Full package improvement

- Update config from upstream
- Use Jinja for config file
- Dynamically generate config file depending of the auto detected system configuration
- Remove dependancy of mysql as it's not needed
- Automatically monitor mysql, postgresql, memcached, redis, php pool v>=8.0, fail2ban, mail, partition and network
- Add some config parameter in config panel to make easy to change values
- Configure alert system (can be enabled by config panel)
- Fix small issue linked to previous packaging v2

.gitignore

@@ -0,0 +1,6 @@
+# From kateproject
+.kateproject
+.kateproject.d
+.directory
+
+*swp

conf/monitorix-alert.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+#
+# Example script used to execute an alert action.
+#
+# This script assumes that you symlink your alert scripts like this:
+# 	disk.pendsect-alert.sh -> monitorix-alert.sh
+# 	disk.realloc-alert.sh -> monitorix-alert.sh
+# 	mail.mqueued-alert.sh -> monitorix-alert.sh
+# 	system.loadavg-alert.sh -> monitorix-alert.sh
+# 	...
+# So you only use one script (saving disk space) and its prefix will
+# appear in the subject and contents of the email, so you will easily
+# identify the source of the alert.
+#
+
+MAILTO="__ALERTS_EMAIL__"
+
+if [ $# != 3 ] && [ $# != 4 ] ; then
+	echo "$0: Wrong number of arguments."
+	exit 1
+fi
+
+ALERT_TIMEINTVL=$1
+ALERT_THRESHOLD=$2
+current_value=$3
+ALERT_WHEN=$4
+ALERT=`basename $0 | cut -f1 -d-`
+
+(
+cat << EOF
+Message from hostname '$HOSTNAME' for '$ALERT' alert.
+
+This system is reaching/exceeding ($ALERT_WHEN) the defined threshold value ($ALERT_THRESHOLD) during the last '$ALERT_TIMEINTVL' seconds.
+
+The current value is: $current_value
+
+Please take proper actions to correct this situation.
+EOF
+) | mail -s "WARNING: Monitorix alert ($ALERT) from '$HOSTNAME'!" $MAILTO
+

conf/nginx.conf

@@ -1,9 +1,12 @@
 location __PATH__ {
-    proxy_pass		http://127.0.0.1:__PORT____PATH__;
+    proxy_pass http://127.0.0.1:__PORT____PATH__;
-    allow		127.0.0.0/8;
+    allow      127.0.0.0/8;
 
-    location ~ ^__PATH__/(.+\.png)$ {
+    location ~ ^__PATH__/(.+\.(png|svg))$ {
-        alias /var/lib/monitorix/www/$1;
+        alias __DATA_DIR__/www/$1;
+
+        # Include SSOWAT user panel.
+        include conf.d/yunohost_panel.conf.inc;
     }
 
     proxy_set_header Host $host;

conf/nginx_status.conf

@@ -1,6 +1,6 @@
 server {
-    listen __PORT_NGINX_STATUS__;
+    listen {{ port_nginx_status }};
-    listen [::]:__PORT_NGINX_STATUS__;
+    listen [::]:{{ port_nginx_status }};
 
     access_log /var/log/nginx/localhost-nginx_status_monitorix.lan-access.log;
     error_log /var/log/nginx/localhost-nginx_status_monitorix.lan-error.log;
@@ -12,4 +12,19 @@ server {
         allow ::1;
         deny all;
     }
+
+{%- if phpfpm_installed == 'true' %}
+    {%- for php_pool_info in php_pools_infos.splitlines() %}
+        {%- set phpversion = php_pool_info.split(',')[0] %}
+        {%- set pool_name = php_pool_info.split(',')[1] %}
+
+    location {{ path.rstrip('/') }}/php-pool-status/php{{ phpversion }}-fpm-{{ pool_name }} {
+            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+            fastcgi_pass unix:/var/run/php/php{{ phpversion }}-fpm-{{ pool_name }}-{{ app }}-status.sock;
+            include fastcgi_params;
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param SCRIPT_FILENAME cas_server.php;
+    }
+    {%- endfor %}
+{%- endif %}
 }

conf/php_status.conf

@@ -0,0 +1,10 @@
+{% for php_pool_info in php_pools_infos.splitlines() %}
+    {%- set phpversion = php_pool_info.split(',')[0] %}
+    {%- set pool_name = php_pool_info.split(',')[1] %}
+    {%- if phpversion == pool_version %}
+; Auto generated config for Monitorix monitoring
+[{{ pool_name }}]
+pm.status_listen = /var/run/php/php{{ phpversion }}-fpm-{{ pool_name }}-{{ app }}-status.sock
+pm.status_path = /php-pool-status/php{{ phpversion }}-fpm-{{ pool_name }}
+    {%- endif %}
+{% endfor %}

