MediaWiki на Ubuntu 26.04: установка с Nginx, PHP-FPM 8.5 и Percona

<?php
// Local configuration for MediaWiki 1.46.x. Load after the other LocalSettings settings.
// Restricts wikitext interfaces; rendered HTML and published files remain public.

$wgAvailableRights[] = 'internalwiki-viewsource';
foreach ( array_keys( $wgGroupPermissions ?? [] ) as $internalWikiGroup ) {
    $wgGroupPermissions[$internalWikiGroup]['internalwiki-viewsource'] = false;
}
$wgGroupPermissions['*']['internalwiki-viewsource'] = false;
$wgGroupPermissions['user']['internalwiki-viewsource'] = false;
$wgGroupPermissions['sysop']['internalwiki-viewsource'] = true;
unset( $internalWikiGroup );

final class InternalWikiSourceAccess {
    private const RIGHT = 'internalwiki-viewsource';

    private static function allowed( $context ): bool {
        // Use MediaWiki's existing permission cache, with no custom SQL queries.
        return $context->getAuthority()->isAllowed( self::RIGHT );
    }

    private static function denyPage( $output ): bool {
        $output->setStatusCode( 403 );
        $output->disableClientCache();
        $output->setRobotPolicy( 'noindex,nofollow' );
        $output->setPageTitle( 'Доступ запрещён' );
        $output->addHTML( '<p>Просмотр исходного викитекста доступен только администраторам.</p>' );
        return false;
    }

    public static function onAction( $output, $article, $title, $user, $request, $wiki ): bool {
        if ( self::allowed( $output ) ) {
            return true;
        }
        // A diff contains wikitext even though its action is normally "view".
        if ( !in_array( $request->getVal( 'action', 'view' ), [ 'view', 'render' ], true )
            || $request->getCheck( 'diff' ) || $request->getCheck( 'feed' )
        ) {
            return self::denyPage( $output );
        }
        return true;
    }

    public static function onSpecialPage( $special, $subPage ): bool {
        if ( self::allowed( $special ) ) {
            return true;
        }
        // Canonical names also cover translated aliases and subpage URLs.
        if ( in_array( $special->getName(), [
            'Export', 'ExpandTemplates', 'Diff', 'ComparePages', 'ApiSandbox'
        ], true ) || $special->getRequest()->getCheck( 'feed' ) ) {
            return self::denyPage( $special->getOutput() );
        }
        return true;
    }

    public static function onNavigation( $skin, &$links ): void {
        if ( self::allowed( $skin ) ) {
            return;
        }
        foreach ( [ 'views', 'actions' ] as $section ) {
            foreach ( [ 'viewsource', 'edit', 'history' ] as $item ) {
                unset( $links[$section][$item] );
            }
        }
    }

    public static function onApi( $module, $user, &$message ): bool {
        if ( self::allowed( $module ) ) {
            return true;
        }
        $name = $module->getModuleName();
        // Keep search suggestions and login usable before the administrator logs in.
        if ( in_array( $name, [ 'opensearch', 'login', 'clientlogin', 'logout' ], true ) ) {
            return true;
        }
        if ( $name === 'query' ) {
            // Use the API's parsed parameters, including boolean/export and multi-value syntax.
            $params = $module->extractRequestParams();
            $permitted = empty( $params['export'] ) && empty( $params['exportnowrap'] );
            foreach ( [
                'prop' => [ 'info', 'pageimages', 'pageterms' ],
                'list' => [ 'search', 'prefixsearch' ],
                'meta' => [ 'siteinfo', 'userinfo', 'tokens' ]
            ] as $kind => $allowedModules ) {
                if ( array_diff( $params[$kind] ?? [], $allowedModules ) ) {
                    $permitted = false;
                }
            }
            // Generator belongs to ApiPageSet, not ApiQuery's own parameter collection.
            if ( !in_array( $module->getRequest()->getVal( 'generator' ),
                [ null, 'search', 'prefixsearch' ], true )
            ) {
                $permitted = false;
            }
            if ( $permitted ) {
                return true;
            }
        }
        // Includes revisions, compare, parse, expandtemplates, XML export and future modules.
        $message = 'apierror-action-notallowed';
        return false;
    }

    public static function onRest( $module, $handler, $path, $request, &$error ): bool {
        if ( self::allowed( $handler ) ) {
            return true;
        }
        // REST exposes both source and Parsoid HTML with editing metadata.
        $error = new \MediaWiki\Rest\HttpException(
            'Просмотр исходного викитекста доступен только администраторам.', 403
        );
        return false;
    }
}

