first commit

conf/nginx.conf

@@ -0,0 +1,16 @@
+#sub_path_only rewrite ^__PATH__$ __PATH__/ permanent;
+location __PATH__/ {
+
+  client_max_body_size 10M;
+
+  proxy_pass http://127.0.0.1:__PORT__;
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection "Upgrade";
+
+  # preserve client IP
+  proxy_set_header X-Forwarded-For $remote_addr;
+
+  # Include SSOWAT user panel's shortcut tile.
+  include conf.d/yunohost_panel.conf.inc;
+}

conf/systemd.service

@@ -0,0 +1,52 @@
+[Unit]
+Description=Service for Diacamma (__APP__)
+After=network.target
+
+[Service]
+Type=simple
+User=__APP__
+Group=__APP__
+
+WorkingDirectory=__INSTALL_DIR__/
+ExecStart=
+StandardOutput=append:/var/log/__APP__/__APP__.log
+StandardError=inherit
+Restart=on-failure
+RestartSec=10
+
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap @cpu-emulation @privileged
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
+
+[Install]
+WantedBy=multi-user.target

manifest.toml

@@ -0,0 +1,92 @@
+packaging_format = 2
+
+id = "diacamma"
+name = "Diacamma"
+
+description.en = "Management application for volunteers (association, condominium)"
+description.fr = "Application de gestion pour les bénévoles (association, copropriété)"
+
+version = "23.10.25.13~ynh1"
+
+maintainers = ["Laurent Gay"]
+
+[upstream]
+license = "GNU General Public License v3.0"
+website = "https://www.diacamma.org"
+
+code = "https://github.com/Diacamma2/"
+
+[integration]
+yunohost = '>= 11.2'
+# List of supported archs using the dpkg --print-architecture nomenclature (amd64/i386/armhf/arm64), for example: ["amd64", "i386']
+architectures = "all" # TODO : handle the "all" option (no ["all"])
+multi_instance = true
+ldap = false
+sso = false
+disk = "50M"
+ram.build = "50M"
+ram.runtime = "50M"
+
+[install]
+
+    [install.domain]
+    # this is a generic question - ask strings are automatically handled by YunoHost's core
+    type = "domain"
+
+    [install.path]
+    # this is a generic question - ask strings are automatically handled by YunoHost's core
+    type = "path"
+    default = "/diacamma"
+
+    [install.init_main_permission]
+    # this is a generic question - ask strings are automatically handled by YunoHost's core
+    # This won't be saved as setting and will instead be used to initialize the SSOwat permission
+    type = "group"
+    default = "visitors"
+
+    [install.lct_appli]
+    ask.en = "Application"
+    help.en = "What application do you want to install?"
+    ask.fr = "Application"
+    help.fr = "Quelle application voulez-vous installer ?"
+    type = "string"
+    choices.asso = "Asso"
+    choices.syndic = "Syndic"
+    
+    [install.language]
+    ask.en = "Choose the application language"
+    ask.fr = "Choisissez la langue de l'application"
+    type = "select"
+    choices = ["en","fr"]
+
+[resources]
+    # See the packaging documentation for the full set
+    # of explanation regarding the behavior and properties for each of those
+    # https://yunohost.org/packaging_apps_resources
+
+    [resources.system_user]
+    # This will provision/deprovision a unix system user
+
+    [resources.install_dir]
+    # This will create/remove the install dir as /var/www/$app
+    # and store the corresponding setting $install_dir
+
+    [resources.data_dir]
+    # This will create/remove the data dir as /home/yunohost.app/$app
+    # and store the corresponding setting $data_dir
+
+    [resources.permissions]
+    # This will configure SSOwat permission for $domain/$path/
+    # The initial allowed group of user is configured via the init_main_permission question (public=visitors, private=all_users)
+    main.url = "/"
+
+    [resources.apt]
+    packages = "libxml2-dev,libxslt-dev,libjpeg-dev,libfreetype6,libfreetype6-dev,zlib1g-dev,python3-pip,python3-dev,python3-tk,python3-pil,python3-dev,build-essential,pkg-config"
+
+    [resources.ports]
+    # This will pick a random port for reverse-proxying and store it as the $port setting
+    [resources.database]
+    # This will automatically provision/deprovison a database and store the corresponding credentials in settings $db_user, $db_name, $db_pwd
+    type = "postgresql"
+
+    