config_panel.toml

@@ -0,0 +1,246 @@
+version = "1.0"
+
+[main]
+name.en = "Main configuration"
+name.fr = "Configuration principale"
+
+services = ["__APP__"]
+
+    [main.email_alerts]
+
+    name = "Email alerts"
+
+        [main.email_alerts.alerts_email]
+
+        ask.en = "Email address to send alerts emails"
+        type = "email"
+        help = "The Email address on which monitorix will send Alets email. It could by linked to many time of alerts."
+
+    [main.others]
+
+    name = "Others"
+
+        [main.others.theme_color]
+        ask.en = "Theme color"
+        type = "select"
+        choices = ["black", "white"]
+        help = "RRDtool comes with a default white theme, and since Monitorix introduces its own black theme, you have two predefined themes to choose from."
+
+        [main.others.enable_hourly_view]
+        ask.en = "Enable hourly view"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+        help = "This option enables or disables the ability to select the hourly view in the main page.\nNo .rrd file will change by selecting this option and the historical data won’t be affected."
+
+        [main.others.image_format]
+        ask.en = "Image format"
+        type = "select"
+        choices = ["svg", "png"]
+        help = "This is the format of each generated graph. There are only two possible values: PNG and SVG."
+
+        [main.others.max_historic_years]
+        ask.en = "Maximum number of years of historical"
+        type = "number"
+        help = "This option defines the maximum number of years of historical data in all graphs.\nWARNING: Every time this value is extended Monitorix will resize every .rrd file accordingly, removing all historical data.\nThere is no longer any upper limit for this value."
+
+        [main.others.process_priority]
+        ask.en = "Process priority"
+        type = "number"
+        min = -20
+        max = 20
+        help = "Sometimes when a server is under heavy use, Monitorix might be unable to collect some statistical data due to its normal priority (0 by default). This makes monitoring useless because graphs are empty during that hard period of time.\n\nIn order to mitigate this situation this option sets the priority in which Monitorix will be scheduled by the kernel. The accepted range of values is the same as in the setpriority() system call: that is, from -20 (maximum priority) to 19 (lowest priority)."
+
+[config]
+name.en = "Monitorix configuration"
+
+    [config.system]
+    name = "System load average and usage"
+
+        [config.system.system_alerts_loadavg_enabled]
+        ask.en = "Load average enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+        help = "This section enables or disables the alert capabilities for this graph. Only the alert for the average CPU load is currently implemented. It works as follows:\n\nThis alert uses the minimum value between the second and the third load averages (those that represent the last 5 and 15 minutes), and if it reaches the loadavg_threshold value for the interval of time defined in loadavg_timeintvl, Monitorix will execute the external alert script defined in loadavg_script.\n\nThe idea to use min(load5, load15) is to obtain a more symmetric curve and a sooner cancellation of the alert.\n\nThe default Monitorix installation includes an example of a shell-script alert called monitorix-alert.sh which you can use as a base for your own script."
+
+        [config.system.system_alerts_loadavg_timeintvl]
+        ask.en = "Load average time interval"
+        type = "number"
+        help = "This is the period of time (in seconds) that the threshold needs to be exceeded before the external alert script is executed."
+
+        [config.system.system_alerts_loadavg_threshold]
+        ask.en = "Load average threshold"
+        type = "range"
+        help = "This is the value that needs to be reached or exceeded within the specified time period in loadavg_timeintvl to trigger the mechanism for a particular action, which in this case is the execution of an external alert script.\n\nThe value of this option is compared against the last 15 minutes of CPU load average."
+
+    [config.disk]
+    name = "Disk usage"
+
+        [config.disk.disk_alerts_loadavg_enabled]
+        ask.en = "Disk alert enabled"
+        type = "boolean"
+        yes = "true"
+        no = "false"
+
+        [config.disk.disk_alerts_loadavg_timeintvl]
+        ask.en = "Time interval"
+        type = "number"
+        help = "Time interval on which disk usage will be checked"
+
+        [config.disk.disk_alerts_loadavg_threshold]
+        ask.en = "Disk usage threshold"
+        type = "number"
+        help = "Percentage to reach to send alert."
+
+    [config.mail]
+    name = "Mail statistics"
+
+        [config.mail.mail_delvd_enabled]
+        ask.en = "Mail delivery enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+        help = "This section enables or disables one of the alert capabilities for this graph; the alert for the number of delivered messages. It works as follows:\n\nIf the number of delivered messages reaches the delvd_threshold value for the interval of time defined in delvd_timeintvl, Monitorix will execute the external alert script defined in delvd_script.\n\nThe default Monitorix installation includes an example of a shell-script alert called monitorix-alert.sh which you can use as a base for your own script."
+
+        [config.mail.mail_delvd_timeintvl]
+        ask.en = "Mail delivery time interval"
+        type = "number"
+        help = "This is the period of time (in seconds) that the threshold needs to be exceeded before the external alert script is executed."
+
+        [config.mail.mail_delvd_threshold]
+        ask.en = "Mail delivery threshold"
+        type = "number"
+        help = "This is the value that needs to be reached or exceeded within the specified time period in delvd_timeintvl to trigger the mechanism for a particular action, which in this case is the execution of an external alert script.\n\nThe value of this option is compared against the number of delivered messages since the last delvd_timeintvl seconds."
+
+        [config.mail.mail_mqueued_enabled]