$wgHooks['MediaWikiPerformAction'][] = [ InternalWikiSourceAccess::class, 'onAction' ];
$wgHooks['SpecialPageBeforeExecute'][] = [ InternalWikiSourceAccess::class, 'onSpecialPage' ];
$wgHooks['SkinTemplateNavigation::Universal'][] = [ InternalWikiSourceAccess::class, 'onNavigation' ];
$wgHooks['ApiCheckCanExecute'][] = [ InternalWikiSourceAccess::class, 'onApi' ];
$wgHooks['RestCheckCanExecute'][] = [ InternalWikiSourceAccess::class, 'onRest' ];

<?php
// MediaWiki 1.46: complement Nginx Basic Auth for aliases, APIs and transclusion.
// Password verification is performed only by Nginx. No custom database queries.
final class InternalAuditPageAccess {
    public const TITLE = 'Аудит_прав_пользователей,_групп_и_групповых_политик_в_домене';

    public static function verified(): bool {
        return ($_SERVER['MEDIAWIKI_AUDIT_VERIFIED'] ?? '') === '1';
    }

    public static function protectedTitle($title): bool {
        return $title && $title->getNamespace() === NS_MAIN
            && $title->getDBkey() === self::TITLE;
    }

    private static function protectedText($text): bool {
        return is_string($text) && self::protectedTitle(\MediaWiki\Title\Title::newFromText($text));
    }

    public static function beforeInitialize($title, $unused, $output, $user, $request, $entry): void {
        if (self::protectedTitle($title) && !self::verified()) {
            // Non-canonical URLs challenge too. On retry with Authorization,
            // Nginx validates credentials before forwarding the request to PHP.
            $request->response()->header('WWW-Authenticate: Basic realm="Audit article"');
            $request->response()->header('Cache-Control: private, no-store');
            throw new \MediaWiki\Exception\HttpError(401, 'Для этой статьи требуется пароль Nginx.');
        }
    }

    public static function permissions($title, $user, $action, &$result): bool {
        if (self::protectedTitle($title) && !self::verified()) {
            $result = ['badaccess-group0'];
            return false;
        }
        return true;
    }

    public static function template($context, $title, &$skip, &$revision): void {
        // Never cache the protected article's text inside another public page,
        // even when the editor/reader supplying the template has authenticated.
        if (self::protectedTitle($title)) {
            $skip = true;
            $revision = null;
        }
    }

    public static function search($term, &$titleMatches, &$textMatches): void {
        if (self::verified()) {
            return;
        }
        foreach (['titleMatches', 'textMatches'] as $which) {
            $set = $$which;
            if (!$set) {
                continue;
            }
            $rows = $set->extractResults();
            $visible = array_values(array_filter($rows,
                static fn($row) => !self::protectedTitle($row->getTitle())));
            if (count($visible) !== count($rows)) {
                $$which = new \MediaWiki\Search\FauxSearchResultSet($visible,
                    max(count($visible), ($set->getTotalHits() ?? count($rows)) - count($rows) + count($visible)));
            }
        }
    }

    public static function afterApi($module): void {
        if (self::verified()) {
            return;
        }
        $result = $module->getResult();
        foreach (['search', 'prefixsearch', 'pages'] as $collection) {
            $rows = $result->getResultData(['query', $collection]);
            if (!is_array($rows)) {
                continue;
            }
            foreach ($rows as $key => $row) {
                if (is_array($row) && self::protectedText($row['title'] ?? null)) {
                    $result->removeValue(['query', $collection], $key);
                }
            }
        }
        // OpenSearch uses parallel arrays of titles, descriptions and links.
        if ($module->getModuleName() === 'opensearch') {
            $titles = $result->getResultData([1]);
            if (is_array($titles)) {
                foreach ($titles as $key => $title) {
                    if (self::protectedText($title)) {
                        foreach ([1, 2, 3] as $column) {
                            $result->removeValue([$column], $key);
                        }
                    }
                }
            }
        }
    }
}

