mirror of
https://github.com/YunoHost-Apps/dispatch_ynh.git
synced 2024-09-03 18:25:53 +02:00
Éric Gaspar
GitHub
commit
fbb26d2b2b
14 changed files with 246 additions and 30 deletions
138
.github/workflows/updater.sh
vendored
Normal file
138
.github/workflows/updater.sh
vendored
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
#!/bin/bash
|
||||
|
||||
#=================================================
|
||||
# PACKAGE UPDATING HELPER
|
||||
#=================================================
|
||||
|
||||
# This script is meant to be run by GitHub Actions
|
||||
# The YunoHost-Apps organisation offers a template Action to run this script periodically
|
||||
# Since each app is different, maintainers can adapt its contents so as to perform
|
||||
# automatic actions when a new upstream release is detected.
|
||||
|
||||
# Remove this exit command when you are ready to run this Action
|
||||
#exit 1
|
||||
|
||||
#=================================================
|
||||
# FETCHING LATEST RELEASE AND ITS ASSETS
|
||||
#=================================================
|
||||
|
||||
# Fetching information
|
||||
current_version=$(cat manifest.json | jq -j '.version|split("~")[0]')
|
||||
repo=$(cat manifest.json | jq -j '.upstream.code|split("https://github.com/")[1]')
|
||||
# Some jq magic is needed, because the latest upstream release is not always the latest version (e.g. security patches for older versions)
|
||||
version=$(curl --silent "https://api.github.com/repos/$repo/releases" | jq -r '.[] | select( .prerelease != true ) | .tag_name' | sort -V | tail -1)
|
||||
assets=($(curl --silent "https://api.github.com/repos/$repo/releases" | jq -r '[ .[] | select(.tag_name=="'$version'").assets[].browser_download_url ] | join(" ") | @sh' | tr -d "'"))
|
||||
|
||||
if [[ ${version:0:1} == "v" || ${version:0:1} == "V" ]]; then
|
||||
version=${version:1}
|
||||
fi
|
||||
|
||||
# Setting up the environment variables
|
||||
echo "Current version: $current_version"
|
||||
echo "Latest release from upstream: $version"
|
||||
echo "VERSION=$version" >> $GITHUB_ENV
|
||||
# For the time being, let's assume the script will fail
|
||||
echo "PROCEED=false" >> $GITHUB_ENV
|
||||
|
||||
# Proceed only if the retrieved version is greater than the current one
|
||||
if ! dpkg --compare-versions "$current_version" "lt" "$version" ; then
|
||||
echo "::warning ::No new version available"
|
||||
exit 0
|
||||
# Proceed only if a PR for this new version does not already exist
|
||||
elif git ls-remote -q --exit-code --heads https://github.com/$GITHUB_REPOSITORY.git ci-auto-update-v$version ; then
|
||||
echo "::warning ::A branch already exists for this update"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Each release can hold multiple assets (e.g. binaries for different architectures, source code, etc.)
|
||||
echo "${#assets[@]} available asset(s)"