scripts/_common.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+#=================================================
+# COMMON VARIABLES
+#=================================================
+
+#=================================================
+# PERSONAL HELPERS
+#=================================================

scripts/backup

@@ -0,0 +1,54 @@
+#!/bin/bash
+#### App file generated with YoloGen, the YunoHost app generator, version .
+# This is the tutorial version of the app.
+# It contains extra commands to explain what should be done in case you want to adjust some part of the script.
+# Once you are done, you may remove them.
+
+#=================================================
+# GENERIC START
+#=================================================
+# IMPORT GENERIC HELPERS
+#=================================================
+
+# Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
+source ../settings/scripts/_common.sh
+source /usr/share/yunohost/helpers
+
+#=================================================
+# DECLARE DATA AND CONF FILES TO BACKUP
+#=================================================
+ynh_print_info --message="Declaring files to be backed up..."
+
+### N.B. : the following 'ynh_backup' calls are only a *declaration* of what needs
+### to be backuped and not an actual copy of any file. The actual backup that
+### creates and fill the archive with the files happens in the core after this
+### script is called. Hence ynh_backups calls takes basically 0 seconds to run.
+
+ynh_backup --src_path="$install_dir"
+
+# The --is_big parameters ensure this folder is not included in the backup by default (taking less space), except if BACKUP_CORE_ONLY=0 is passed before the backup command. You might want to document that for your users.
+
+ynh_backup --src_path="$data_dir" --is_big
+
+ynh_backup --src_path="/etc/nginx/conf.d/$domain.d/$app.conf"
+
+ynh_backup --src_path="/etc/fail2ban/jail.d/$app.conf"
+ynh_backup --src_path="/etc/fail2ban/filter.d/$app.conf"
+
+ynh_backup --src_path="/etc/logrotate.d/$app"
+
+ynh_backup --src_path="/etc/systemd/system/$app.service"
+
+#=================================================
+# BACKUP THE DATABASE
+#=================================================
+ynh_print_info --message="Backing up the postgresql database..."
+
+### (However, things like MySQL dumps *do* take some time to run, though the
+### copy of the generated dump to the archive still happens later)
+
+#=================================================
+# END OF SCRIPT
+#=================================================
+
+ynh_print_info --message="Backup script completed for $app. (YunoHost will then actually copy those files to the archive)."

scripts/change_url

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# This is the tutorial version of the app.
+# It contains extra commands to explain what should be done in case you want to adjust some part of the script.
+# Once you are done, you may remove them.
+
+#=================================================
+# GENERIC STARTING
+#=================================================
+# IMPORT GENERIC HELPERS
+#=================================================
+
+source _common.sh
+source /usr/share/yunohost/helpers
+
+#=================================================
+# STOP SYSTEMD SERVICE
+#=================================================
+ynh_script_progression --message="Stopping a systemd service..."
+
+ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
+
+#=================================================
+# MODIFY URL IN NGINX CONF
+#=================================================
+ynh_script_progression --message="Updating NGINX web server configuration..."
+
+ynh_change_url_nginx_config
+
+#=================================================
+# SPECIFIC MODIFICATIONS
+#=================================================
+# ...
+#=================================================
+
+#=================================================
+# START SYSTEMD SERVICE
+#=================================================
+ynh_script_progression --message="Starting a systemd service..."
+
+ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log"
+
+#=================================================
+# END OF SCRIPT
+#=================================================
+
+ynh_script_progression --message="Change of URL completed for $app" --last