$wgHooks['BeforeInitialize'][] = [InternalAuditPageAccess::class, 'beforeInitialize'];
$wgHooks['getUserPermissionsErrors'][] = [InternalAuditPageAccess::class, 'permissions'];
$wgHooks['BeforeParserFetchTemplateRevisionRecord'][] = [InternalAuditPageAccess::class, 'template'];
$wgHooks['SpecialSearchResults'][] = [InternalAuditPageAccess::class, 'search'];
$wgHooks['APIAfterExecute'][] = [InternalAuditPageAccess::class, 'afterApi'];

# Ubuntu includes sites-enabled/* inside http {}. These directives must stay
# outside server {}. ResourceLoader serves CSS/JS and has no per-IP limit.
map_hash_bucket_size 512;
server_names_hash_bucket_size 512;
map $host $mediawiki_public_host {
    default "";
    include /etc/nginx/mediawiki-public-hosts.conf;
}
map $request_uri $mediawiki_legacy_target {
    default "";
    ~^/wiki(/.*)$ $1;
}
map $uri $mediawiki_is_audit_uri {
    default 0;
    /Аудит_прав_пользователей,_групп_и_групповых_политик_в_домене 1;
}
# If credentials accompany an alternative URL/API request, Nginx verifies them
# too. PHP never trusts the unverified remote_user variable by itself.
map "$mediawiki_audit_entry:$http_authorization" $mediawiki_auth_realm {
    "0:" off;
    default "Audit article";
}
map "$mediawiki_auth_realm:$remote_user" $mediawiki_audit_verified {
    default 0;
    "Audit article:root" 1;
}
map "$uri:$mediawiki_audit_verified" $mediawiki_private_cache {
    default "";
    ~^/(?:index|api|opensearch_desc|thumb)\.php:1$ "private, no-store";
    ~^/rest\.php(?:/.*)?:1$ "private, no-store";
}
map $uri $mediawiki_limit_key {
    default   $binary_remote_addr;
    /load.php "";
}
limit_req_zone $mediawiki_limit_key zone=mediawiki_per_ip:10m rate=1r/s;

server {
    listen 172.16.2.246:80;
    listen 172.16.2.246:443 ssl;
    http2 on;
    include /etc/nginx/mediawiki-server-names.conf;
    if ($mediawiki_public_host = "") { return 444; }
    # Evaluate the map before location rewrites change $uri to /index.php.
    set $mediawiki_audit_entry $mediawiki_is_audit_uri;
    root /var/www/mediawiki;
    index index.php;
    autoindex off;
    server_tokens off;
    client_max_body_size 25m;
    limit_req_status 429;
    limit_req_log_level warn;

    # Ubuntu package: libnginx-mod-http-headers-more-filter.
    # Replace any upstream value; also applies to Nginx error responses.
    more_set_headers 'X-Powered-By: https://sysadmin.guru';
    more_set_headers -s 429 'Retry-After: 1';

    ssl_certificate /etc/ssl/certs/mediawiki.crt;
    ssl_certificate_key /etc/ssl/private/mediawiki.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:MediaWikiTLS:10m;
    ssl_session_timeout 1h;
    ssl_session_tickets off;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;
    add_header Cache-Control $mediawiki_private_cache always;

    # MediaWiki reads the original REQUEST_URI using wgArticlePath.
    # No title interpolation into a query string: &, + and Unicode titles stay intact.
    location = / { rewrite ^ /index.php last; }
    location = /wiki { return 308 $scheme://$mediawiki_public_host/; }
    location ^~ /wiki/ {
        if ($mediawiki_legacy_target = "") { return 404; }
        # Keep original escaping/query; never put a decoded title into Location.
        return 308 $scheme://$mediawiki_public_host$mediawiki_legacy_target;
    }

    location = /robots.txt {
        default_type text/plain;
        return 200 "User-agent: *\nDisallow: /\n";
    }
    location ~ (^|/)\. { return 404; }
    location ~* ^/(includes|vendor|maintenance|mw-config|cache|tests|docs|sql|node_modules|serialized|backups?)(/|$) { return 404; }
    location ~* /(tests|docs|node_modules|vendor)/ { return 404; }
    location ^~ /images/deleted/ { return 404; }
    location ^~ /images/temp/ { return 404; }
    location ^~ /images/lockdir/ { return 404; }