+        ask.en = "Mail message queue enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+        help = "This section enables or disables one of the alert capabilities for this graph; the alert for the number of queued messages. It works as follows:\n\nIf the number of queued messages reaches the mqueued_threshold value for the interval of time defined in mqueued_timeintvl, Monitorix will execute the external alert script defined in mqueued_script.\n\nThe default Monitorix installation includes an example of a shell-script alert called monitorix-alert.sh which you can use as a base for your own script."
+
+        [config.mail.mail_mqueued_timeintvl]
+        ask.en = "Mail message queue time interval"
+        type = "number"
+        help = "This is the period of time (in seconds) that the threshold needs to be exceeded before the external alert script is executed."
+
+        [config.mail.mail_mqueued_threshold]
+        ask.en = "Mail message queue threshold"
+        type = "number"
+        help = "This is the value that needs to be reached or exceeded within the specified time period in mqueued_timeintvl to trigger the mechanism for a particular action, which in this case is the execution of an external alert script.\n\nThe value of this option is compared with the number of messages in the mail queue."
+
+[emailreports]
+name = "Automatic email reports"
+help = "This allows to send automatically selected graphs to one or more email addresses. This could be specially useful for some system administrators who prefer receiving via email selected graphs instead of browsing to the remote servers every day."
+
+    [emailreports.global]
+    name = "Global config for email reports"
+
+        [emailreports.global.emailreports_enabled]
+        ask.en = "Mail reports enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+        help = "This option enables this feature. Note that you still need to enable the same option for each time interval you want to activate: daily, weekly, monthly, yearly."
+
+        [emailreports.global.emailreports_subject_prefix]
+        ask.en = "Email report subject prefix"
+        type = "string"
+        help = "This is a string that will be prefixed in the Subject of all emails that will be sent."
+
+        [emailreports.global.emailreports_hour]
+        ask.en = "Mail report send hour"
+        type = "number"
+        max = 23
+        help = "This is the hour (in 24h format) when the email reports will be sent."
+
+        [emailreports.global.emailreports_minute]
+        ask.en = "Mail report send minute"
+        type = "number"
+        max = 59
+        help = "This is the minute when the email reports will be sent."
+
+    [emailreports.daily]
+    name = "Daily email reports"
+    help = "Daily reports will be sent every day at the specific time on the global mail report settings."
+
+        [emailreports.daily.emailreports_daily_enabled]
+        ask.en = "Daily mail reports enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+
+        [emailreports.daily.emailreports_daily_graphs]
+        ask.en = "Daily mail reports graphs list"
+        type = "tags"
+        choices = ["system", "kern", "proc", "fs", "du", "net", "netstat", "process", "serv", "mail", "port", "user", "nginx", "mysql", "pgsql", "fail2ban", "memcached", "redis", "phpfpm", "int"]
+        help = "List of graph names you want to appear in the email report. The names are the same as their .rrd files. There is a list of them in the graph_name option in monitorix.conf."
+
+        [emailreports.daily.emailreports_daily_to]
+        ask.en = "Daily mail reports emails"
+        type = "string"
+        help = "This is a comma-separated list of recipient email addresses."
+
+    [emailreports.weekly]
+    name = "Weekly email reports"
+    help = "Weekly reports will be sent the first Monday of each week."
+
+        [emailreports.weekly.emailreports_weekly_enabled]
+        ask.en = "Weekly mail reports enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+
+        [emailreports.weekly.emailreports_weekly_graphs]
+        ask.en = "Weekly mail reports graphs list"
+        type = "tags"
+        choices = ["system", "kern", "proc", "fs", "du", "net", "netstat", "process", "serv", "mail", "port", "user", "nginx", "mysql", "pgsql", "fail2ban", "memcached", "redis", "phpfpm", "int"]
+        help = "List of graph names you want to appear in the email report. The names are the same as their .rrd files. There is a list of them in the graph_name option in monitorix.conf."
+
+        [emailreports.weekly.emailreports_weekly_to]
+        ask.en = "Weekly mail reports emails"
+        type = "string"
+        help = "This is a comma-separated list of recipient email addresses."
+
+    [emailreports.monthly]
+    name = "Monthly email reports"
+    help = "Monthly reports will be sent the first day of each month."
+
+        [emailreports.monthly.emailreports_monthly_enabled]
+        ask.en = "Monthly mail reports enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+
+        [emailreports.monthly.emailreports_monthly_graphs]
+        ask.en = "Monthly mail reports graphs list"
+        type = "tags"
+        choices = ["system", "kern", "proc", "fs", "du", "net", "netstat", "process", "serv", "mail", "port", "user", "nginx", "mysql", "pgsql", "fail2ban", "memcached", "redis", "phpfpm", "int"]
+        help = "List of graph names you want to appear in the email report. The names are the same as their .rrd files. There is a list of them in the graph_name option in monitorix.conf."
+
+        [emailreports.monthly.emailreports_monthly_to]
+        ask.en = "Monthly mail reports emails"
+        type = "string"
+        help = "This is a comma-separated list of recipient email addresses."
+
+    [emailreports.yearly]
+    name = "Yearly email reports"
+    help = "Yearly reports will be sent the first day of each year."
+
+        [emailreports.yearly.emailreports_yearly_enabled]
+        ask.en = "Yearly mail reports enabled"
+        type = "boolean"
+        yes = "y"
+        no = "n"
+
+        [emailreports.yearly.emailreports_yearly_graphs]
+        ask.en = "Yearly mail reports graphs list"
+        type = "tags"
+        choices = ["system", "kern", "proc", "fs", "du", "net", "netstat", "process", "serv", "mail", "port", "user", "nginx", "mysql", "pgsql", "fail2ban", "memcached", "redis", "phpfpm", "int"]
+        help = "List of graph names you want to appear in the email report. The names are the same as their .rrd files. There is a list of them in the graph_name option in monitorix.conf."
+
+        [emailreports.yearly.emailreports_yearly_to]
+        ask.en = "Yearly mail reports emails"
+        type = "string"
+        help = "This is a comma-separated list of recipient email addresses."