|
||||
|
||||
#=================================================
|
||||
# UPDATE SOURCE FILES
|
||||
#=================================================
|
||||
|
||||
# Here we use the $assets variable to get the resources published in the upstream release.
|
||||
# Here is an example for Grav, it has to be adapted in accordance with how the upstream releases look like.
|
||||
|
||||
# Let's loop over the array of assets URLs
|
||||
for asset_url in ${assets[@]}; do
|
||||
|
||||
echo "Handling asset at $asset_url"
|
||||
|
||||
# Assign the asset to a source file in conf/ directory
|
||||
# Here we base the source file name upon a unique keyword in the assets url (admin vs. update)
|
||||
# Leave $src empty to ignore the asset
|
||||
case $asset_url in
|
||||
*"dispatch_"*"_linux_armv64.tar.gz"*)
|
||||
src="arm64"
|
||||
;;
|
||||
*"dispatch_"*"_linux_armv6.tar.gz"*)
|
||||
src="armv6"
|
||||
;;
|
||||
*"dispatch_"*"_linux_armv7.tar.gz"*)
|
||||
src="armv7"
|
||||
;;
|
||||
*"dispatch_"*"_linux_x64.tar.gz"*)
|
||||
src="x86-64"
|
||||
;;
|
||||
esac
|
||||
|
||||
# If $src is not empty, let's process the asset
|
||||
if [ ! -z "$src" ]; then
|
||||
|
||||
# Create the temporary directory
|
||||
tempdir="$(mktemp -d)"
|
||||
|
||||
# Download sources and calculate checksum
|
||||
filename=${asset_url##*/}
|
||||
curl --silent -4 -L $asset_url -o "$tempdir/$filename"
|
||||
checksum=$(sha256sum "$tempdir/$filename" | head -c 64)
|
||||
|
||||
# Delete temporary directory
|
||||
rm -rf $tempdir
|
||||
|
||||
# Get extension
|
||||
if [[ $filename == *.tar.gz ]]; then
|
||||
extension=tar.gz
|
||||
else
|
||||
extension=${filename##*.}
|
||||
fi
|
||||
|
||||
# Rewrite source file
|
||||
cat <<EOT > conf/$src.src
|
||||
SOURCE_URL=$asset_url
|
||||
SOURCE_SUM=$checksum
|
||||
SOURCE_SUM_PRG=sha256sum
|
||||
SOURCE_FORMAT=$extension
|
||||
SOURCE_IN_SUBDIR=false
|
||||
EOT
|
||||
echo "... conf/$src.src updated"
|
||||
|
||||
else
|
||||
echo "... asset ignored"
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
#=================================================
|
||||
# SPECIFIC UPDATE STEPS
|
||||
#=================================================
|
||||
|
||||
# Any action on the app's source code can be done.
|
||||
# The GitHub Action workflow takes care of committing all changes after this script ends.
|
||||
|
||||
#=================================================
|
||||
# GENERIC FINALIZATION
|
||||
#=================================================
|
||||
|
||||
# Install moreutils, needed for sponge
|
||||
sudo apt-get install moreutils
|
||||
|
||||
# Replace new version in manifest
|
||||
echo "$(jq -s --indent 4 ".[] | .version = \"$version~ynh1\"" manifest.json)" > manifest.json
|
||||
|
||||
# No need to update the README, yunohost-bot takes care of it
|
||||
|
||||
# The Action will proceed only if the PROCEED environment variable is set to true
|
||||
echo "PROCEED=true" >> $GITHUB_ENV
|
||||
exit 0
|
||||
48
.github/workflows/updater.yml
vendored
Normal file
48
.github/workflows/updater.yml
vendored
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# This workflow allows GitHub Actions to automagically update your app whenever a new upstream release is detected.
|
||||
# You need to enable Actions in your repository settings, and fetch this Action from the YunoHost-Apps organization.
|
||||
# This file should be enough by itself, but feel free to tune it to your needs.
|
||||
# It calls updater.sh, which is where you should put the app-specific update steps.
|
||||
name: Check for new upstream releases
|
||||
on:
|
||||
# Allow to manually trigger the workflow
|
||||
workflow_dispatch:
|
||||
# Run it every day at 6:00 UTC
|
||||
schedule:
|
||||
- cron: '0 6 * * *'
|
||||
jobs:
|
||||
updater:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Fetch the source code
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Run the updater script
|
||||
id: run_updater
|
||||
run: |
|
||||
# Setting up Git user
|
||||
git config --global user.name 'yunohost-bot'
|
||||
git config --global user.email 'yunohost-bot@users.noreply.github.com'
|
||||
# Run the updater script
|
||||
/bin/bash .github/workflows/updater.sh
|
||||
- name: Commit changes
|
||||
id: commit
|
||||
if: ${{ env.PROCEED == 'true' }}
|
||||
run: |
|
||||
git commit -am "Upgrade to v$VERSION"
|
||||
- name: Create Pull Request
|
||||
id: cpr
|
||||
if: ${{ env.PROCEED == 'true' }}
|
||||
uses: peter-evans/create-pull-request@v3
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
commit-message: Update to version ${{ env.VERSION }}
|
||||
committer: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
|
||||
author: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
|
||||
signoff: false
|
||||
branch: ci-auto-update-v${{ env.VERSION }}
|
||||
delete-branch: true
|
||||
title: 'Upgrade to version ${{ env.VERSION }}'
|
||||
body: |
|
||||
Upgrade to v${{ env.VERSION }}
|
||||
draft: false
|
||||
|
|
@ -2,10 +2,13 @@
|
|||
; Manifest
|
||||
domain="domain.tld"
|
||||
path="/path"
|
||||
admin="john"
|
||||
language="fr"
|
||||
is_public=1
|
||||
password="pass"
|
||||
; Checks
|
||||
pkg_linter=1
|
||||
setup_sub_dir=0
|
||||
setup_sub_dir=1
|
||||
setup_root=1
|
||||
setup_nourl=0
|
||||
setup_private=1
|
||||
|
|
@ -18,3 +21,7 @@
|
|||
;;; Options
|
||||
Email=
|
||||
Notification=none
|
||||
;;; Upgrade options
|
||||
; commit=CommitHash
|
||||
name=Name and date of the commit.