    # ResourceLoader does not serve article text; skip repeated bcrypt work for CSS/JS.
    location = /load.php {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/load.php;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param MEDIAWIKI_PUBLIC_HOST $mediawiki_public_host;
        fastcgi_param MEDIAWIKI_AUDIT_VERIFIED 0;
        fastcgi_pass unix:/run/php/php8.5-fpm-mediawiki.sock;
        fastcgi_read_timeout 120s;
    }
    location ~ ^/(index|api|opensearch_desc|thumb)\.php$ {
        auth_basic $mediawiki_auth_realm;
        auth_basic_user_file /etc/nginx/auth/mediawiki-audit.htpasswd;
        limit_req zone=mediawiki_per_ip burst=5 nodelay;
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param MEDIAWIKI_PUBLIC_HOST $mediawiki_public_host;
        fastcgi_param MEDIAWIKI_AUDIT_VERIFIED $mediawiki_audit_verified;
        fastcgi_pass unix:/run/php/php8.5-fpm-mediawiki.sock;
        fastcgi_read_timeout 120s;
    }
    location ~ ^/rest\.php(?:/|$) {
        auth_basic $mediawiki_auth_realm;
        auth_basic_user_file /etc/nginx/auth/mediawiki-audit.htpasswd;
        limit_req zone=mediawiki_per_ip burst=5 nodelay;
        fastcgi_split_path_info ^(/rest\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/rest.php;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param MEDIAWIKI_PUBLIC_HOST $mediawiki_public_host;
        fastcgi_param MEDIAWIKI_AUDIT_VERIFIED $mediawiki_audit_verified;
        fastcgi_pass unix:/run/php/php8.5-fpm-mediawiki.sock;
        fastcgi_read_timeout 120s;
    }
    location ~* \.(php[0-9]?|phtml|phar)([./]|$) { return 404; }
    location ~* ^/(composer\.(json|lock)|package(-lock)?\.json|COPYING|CREDITS|HISTORY|INSTALL|README(\..*)?|SECURITY(\..*)?)$ { return 404; }
    location ~* ^/images/.+\.(png|gif|jpe?g|webp|pdf)$ {
        try_files $uri =404;
        expires 7d;
        access_log off;
    }
    location ~ ^/(resources|skins|extensions)/.+\.(css|js|png|gif|jpe?g|webp|svg|ico|woff2?|ttf|eot|wasm)$ {
        try_files $uri =404;
        expires 7d;
        access_log off;
    }
    location ~* ^/(images|resources|skins|extensions)(/|$) { return 404; }
    # Every other URL is an article, never a file-system fallback.
    location / { rewrite ^ /index.php last; }
    error_page 502 504 =503 @maintenance;
    location @maintenance {
        default_type text/plain;
        add_header Retry-After 60 always;
        return 503 "Wiki maintenance in progress. Please retry shortly.\n";
    }
}

#!/usr/bin/python3
"""Consistent local MediaWiki backups. Root only; no database password in argv."""
import argparse
import hashlib
import json
import os
import re
import shutil
import signal
import subprocess
import sys
import tarfile
import uuid
from datetime import datetime, timedelta, timezone
from pathlib import Path

ROOT = Path('/var/backups/mediawiki')
STATE = Path('/run/mediawiki-backup-state.json')
NAME = re.compile(r'^mediawiki-\d{4}-\d{2}-\d{2}T\d{6}Z-[a-f0-9]{8}\.tar\.gz$')
MYSQL = ['mysql', '--no-defaults', '--protocol=socket', '--socket=/run/mysqld/mysqld.sock', '--user=root']

def run(args, **kwargs):
    return subprocess.run(args, check=True, **kwargs)

def prune_backups(root, now):
    """Only remove this program's completed backups, after a new success exists."""
    for item in root.iterdir():
        if item.is_symlink() or not item.is_file() or not NAME.fullmatch(item.name):
            continue
        try:
            with tarfile.open(item, 'r|gz') as archive:
                first = archive.next()
                if first is None or first.name != 'manifest.json' or first.size > 65536:
                    continue
                data = json.load(archive.extractfile(first))
            completed = datetime.fromisoformat(data['completed_at'])
            if data['kind'] != 'mediawiki-backup-v1' or completed.tzinfo is None:
                continue
        except (ValueError, KeyError, tarfile.TarError, EOFError, OSError):
            continue
        if completed < now - timedelta(days=7):
            if item.resolve().parent != root.resolve():
                raise RuntimeError('Unsafe backup retention path')
            item.unlink()

