diff --git a/.github/workflows/updater.sh b/.github/workflows/updater.sh new file mode 100644 index 0000000..7323a69 --- /dev/null +++ b/.github/workflows/updater.sh @@ -0,0 +1,138 @@ +#!/bin/bash + +#================================================= +# PACKAGE UPDATING HELPER +#================================================= + +# This script is meant to be run by GitHub Actions +# The YunoHost-Apps organisation offers a template Action to run this script periodically +# Since each app is different, maintainers can adapt its contents so as to perform +# automatic actions when a new upstream release is detected. + +# Remove this exit command when you are ready to run this Action +#exit 1 + +#================================================= +# FETCHING LATEST RELEASE AND ITS ASSETS +#================================================= + +# Fetching information +current_version=$(cat manifest.json | jq -j '.version|split("~")[0]') +repo=$(cat manifest.json | jq -j '.upstream.code|split("https://github.com/")[1]') +# Some jq magic is needed, because the latest upstream release is not always the latest version (e.g. security patches for older versions) +version=$(curl --silent "https://api.github.com/repos/$repo/releases" | jq -r '.[] | select( .prerelease != true ) | .tag_name' | sort -V | tail -1) +assets=($(curl --silent "https://api.github.com/repos/$repo/releases" | jq -r '[ .[] | select(.tag_name=="'$version'").assets[].browser_download_url ] | join(" ") | @sh' | tr -d "'")) + +if [[ ${version:0:1} == "v" || ${version:0:1} == "V" ]]; then + version=${version:1} +fi + +# Setting up the environment variables +echo "Current version: $current_version" +echo "Latest release from upstream: $version" +echo "VERSION=$version" >> $GITHUB_ENV +# For the time being, let's assume the script will fail +echo "PROCEED=false" >> $GITHUB_ENV + +# Proceed only if the retrieved version is greater than the current one +if ! dpkg --compare-versions "$current_version" "lt" "$version" ; then + echo "::warning ::No new version available" + exit 0 +# Proceed only if a PR for this new version does not already exist +elif git ls-remote -q --exit-code --heads https://github.com/$GITHUB_REPOSITORY.git ci-auto-update-v$version ; then + echo "::warning ::A branch already exists for this update" + exit 0 +fi + +# Each release can hold multiple assets (e.g. binaries for different architectures, source code, etc.) +echo "${#assets[@]} available asset(s)" + +#================================================= +# UPDATE SOURCE FILES +#================================================= + +# Here we use the $assets variable to get the resources published in the upstream release. +# Here is an example for Grav, it has to be adapted in accordance with how the upstream releases look like. + +# Let's loop over the array of assets URLs +for asset_url in ${assets[@]}; do + +echo "Handling asset at $asset_url" + +# Assign the asset to a source file in conf/ directory +# Here we base the source file name upon a unique keyword in the assets url (admin vs. update) +# Leave $src empty to ignore the asset +case $asset_url in + *"dispatch_"*"_linux_armv64.tar.gz"*) + src="arm64" + ;; + *"dispatch_"*"_linux_armv6.tar.gz"*) + src="armv6" + ;; + *"dispatch_"*"_linux_armv7.tar.gz"*) + src="armv7" + ;; + *"dispatch_"*"_linux_x64.tar.gz"*) + src="x86-64" + ;; +esac + +# If $src is not empty, let's process the asset +if [ ! -z "$src" ]; then + +# Create the temporary directory +tempdir="$(mktemp -d)" + +# Download sources and calculate checksum +filename=${asset_url##*/} +curl --silent -4 -L $asset_url -o "$tempdir/$filename" +checksum=$(sha256sum "$tempdir/$filename" | head -c 64) + +# Delete temporary directory +rm -rf $tempdir + +# Get extension +if [[ $filename == *.tar.gz ]]; then + extension=tar.gz +else + extension=${filename##*.} +fi + +# Rewrite source file +cat < conf/$src.src +SOURCE_URL=$asset_url +SOURCE_SUM=$checksum +SOURCE_SUM_PRG=sha256sum +SOURCE_FORMAT=$extension +SOURCE_IN_SUBDIR=false +EOT +echo "... conf/$src.src updated" + +else +echo "... asset ignored" +fi + +done + +#================================================= +# SPECIFIC UPDATE STEPS +#================================================= + +# Any action on the app's source code can be done. +# The GitHub Action workflow takes care of committing all changes after this script ends. + +#================================================= +# GENERIC FINALIZATION +#================================================= + +# Install moreutils, needed for sponge +sudo apt-get install moreutils + +# Replace new version in manifest +echo "$(jq -s --indent 4 ".