnvVars:
+		#	 This exports the standard SSL/TLS related `SSL_*' environment variables.
+		#	 Per default this exportation is switched off for performance reasons,
+		#	 because the extraction step is an expensive operation and is usually
+		#	 useless for serving static content. So one usually enables the
+		#	 exportation for CGI and SSI requests only.
+		#   o OptRenegotiate:
+		#	 This enables optimized SSL connection renegotiation handling when SSL
+		#	 directives are used in per-directory context.
+		#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
 		<FilesMatch "\.(cgi|shtml|phtml|php)$">
-			SSLOptions +StdEnvVars
+				SSLOptions +StdEnvVars
 		</FilesMatch>
-		
 		<Directory /usr/lib/cgi-bin>
-			SSLOptions +StdEnvVars
+				SSLOptions +StdEnvVars
 		</Directory>
+
+		#   SSL Protocol Adjustments:
+		#   The safe and default but still SSL/TLS standard compliant shutdown
+		#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+		#   the close notify alert from client. When you need a different shutdown
+		#   approach you can use one of the following variables:
+		#   o ssl-unclean-shutdown:
+		#	 This forces an unclean shutdown when the connection is closed, i.e. no
+		#	 SSL close notify alert is send or allowed to received.  This violates
+		#	 the SSL/TLS standard but is needed for some brain-dead browsers. Use
+		#	 this when you receive I/O errors because of the standard approach where
+		#	 mod_ssl sends the close notify alert.
+		#   o ssl-accurate-shutdown:
+		#	 This forces an accurate shutdown when the connection is closed, i.e. a
+		#	 SSL close notify alert is send and mod_ssl waits for the close notify
+		#	 alert of the client. This is 100% SSL/TLS standard compliant, but in
+		#	 practice often causes hanging connections with brain-dead browsers. Use
+		#	 this only for browsers where you know that their SSL implementation
+		#	 works correctly.
+		#   Notice: Most problems of broken clients are also related to the HTTP
+		#   keep-alive facility, so you usually additionally want to disable
+		#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+		#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+		#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+		#   "force-response-1.0" for this.
+		# BrowserMatch "MSIE [2-6]" \
+		#		nokeepalive ssl-unclean-shutdown \
+		#		downgrade-1.0 force-response-1.0
+
+		SSLCertificateFile	/etc/letsencrypt/live/cro.ipsocloud.com/fullchain.pem
+		SSLCertificateKeyFile	/etc/letsencrypt/live/cro.ipsocloud.com/privkey.pem
+Include /etc/letsencrypt/options-ssl-apache.conf
 	</VirtualHost>
 </IfModule>
 
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

debian/Math-Cloud-server/etc/apache2/sites-available/www.conf

@@ -1,3 +1,16 @@
+<VirtualHost *:80>
+        ServerName www.ipsocloud.com
+        DocumentRoot /var/www/www/
+        <Directory /var/www/www>
+                AllowOverride All
+                Options Indexes FollowSymLinks
+                Require all granted
+        </Directory>
+        RewriteEngine On
+        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
+</VirtualHost>
+
+
 <IfModule mod_ssl.c>
 	<VirtualHost _default_:443>
 		ServerAdmin webmaster@localhost
@@ -5,21 +18,135 @@
 
 		DocumentRoot /var/www/www
 
+		# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
+		# error, crit, alert, emerg.
+		# It is also possible to configure the loglevel for particular
+		# modules, e.g.
+		#LogLevel info ssl:warn
+
 		ErrorLog ${APACHE_LOG_DIR}/error.log
 		CustomLog ${APACHE_LOG_DIR}/access.log combined
 
+		# For most configuration files from conf-available/, which are
+		# enabled or disabled at a global level, it is possible to
+		# include a line for only one particular virtual host. For example the
+		# following line enables the CGI configuration for this host only
+		# after it has been globally disabled with "a2disconf".
+		#Include conf-available/serve-cgi-bin.conf
+
+		#   SSL Engine Switch:
+		#   Enable/Disable SSL for this virtual host.
 		SSLEngine on
-		SSLCertificateFile	/etc/ssl/ipsocloud.crt
-		SSLCertificateKeyFile	/etc/ssl/ipsocloud.key
-		SSLCACertificateFile /etc/ssl/ipsocloud.ca
 