def snapshot(root, controller, writer):
    now = datetime.now(timezone.utc)
    name = 'mediawiki-' + now.strftime('%Y-%m-%dT%H%M%SZ') + '-' + uuid.uuid4().hex[:8]
    stage = root / ('.partial-' + name)
    stage.mkdir(mode=0o700)
    try:
        try:
            controller.pause()
            writer(stage)
        finally:
            controller.resume()
        result = root / (name + '.tar.gz')
        (stage / 'backup.tar.gz').rename(result)
        prune_backups(root, datetime.now(timezone.utc))
        return result
    finally:
        if stage.is_dir() and not stage.is_symlink() and stage.parent == root:
            shutil.rmtree(stage)

class Services:
    units = ['mediawiki-jobs.timer', 'php8.5-fpm.service']

    def pause(self):
        states = {unit: subprocess.run(['systemctl', 'is-active', '--quiet', unit]).returncode == 0
                  for unit in self.units}
        # Record recovery information BEFORE stopping anything; ExecStopPost also uses this.
        STATE.write_text(json.dumps(states))
        os.chmod(STATE, 0o600)
        if states['mediawiki-jobs.timer']:
            run(['systemctl', 'stop', 'mediawiki-jobs.timer'])
        run(['systemctl', 'stop', 'mediawiki-jobs.service'])
        if states['php8.5-fpm.service']:
            run(['systemctl', 'stop', 'php8.5-fpm.service'])

    def resume(self):
        if not STATE.exists():
            return
        states = json.loads(STATE.read_text())
        errors = []
        for unit in reversed(self.units):
            if states.get(unit):
                try:
                    run(['systemctl', 'start', unit])
                except subprocess.CalledProcessError:
                    errors.append(unit)
        if errors:
            raise RuntimeError('Could not resume services: ' + ', '.join(errors))
        STATE.unlink()

def verify(backup):
    # One streaming pass checks each archived regular file's SHA-256.
    digests = {}
    expected = None
    with tarfile.open(backup, 'r|gz') as archive:
        for member in archive:
            if not member.isfile():
                continue
            stream = archive.extractfile(member)
            if member.name == 'SHA256SUMS':
                if member.size > 32 * 1024 * 1024:
                    raise RuntimeError('Checksum list too large')
                expected = {}
                for line in stream.read().decode().splitlines():
                    digest, filename = line.split('  ', 1)
                    if filename in expected:
                        raise RuntimeError('Duplicate checksum entry')
                    expected[filename] = digest
            else:
                digests[member.name] = hashlib.file_digest(stream, 'sha256').hexdigest()
    if expected is None or digests != expected:
        raise RuntimeError('Backup checksum mismatch')
    required = {'database.sql', 'accounts.sql', 'manifest.json',
                'var/www/mediawiki/LocalSettings.php', 'etc/nginx/sites-available/mediawiki'}
    if not required <= digests.keys():
        raise RuntimeError('Required files missing from backup')

def pack_archive(stage, include):
    import io
    digests = {}
    class HashReader:
        def __init__(self, stream):
            self.stream = stream
            self.digest = hashlib.sha256()
        def read(self, length=-1):
            data = self.stream.read(length)
            self.digest.update(data)
            return data
    with tarfile.open(stage / 'backup.tar.gz', 'w:gz', compresslevel=1, dereference=False) as archive:
        def add(path, name):
            info = archive.gettarinfo(str(path), arcname=name)
            if info.isfile():
                with path.open('rb') as stream:
                    reader = HashReader(stream)
                    archive.addfile(info, reader)
                    digests[name] = reader.digest.hexdigest()
            else:
                archive.addfile(info)
            if info.isdir():
                for child in sorted(path.iterdir()):
                    add(child, name + '/' + child.name)
        # Manifest FIRST lets retention inspect old copies without reading database/files.
        for name in ['manifest.json', 'database.sql', 'accounts.sql', 'versions.txt']:
            add(stage / name, name)
        for path, name in include:
            add(path, name)
        data = ''.join(digest + '  ' + name + '\n' for name, digest in digests.items()).encode()
        info = tarfile.TarInfo('SHA256SUMS')
        info.size, info.mode = len(data), 0o600
        archive.addfile(info, io.BytesIO(data))