scripts/install

@@ -0,0 +1,80 @@
+#!/bin/bash
+
+source _common.sh
+source /usr/share/yunohost/helpers
+
+#=================================================
+# INSTALL APP
+#=================================================
+ynh_script_progression --message="Installing app..." --weight=5
+
+pushd $install_dir
+APPLITYPE="lucterios.standard"
+MODULES="lucterios lucterios-standard lucterios-contacts lucterios-documents"
+DATABASE="postgresql:name=$db_name,user=$db_user,password=$db_pwd,host=localhost"
+if [ "$lct_appli" == "asso" ]
+then
+    MODULES="lucterios.contacts,lucterios.documents,lucterios.mailing,diacamma.member,diacamma.event,diacamma.accounting,diacamma.invoice,diacamma.payoff"
+    APPLITYPE="diacamma.asso"
+fi
+if [ "$lct_appli" == "syndic" ]
+then
+    MODULES="lucterios.contacts,lucterios.documents,lucterios.mailing,diacamma.member,diacamma.event,diacamma.accounting,diacamma.invoice,diacamma.payoff"
+    APPLITYPE="diacamma.syndic"
+fi
+python3 -m venv venv
+venv/bin/pip3 install -U lucterios lucterios-standard lucterios-contacts lucterios-documents diacamma-asso diacamma-syndic diacamma-financial gunicorn psycopg2-binary psycopg2
+venv/bin/python -m lucterios.install.lucterios_admin add -n ${app} -p $APPLITYPE -m $MODULES -d $DATABASE -e '{}'
+
+venv/bin/python manage_${app}.py collectstatic --noinput -l
+rm -rf ${app}/static/static
+rm -rf ${app}/static/plugins
+rm -rf ${app}/static/tmp
+rm -rf ${app}/static/archives
+rm -rf ${app}/static/usr
+rm -rf ${app}/static/__pycache__
+rm -rf ${app}/static/settings.py
+rm -rf ${app}/static/django_error.log
+rm -rf ${app}/static/__init__.py
+
+popd
+
+chmod 400 "$install_dir/"
+chown ${app}:${app} "$install_dir/"
+
+#=================================================
+# SYSTEM CONFIGURATION
+#=================================================
+ynh_script_progression --message="Adding system configurations related to ${app}..."
+
+# Create a dedicated NGINX config using the conf/nginx.conf template
+ynh_add_nginx_config
+
+### `ynh_systemd_config` is used to configure a systemd script for an app, using the conf/systemd.service template
+
+# Create a dedicated systemd config
+ynh_add_systemd_config
+
+### `yunohost service add` integrates a service in YunoHost. It then gets
+### displayed in the admin interface and through the others `yunohost service` commands.
+
+yunohost service add ${app} --log="/var/log/${app}/${app}.log"
+
+# Use logrotate to manage application logfile(s)
+ynh_use_logrotate
+
+# Create a dedicated Fail2Ban config
+ynh_add_fail2ban_config --logpath="/var/log/nginx/${domain}-error.log" --failregex=""
+
+#=================================================
+# START SYSTEMD SERVICE
+#=================================================
+ynh_script_progression --message="Starting app's systemd service..."
+
+# Start a systemd service
+ynh_systemd_action --service_name=${app} --action="start" --log_path="/var/log/${app}/${app}.log"
+
+#=================================================
+# END OF SCRIPT
+#=================================================
+ynh_script_progression --message="Installation of ${app} completed" --last

scripts/remove

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# This is the tutorial version of the app.
+# It contains extra commands to explain what should be done in case you want to adjust some part of the script.
+# Once you are done, you may remove them.
+
+#=================================================
+# GENERIC START
+#=================================================
+# IMPORT GENERIC HELPERS
+#=================================================
+source _common.sh
+source /usr/share/yunohost/helpers
+
+# Settings are automatically loaded as bash variables
+# in every app script context, therefore typically these will exist:
+# - $domain
+# - $path
+# - $language
+# - $install_dir
+# - $port
+# ...
+
+# For remove operations :
+# - the core will deprovision every resource defined in the manifest **after** this script is ran
+# this includes removing the install directory, and data directory (if --purge was used)
+
+#=================================================
+# REMOVE SYSTEM CONFIGURATIONS
+#=================================================
+# REMOVE SYSTEMD SERVICE
+#=================================================
+ynh_script_progression --message="Removing system configurations related to $app..."
+
+# This should be a symetric version of what happens in the install script
+
+# Remove the service from the list of services known by YunoHost (added from `yunohost service add`)
+if ynh_exec_warn_less yunohost service status $app >/dev/null
+then
+	ynh_script_progression --message="Removing $app service integration..."
+	yunohost service remove $app
+fi
+
+ynh_remove_systemd_config
+
+ynh_remove_nginx_config
+
+ynh_remove_logrotate
+
+ynh_remove_fail2ban_config
+
+# Remove other various files specific to the app... such as :
+
+ynh_secure_remove --file="/var/log/$app"
+
+#=================================================
+# END OF SCRIPT
+#=================================================
+
+ynh_script_progression --message="Removal of $app completed" --last

