Merge branch 'testing' into without-turn

.gitignore

@@ -0,0 +1,2 @@
+.DS_Store
+._.DS_Store

check_process

@@ -17,6 +17,7 @@
 		setup_private=1
 		setup_public=1
 		upgrade=1
+		upgrade=1	from_commit=c06f6235a93587e16524fa5b124e4d9e138a8109
 		backup_restore=1
 		multi_instance=0
 		port_already_use=1
@@ -25,6 +26,6 @@
 Email=
 Notification=none
 ;;; Upgrade options
-	; commit=CommitHash
+	; commit=c06f6235a93587e16524fa5b124e4d9e138a8109
-		name=Name and date of the commit.
+		name=Allow naming groups with spaces (#21) 
 		manifest_arg=domain=DOMAIN&path=PATH&admin=USER&language=fr&is_public=1&password=pass&port=666&

conf/coturn-galene.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Coturn STUN/TURN Server
+Documentation=man:coturn(1) man:turnadmin(1) man:turnserver(1)
+After=syslog.target network.target
+
+[Service]
+User=turnserver
+Group=turnserver
+Type=forking
+EnvironmentFile=/etc/default/coturn-__APP__
+PIDFile=/run/coturn-__APP__/turnserver.pid
+RuntimeDirectory=coturn-__APP__
+RuntimeDirectoryMode=0755
+ExecStart=/usr/bin/turnserver -o -c /etc/__APP__/coturn.conf $EXTRA_OPTIONS
+ExecStopPost=/bin/rm -f /run/coturn-__APP__/turnserver.pid
+Restart=on-abort
+
+LimitCORE=infinity
+LimitNOFILE=999999
+LimitNPROC=60000
+LimitRTPRIO=infinity
+LimitRTTIME=7000000
+CPUSchedulingPolicy=other
+UMask=0007
+
+[Install]
+WantedBy=multi-user.target

conf/coturn/default_coturn

@@ -0,0 +1,5 @@
+#
+# Uncomment it if you want to have the turnserver running as 
+# an automatic system service daemon
+#
+TURNSERVER_ENABLED=1

conf/coturn/turnserver.conf

@@ -0,0 +1,28 @@
+lt-cred-mech
+use-auth-secret
+static-auth-secret=__TURNSERVER_PWD__
+realm=__DOMAIN__
+
+tls-listening-port=__TURNSERVER_TLS_PORT__
+alt-tls-listening-port=__TURNSERVER_ALT_TLS_PORT__
+min-port=49153
+max-port=49193
+cli-port=__CLI_PORT__
+
+cert=/etc/yunohost/certs/__DOMAIN__/crt.pem
+pkey=/etc/yunohost/certs/__DOMAIN__/key.pem
+dh-file=/etc/ssl/private/dh2048.pem
+
+no-sslv2
+no-sslv3
+no-tlsv1
+no-tlsv1_1
+
+no-loopback-peers
+no-multicast-peers
+
+no-cli
+
+log-file=/var/log/__APP__/turnserver.log
+pidfile=/run/coturn-__APP__/turnserver.pid
+simple-log

conf/ice-servers.json

@@ -4,8 +4,8 @@
             "turn:example.com:5349",
             "turn:example.com:5349?transport=tcp"
         ],
-        "username": "galene",
+        "username": "__APP__",
-        "credential": "secret",
+        "credential": "__TURNSERVER_PWD__",
         "credentialType": "hmac-sha1"
     }
-]
+]

conf/nginx.conf

@@ -14,6 +14,7 @@ location __PATH__/ {
   proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header  X-Forwarded-Host $server_name;
   