doc/ADMIN.md

@@ -1,6 +1,6 @@
 ### Remove
 
-Due of the backup core only feature the data directory in `/var/lib/monitorix` **is not removed**. It must be manually deleted to purge user data from the app.
+Due of the backup core only feature the data directory in `/home/yunohost.app/monitorix` **is not removed**. It must be manually deleted to purge user data from the app.
 
 ### More sensor
 
@@ -15,14 +15,10 @@ You will have a full complete documentation for monitorix config here : https://
 By example you can extends the basic config by this :
 
 ```xml
-priority = 5
-
 <graph_enable>
-
         disk            = y
         lmsens          = y
         gensens         = y
-        mail            = y
 </graph_enable>
 
 # LMSENS graph
@@ -97,123 +93,10 @@ priority = 5
                 pendsect_script = /etc/monitorix/monitorix_alerts_scripts/disk_pendsect.sh
         </alerts>
 </disk>
-
-# FS graph
-# -----------------------------------------------------------------------------
-<fs>
-        <list>
-                0 = /, /home, /var, /$tempdir, swap
-        </list>
-        <desc>
-                / = Root FS
-                /home = home
-                /var = var
-                /$tempdir = tmp
-        </desc>
-        <devmap>
-        </devmap>
-        rigid = 2, 0, 2, 0
-        limit = 100, 1000, 100, 1000
-        <alerts>
-            / = 3600, 98, /etc/monitorix/monitorix_alerts_scripts/fs_rootfs.sh
-            /home = 3600, 98, /etc/monitorix/monitorix_alerts_scripts/fs_home.sh
-            /var = 3600, 98, /etc/monitorix/monitorix_alerts_scripts/fs_var.sh
-            /$tempdir = 3600, 98, /etc/monitorix/monitorix_alerts_scripts/fs_tmp.sh
-            swap = 3600, 98, /etc/monitorix/monitorix_alerts_scripts/fs_swap.sh
-        </alerts>
-</fs>
-
-
-# MAIL graph
-# -----------------------------------------------------------------------------
-<mail>
-        mta = postfix
-        greylist = postgrey
-        stats_rate = real
-        rigid = 0, 0, 0, 0, 0
-        limit = 1, 1000, 1000, 1000, 1000
-        <alerts>
-                delvd_enabled = y
-                delvd_timeintvl = 60
-                delvd_threshold = 100
-                delvd_script = /etc/monitorix/monitorix_alerts_scripts/mail_delvd.sh
-                mqueued_enabled = y
-                mqueued_timeintvl = 3600
-                mqueued_threshold = 100
-                mqueued_script = /etc/monitorix/monitorix_alerts_scripts/mail_mqueued.sh
-        </alerts>
-</mail>
-
-
-# NET graph
-# -----------------------------------------------------------------------------
-<net>
-        list = eth0,lo
-        <desc>
-                eth0 = FastEthernet LAN, 0, 10000000
-                lo = loopback, 0, 10000000
-        </desc>
-
-        gateway = eth0
-</net>
-
-# PROCESS graph
-# -----------------------------------------------------------------------------
-<process>
-        <list>
-                0 = sshd, ntpd, monitorix, monitorix-httpd
-                1 = openvpn, ...
-                ...
-                6 = mysqld, slapd, postgresql
-        </list>
-        <desc>
-                master = Postfix
-                imap = Dovecot
-        </desc>
-        rigid = 2, 0, 0, 0, 0, 0, 0, 0
-        limit = 100, 1000, 1000, 1000, 1000, 1000, 1000, 1000
-</process>
-
-
-
-<emailreports>
-        enabled = y
-        url_prefix = http://127.0.0.1:8081/monitorix
-        smtp_hostname = localhost
-        from_address = noreply@domain.tld
-        hour = 2
-        minute = 7
-        <daily>
-                enabled = y
-                graphs = system, fs, gensens, disk, netstat, port, nginx
-                to = user@domain.tld
-        </daily>
-        <weekly>
-                enabled = y
-                graphs = system, fs, gensens, disk, kern, proc, net, netstat, process, serv, port, user, nginx, mysql, fail2ban, int
-                to = user@domain.tld
-        </weekly>
-        <monthly>
-                enabled = y
-                graphs = system, fs, gensens, disk, kern, proc, net, netstat, process, serv, port, user, nginx, mysql, fail2ban, int
-                to = user@domain.tld
-        </monthly>
-        <yearly>
-                enabled = y
-                graphs = system, fs, gensens, disk, kern, proc, net, netstat, process, serv, port, user, nginx, mysql, fail2ban, int
-                to = user@domain.tld
-        </yearly>
-</emailreports>
-
 ```
 
 In this config :
 
-- We set the process priority to 5 (which mean that it will be lower priority than the other process).
 - We get the lmsensor sensor data.
 - We get some sensors data not accessible with lmsensor (with gensens)
 - We check the disk health and send an email if any error happens. For that you need to make some script. An example is available in `/usr/share/doc/monitorix/monitorix-alert.sh`.
-- We check the filesystem.
-- We check the traffic in the network card.
-- We check some process.
-- We send every day, week, month and year a rapport.