scripts/restore

@@ -0,0 +1,84 @@
+#!/bin/bash
+
+# This is the tutorial version of the app.
+# It contains extra commands to explain what should be done in case you want to adjust some part of the script.
+# Once you are done, you may remove them.
+
+#=================================================
+# GENERIC START
+#=================================================
+# IMPORT GENERIC HELPERS
+#=================================================
+
+# Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
+source ../settings/scripts/_common.sh
+source /usr/share/yunohost/helpers
+
+#=================================================
+# RESTORE THE APP MAIN DIR
+#=================================================
+ynh_script_progression --message="Restoring the app main directory..." --weight=1
+
+ynh_restore_file --origin_path="$install_dir"
+
+# $install_dir will automatically be initialized with some decent
+# permission by default ... however, you may need to recursively reapply
+# ownership to all files such as after the ynh_setup_source step
+
+chown -R $app:www-data "$install_dir"
+
+#=================================================
+# RESTORE THE DATA DIRECTORY
+#=================================================
+ynh_script_progression --message="Restoring the data directory..." --weight=1
+
+ynh_restore_file --origin_path="$data_dir" --not_mandatory
+
+# (Same as for install dir)
+chown -R $app:www-data "$data_dir"
+
+#=================================================
+# RESTORE THE MYSQL DATABASE
+#=================================================
+
+ynh_script_progression --message="Restoring the PostgreSQL database..." --weight=1
+
+ynh_psql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < ./db.sql
+
+#=================================================
+# RESTORE SYSTEM CONFIGURATIONS
+#=================================================
+ynh_script_progression --message="Restoring system configurations related to $app..." --weight=1
+
+# This should be a symetric version of what happens in the install script
+
+ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
+
+ynh_restore_file --origin_path="/etc/systemd/system/$app.service"
+systemctl enable $app.service --quiet
+
+yunohost service add $app --log="/var/log/$app/$app.log"
+
+ynh_restore_file --origin_path="/etc/logrotate.d/$app"
+
+ynh_restore_file --origin_path="/etc/fail2ban/jail.d/$app.conf"
+ynh_restore_file --origin_path="/etc/fail2ban/filter.d/$app.conf"
+ynh_systemd_action --action=restart --service_name=fail2ban
+
+# Other various files...
+
+#=================================================
+# RELOAD NGINX AND PHP-FPM OR THE APP SERVICE
+#=================================================
+ynh_script_progression --message="Reloading NGINX web server and $app's service..." --weight=1
+
+# Typically you only have either $app or php-fpm but not both at the same time...
+ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log"
+
+ynh_systemd_action --service_name=nginx --action=reload
+
+#=================================================
+# END OF SCRIPT
+#=================================================
+
+ynh_script_progression --message="Restoration completed for $app" --last

