[Typo3-debian] Using several sites with one source

[Michael Stucki]

Dear Steffen,

> Some time ago, I started a thread about multihosting (using the Debian
> package). I asked, if there could be problems hosting several sites,
> which make use of one source (from the debian package).

Thanks for your comments.

> *** Problems:
> - Reconfiguration of a file from a global extension (e.g. with the
> extension manager) will have consequences for every site.

That's true. This is a general problem when you are mixing global with
several local extensions. Who would you solve it?

My opinion on this is: When finishing a page, let's accept that the version
we used for this project is fixed. I have considered this in the
site-installer: As long as you don't use the '-a' switch, the site will be
linked with the absolute path of the current version. ('-a' would point to
/var/lib/typo3/latest instead.)

Feel free to update to the most recent version, and your future projects
will be based on this one. But the sites that already exist will not be
touched by this step - I think this is good!)

If once a security hole will be detected, these bugs should be fixed in two
ways:
- by providing an extension which fixes the bug (if possible)
- by backporting the fix to the Debian package (I like the comparison with
  Debians packageso of the Linux kernel)

> - Once enabled, the install-tool is available from every site. This is
> not really a problem, but a minor security issue.

I agree. I think this will need some modifications to the core of TYPO3
(since this problem is not Debian specific).
=> Does anybody know if someone already worked on that?

> *** Conclusion:
> hosting more than one independent site with the debian package, could
> lead into trouble, when editing extensions is allowed.

I don't think so, see above. And keep in mind: As long as an extension is
installed _locally_ this one will be preferred by TYPO3 over the _global_
one.

> *** Possible solution:
> Split up the source package into:
> - one read-only part (will be the new source package)
> - one writeable part (as a new part of each site). this provides:
>    - the global extensions /var/lib/typo3_src-3.5.0/typo3/ext
>    - the install directory /var/lib/typo3_src-3.5.0/typo3/install
>    - the temporary files /var/lib/typo3_src-3.5.0/typo3/temp

I remember my first steps with creating Debian packages. The source was
stored in /usr/share/typo3 (read-only) while typo3/ext and typo3/temp were
placed in /var/lib/typo3. I used symbolic links to connect these
directories with each other.

However, this doesn't work, feel free to make a test. PHP seems to have
problems with symbolic links. There should be something about that in the
list archive!

By the way, TYPO3 3.6.0 will not contain typo3/temp anymore, so the only
folder that may need R/W access is typo3/ext. Since I only install
extensions _locally_ this was never a problem for me (I think this setting
is also the default of TYPO3 - you have to explicitely allow it if you want
to install your extensions globally.)

> i couldn't find out, what exactly makes use of the typo3/temp dirctory.
> but since this is writeable for the www-data user, it should be seperated.
> because i didn't check all dependencies, there could be some more
> directories, which need to be sererated.

See above.

> what do you think?

What do you think? ;-)

Best regards
- michael
-- 
Want support? Please read the list rules first: http://typo3.org/1438.0.html