hooks/post_app_install

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+bash __INSTALL_DIR__/update_config_if_needed.sh

hooks/post_app_remove

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+bash __INSTALL_DIR__/update_config_if_needed.sh

hooks/post_app_upgrade

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+bash __INSTALL_DIR__/update_config_if_needed.sh

hooks/post_iptable_rules

@@ -1,9 +1,9 @@
 #/bin/bash
 
-if [[ $(systemctl status monitorix.service | grep "Active" | cut -d'(' -f2 | cut -d ')' -f1) = 'running' ]]
+if [[ $(systemctl status __APP__.service | grep "Active" | cut -d'(' -f2 | cut -d ')' -f1) = 'running' ]]
 then
     systemctl stop monitorix.service
     sleep 1
     pkill -f "monitorix-httpd listening on" || true
-    systemctl start monitorix.service
+    systemctl start __APP__.service
 fi

manifest.toml

@@ -7,7 +7,7 @@ name = "Monitorix"
 description.en = "A system monitoring tool"
 description.fr = "Un outil de monitoring système"
 
-version = "3.15.0~ynh4"
+version = "3.15.0~ynh5"
 
 maintainers = ["Josue-T"]
 
@@ -37,16 +37,26 @@ ram.runtime = "50M"
     type = "path"
     default = "/monitorix"
 
+[install.init_main_permission]
+    type = "group"
+    default = "admins"
+
 [resources]
     [resources.sources.main]
     url = "https://www.monitorix.org/monitorix_3.15.0-izzy1_all.deb"
     sha256 = "0d960b9433ecbaba38d9befe27163644886fb5a466d44f5380576ca975b9d8e4"
     rename = "monitorix.deb"
-    format = "whatever"
     extract = false
 
     [resources.system_user]
 
+    [resources.install_dir]
+    dir = "/opt/yunohost/__APP__"
+    owner = "__APP__:rwx"
+    group = "www-data:rx"
+
+    [resources.data_dir]
+
     [resources.permissions]
     main.url = "/"
 
@@ -55,9 +65,5 @@ ram.runtime = "50M"
     nginx_status.default = 8081
 
     [resources.apt]
-    packages = [
+    packages = ["libdbd-pg-perl", "pflogsumm"]
-        "mariadb-server",
-    ]
 
-    [resources.database]
-    type = "mysql"

scripts/_common.sh

@@ -2,15 +2,91 @@
 # SET ALL CONSTANTS
 #=================================================
 
-pkg_version="3.15.0-izzy1"
+readonly systemd_user=root
-systemd_user=root
+readonly nginx_status_conf="/etc/nginx/conf.d/${app}_status.conf"
 
-nginx_status_conf="/etc/nginx/conf.d/monitorix_status.conf"
+readonly db_user=$app
+
+readonly var_list_to_manage='mysql_installed postgresql_installed memcached_installed redis_installed phpfpm_installed jail_list mount_parts home_user_dirs php_pools_infos net_gateway net_interface_list'
 
 #=================================================
 # DEFINE ALL COMMON FONCTIONS
 #=================================================
 
+installed_php_fpm_filter() {
+    while read -r item; do
+        local version=${item%,*}
+        if ynh_package_is_installed --package=php"$version"-fpm; then
+            echo "$item"
+        fi
+    done
+}
+
+home_dir_filter() {
+    while read -r -d' ' item; do
+        if [ "$item" != /home/yunohost.app ] && [ "$item" != /home/yunohost.backup ]; then
+            echo "$item"
+        fi
+    done
+}
+
+interface_speed_map() {
+    while read -r item; do
+        speed=$(cat /sys/class/net/"$item"/speed || echo 1000)
+        echo "$item,$speed"
+    done
+}
+
+load_vars() {
+    if ynh_package_is_installed --package=mysql; then
+        readonly mysql_installed=true
+    else
+        readonly mysql_installed=false
+    fi
+    if ynh_package_is_installed --package=postgresql; then
+        readonly postgresql_installed=true
+    else
+        readonly postgresql_installed=false
+    fi
+    if ynh_package_is_installed --package=memcached; then
+        readonly memcached_installed=true
+    else
+        readonly memcached_installed=false
+    fi
+    if ynh_package_is_installed --package=redis-server; then
+        readonly redis_installed=true
+    else
+        readonly redis_installed=false
+    fi
+    if ynh_package_is_installed --package='php*-fpm'; then
+        readonly phpfpm_installed=true
+    else
+        readonly phpfpm_installed=false
+    fi
+    readonly jail_list="$(fail2ban-client status |
+        grep 'Jail list:' | sed 's/.*Jail list://' | sed 's/,//g')"
+    readonly mount_parts="$(mount |
+        cut -d' '  -f3 |
+        grep -E -v '^/run|^/dev|^/proc|^/sys|^/snap')"
+    app_data_dirs="$(echo /home/yunohost.app/*)"
+    readonly home_user_dirs="$(echo /home/* | home_dir_filter)"
+    # Note that 'pm.status_listen' option is only supported on php >= 8.0 so we ignore older pools
+    readonly php_pools_infos="$(grep -E '^\[.*\]' \
+            --exclude=/etc/php/*/fpm/pool.d/"$app"_status.conf \
+            --exclude=/etc/php/7.*/fpm/pool.d/* /etc/php/*/fpm/pool.d/* |
+        sed -E 's|/etc/php/([[:digit:]]\.[[:digit:]]+)/fpm/pool.d/.+\.conf\:\[(.+)\]|\1,\2|' |
+        installed_php_fpm_filter)"
+    readonly net_gateway="$(ip --json route show default | jq -r '.[0].dev')"
+    readonly net_interface_list="$(ip --json link show | jq -r '.[].ifname | select(. != "lo")' | interface_speed_map)"
+}
+
+# Used by update_config_if_needed.sh hook
+save_vars_current_value() {
+    for var in $var_list_to_manage; do
+        ynh_app_setting_set --app "$app" --key previous_$var --value "${!var}"
+    done
+}
+
 install_monitorix_package() {
     # Create the temporary directory
     tempdir="$(mktemp -d)"
@@ -20,46 +96,243 @@ install_monitorix_package() {
 