scripts/upgrade

@@ -0,0 +1,147 @@
+#!/bin/bash
+
+# This is the tutorial version of the app.
+# It contains extra commands to explain what should be done in case you want to adjust some part of the script.
+# Once you are done, you may remove them.
+
+#=================================================
+# GENERIC START
+#=================================================
+# IMPORT GENERIC HELPERS
+#=================================================
+
+source _common.sh
+source /usr/share/yunohost/helpers
+
+# Settings are automatically loaded as bash variables
+# in every app script context, therefore typically these will exist:
+# - $domain
+# - $path
+# - $language
+# - $install_dir
+# - $port
+# ...
+
+# In the context of upgrade,
+# - resources are automatically provisioned / updated / deleted (depending on existing resources)
+# - a safety backup is automatically created by the core and will be restored if the upgrade fails
+
+### This helper will compare the version of the currently installed app and the version of the upstream package.
+### $upgrade_type can have 2 different values
+### - UPGRADE_APP if the upstream app version has changed
+### - UPGRADE_PACKAGE if only the YunoHost package has changed
+### ynh_check_app_version_changed will stop the upgrade if the app is up to date.
+### UPGRADE_APP should be used to upgrade the core app only if there's an upgrade to do.
+
+upgrade_type=$(ynh_check_app_version_changed)
+
+#=================================================
+# STANDARD UPGRADE STEPS
+#=================================================
+# ENSURE DOWNWARD COMPATIBILITY
+#=================================================
+#ynh_script_progression --message="Ensuring downward compatibility..."
+
+#
+# N.B. : the followings setting migrations snippets are provided as *EXAMPLES*
+# of what you may want to do in some cases (e.g. a setting was not defined on
+# some legacy installs and you therefore want to initialize stuff during upgrade)
+#
+
+# If db_name doesn't exist, create it
+#if [ -z "${db_name:-}" ]; then
+#	db_name=$(ynh_sanitize_dbid --db_name=$app)
+#	ynh_app_setting_set --app=$app --key=db_name --value=$db_name
+#fi
+
+# If install_dir doesn't exist, create it
+#if [ -z "${install_dir:-}" ]; then
+#	install_dir=/var/www/$app
+#	ynh_app_setting_set --app=$app --key=install_dir --value=$install_dir
+#fi
+
+#=================================================
+# STOP SYSTEMD SERVICE
+#=================================================
+ynh_script_progression --message="Stopping a systemd service..."
+
+ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
+
+#=================================================
+# "REBUILD" THE APP (DEPLOY NEW SOURCES, RERUN NPM BUILD...)
+#=================================================
+# DOWNLOAD, CHECK AND UNPACK SOURCE
+#=================================================
+
+if [ "$upgrade_type" == "UPGRADE_APP" ]
+then
+	ynh_script_progression --message="Upgrading source files..."
+
+	# Download, check integrity, uncompress and patch the source from app.src
+	ynh_setup_source --dest_dir="$install_dir"
+fi
+
+# $install_dir will automatically be initialized with some decent
+# permission by default ... however, you may need to recursively reapply
+# ownership to all files such as after the ynh_setup_source step
+
+chown -R $app:www-data "$install_dir"
+
+#=================================================
+# REAPPLY SYSTEM CONFIGURATIONS
+#=================================================
+ynh_script_progression --message="Upgrading system configurations related to $app..."
+
+# This should be a literal copypasta of what happened in the install's "System configuration" section
+
+ynh_add_nginx_config
+
+ynh_add_systemd_config
+
+yunohost service add $app --log="/var/log/$app/$app.log"
+
+ynh_use_logrotate --non-append
+
+# Create a dedicated Fail2Ban config
+ynh_add_fail2ban_config --logpath="/var/log/nginx/${domain}-error.log" --failregex=""
+
+#=================================================
+# RECONFIGURE THE APP (UPDATE CONF, APPLY MIGRATIONS...)
+#=================================================
+# UPDATE A CONFIG FILE
+#=================================================
+ynh_script_progression --message="Updating a configuration file..."
+
+### Same as during install
+###
+### The file will automatically be backed-up if it's found to be manually modified (because
+### ynh_add_config keeps track of the file's checksum)
+
+ynh_add_config --template="" --destination="$install_dir/"
+
+# FIXME: this should be handled by the core in the future
+# You may need to use chmod 600 instead of 400,
+# for example if the app is expected to be able to modify its own config
+
+chmod 400 "$install_dir/some_config_file"
+chown $app:$app "$install_dir/some_config_file"
+
+### For more complex cases where you want to replace stuff using regexes,
+### you shoud rely on ynh_replace_string (which is basically a wrapper for sed)
+### When doing so, you also need to manually call ynh_store_file_checksum
+###
+### ynh_replace_string --match_string="match_string" --replace_string="replace_string" --target_file="$install_dir/some_config_file"
+### ynh_store_file_checksum --file="$install_dir/some_config_file"
+
+#=================================================
+# START SYSTEMD SERVICE
+#=================================================
+ynh_script_progression --message="Starting a systemd service..."
+
+ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log"
+
+#=================================================
+# END OF SCRIPT
+#=================================================
+
+ynh_script_progression --message="Upgrade of $app completed" --last