[] | .version = \"$version~ynh1\"" manifest.json)" > manifest.json + +# No need to update the README, yunohost-bot takes care of it + +# The Action will proceed only if the PROCEED environment variable is set to true +echo "PROCEED=true" >> $GITHUB_ENV +exit 0 diff --git a/.github/workflows/updater.yml b/.github/workflows/updater.yml new file mode 100644 index 0000000..ca77fed --- /dev/null +++ b/.github/workflows/updater.yml @@ -0,0 +1,48 @@ +# This workflow allows GitHub Actions to automagically update your app whenever a new upstream release is detected. +# You need to enable Actions in your repository settings, and fetch this Action from the YunoHost-Apps organization. +# This file should be enough by itself, but feel free to tune it to your needs. +# It calls updater.sh, which is where you should put the app-specific update steps. +name: Check for new upstream releases +on: + # Allow to manually trigger the workflow + workflow_dispatch: + # Run it every day at 6:00 UTC + schedule: + - cron: '0 6 * * *' +jobs: + updater: + runs-on: ubuntu-latest + steps: + - name: Fetch the source code + uses: actions/checkout@v2 + with: + token: ${{ secrets.GITHUB_TOKEN }} + - name: Run the updater script + id: run_updater + run: | + # Setting up Git user + git config --global user.name 'yunohost-bot' + git config --global user.email 'yunohost-bot@users.noreply.github.com' + # Run the updater script + /bin/bash .github/workflows/updater.sh + - name: Commit changes + id: commit + if: ${{ env.PROCEED == 'true' }} + run: | + git commit -am "Upgrade to v$VERSION" + - name: Create Pull Request + id: cpr + if: ${{ env.PROCEED == 'true' }} + uses: peter-evans/create-pull-request@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + commit-message: Update to version ${{ env.VERSION }} + committer: 'yunohost-bot ' + author: 'yunohost-bot ' + signoff: false + branch: ci-auto-update-v${{ env.VERSION }} + delete-branch: true + title: 'Upgrade to version ${{ env.VERSION }}' + body: | + Upgrade to v${{ env.VERSION }} + draft: false diff --git a/check_process b/check_process index 2d042c8..2212ec3 100644 --- a/check_process +++ b/check_process @@ -2,10 +2,13 @@ ; Manifest domain="domain.tld" path="/path" + admin="john" + language="fr" is_public=1 + password="pass" ; Checks pkg_linter=1 - setup_sub_dir=0 + setup_sub_dir=1 setup_root=1 setup_nourl=0 setup_private=1 @@ -17,4 +20,8 @@ change_url=1 ;;; Options Email= -Notification=none \ No newline at end of file +Notification=none +;;; Upgrade options + ; commit=CommitHash + name=Name and date of the commit. + manifest_arg=domain=DOMAIN&path=PATH&admin=USER&language=fr&is_public=1&password=pass&port=666& \ No newline at end of file diff --git a/conf/arm64.src b/conf/arm64.src index 3fa311e..bb00d6c 100644 --- a/conf/arm64.src +++ b/conf/arm64.src @@ -3,4 +3,3 @@ SOURCE_SUM= SOURCE_SUM_PRG=sha256sum SOURCE_FORMAT=tar.gz SOURCE_IN_SUBDIR=false -SOURCE_FILENAME= \ No newline at end of file diff --git a/conf/armv6.src b/conf/armv6.src index 025618d..ccf2df4 100644 --- a/conf/armv6.src +++ b/conf/armv6.src @@ -3,4 +3,3 @@ SOURCE_SUM= SOURCE_SUM_PRG=sha256sum SOURCE_FORMAT=tar.gz SOURCE_IN_SUBDIR=false -SOURCE_FILENAME= \ No newline at end of file diff --git a/conf/armv7.src b/conf/armv7.src index d45d5c8..c5d60d3 100644 --- a/conf/armv7.src +++ b/conf/armv7.src @@ -3,4 +3,3 @@ SOURCE_SUM=07c678c29dea633fe7e372c48cebe1876bfc43b0f7abbd88a55318587994750c SOURCE_SUM_PRG=sha256sum SOURCE_FORMAT=tar.gz SOURCE_IN_SUBDIR=false -SOURCE_FILENAME= \ No newline at end of file diff --git a/conf/config.default.toml b/conf/config.default.toml index 0b30d7b..0f34137 100644 --- a/conf/config.default.toml +++ b/conf/config.default.toml @@ -1,5 +1,5 @@ # IP address to listen on, leave empty to listen on anything -address = "127.0.0.1" +address = "" port = __PORT__ # Run ident daemon on port 113 identd = true @@ -83,10 +83,10 @@ delete_after = "30m" [proxy] # Dispatch will make all outgoing connections through the specified proxy when enabled -enabled = false +enabled = true protocol = "socks5" host = "127.0.0.1" -port = 1080 +port = __PORT__ username = "" password = "" diff --git a/conf/nginx.conf b/conf/nginx.conf index 0119228..7b4d98f 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -5,15 +5,11 @@ location / { rewrite ^ https://$server_name$request_uri? permanent; } - proxy_pass http://127.0.0.1:__PORT__/; - proxy_redirect off; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Host $server_name; - + proxy_pass http://127.0.0.1:__PORT__/; proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header Host $host; + } diff --git a/conf/systemd.service b/conf/systemd.service index 1bcd5fc..faef750 