     # Install the package
     ynh_package_install "$tempdir/monitorix.deb"
-
+    cp -r /var/lib/monitorix/* "$data_dir"/
-    # The doc says it should be called only once,
-    # but the code says multiple calls are supported.
-    # Also, they're already installed so that should be quasi instantaneous.
-    ynh_install_app_dependencies monitorix="$pkg_version"
-
-    # Mark packages as dependencies, to allow automatic removal
-    apt-mark auto monitorix
 }
 
-config_monitorix() {
+configure_db() {
-    jail_list=$(fail2ban-client status | grep 'Jail list:' | sed 's/.*Jail list://' | sed 's/,//g')
+    # Here the idea is to monitor available database
-    f2b_additional_jail=""
+    # So if mysql is installed we monitor it but mysql could also not be installed and in this case don't need to monitor it
-    for jail in $jail_list; do
+    # For postgresql it's the same case
-        if ! [[ "$jail" =~ (recidive|pam-generic|yunohost|postfix|postfix-sasl|dovecot|nginx-http-auth|sshd|sshd-ddos) ]]; then
+    if $mysql_installed && ! ynh_mysql_user_exists --user="$db_user"; then
-            if [ -z "$f2b_additional_jail" ]; then
+        ynh_mysql_create_user "$db_user" "$db_pwd"
-                f2b_additional_jail="[$jail]"
+    fi
-            else
+    if $postgresql_installed && ! ynh_psql_user_exists --user="$db_user"; then
-                f2b_additional_jail+=", [$jail]"
+        ynh_psql_create_user "$db_user" "$db_pwd"
+    fi
+}
+
+config_php_fpm() {
+    for pool_dir_by_version in /etc/php/*; do
+        pool_version=$(echo "$pool_dir_by_version" | cut -d/ -f4)
+        pool_file="/etc/php/$pool_version/fpm/pool.d/${app}_status.conf"
+        if ynh_package_is_installed --package="php$pool_version-fpm"; then
+            ynh_add_jinja_config --template=php_status.conf --destination="$pool_file"
+
+            chown root:root "$pool_file"
+            chmod 444 "$pool_file"
+            ynh_systemd_action --service_name="php$pool_version"-fpm.service --action=reload
+        else
+            if [ -e "$pool_file" ]; then
+                ynh_secure_remove --file="$pool_file"
             fi
         fi
     done
+}
 