def capture(stage):
    # Cold capture also covers non-InnoDB tables, uploads, and maintenance side effects.
    dump = ['mysqldump', '--no-defaults', '--protocol=socket', '--socket=/run/mysqld/mysqld.sock',
            '--user=root', '--single-transaction', '--quick', '--hex-blob', '--no-tablespaces',
            '--set-gtid-purged=OFF', '--default-character-set=utf8mb4', '--routines', '--events',
            '--triggers', '--databases', 'mediawiki']
    with (stage / 'database.sql').open('wb') as target:
        run(dump, stdout=target)
    with (stage / 'accounts.sql').open('w') as target:
        created = run(MYSQL + ['--batch', '--skip-column-names', '--raw', '-e',
            "SHOW CREATE USER 'mediawiki'@'localhost'"], capture_output=True, text=True).stdout
        target.write(created.rstrip().split('\t', 1)[-1] + ';\n')
        grants = run(MYSQL + ['--batch', '--skip-column-names', '--raw', '-e',
            "SHOW GRANTS FOR 'mediawiki'@'localhost'"], capture_output=True, text=True).stdout
        target.write(''.join(line + ';\n' for line in grants.splitlines()))
    include = ['var/www/mediawiki', 'etc/nginx', 'etc/php/8.5', 'etc/mysql']
    optional = ['etc/systemd/system/mediawiki-jobs.service', 'etc/systemd/system/mediawiki-jobs.timer',
        'etc/systemd/system/mediawiki-backup.service', 'etc/cron.d/mediawiki-backup',
        'etc/systemd/system/mediawiki-memcached.service', 'etc/logrotate.d/mediawiki',
        'etc/apt/apt.conf.d/52mediawiki-security', 'etc/apt/apt.conf.d/20mediawiki-periodic',
        'etc/apt/apt.conf.d/99zz-mediawiki-no-auto-updates',
        'etc/systemd/system/apt-daily.timer', 'etc/systemd/system/apt-daily-upgrade.timer',
        'etc/systemd/system/apt-daily.service', 'etc/systemd/system/apt-daily-upgrade.service',
        'etc/ssl/private/mediawiki.key', 'etc/ssl/certs/mediawiki.crt',
        'usr/local/sbin/mediawiki-backup.py', 'usr/local/sbin/mediawiki-update-schema',
        'etc/tmpfiles.d/mediawiki.conf']
    include += [entry for entry in optional if Path('/' + entry).exists()]
    with (stage / 'versions.txt').open('w') as target:
        run(['dpkg-query', '-W', 'percona-server-server', 'nginx', 'php8.5-fpm'],
            stdout=target)
    (stage / 'manifest.json').write_text(json.dumps({
        'kind': 'mediawiki-backup-v1', 'completed_at': datetime.now(timezone.utc).isoformat(),
        'database': 'mediawiki', 'wiki': '/var/www/mediawiki',
        'consistency': 'PHP-FPM and scheduled jobs stopped during capture'
    }, indent=2) + '\n')
    pack_archive(stage, [(Path('/') / name, name) for name in include])
    # Validation consumes I/O; do it after PHP-FPM has resumed (see main writer wrapper).

def main():
    import fcntl
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--recover', action='store_true')
    parser.add_argument('--check-latest', action='store_true')
    options = parser.parse_args()
    if os.geteuid() != 0:
        raise RuntimeError('Run as root')
    os.umask(0o077)
    os.environ['PATH'] = '/usr/sbin:/usr/bin:/sbin:/bin'
    with open('/run/lock/mediawiki-maintenance.lock', 'a') as lock:
        fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
        service = Services()
        if options.recover:
            service.resume()
            return
        ROOT.mkdir(mode=0o700, parents=True, exist_ok=True)
        if ROOT.is_symlink() or ROOT.resolve() != ROOT or ROOT.stat().st_uid != 0:
            raise RuntimeError('Backup directory must be a root-owned physical directory')
        os.chmod(ROOT, 0o700)
        if options.check_latest:
            backups = sorted(p for p in ROOT.iterdir() if NAME.fullmatch(p.name) and not p.is_symlink())
            if not backups:
                raise RuntimeError('No completed backup')
            verify(backups[-1])
            print('Verified:', backups[-1])
            return
        def interrupted(signum, frame):
            raise RuntimeError('Backup interrupted by signal ' + str(signum))
        signal.signal(signal.SIGTERM, interrupted)
        signal.signal(signal.SIGINT, interrupted)
        # Keep failed recovery visible rather than overwriting its state on the next run.
        service.resume()
        class CaptureServices(Services):
            def resume(self):
                super().resume()
                if capture_complete:
                    verify(staging[0] / 'backup.tar.gz')
        staging = []
        capture_complete = []
        def writer(stage):
            staging.append(stage)
            capture(stage)
            capture_complete.append(True)
        result = snapshot(ROOT, CaptureServices(), writer)
        print('Backup completed and verified:', result)