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -7,7 +7,41 @@ Type=simple User=__APP__ Group=__APP__ WorkingDirectory=__FINALPATH__/ -ExecStart=__FINALPATH__/dispatch +ExecStart=__FINALPATH__/dispatch -a 127.0.0.1 -p __PORT__ +Restart=on-failure +RestartSec=5 +StartLimitInterval=60s +StartLimitBurst=3 + +# Sandboxing options to harden security +# Depending on specificities of your service/app, you may need to tweak these +# .. but this should be a good baseline +# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +DevicePolicy=closed +ProtectSystem=full +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +LockPersonality=yes +SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap + +# Denying access to capabilities that should not be relevant for webapps +# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html +CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM +CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE +CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG [Install] WantedBy=multi-user.target diff --git a/conf/x86-64.src b/conf/x86-64.src index e3ff6ad..73af6d5 100644 --- a/conf/x86-64.src +++ b/conf/x86-64.src @@ -3,4 +3,3 @@ SOURCE_SUM=7a94cb965de08919a32523116265e7facb69deaa6cfc916adbb34f4083f9e1d9 SOURCE_SUM_PRG=sha256sum SOURCE_FORMAT=tar.gz SOURCE_IN_SUBDIR=false -SOURCE_FILENAME= \ No newline at end of file diff --git a/manifest.json b/manifest.json index 05683f4..fbbda34 100644 --- a/manifest.json +++ b/manifest.json @@ -15,7 +15,7 @@ }, "license": "AGPL-3.0-only", "maintainer": { - "name": "" + "name": "eric_G" }, "requirements": { "yunohost": ">= 4.2.4" @@ -28,8 +28,7 @@ "install" : [ { "name": "domain", - "type": "domain", - "example": "domain.org" + "type": "domain" }, { "name": "is_public", diff --git a/scripts/install b/scripts/install index 982934a..800e1ab 100644 --- a/scripts/install +++ b/scripts/install @@ -105,7 +105,7 @@ ynh_add_systemd_config #================================================= ynh_script_progression --message="Integrating service in YunoHost..." --weight=1 -yunohost service add $app --description="Web-based IRC client in Go" --log="/var/log/$app/$app.log" +yunohost service add $app --description="Web-based IRC client" --log="/var/log/$app/$app.log" #================================================= # START SYSTEMD SERVICE @@ -113,9 +113,7 @@ yunohost service add $app --description="Web-based IRC client in Go" --log="/var ynh_script_progression --message="Starting a systemd service..." --weight=2 # Start a systemd service -ynh_systemd_action --service_name=$app --action=start --log_path="systemd" - -#sleep 60 +ynh_systemd_action --service_name=$app --action=start --log_path="systemd" --line_match="Listening on port" #================================================= # SETUP SSOWAT diff --git a/scripts/restore b/scripts/restore index 816553c..d875358 100644 --- a/scripts/restore +++ b/scripts/restore @@ -81,14 +81,14 @@ systemctl enable $app.service --quiet #================================================= ynh_script_progression --message="Integrating service in YunoHost..." -yunohost service add $app --description="Web-based IRC client in Go" --log="/var/log/$app/$app.log" +yunohost service add $app --description="Web-based IRC client" --log="/var/log/$app/$app.log" #================================================= # START SYSTEMD SERVICE #================================================= ynh_script_progression --message="Starting a systemd service..." --weight=1 -ynh_systemd_action --service_name=$app --action=start --log_path=systemd +ynh_systemd_action --service_name=$app --action=start --log_path=systemd --line_match="Listening on port" #================================================= # GENERIC FINALIZATION diff --git a/scripts/upgrade b/scripts/upgrade index b51807a..f943ce1 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -109,14 +109,14 @@ ynh_add_systemd_config #================================================= ynh_script_progression --message="Integrating service in YunoHost..." -yunohost service add $app --description="Web-based IRC client in Go" --log="/var/log/$app/$app.log" +yunohost service add $app --description="Web-based IRC client" --log="/var/log/$app/$app.log" #================================================= # START SYSTEMD SERVICE #================================================= ynh_script_progression --message="Starting a systemd service..." --weight=1 -ynh_systemd_action --service_name=$app --action=start --log_path=systemd +ynh_systemd_action --service_name=$app --action=start --log_path=systemd --line_match="Listening on port" #================================================= # RELOAD NGINX