Server Tools: Configuration

Configuring Server Tools: config file and file permissions, all ST_* variables with defaults, validation rules with automatic reset, environment variables and an example config.

Deutsche Version

Back to overview

Configuration

Config file

The file is located at /etc/server-tools/config. The environment variable ST_CONFIG_FILE changes the path. The template conf/server-tools.conf.example contains most options commented out, you only uncomment what you want to change. ST_INSTALL_DIR, ST_BIN_DIR and ST_PROXY_PRESERVE_HOST are not in the template, you can add them yourself if needed.

sudo cp conf/server-tools.conf.example /etc/server-tools/config
sudo chmod 600 /etc/server-tools/config

The file is read with source as Bash code and therefore runs as root. Whoever can write it executes code as root.

Before reading it, the tool checks the file and aborts if

it is not owned by root (Config file not owned by root),
any permission for "others" is set, for example 644 (Config file has unsafe permissions),
it is writable by the group, for example 660 (Config file is group-writable).

This allows 600, 400 and 640, among others. If the file does not exist, the defaults apply.

Values are determined in this order: default value, then an already set environment variable of the same name, then the config file. The config file wins.

Variables

Paths

Variable	Default	Meaning
`ST_CREDENTIAL_DIR`	`/root/db-credentials`	Location of the credential files per database
`ST_AUDIT_LOG`	`/var/log/server-tools-audit.log`	Audit log
`ST_BACKUP_DIR`	`/root/server-tools-backups`	Backups before deletion (`.tar.gz`)
`ST_DB_BACKUP_DIR`	`/root/db-backups`	Database dumps from `db backup`, default target of `db export`
`ST_INSTALL_DIR`	`/usr/local/lib/server-tools`	Target for the libraries on `install` and `uninstall`
`ST_BIN_DIR`	`/usr/local/bin`	Target for binary and shortcuts on `install` and `uninstall`

Webserver

Variable	Default	Meaning
`ST_WEBSERVER`	`apache`	Backend for VHosts, logs and status: `apache` or `nginx`. Applies globally, not per VHost
`ST_APACHE_SITES_AVAILABLE`	`/etc/apache2/sites-available`	Location of Apache VHost files
`ST_APACHE_SITES_ENABLED`	`/etc/apache2/sites-enabled`	Read for listing and status display, enabling is done via `a2ensite`
`ST_NGINX_SITES_AVAILABLE`	`/etc/nginx/sites-available`	Location of Nginx server blocks
`ST_NGINX_SITES_ENABLED`	`/etc/nginx/sites-enabled`	Target of the symlinks when enabling
`ST_APACHE_SERVER_ADMIN`	`webmaster@localhost`	`ServerAdmin` in generated Apache VHosts
`ST_ALLOWED_DOCROOT_PATHS`	`/var/www:/srv/www`	Colon-separated base paths under which a custom `--docroot` must be located
`ST_PROXY_PRESERVE_HOST`	`true`	Default for ProxyPreserveHost on proxy VHosts. Only the value `false` turns it off

PHP

Variable	Default	Meaning
`ST_DEFAULT_PHP_VERSION`	`8.3`	PHP version for new VHosts when `--php` is missing
`ST_PHP_VERSIONS_TO_SCAN`	`7.4 8.0 8.1 8.2 8.3 8.4`	Versions for which FPM sockets and services are looked up

The version check when creating or changing a VHost only allows 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4. Adding another version to ST_PHP_VERSIONS_TO_SCAN does not change that.

Database and passwords

Variable	Default	Meaning
`ST_MYSQL_CONFIG_FILE`	`/root/.my.cnf`	Options file with the root credentials, passed as `--defaults-file`
`ST_DEFAULT_CHARSET`	`utf8mb4`	Character set of new databases
`ST_DEFAULT_COLLATION`	`utf8mb4_unicode_ci`	Collation of new databases
`ST_PASSWORD_LENGTH`	`25`	Length of generated passwords
`ST_PASSWORD_MIN_LENGTH`	`12`	Minimum length for passwords you set yourself
`ST_CREDENTIAL_FILE_PERMISSIONS`	`600`	File mode of the credential files, `600` and `400` are allowed

Generated passwords consist of letters and digits and are at most 43 characters long, even if ST_PASSWORD_LENGTH is larger.