-    ynh_add_config --template=../conf/monitorix.conf --destination="/etc/monitorix/monitorix.conf"
+configure_hooks() {
+    ynh_replace_string --match_string=__INSTALL_DIR__ --replace_string="$install_dir" --target_file=../hooks/post_app_install
+    ynh_replace_string --match_string=__INSTALL_DIR__ --replace_string="$install_dir" --target_file=../hooks/post_app_remove
+    ynh_replace_string --match_string=__INSTALL_DIR__ --replace_string="$install_dir" --target_file=../hooks/post_app_upgrade
+
+    cp ../sources/update_config_if_needed.sh "$install_dir"/
+    ynh_replace_string --match_string=__APP__ --replace_string="$app" --target_file="$install_dir"/update_config_if_needed.sh
+}
+
+configure_alerts_email() {
+    ynh_add_config --template=monitorix-alert.sh --destination="$install_dir"/monitorix-alert.sh
+    for alias_file in system.loadavg-alert.sh \
+                      fs.loadavg-alert.sh \
+                      mail.mqueued-alert.sh \
+                      mail.delvd-alert.sh
+    do
+        alias_path="$install_dir/$alias_file"
+        if [ ! -h "$alias_path" ]; then
+            if [ -e "$alias_path" ]; then
+                ynh_secure_remove --file="$alias_path"
+            fi
+            ln -s "$install_dir/monitorix-alert.sh" "$install_dir/$alias_file"
+        fi
+    done
+}
+
+ensure_vars_set() {
+    if [ -z "${db_pwd:-}" ]; then
+        db_pwd="$(ynh_string_random 12)"
+        ynh_app_setting_set --app="$app" --key=db_pwd --value="$db_pwd"
+    fi
+
+    if [ -z "${alerts_email:-}" ]; then
+        alerts_email="admins@$domain"
+        ynh_app_setting_set --app="$app" --key=alerts_email --value="$alerts_email"
+    fi
+    if [ -z "${enable_hourly_view:-}" ]; then
+        enable_hourly_view=n
+        ynh_app_setting_set --app="$app" --key=enable_hourly_view --value="$enable_hourly_view"
+    fi
+    if [ -z "${image_format:-}" ]; then
+        image_format=svg
+        ynh_app_setting_set --app="$app" --key=image_format --value="$image_format"
+    fi
+    if [ -z "${theme_color:-}" ]; then
+        theme_color=black
+        ynh_app_setting_set --app="$app" --key=theme_color --value="$theme_color"
+    fi
+    if [ -z "${max_historic_years:-}" ]; then
+        max_historic_years=5
+        ynh_app_setting_set --app="$app" --key=max_historic_years --value="$max_historic_years"
+    fi
+    if [ -z "${process_priority:-}" ]; then
+        process_priority=0
+        ynh_app_setting_set --app="$app" --key=process_priority --value="$process_priority"
+    fi
+
+    if [ -z "${system_alerts_loadavg_enabled:-}" ]; then
+        system_alerts_loadavg_enabled=n
+        ynh_app_setting_set --app="$app" --key=system_alerts_loadavg_enabled --value="$system_alerts_loadavg_enabled"
+    fi
+    if [ -z "${system_alerts_loadavg_timeintvl:-}" ]; then
+        system_alerts_loadavg_timeintvl=3600
+        ynh_app_setting_set --app="$app" --key=system_alerts_loadavg_timeintvl --value="$system_alerts_loadavg_timeintvl"
+    fi
+    if [ -z "${system_alerts_loadavg_threshold:-}" ]; then
+        system_alerts_loadavg_threshold=5.0
+        ynh_app_setting_set --app="$app" --key=system_alerts_loadavg_threshold --value="$system_alerts_loadavg_threshold"
+    fi
+
+    if [ -z "${disk_alerts_loadavg_enabled:-}" ]; then
+        disk_alerts_loadavg_enabled=false
+        ynh_app_setting_set --app="$app" --key=disk_alerts_loadavg_enabled --value="$disk_alerts_loadavg_enabled"
+    fi
+    if [ -z "${disk_alerts_loadavg_timeintvl:-}" ]; then
+        disk_alerts_loadavg_timeintvl=3600
+        ynh_app_setting_set --app="$app" --key=disk_alerts_loadavg_timeintvl --value="$disk_alerts_loadavg_timeintvl"
+    fi
+    if [ -z "${disk_alerts_loadavg_threshold:-}" ]; then
+        disk_alerts_loadavg_threshold=98
+        ynh_app_setting_set --app="$app" --key=disk_alerts_loadavg_threshold --value="$disk_alerts_loadavg_threshold"
+    fi
+
+    if [ -z "${mail_delvd_enabled:-}" ]; then
+        mail_delvd_enabled=n
+        ynh_app_setting_set --app="$app" --key=mail_delvd_enabled --value="$mail_delvd_enabled"
+    fi
+    if [ -z "${mail_delvd_timeintvl:-}" ]; then
+        mail_delvd_timeintvl=60
+        ynh_app_setting_set --app="$app" --key=mail_delvd_timeintvl --value="$mail_delvd_timeintvl"
+    fi
+    if [ -z "${mail_delvd_threshold:-}" ]; then
+        mail_delvd_threshold=100
+        ynh_app_setting_set --app="$app" --key=mail_delvd_threshold --value="$mail_delvd_threshold"
+    fi
+    if [ -z "${mail_mqueued_enabled:-}" ]; then
+        mail_mqueued_enabled=n
+        ynh_app_setting_set --app="$app" --key=mail_mqueued_enabled --value="$mail_mqueued_enabled"
+    fi
+    if [ -z "${mail_mqueued_timeintvl:-}" ]; then
+        mail_mqueued_timeintvl=3600
+        ynh_app_setting_set --app="$app" --key=mail_mqueued_timeintvl --value="$mail_mqueued_timeintvl"
+    fi
+    if [ -z "${mail_mqueued_threshold:-}" ]; then
+        mail_mqueued_threshold=100
+        ynh_app_setting_set --app="$app" --key=mail_mqueued_threshold --value="$mail_mqueued_threshold"
+    fi
+
+    if [ -z "${emailreports_enabled:-}" ]; then
+        emailreports_enabled=n
+        ynh_app_setting_set --app="$app" --key=emailreports_enabled --value="$emailreports_enabled"
+    fi
+    if [ -z "${emailreports_subject_prefix:-}" ]; then
+        emailreports_subject_prefix='Monitorix:'
+        ynh_app_setting_set --app="$app" --key=emailreports_subject_prefix --value="$emailreports_subject_prefix"
+    fi
+    if [ -z "${emailreports_hour:-}" ]; then
+        emailreports_hour=0
+        ynh_app_setting_set --app="$app" --key=emailreports_hour --value="$emailreports_hour"
+    fi
+    if [ -z "${emailreports_minute:-}" ]; then
+        emailreports_minute=0
+        ynh_app_setting_set --app="$app" --key=emailreports_minute --value="$emailreports_minute"
+    fi
+
+    if [ -z "${emailreports_daily_enabled:-}" ]; then
+        emailreports_daily_enabled=n
+        ynh_app_setting_set --app="$app" --key=emailreports_daily_enabled --value="$emailreports_daily_enabled"
+    fi
+    if [ -z "${emailreports_daily_graphs:-}" ]; then
+        emailreports_daily_graphs='system,fs'
+        ynh_app_setting_set --app="$app" --key=emailreports_daily_graphs --value="$emailreports_daily_graphs"
+    fi
+    if [ -z "${emailreports_daily_to:-}" ]; then
+        emailreports_daily_to="admins@$domain"
+        ynh_app_setting_set --app="$app" --key=emailreports_daily_to --value="$emailreports_daily_to"
+    fi
+
+    if [ -z "${emailreports_weekly_enabled:-}" ]; then
+        emailreports_weekly_enabled=n
+        ynh_app_setting_set --app="$app" --key=emailreports_weekly_enabled --value="$emailreports_weekly_enabled"
+    fi
+    if [ -z "${emailreports_weekly_graphs:-}" ]; then
+        emailreports_weekly_graphs='system,fs'
+        ynh_app_setting_set --app="$app" --key=emailreports_weekly_graphs --value="$emailreports_weekly_graphs"
+    fi
+    if [ -z "${emailreports_weekly_to:-}" ]; then
+        emailreports_weekly_to="admins@$domain"
+        ynh_app_setting_set --app="$app" --key=emailreports_weekly_to --value="$emailreports_weekly_to"
+    fi
+
+    if [ -z "${emailreports_monthly_enabled:-}" ]; then
+        emailreports_monthly_enabled=n
+        ynh_app_setting_set --app="$app" --key=emailreports_monthly_enabled --value="$emailreports_monthly_enabled"
+    fi
+    if [ -z "${emailreports_monthly_graphs:-}" ]; then
+        emailreports_monthly_graphs='system,fs'
+        ynh_app_setting_set --app="$app" --key=emailreports_monthly_graphs --value="$emailreports_monthly_graphs"
+    fi
+    if [ -z "${emailreports_monthly_to:-}" ]; then
+        emailreports_monthly_to="admins@$domain"
+        ynh_app_setting_set --app="$app" --key=emailreports_monthly_to --value="$emailreports_monthly_to"
+    fi
+
+    if [ -z "${emailreports_yearly_enabled:-}" ]; then
+        emailreports_yearly_enabled=n
+        ynh_app_setting_set --app="$app" --key=emailreports_yearly_enabled --value="$emailreports_yearly_enabled"
+    fi
+    if [ -z "${emailreports_yearly_graphs:-}" ]; then
+        emailreports_yearly_graphs='system,fs'
+        ynh_app_setting_set --app="$app" --key=emailreports_yearly_graphs --value="$emailreports_yearly_graphs"
+    fi
+    if [ -z "${emailreports_yearly_to:-}" ]; then
+        emailreports_yearly_to="admins@$domain"
+        ynh_app_setting_set --app="$app" --key=emailreports_yearly_to --value="$emailreports_yearly_to"
+    fi
 }
 