|
||||
manifest_arg=domain=DOMAIN&path=PATH&admin=USER&language=fr&is_public=1&password=pass&port=666&
|
||||
|
|
@ -3,4 +3,3 @@ SOURCE_SUM=
|
|||
SOURCE_SUM_PRG=sha256sum
|
||||
SOURCE_FORMAT=tar.gz
|
||||
SOURCE_IN_SUBDIR=false
|
||||
SOURCE_FILENAME=
|
||||
|
|
@ -3,4 +3,3 @@ SOURCE_SUM=
|
|||
SOURCE_SUM_PRG=sha256sum
|
||||
SOURCE_FORMAT=tar.gz
|
||||
SOURCE_IN_SUBDIR=false
|
||||
SOURCE_FILENAME=
|
||||
|
|
@ -3,4 +3,3 @@ SOURCE_SUM=07c678c29dea633fe7e372c48cebe1876bfc43b0f7abbd88a55318587994750c
|
|||
SOURCE_SUM_PRG=sha256sum
|
||||
SOURCE_FORMAT=tar.gz
|
||||
SOURCE_IN_SUBDIR=false
|
||||
SOURCE_FILENAME=
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
# IP address to listen on, leave empty to listen on anything
|
||||
address = "127.0.0.1"
|
||||
address = ""
|
||||
port = __PORT__
|
||||
# Run ident daemon on port 113
|
||||
identd = true
|
||||
|
|
@ -83,10 +83,10 @@ delete_after = "30m"
|
|||
|
||||
[proxy]
|
||||
# Dispatch will make all outgoing connections through the specified proxy when enabled
|
||||
enabled = false
|
||||
enabled = true
|
||||
protocol = "socks5"
|
||||
host = "127.0.0.1"
|
||||
port = 1080
|
||||
port = __PORT__
|
||||
username = ""
|
||||
password = ""
|
||||
|
||||
|
|
|
|||
|
|
@ -5,15 +5,11 @@ location / {
|
|||
rewrite ^ https://$server_name$request_uri? permanent;
|
||||
}
|
||||
|
||||
proxy_pass http://127.0.0.1:__PORT__/;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $server_name;
|
||||
|
||||
proxy_pass http://127.0.0.1:__PORT__/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,41 @@ Type=simple
|
|||
User=__APP__
|
||||
Group=__APP__
|
||||
WorkingDirectory=__FINALPATH__/
|
||||
ExecStart=__FINALPATH__/dispatch
|
||||
ExecStart=__FINALPATH__/dispatch -a 127.0.0.1 -p __PORT__
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
StartLimitInterval=60s
|
||||
StartLimitBurst=3
|
||||
|
||||
# Sandboxing options to harden security
|
||||
# Depending on specificities of your service/app, you may need to tweak these
|
||||
# .. but this should be a good baseline
|
||||
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
PrivateDevices=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
DevicePolicy=closed
|
||||
ProtectSystem=full
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
LockPersonality=yes
|
||||
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
|
||||
|
||||
# Denying access to capabilities that should not be relevant for webapps
|
||||
# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
|
||||
CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
|
||||
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
||||
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
|
||||
CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
|
||||
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
|
||||
CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
|
||||
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
|
||||
CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
|
||||
CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
|
|||
|
|
@ -3,4 +3,3 @@ SOURCE_SUM=7a94cb965de08919a32523116265e7facb69deaa6cfc916adbb34f4083f9e1d9
|
|||
SOURCE_SUM_PRG=sha256sum
|
||||
SOURCE_FORMAT=tar.gz
|
||||
SOURCE_IN_SUBDIR=false
|
||||
SOURCE_FILENAME=
|
||||
|
|
@ -15,7 +15,7 @@
|
|||
},
|
||||