+  # WebSocket support
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "upgrade";

scripts/_common.sh

@@ -12,6 +12,145 @@
 # EXPERIMENTAL HELPERS
 #=================================================
 
+# Send an email to inform the administrator
+#
+# usage: ynh_send_readme_to_admin --app_message=app_message [--recipients=recipients] [--type=type]
+# | arg: -m --app_message= - The file with the content to send to the administrator.
+# | arg: -r, --recipients= - The recipients of this email. Use spaces to separate multiples recipients. - default: root
+#       example: "root admin@domain"
+#       If you give the name of a YunoHost user, ynh_send_readme_to_admin will find its email adress for you
+#       example: "root admin@domain user1 user2"
+# | arg: -t, --type= - Type of mail, could be 'backup', 'change_url', 'install', 'remove', 'restore', 'upgrade'
+ynh_send_readme_to_admin() {
+        # Declare an array to define the options of this helper.
+        declare -Ar args_array=( [m]=app_message= [r]=recipients= [t]=type= )
+        local app_message
+        local recipients
+        local type
+        # Manage arguments with getopts
+
+        ynh_handle_getopts_args "$@"
+        app_message="${app_message:-}"
+        recipients="${recipients:-root}"
+        type="${type:-install}"
+
+        # Get the value of admin_mail_html
+        admin_mail_html=$(ynh_app_setting_get $app admin_mail_html)
+        admin_mail_html="${admin_mail_html:-0}"
+
+        # Retrieve the email of users
+        find_mails () {
+                local list_mails="$1"
+                local mail
+                local recipients=" "
+                # Read each mail in argument
+                for mail in $list_mails
+                do
+                        # Keep root or a real email address as it is
+                        if [ "$mail" = "root" ] || echo "$mail" | grep --quiet "@"
+                        then
+                                recipients="$recipients $mail"
+                        else
+                                # But replace an user name without a domain after by its email
+                                if mail=$(ynh_user_get_info "$mail" "mail" 2> /dev/null)
+                                then
+                                        recipients="$recipients $mail"
+                                fi
+                        fi
+                done
+                echo "$recipients"
+        }
+        recipients=$(find_mails "$recipients")
+
+        # Subject base
+        local mail_subject="☁️🆈🅽🅷☁️: \`$app\`"
+
+        # Adapt the subject according to the type of mail required.
+        if [ "$type" = "backup" ]; then
+                mail_subject="$mail_subject has just been backup."
+        elif [ "$type" = "change_url" ]; then
+                mail_subject="$mail_subject has just been moved to a new URL!"
+        elif [ "$type" = "remove" ]; then
+                mail_subject="$mail_subject has just been removed!"
+        elif [ "$type" = "restore" ]; then
+                mail_subject="$mail_subject has just been restored!"
+        elif [ "$type" = "upgrade" ]; then
+                mail_subject="$mail_subject has just been upgraded!"
+        else    # install
+                mail_subject="$mail_subject has just been installed!"
+        fi
+
+        local mail_message="This is an automated message from your beloved YunoHost server.
+
+Specific information for the application $app.
+
+$(if [ -n "$app_message" ]
+then
+        cat "$app_message"
+else
+        echo "...No specific information..."
+fi)
+
+---
+Automatic diagnosis data from YunoHost
+
+__PRE_TAG1__$(yunohost tools diagnosis | grep -B 100 "services:" | sed '/services:/d')__PRE_TAG2__"
+
+        # Store the message into a file for further modifications.
+        echo "$mail_message" > mail_to_send
+
+        # If a html email is required. Apply html tags to the message.
+        if [ "$admin_mail_html" -eq 1 ]
+        then
+                # Insert 'br' tags at each ending of lines.
+                ynh_replace_string "$" "<br>" mail_to_send
+
+                # Insert starting HTML tags
+                sed --in-place '1s@^@<!DOCTYPE html>\n<html>\n<head></head>\n<body>\n@' mail_to_send
+
+                # Keep tabulations
+                ynh_replace_string "  " "\&#160;\&#160;" mail_to_send
+                ynh_replace_string "\t" "\&#160;\&#160;" mail_to_send
+
+                # Insert url links tags
+                ynh_replace_string "__URL_TAG1__\(.*\)__URL_TAG2__\(.*\)__URL_TAG3__" "<a href=\"\2\">\1</a>" mail_to_send
+
+                # Insert pre tags
+                ynh_replace_string "__PRE_TAG1__" "<pre>" mail_to_send
+                ynh_replace_string "__PRE_TAG2__" "<\pre>" mail_to_send
+
+                # Insert finishing HTML tags
+                echo -e "\n</body>\n</html>" >> mail_to_send
+
+        # Otherwise, remove tags to keep a plain text.
+        else
+                # Remove URL tags
+                ynh_replace_string "__URL_TAG[1,3]__" "" mail_to_send
+                ynh_replace_string "__URL_TAG2__" ": " mail_to_send
+
+                # Remove PRE tags
+                ynh_replace_string "__PRE_TAG[1-2]__" "" mail_to_send
+        fi
+
+        # Define binary to use for mail command
+        if [ -e /usr/bin/bsd-mailx ]
+        then
+                local mail_bin=/usr/bin/bsd-mailx
+        else
+                local mail_bin=/usr/bin/mail.mailutils
+        fi
+
+        if [ "$admin_mail_html" -eq 1 ]
+        then
+                content_type="text/html"
+        else
+                content_type="text/plain"
+        fi
+
+        # Send the email to the recipients
+        cat mail_to_send | $mail_bin -a "Content-Type: $content_type; charset=UTF-8" -s "$mail_subject" "$recipients"
+}
+
 #=================================================
 # FUTURE OFFICIAL HELPERS
 #=================================================