if __name__ == '__main__':
    try:
        main()
    except Exception as error:
        print('BACKUP FAILED:', error, file=sys.stderr)
        sys.exit(1)

if ($mediawiki_public_host = "") { return 444; }
# Evaluate the map before location rewrites change $uri to /index.php.
set $mediawiki_audit_entry $mediawiki_is_audit_uri;
root /var/www/mediawiki;
index index.php;
autoindex off;
server_tokens off;
client_max_body_size 25m;
limit_req_status 429;
limit_req_log_level warn;

# Ubuntu package: libnginx-mod-http-headers-more-filter.
# Replace any upstream value; also applies to Nginx error responses.
more_set_headers 'X-Powered-By: https://sysadmin.guru';
more_set_headers -s 429 'Retry-After: 1';

ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:MediaWikiTLS:10m;
ssl_session_timeout 1h;
ssl_session_tickets off;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
add_header Cache-Control $mediawiki_private_cache always;

# MediaWiki reads the original REQUEST_URI using wgArticlePath.
# No title interpolation into a query string: &, + and Unicode titles stay intact.
location = / { rewrite ^ /index.php last; }
location = /wiki { return 308 $scheme://$mediawiki_public_host/; }
location ^~ /wiki/ {
    if ($mediawiki_legacy_target = "") { return 404; }
    # Keep original escaping/query; never put a decoded title into Location.
    return 308 $scheme://$mediawiki_public_host$mediawiki_legacy_target;
}

location = /robots.txt {
    default_type text/plain;
    return 200 "User-agent: *\nDisallow: /\n";
}
# Public HTTP-01 tokens live outside the MediaWiki installation.
location ^~ /.well-known/acme-challenge/ {
    root /var/lib/letsencrypt;
    default_type text/plain;
    auth_basic off;
    limit_except GET { deny all; }
    try_files $uri =404;
}

location ~ (^|/)\. { return 404; }
location ~* ^/(includes|vendor|maintenance|mw-config|cache|tests|docs|sql|node_modules|serialized|backups?)(/|$) { return 404; }
location ~* /(tests|docs|node_modules|vendor)/ { return 404; }
location ^~ /images/deleted/ { return 404; }
location ^~ /images/temp/ { return 404; }
location ^~ /images/lockdir/ { return 404; }