Backup and audit

Variable	Default	Meaning
`ST_AUTO_BACKUP`	`true`	Backup before deleting a VHost or a database. Only the value `true` turns it on
`ST_BACKUP_RETENTION_DAYS`	`30`	Shown as the retention period in the backup overview. The tool does not delete old backups itself
`ST_AUDIT_LOGGING`	`true`	Write the audit log. Only the value `true` turns it on

SSL

Variable	Default	Meaning
`ST_CERTBOT_EMAIL`	empty	Email for Let's Encrypt. Empty: `webmaster@<domain>`
`ST_DNS_PROVIDER`	empty	DNS provider for wildcard certificates
`ST_DNS_CREDENTIALS_FILE`	empty	File with the DNS API credentials. Empty: `/root/.certbot-dns-<provider>.ini`

Logs and logrotate

Variable	Default	Meaning
`ST_APACHE_LOG_DIR`	`/var/log/apache2`	Global log directory with `ST_WEBSERVER=apache`
`ST_NGINX_LOG_DIR`	`/var/log/nginx`	Global log directory with `ST_WEBSERVER=nginx`
`ST_MYSQL_LOG_FILE`	`/var/log/mysql/error.log`	MySQL error log
`ST_LOG_LINES`	`50`	Default number of lines shown
`ST_LOGROTATE_ROTATE`	`52`	`rotate` in the generated logrotate file
`ST_LOGROTATE_DAYS`	`14`	`maxage` in the generated logrotate file

SSH users

Variable	Default	Meaning
`ST_USER_DEFAULT_SHELL`	`/bin/bash`	Login shell of new domain users. Must be an absolute path and executable

Validation rules

After reading the file, the tool corrects invalid values with a warning:

Variable	Valid	Otherwise reset to
`ST_WEBSERVER`	`apache` or `nginx`	`apache`
`ST_PASSWORD_LENGTH`	12 to 64	`25`
`ST_PASSWORD_MIN_LENGTH`	at least 8	`12`
`ST_CREDENTIAL_FILE_PERMISSIONS`	`600` or `400`	`600`
`ST_BACKUP_RETENTION_DAYS`	1 to 365	`30`

Environment variables

Variable	Effect
`ST_CONFIG_FILE`	Path of the config file
`ST_DEBUG=1`	Prints additional `[DEBUG]` lines
`NO_COLOR`	Turns off colored output
`ST_AUTO_CONFIRM=true`	Acts like `--yes`, see Usage

Show the active configuration

sudo server-tools --config

Shows paths, defaults, webserver backend, password lengths, auto backup, audit logging and whether the config file was found. The example shows the format, the values depend on your installation:

=== Current Configuration ===

Paths:
  Credentials:   /root/db-credentials
  Audit log:     /var/log/server-tools-audit.log
  Backups:       /root/server-tools-backups
  DB backups:    /root/db-backups
  Config file:   /etc/server-tools/config

Defaults:
  PHP version:   8.3
  DB charset:    utf8mb4 / utf8mb4_unicode_ci

Webserver:
  Backend:       apache

Passwords:
  Auto length:   25
  Min length:    12

Features:
  Auto-backup:   true
  Audit logging: true

Config file:     loaded from /etc/server-tools/config

Example

# /etc/server-tools/config
ST_WEBSERVER="nginx"
ST_DEFAULT_PHP_VERSION="8.3"
ST_CERTBOT_EMAIL="admin@example.com"
ST_PASSWORD_LENGTH=30
ST_AUTO_BACKUP=true
ST_USER_DEFAULT_SHELL="/bin/bash"