scripts/backup

@@ -39,6 +39,15 @@ ynh_print_info --message="Declaring files to be backed up..."
 #=================================================
 
 ynh_backup --src_path="$final_path"
+ynh_backup --src_path="/etc/$app"
+
+#=================================================
+# BACKUP SYSTEMD
+#=================================================
+
+ynh_backup --src_path="/etc/systemd/system/$app.service"
+ynh_backup --src_path="/etc/default/coturn-$app"
+ynh_backup --src_path="/etc/systemd/system/coturn-$app.service"
 
 #=================================================
 # BACKUP THE NGINX CONFIGURATION
@@ -51,9 +60,11 @@ ynh_backup --src_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 #=================================================
 
 ynh_backup --src_path="/etc/systemd/system/$app.service"
+ynh_backup --src_path="/etc/default/coturn-$app"
+ynh_backup --src_path="/etc/systemd/system/coturn-$app.service"
 
 #=================================================
 # END OF SCRIPT
 #=================================================
 
-ynh_print_info --message="Backup script completed for $app. (YunoHost will then actually copy those files to the archive)."
+ynh_print_info --message="Backup script completed for Galène. (YunoHost will then actually copy those files to the archive)."

scripts/change_url

@@ -33,7 +33,7 @@ port=$(ynh_app_setting_get --app=$app --key=port)
 #=================================================
 # BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
 #=================================================
-ynh_script_progression --message="Backing up the app before changing its URL (may take a while)..." --weight=1
+ynh_script_progression --message="Backing up Galène before changing its URL (may take a while)..." --weight=1
 
 # Backup the current version of the app
 ynh_backup_before_upgrade
@@ -121,4 +121,4 @@ ynh_systemd_action --service_name=nginx --action=reload
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Change of URL completed for $app" --last
+ynh_script_progression --message="Change of URL completed for Galène" --last

scripts/install

@@ -27,7 +27,10 @@ domain=$YNH_APP_ARG_DOMAIN
 path_url="/"
 admin=$YNH_APP_ARG_ADMIN
 is_public=$YNH_APP_ARG_IS_PUBLIC
+email=$(ynh_user_get_info --username=$admin --key=mail)
+ynh_print_OFF
 password=$YNH_APP_ARG_PASSWORD
+ynh_print_ON
 group_name=$YNH_APP_ARG_GROUP_NAME
 architecture=$(ynh_detect_arch)
 
@@ -64,6 +67,10 @@ ynh_script_progression --message="Finding an available port..." --weight=3
 