"license": "AGPL-3.0-only",
|
||||
"maintainer": {
|
||||
"name": ""
|
||||
"name": "eric_G"
|
||||
},
|
||||
"requirements": {
|
||||
"yunohost": ">= 4.2.4"
|
||||
|
|
@ -28,8 +28,7 @@
|
|||
"install" : [
|
||||
{
|
||||
"name": "domain",
|
||||
"type": "domain",
|
||||
"example": "domain.org"
|
||||
"type": "domain"
|
||||
},
|
||||
{
|
||||
"name": "is_public",
|
||||
|
|
|
|||
|
|
@ -105,7 +105,7 @@ ynh_add_systemd_config
|
|||
#=================================================
|
||||
ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
|
||||
|
||||
yunohost service add $app --description="Web-based IRC client in Go" --log="/var/log/$app/$app.log"
|
||||
yunohost service add $app --description="Web-based IRC client" --log="/var/log/$app/$app.log"
|
||||
|
||||
#=================================================
|
||||
# START SYSTEMD SERVICE
|
||||
|
|
@ -113,9 +113,7 @@ yunohost service add $app --description="Web-based IRC client in Go" --log="/var
|
|||
ynh_script_progression --message="Starting a systemd service..." --weight=2
|
||||
|
||||
# Start a systemd service
|
||||
ynh_systemd_action --service_name=$app --action=start --log_path="systemd"
|
||||
|
||||
#sleep 60
|
||||
ynh_systemd_action --service_name=$app --action=start --log_path="systemd" --line_match="Listening on port"
|
||||
|
||||
#=================================================
|
||||
# SETUP SSOWAT
|
||||
|
|
|
|||
|
|
@ -81,14 +81,14 @@ systemctl enable $app.service --quiet
|
|||
#=================================================
|
||||
ynh_script_progression --message="Integrating service in YunoHost..."
|
||||
|
||||
yunohost service add $app --description="Web-based IRC client in Go" --log="/var/log/$app/$app.log"
|
||||
yunohost service add $app --description="Web-based IRC client" --log="/var/log/$app/$app.log"
|
||||
|
||||
#=================================================
|
||||
# START SYSTEMD SERVICE
|
||||
#=================================================
|
||||
ynh_script_progression --message="Starting a systemd service..." --weight=1
|
||||
|
||||
ynh_systemd_action --service_name=$app --action=start --log_path=systemd
|
||||
ynh_systemd_action --service_name=$app --action=start --log_path=systemd --line_match="Listening on port"
|
||||
|
||||
#=================================================
|
||||
# GENERIC FINALIZATION
|
||||
|
|
|
|||
|
|
@ -109,14 +109,14 @@ ynh_add_systemd_config
|
|||
#=================================================
|
||||
ynh_script_progression --message="Integrating service in YunoHost..."
|
||||
|
||||
yunohost service add $app --description="Web-based IRC client in Go" --log="/var/log/$app/$app.log"
|
||||
yunohost service add $app --description="Web-based IRC client" --log="/var/log/$app/$app.log"
|
||||
|
||||
#=================================================
|
||||
# START SYSTEMD SERVICE
|
||||
#=================================================
|
||||
ynh_script_progression --message="Starting a systemd service..." --weight=1
|
||||
|
||||
ynh_systemd_action --service_name=$app --action=start --log_path=systemd
|
||||
ynh_systemd_action --service_name=$app --action=start --log_path=systemd --line_match="Listening on port"
|
||||
|
||||
#=================================================
|
||||
# RELOAD NGINX
|
||||
|
|
|
|||
Loading…
Reference in a new issue