# ResourceLoader does not serve article text; skip repeated bcrypt work for CSS/JS.
location = /load.php {
    try_files $uri =404;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root/load.php;
    fastcgi_param HTTPS $https if_not_empty;
    fastcgi_param HTTP_PROXY "";
    fastcgi_param MEDIAWIKI_PUBLIC_HOST $mediawiki_public_host;
    fastcgi_param MEDIAWIKI_AUDIT_VERIFIED 0;
    fastcgi_pass unix:/run/php/php8.5-fpm-mediawiki.sock;
    fastcgi_read_timeout 120s;
}
location ~ ^/(index|api|opensearch_desc|thumb)\.php$ {
    auth_basic $mediawiki_auth_realm;
    auth_basic_user_file /etc/nginx/auth/mediawiki-audit.htpasswd;
    limit_req zone=mediawiki_per_ip burst=5 nodelay;
    try_files $uri =404;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param HTTPS $https if_not_empty;
    fastcgi_param HTTP_PROXY "";
    fastcgi_param MEDIAWIKI_PUBLIC_HOST $mediawiki_public_host;
    fastcgi_param MEDIAWIKI_AUDIT_VERIFIED $mediawiki_audit_verified;
    fastcgi_pass unix:/run/php/php8.5-fpm-mediawiki.sock;
    fastcgi_read_timeout 120s;
}
location ~ ^/rest\.php(?:/|$) {
    auth_basic $mediawiki_auth_realm;
    auth_basic_user_file /etc/nginx/auth/mediawiki-audit.htpasswd;
    limit_req zone=mediawiki_per_ip burst=5 nodelay;
    fastcgi_split_path_info ^(/rest\.php)(/.*)$;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root/rest.php;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param HTTPS $https if_not_empty;
    fastcgi_param HTTP_PROXY "";
    fastcgi_param MEDIAWIKI_PUBLIC_HOST $mediawiki_public_host;
    fastcgi_param MEDIAWIKI_AUDIT_VERIFIED $mediawiki_audit_verified;
    fastcgi_pass unix:/run/php/php8.5-fpm-mediawiki.sock;
    fastcgi_read_timeout 120s;
}
location ~* \.(php[0-9]?|phtml|phar)([./]|$) { return 404; }
location ~* ^/(composer\.(json|lock)|package(-lock)?\.json|COPYING|CREDITS|HISTORY|INSTALL|README(\..*)?|SECURITY(\..*)?)$ { return 404; }
location ~* ^/images/.+\.(png|gif|jpe?g|webp|pdf)$ {
    try_files $uri =404;
    expires 7d;
    access_log off;
}
location ~ ^/(resources|skins|extensions)/.+\.(css|js|png|gif|jpe?g|webp|svg|ico|woff2?|ttf|eot|wasm)$ {
    try_files $uri =404;
    expires 7d;
    access_log off;
}
location ~* ^/(images|resources|skins|extensions)(/|$) { return 404; }
# Every other URL is an article, never a file-system fallback.
location / { rewrite ^ /index.php last; }
error_page 502 504 =503 @maintenance;
location @maintenance {
    default_type text/plain;
    add_header Retry-After 60 always;
    return 503 "Wiki maintenance in progress. Please retry shortly.\n";
}

# Ubuntu includes sites-enabled/* inside http {}. These directives must stay
# outside server {}. ResourceLoader serves CSS/JS and has no per-IP limit.
map_hash_bucket_size 512;
server_names_hash_bucket_size 512;
map $host $mediawiki_public_host {
    default "";
    include /etc/nginx/mediawiki-public-hosts.conf;
}
map $request_uri $mediawiki_legacy_target {
    default "";
    ~^/wiki(/.*)$ $1;
}
map $uri $mediawiki_is_audit_uri {
    default 0;
    /Аудит_прав_пользователей,_групп_и_групповых_политик_в_домене 1;
}
# If credentials accompany an alternative URL/API request, Nginx verifies them
# too. PHP never trusts the unverified remote_user variable by itself.
map "$mediawiki_audit_entry:$http_authorization" $mediawiki_auth_realm {
    "0:" off;
    default "Audit article";
}
map "$mediawiki_auth_realm:$remote_user" $mediawiki_audit_verified {
    default 0;
    "Audit article:root" 1;
}
map "$uri:$mediawiki_audit_verified" $mediawiki_private_cache {
    default "";
    ~^/(?:index|api|opensearch_desc|thumb)\.php:1$ "private, no-store";
    ~^/rest\.php(?:/.*)?:1$ "private, no-store";
}
map $uri $mediawiki_limit_key {
    default   $binary_remote_addr;
    /load.php "";
}
limit_req_zone $mediawiki_limit_key zone=mediawiki_per_ip:10m rate=1r/s;


server {
    listen 172.16.2.246:80 default_server;
    listen 172.16.2.246:443 ssl default_server;
    http2 on;
    server_name 172.16.2.246;
    ssl_certificate /etc/ssl/certs/mediawiki.crt;
    ssl_certificate_key /etc/ssl/private/mediawiki.key;
    include /etc/nginx/snippets/mediawiki-site.conf;
}

server {
    listen 172.16.2.246:80;
    listen 172.16.2.246:443 ssl;
    http2 on;
    server_name example.com;
    ssl_certificate /etc/ssl/certs/mediawiki.crt;
    ssl_certificate_key /etc/ssl/private/mediawiki.key;
    include /etc/nginx/snippets/mediawiki-site.conf;
}