Although Acquia maintains the core platform of Site Factory, you have the freedom to develop your websites to meet your specific needs, including selecting a Drupal distribution to use for the websites on your platform.

If you have some websites running different major versions of Drupal, and others requiring Drupal 7, you must manage them in separate Site Factory stacks. A single stack can only operate one major version of Drupal at a time. For more information, see Using Site Factory Stacks.

To ensure your websites using a custom distribution can communicate with Site Factory and the Site Factory Management Console, you must install the Acquia Connector module in your distribution’s code.

Planning for security with your custom Drupal distribution

Although Site Factory uses Drupal’s native multisite features for governance and resource efficiency, the distribution of Drupal used by Site Factory is ultimately your responsibility. You must remember your Site Factory-hosted websites will have separate databases, content, and user account—they are all in a single multi-tenant application. When granting Drupal users elevated platform admin or site builder permissions, these permissions may include permission to run PHP code using Drupal’s user interface, based on your configuration.

Acquia recommends the following security practices:

• Grant elevated permissions only to trusted developers on your team.

• When developing your distribution, ensure the standard user experience does not require elevated permissions.

• Never enable Drupal’s core PHP module.

• Follow Drupal best practices for writing secure code.

• Consider installing the Paranoia module, which provides safeguards against the injection of PHP code using Drupal’s user interface.

• Periodically compare your list of installed modules against the Paranoia module, and perform additional tests against the modules not covered by the Paranoia module. Evaluating your installed modules can ensure users cannot inject PHP code using the user interface.

Installing your distribution

To install a distribution that contains the current Drupal version in your Site Factory codebase and prepare it for use:

• Add your SSH key to Cloud Platform, and then clone the website’s code repository to your local machine.

• On your local machine, delete all files and subdirectories in the docroot directory you cloned from Site Factory. When removing its contents, don’t delete the actual docroot directory.

  You can run the following Git command from the docroot directory to remove the files:

  copy

  git rm -r * .htaccess .gitignore

  Do not run the previous Git command after you have installed your Drupal distribution in the docroot directory.

• Move your custom Drupal distribution into the now empty docroot directory.

  After moving the distribution, the docroot directory should contain the distribution’s index.php file, along with all other files and subdirectories.

• Install the Site Factory Connector module to your codebase as described in Updating with the acsf-init command.

• Ensure each of the following files can be read, written to, and executed by its owner, its group, and by other users:

  • hooks/common/pre-web-activate/000-acquia-deployment.php

  • hooks/common/post-db-copy/000-acquia_required_scrub.php

  To set the correct permissions on Unix-like operating systems, use a command like the following example:

  copy

  chmod 0755 [file names]

After installing your distribution, you must configure it for use.

Configuring your distribution

To configure a distribution that contains the current Drupal version for use with your websites, complete the following:

• Configure your installation profiles to require the module using the appropriate instruction by adding the following line to your profile’s installation profile file at profiles/[profilename]/[profilename].info.yml, where [profilename] is the name of your profile:

  - acsf

• Run the following Drush command from the docroot directory to initialize your custom distribution:

  copy

  drush --include=/path/to/acsf/acsf_init acsf-init

  Note

  This command does not bootstrap a Drupal website, so you must run it with the --include argument pointing to acsf/acsf_init/acsf_init.

  The previous Drush command creates several directories, and then copies files Site Factory requires for its tasks, including locating the correct database credentials.

• Run the following Drush command from the docroot directory to ensure everything is in order before you commit the custom distribution to the repository:

  copy

  drush --include=/path/to/acsf/acsf_init acsf-init-verify

  The command should return the following result:

  copy

  acsf-init required files ok

• to Site Factory.

Your new custom Drupal distribution is now configured and available for use.

Using the Drupal distribution

After installing and configuring your new Drupal distribution, website builders can select the distribution for their use when creating new websites. For more information about selecting your custom profile when creating a new Site Factory website, see Managing installation profiles in your Factory.

Building your Drupal distribution