 # Find an available port
 port=$(ynh_find_port --port=8443)
+turnserver_tls_port=$(ynh_find_port --port=5349)
+turnserver_alt_tls_port=$(ynh_find_port --port=$((turnserver_tls_port+1)))
+cli_port=$(ynh_find_port --port=5766)
+
 ynh_app_setting_set --app=$app --key=port --value=$port
 
 # Find an available port
@@ -118,6 +125,8 @@ ynh_script_progression --message="Configuring system user..." --weight=3
 
 # Create a system user
 ynh_system_user_create --username=$app
+ynh_system_user_create --username=turnserver
+adduser turnserver ssl-cert
 
 #=================================================
 # SETUP SYSTEMD
@@ -131,9 +140,19 @@ ynh_replace_string --match_string="__IPV4__" --replace_string="$public_ip4" --ta
 # Create a dedicated systemd config
 ynh_add_systemd_config
 
+mkdir -p /var/log/$app
+mkdir -p /etc/$app
+# Create systemd service for turnserver
+cp ../conf/coturn/default_coturn /etc/default/coturn-$app
+ynh_add_systemd_config --service=coturn-$app --template=coturn-galene.service
+
 #=================================================
 # CREATE GROUPS FOLDER
 #=================================================
+ynh_script_progression --message="Configuring Coturn..." --weight=1
+
+# WARNING: theses command are used in INSTALL, UPGRADE
+# For any update do it in all files
 
 # Define app's groups directory
 groups="$final_path/groups"
@@ -150,15 +169,26 @@ ynh_store_file_checksum --file="$final_path/data/passwd"
 ynh_add_config --template="../conf/groupname.json" --destination="$final_path/groups/$group_name.json"
 ynh_store_file_checksum --file="$final_path/groups/$group_name.json"
 
+ynh_add_config --template="../conf/ice-servers.json" --destination="$final_path/data/ice-servers.json"
+ynh_store_file_checksum --file="$final_path/data/ice-servers.json"
+
 #=================================================
-# GENERIC FINALIZATION
+# SETUP LOGROTATE
 #=================================================
-# SECURE FILES AND DIRECTORIES
+ynh_script_progression --message="Configuring log rotation..." --weight=1
+
+ynh_use_logrotate --logfile "/var/log/$app"
+
+#=================================================
+# ADD SCRIPT FOR COTURN CRON AND APP SERVICE
 #=================================================
 
-# Set permissions to app files
+# WARNING : theses command are used in INSTALL, UPGRADE
-chown -R $app: $final_path
+# For any update do it in all files
-chmod -R 755 $final_path
+
+cp ../sources/Coturn_config_rotate.sh $final_path/Coturn_config_rotate.sh
+ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$final_path/Coturn_config_rotate.sh"
+chmod +x $final_path/Coturn_config_rotate.sh
 
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
@@ -193,8 +223,25 @@ ynh_script_progression --message="Reloading NGINX web server..." --weight=2
 
 ynh_systemd_action --service_name=nginx --action=reload
 
+#=================================================
+# SEND A README FOR THE ADMIN
+#=================================================
+
+# WARNING : theses command are used in INSTALL, RESTORE
+# For any update do it in all files
+
+echo "Galène was successfully installed :)
+
+Galène is now accesible at this adress: https://$domain
+
+Galène implements a TURN server (for VoIP), to have this fully functional please read the 'TURN server' section in the README available here: https://github.com/YunoHost-Apps/galene_ynh .
+
+If you're facing an issue or want to improve this app, please open a new issue in this project: https://github.com/YunoHost-Apps/galene_ynh" > mail_to_send
+
+ynh_send_readme_to_admin --app_message="mail_to_send" --type="install"
+
 #=================================================
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Installation of $app completed" --last
+ynh_script_progression --message="Installation of Galène completed" --last

scripts/remove

@@ -20,20 +20,28 @@ domain=$(ynh_app_setting_get --app=$app --key=domain)
 port=$(ynh_app_setting_get --app=$app --key=port)
 turn_port=$(ynh_app_setting_get --app=$app --key=turn_port)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+port=$(ynh_app_setting_get --app=$app --key=port)
+turnserver_tls_port=$(ynh_app_setting_get --app=$app --key=turnserver_tls_port)
+turnserver_alt_tls_port=$(ynh_app_setting_get --app=$app --key=turnserver_alt_tls_port)
 