+		#   A self-signed (snakeoil) certificate can be created by installing
+		#   the ssl-cert package. See
+		#   /usr/share/doc/apache2/README.Debian.gz for more info.
+		#   If both key and certificate are stored in the same file, only the
+		#   SSLCertificateFile directive is needed.
+		#SSLCertificateFile	/etc/ssl/certs/apache-selfsigned.crt
+		#SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
+		#SSLCACertificateFile	/etc/ssl/ipsocloud.ca
+
+		#   Server Certificate Chain:
+		#   Point SSLCertificateChainFile at a file containing the
+		#   concatenation of PEM encoded CA certificates which form the
+		#   certificate chain for the server certificate. Alternatively
+		#   the referenced file can be the same as SSLCertificateFile
+		#   when the CA certificates are directly appended to the server
+		#   certificate for convinience.
+		#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
+
+		#   Certificate Authority (CA):
+		#   Set the CA certificate verification path where to find CA
+		#   certificates for client authentication or alternatively one
+		#   huge file containing all of them (file must be PEM encoded)
+		#   Note: Inside SSLCACertificatePath you need hash symlinks
+		#		 to point to the certificate files. Use the provided
+		#		 Makefile to update the hash symlinks after changes.
+		#SSLCACertificatePath /etc/ssl/certs/
+		#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+
+		#   Certificate Revocation Lists (CRL):
+		#   Set the CA revocation path where to find CA CRLs for client
+		#   authentication or alternatively one huge file containing all
+		#   of them (file must be PEM encoded)
+		#   Note: Inside SSLCARevocationPath you need hash symlinks
+		#		 to point to the certificate files. Use the provided
+		#		 Makefile to update the hash symlinks after changes.
+		#SSLCARevocationPath /etc/apache2/ssl.crl/
+		#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
+
+		#   Client Authentication (Type):
+		#   Client certificate verification type and depth.  Types are
+		#   none, optional, require and optional_no_ca.  Depth is a
+		#   number which specifies how deeply to verify the certificate
+		#   issuer chain before deciding the certificate is not valid.
+		#SSLVerifyClient require
+		#SSLVerifyDepth  10
+
+		#   SSL Engine Options:
+		#   Set various options for the SSL engine.
+		#   o FakeBasicAuth:
+		#	 Translate the client X.509 into a Basic Authorisation.  This means that
+		#	 the standard Auth/DBMAuth methods can be used for access control.  The
+		#	 user name is the `one line' version of the client's X.509 certificate.
+		#	 Note that no password is obtained from the user. Every entry in the user
+		#	 file needs this password: `xxj31ZMTZzkVA'.
+		#   o ExportCertData:
+		#	 This exports two additional environment variables: SSL_CLIENT_CERT and
+		#	 SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+		#	 server (always existing) and the client (only existing when client
+		#	 authentication is used). This can be used to import the certificates
+		#	 into CGI scripts.
+		#   o StdEnvVars:
+		#	 This exports the standard SSL/TLS related `SSL_*' environment variables.
+		#	 Per default this exportation is switched off for performance reasons,
+		#	 because the extraction step is an expensive operation and is usually
+		#	 useless for serving static content. So one usually enables the
+		#	 exportation for CGI and SSI requests only.
+		#   o OptRenegotiate:
+		#	 This enables optimized SSL connection renegotiation handling when SSL
+		#	 directives are used in per-directory context.
+		#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
 		<FilesMatch "\.(cgi|shtml|phtml|php)$">
-			SSLOptions +StdEnvVars
+				SSLOptions +StdEnvVars
 		</FilesMatch>
-		
 		<Directory /usr/lib/cgi-bin>
-			SSLOptions +StdEnvVars
+				SSLOptions +StdEnvVars
 		</Directory>
+
+		#   SSL Protocol Adjustments:
+		#   The safe and default but still SSL/TLS standard compliant shutdown
+		#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+		#   the close notify alert from client. When you need a different shutdown
+		#   approach you can use one of the following variables:
+		#   o ssl-unclean-shutdown:
+		#	 This forces an unclean shutdown when the connection is closed, i.e. no
+		#	 SSL close notify alert is send or allowed to received.  This violates
+		#	 the SSL/TLS standard but is needed for some brain-dead browsers. Use
+		#	 this when you receive I/O errors because of the standard approach where
+		#	 mod_ssl sends the close notify alert.
+		#   o ssl-accurate-shutdown:
+		#	 This forces an accurate shutdown when the connection is closed, i.e. a
+		#	 SSL close notify alert is send and mod_ssl waits for the close notify
+		#	 alert of the client. This is 100% SSL/TLS standard compliant, but in
+		#	 practice often causes hanging connections with brain-dead browsers. Use
+		#	 this only for browsers where you know that their SSL implementation
+		#	 works correctly.
+		#   Notice: Most problems of broken clients are also related to the HTTP
+		#   keep-alive facility, so you usually additionally want to disable
+		#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+		#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+		#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+		#   "force-response-1.0" for this.
+		# BrowserMatch "MSIE [2-6]" \
+		#		nokeepalive ssl-unclean-shutdown \
+		#		downgrade-1.0 force-response-1.0
+
+		SSLCertificateFile	/etc/letsencrypt/live/www.ipsocloud.com/fullchain.pem
+		SSLCertificateKeyFile	/etc/letsencrypt/live/www.ipsocloud.com/privkey.pem
+Include /etc/letsencrypt/options-ssl-apache.conf
 	</VirtualHost>
 </IfModule>
 
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

debian/buildDeb.sh

@@ -32,7 +32,7 @@ cp -r ../www.ipsocloud.com/webapp_webpack/www/* Math-Cloud-app/var/www/www/
 
 # Construit les paquets debian
 
-dpkg-deb --build Math-Cloud-devel/
+#dpkg-deb --build Math-Cloud-devel/
 dpkg-deb --build Math-Cloud-server/
 dpkg-deb --build Math-Cloud-app/