📚 GLPI Installation Debian 12 — Guide Complet

# Mise à jour complète du système
apt update && apt upgrade -y
apt install -y curl wget git unzip apt-transport-https ca-certificates

apt install -y apache2

# Toutes les extensions PHP requises par GLPI 10
apt install -y php8.2 php8.2-mysql php8.2-mbstring php8.2-curl \
  php8.2-gd php8.2-xml php8.2-zip php8.2-intl php8.2-bz2 \
  php8.2-ldap php8.2-imap php8.2-apcu php8.2-xmlrpc \
  libapache2-mod-php8.2

# Activer les modules Apache nécessaires
a2enmod rewrite headers ssl
systemctl enable --now apache2

# Vérification
php -v && apache2ctl -v

PHP_INI=/etc/php/8.2/apache2/php.ini

sed -i 's/memory_limit = .*/memory_limit = 256M/' $PHP_INI
sed -i 's/upload_max_filesize = .*/upload_max_filesize = 20M/' $PHP_INI
sed -i 's/post_max_size = .*/post_max_size = 20M/' $PHP_INI
sed -i 's/max_execution_time = .*/max_execution_time = 600/' $PHP_INI
sed -i 's/session.cookie_httponly.*/session.cookie_httponly = On/' $PHP_INI
sed -i 's|;date.timezone.*|date.timezone = Europe/Paris|' $PHP_INI

systemctl restart apache2

apt install -y mariadb-server mariadb-client
mysql_secure_installation

# Connexion en root pour créer la base
mysql -u root -p

# Dans le prompt MariaDB :
CREATE DATABASE glpi CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'glpi_user'@'localhost' IDENTIFIED BY 'GlpiP@ssw0rd!';
GRANT ALL PRIVILEGES ON glpi.* TO 'glpi_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

# Optimisation MariaDB pour GLPI
cat >> /etc/mysql/mariadb.conf.d/50-server.cnf << EOF
[mysqld]
innodb_buffer_pool_size = 256M
innodb_file_per_table = ON
EOF

# Charger les fuseaux horaires (requis par GLPI)
mysql_tzinfo_to_sql /usr/share/zoneinfo | mysql -u root -p mysql
systemctl restart mariadb

# Télécharger GLPI (vérifier la dernière version sur GitHub)
GLPI_VERSION=10.0.17
wget https://github.com/glpi-project/glpi/releases/download/${GLPI_VERSION}/glpi-${GLPI_VERSION}.tgz -O /tmp/glpi.tgz
tar -xzf /tmp/glpi.tgz -C /var/www/html/

# Bonne pratique GLPI 10 : déplacer données sensibles hors webroot
mkdir -p /var/lib/glpi/{files,log,config}
mkdir -p /var/log/glpi
mv /var/www/html/glpi/files /var/lib/glpi/
mv /var/www/html/glpi/config /var/lib/glpi/

# Fichier de redirection vers les nouveaux chemins
cat > /var/www/html/glpi/config/local_define.php << 'EOF'
<?php
define('GLPI_VAR_DIR',    '/var/lib/glpi/files');
define('GLPI_LOG_DIR',    '/var/log/glpi');
define('GLPI_CONFIG_DIR', '/var/lib/glpi/config');
EOF

# Permissions correctes
chown -R www-data:www-data /var/www/html/glpi /var/lib/glpi /var/log/glpi
chmod -R 755 /var/www/html/glpi
chmod -R 775 /var/lib/glpi /var/log/glpi

<VirtualHost *:80>
    ServerName glpi.entreprise.local
    DocumentRoot /var/www/html/glpi/public

    <Directory /var/www/html/glpi/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted

        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteRule ^(.*)$ index.php [QSA,L]
    </Directory>

    ErrorLog  ${APACHE_LOG_DIR}/glpi_error.log
    CustomLog ${APACHE_LOG_DIR}/glpi_access.log combined
</VirtualHost>

a2ensite glpi.conf
a2dissite 000-default.conf
apache2ctl configtest   # Vérifier la syntaxe
systemctl reload apache2

cd /var/www/html/glpi

php bin/console db:install \
  --db-host=localhost \
  --db-name=glpi \
  --db-user=glpi_user \
  --db-password='GlpiP@ssw0rd!' \
  --no-interaction

# OBLIGATOIRE : supprimer le dossier install après l'installation !
rm -rf /var/www/html/glpi/install/

# Cron GLPI — tâches automatiques toutes les 2 minutes
echo "*/2 * * * * www-data php /var/www/html/glpi/front/cron.php" > /etc/cron.d/glpi

# SSL Let's Encrypt (si accessible depuis internet)
apt install -y certbot python3-certbot-apache
certbot --apache -d glpi.exemple.com

# Ou certificat auto-signé pour usage interne
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout /etc/ssl/private/glpi.key \
  -out /etc/ssl/certs/glpi.crt \
  -subj "/CN=glpi.entreprise.local/O=MonEntreprise/C=FR"

# Firewall : n'autoriser que HTTP et HTTPS
ufw allow 80/tcp && ufw allow 443/tcp && ufw enable

# Sauvegarde automatique de la base GLPI
cat > /usr/local/bin/backup-glpi.sh << 'EOF'
#!/bin/bash
DATE=$(date +%Y%m%d_%H%M)
mysqldump -u glpi_user -p'GlpiP@ssw0rd!' glpi | gzip > /backup/glpi_${DATE}.sql.gz
find /backup -name "glpi_*.sql.gz" -mtime +30 -delete
EOF
chmod +x /usr/local/bin/backup-glpi.sh
echo "0 2 * * * root /usr/local/bin/backup-glpi.sh" > /etc/cron.d/glpi-backup