 #=================================================
 # STANDARD REMOVE
 #=================================================
 # REMOVE SERVICE INTEGRATION IN YUNOHOST
 #=================================================
+ynh_script_progression --message="Removing Galène service integration..." --weight=1
 
 # Remove the service from the list of services known by YunoHost (added from `yunohost service add`)
 if ynh_exec_warn_less yunohost service status $app >/dev/null
 then
-	ynh_script_progression --message="Removing $app service integration..." --weight=1
 	yunohost service remove $app
 fi
 
+if ynh_exec_warn_less yunohost service status coturn-$app >/dev/null
+then
+	yunohost service remove coturn-$app
+fi
+
 #=================================================
 # STOP AND REMOVE SERVICE
 #=================================================
@@ -41,14 +49,17 @@ ynh_script_progression --message="Stopping and removing the systemd service..."
 
 # Remove the dedicated systemd config
 ynh_remove_systemd_config
+ynh_remove_systemd_config --service=coturn-$app
 
 #=================================================
 # REMOVE APP MAIN DIR
 #=================================================
-ynh_script_progression --message="Removing app main directory..." --weight=2
+ynh_script_progression --message="Removing Galène main directory..." --weight=2
 
 # Remove the app directory securely
-ynh_secure_remove --file="$final_path"
+ynh_secure_remove --file=$final_path
+ynh_secure_remove --file=/var/log/$app
+ynh_secure_remove --file=/etc/default/coturn-$app
 
 #=================================================
 # REMOVE NGINX CONFIGURATION
@@ -83,9 +94,10 @@ ynh_script_progression --message="Removing the dedicated system user..." --weigh
 
 # Delete a system user
 ynh_system_user_delete --username=$app
+ynh_system_user_delete --username=turnserver
 
 #=================================================
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Removal of $app completed" --last
+ynh_script_progression --message="Removal of Galène completed" --last

scripts/restore

@@ -44,7 +44,15 @@ test ! -d $final_path \
 	|| ynh_die --message="There is already a directory: $final_path "
 
 #=================================================
-# STANDARD RESTORATION STEPS
+# SPECIFIC RESTORATION
+#=================================================
+# REINSTALL DEPENDENCIES
+#=================================================
+ynh_script_progression --message="Reinstalling dependencies..." --weight=1
+
+# Define and install dependencies
+ynh_install_app_dependencies $pkg_dependencies
+
 #=================================================
 # RESTORE THE NGINX CONFIGURATION
 #=================================================
@@ -54,9 +62,11 @@ ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 #=================================================
 # RESTORE THE APP MAIN DIR
 #=================================================
-ynh_script_progression --message="Restoring the app main directory..." --weight=1
+ynh_script_progression --message="Restoring Galène main directory..." --weight=1
 
 ynh_restore_file --origin_path="$final_path"
+ynh_restore_file --origin_path="/etc/$app"
+ynh_restore_file --origin_path="/var/log/$app"
 
 #=================================================
 # RECREATE THE DEDICATED USER
@@ -80,7 +90,10 @@ chmod -R 755 $final_path
 ynh_script_progression --message="Restoring the systemd configuration..." --weight=1
 
 ynh_restore_file --origin_path="/etc/systemd/system/$app.service"
+ynh_restore_file --origin_path="/etc/default/coturn-$app"
+ynh_restore_file --origin_path="/etc/systemd/system/coturn-$app.service"
 systemctl enable $app.service --quiet
+systemctl enable coturn-$app.service --quiet
 
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
@@ -109,4 +122,4 @@ ynh_systemd_action --service_name=nginx --action=reload
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Restoration completed for $app" --last
+ynh_script_progression --message="Restoration completed for Galène" --last

scripts/upgrade

@@ -20,6 +20,7 @@ domain=$(ynh_app_setting_get --app=$app --key=domain)
 path_url=$(ynh_app_setting_get --app=$app --key=path)
 admin=$(ynh_app_setting_get --app=$app --key=admin)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+password=$(ynh_app_setting_get --app=$app --key=password)
 group_name=$(ynh_app_setting_get --app=$app --key=group_name)
 port=$(ynh_app_setting_get --app=$app --key=port)
 turn_port=$(ynh_app_setting_get --app=$app --key=turn_port)
@@ -45,7 +46,7 @@ fi
 #=================================================
 # BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
 #=================================================
-ynh_script_progression --message="Backing up the app before upgrading (may take a while)..." --weight=1
+ynh_script_progression --message="Backing up Galène before upgrading (may take a while)..." --weight=1
 
 # Backup the current version of the app
 ynh_backup_before_upgrade
@@ -88,7 +89,7 @@ then
 	mkdir -p "$final_path/data" "$final_path/groups"
 
 	# Copy the admin saved settings from tmp directory to final path	
-	cp -ar "$tmpdir/groups" "$final_path/groups"
+	cp -ar "$tmpdir/groups" "$final_path"
 
 	# Remove the tmp directory securely
 	ynh_secure_remove --file="$tmpdir"
@@ -105,6 +106,94 @@ then
 
 fi
 
+#=================================================
+# MULTINSTANCE SUPPORT
+#=================================================
+
+if [ ! -e /etc/$app/coturn.conf ]
+then
+    ynh_script_progression --message="Creating an independant service for Coturn..." --weight=1
+
+    #=================================================
+    # CREATE AN INDEPENDANT SERVICE FOR COTURN
+    #=================================================
+
+    # Disable default config for turnserver and create a new service
+    systemctl stop coturn.service
+
+    # Set by default the system config for coturn
+    echo "" > /etc/turnserver.conf
+    ynh_replace_string --match_string="TURNSERVER_ENABLED=1" --replace_string="TURNSERVER_ENABLED=0" --target_file=/etc/default/coturn
+
+    # Set a port for each service in turnserver
+    turnserver_alt_tls_port=$(ynh_find_port --port=$((turnserver_tls_port+1)))
+    cli_port=$(ynh_find_port --port=5766)
+
+    ynh_app_setting_set --app=$app --key=turnserver_alt_tls_port --value=$turnserver_alt_tls_port
+    ynh_app_setting_set --app=$app --key=cli_port --value=$cli_port
+
+    yunohost firewall allow Both $turnserver_alt_tls_port > /dev/null 2>&1
+
+    #=================================================
+    # MAKE A CLEAN LOGROTATE CONFIG
+    #=================================================
+
+    ynh_use_logrotate --logfile /var/log/$app --nonappend
+fi
+
+#=================================================
+# CREATE A DH FILE
+#=================================================
+ynh_script_progression --message="Creating a dhparam file..." --weight=3
+
+# WARNING : theses command are used in INSTALL, UPGRADE, RESTORE
+# For any update do it in all files
+
+# Make dhparam cert for Galène if it doesn't exist
+if [ ! -e /etc/ssl/private/dh2048.pem ]
+then
+    ynh_exec_warn_less openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 -dsaparam
+    chown root:ssl-cert /etc/ssl/private/dh2048.pem
+    chmod 640 /etc/ssl/private/dh2048.pem
+fi
+
+#=================================================
+# SPECIFIC UPGRADE
+#=================================================
+# UPDATE COTURN CONFIG
+#=================================================
+ynh_script_progression --message="Updating Coturn config..." --weight=1
+
+# WARNING : theses command are used in INSTALL, UPGRADE
+# For any update do it in all files
+
+coturn_config_path="/etc/$app/coturn.conf"
+
+ynh_add_config --template="../conf/coturn/turnserver.conf" --destination="$coturn_config_path"
+
+# Get public IP and set as external IP for coturn
+# note : '|| true' is used to ignore the errors if we can't get the public ipv4 or ipv6
+public_ip4="$(curl ip.yunohost.org)" || true
+public_ip6="$(curl ipv6.yunohost.org)" || true
+
+if ( [[ -n "$public_ip4" ]] && ynh_validate_ip4 --ip_address="$public_ip4" || [[ -n "$public_ip6" ]] && ynh_validate_ip6 --ip_address="$public_ip6" )
+then
+    echo "external-ip=${public_ip4}/${public_ip6}" >> "$coturn_config_path"
+fi
+
+ynh_store_file_checksum --file="$coturn_config_path"
+
+#=================================================
+# ADD SCRIPT FOR COTURN CRON AND APP SERVICE
+#=================================================
+
+# WARNING : theses command are used in INSTALL, UPGRADE
+# For any update do it in all files
+
+cp ../sources/Coturn_config_rotate.sh $final_path/Coturn_config_rotate.sh
+ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$final_path/Coturn_config_rotate.sh"
+chmod +x $final_path/Coturn_config_rotate.sh
+
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
@@ -120,6 +209,7 @@ ynh_script_progression --message="Making sure dedicated system user exists..." -
 
 # Create a dedicated user (if not existing)
 ynh_system_user_create --username=$app
+adduser turnserver ssl-cert
 
 #=================================================
 # SETUP SYSTEMD
@@ -140,13 +230,20 @@ ynh_add_systemd_config
 #=================================================
 
 # Set permissions on app files
-chown -R $app: $final_path
+chown -R $app:$app $final_path
 chmod -R 755 $final_path
+chown -R $app:root /var/log/$app
+chown -R $app:root /etc/$app
+chown turnserver:root $coturn_config_path
+chmod -R u=rwX,g=rX,o= /etc/$app
+chmod 770 $final_path/Coturn_config_rotate.sh
+setfacl -R -m user:turnserver:rX  /etc/$app
+setfacl -R -m user:turnserver:rwX  /var/log/$app
 
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
-ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
+ynh_script_progression --message="Integrating service in YunoHost..." --weight=2
 
 yunohost service add $app --description="Videoconferencing server" --log="/var/log/$app/$app.log" --needs_exposed_ports="$turn_port"
 
@@ -168,4 +265,4 @@ ynh_systemd_action --service_name=nginx --action=reload
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Upgrade of $app completed" --last
+ynh_script_progression --message="Upgrade of Galène completed" --last

sources/Coturn_config_rotate.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+source /usr/share/yunohost/helpers
+
+external_IP_line="external-ip=__IPV4__/__IPV6__"
+
+public_ip4="$(curl ip.yunohost.org)" || true
+public_ip6="$(curl ipv6.yunohost.org)" || true
+
+if [ -n "$public_ip4" ] && ynh_validate_ip4 --ip_address="$public_ip4"
+then
+    external_IP_line="${external_IP_line/'__IPV4__'/$public_ip4}"
+else
+    external_IP_line="${external_IP_line/'__IPV4__/'/}"
+fi
+
+if [ -n "$public_ip6" ] && ynh_validate_ip6 --ip_address="$public_ip6"
+then
+    external_IP_line="${external_IP_line/'__IPV6__'/$public_ip6}"
+else
+    external_IP_line="${external_IP_line/'/__IPV6__'/}"
+fi
+
+old_config_line=$(egrep "^external-ip=.*\$" "/etc/$app/coturn.conf")
+ynh_replace_string "^external-ip=.*\$" "$external_IP_line" "/etc/$app/coturn.conf"
+new_config_line=$(egrep "^external-ip=.*\$" "/etc/$app/coturn.conf")
+
+setfacl -R -m user:turnserver:rX  /etc/__APP__
+
+if [ "$old_config_line" != "$new_config_line" ]
+then
+    systemctl restart coturn-__APP__.service
+fi
+
+exit 0