 set_permission() {
-    chown www-data:root -R /etc/monitorix
+    chown "$app":root -R /etc/monitorix
     chmod u=rX,g=rwX,o= -R /etc/monitorix
-    chown www-data:root -R /var/lib/monitorix
+    chown www-data:root -R "$nginx_status_conf"
-    chmod u=rwX,g=rwX,o= -R /var/lib/monitorix
+    chmod u=r,g=r,o= "$nginx_status_conf"
-}
+    chown "$app":root "$install_dir"
+    chmod u=rwX,g=rwX,o= -R "$install_dir"
+    chmod 750 "$install_dir"/monitorix-alert.sh
+    chown "$app":root -R /var/log/"$app"
+    chmod u=rwX,g=rwX,o= -R /var/log/"$app"
 
-_ynh_systemd_restart_monitorix() {
+    chmod u=rwx,g=rx,o= "$data_dir"
-    # Reload monitorix
+    chown "$app":www-data "$data_dir"
-    # While we stop monitorix sometime the built-in web server is not stopped cleanly. So are sure that everything is cleanly stoped by that
-    # So this fix that
 
-    ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd"
+    chmod u=rwx,g=rx,o= "$data_dir"/*.rrd || true
-    sleep 1
+    chown "$app":root "$data_dir"/*.rrd || true
-    pkill -f "monitorix-httpd listening on" || true
+    find "$data_dir"/{reports,usage} \(   \! -perm -o= \
-    ynh_systemd_action --service_name="$app" --action="start" --log_path 'systemd' --line_match ' - Ok, ready.'
+                                       -o \! -user "$app" \
+                                       -o \! -group "$app" \) \
+                   -exec chown "$app:$app" {} \; \
+                   -exec chmod o= {} \;
+
+    find "$data_dir"/www \(   \! -perm -o= \
+                           -o \! -perm -g=rX \
+                           -o \! -user "$app" \
+                           -o \! -group www-data \) \
+                   -exec chown "$app:www-data" {} \; \
+                   -exec chmod g+rX,o= {} \;
 }

scripts/backup

@@ -8,14 +8,16 @@
 
 # Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
 source ../settings/scripts/_common.sh
+source ../settings/scripts/experimental_helper.sh
 source /usr/share/yunohost/helpers
+load_vars
 
 #=================================================
 # STOP SYSTEMD SERVICE
 #=================================================
-ynh_script_progression --message="Stopping a systemd service..." --weight=1
+if [[ ! "$(systemctl status $app.service)" =~ "Active: inactive (dead)" ]]; then
-
+    ynh_print_warn --message="It's highly recommended to make your backup when the service is stopped. Please stop $app service with this command before to run the backup 'systemctl stop $app.service'"
-ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
+fi
 
 #=================================================
 # DECLARE DATA AND CONF FILES TO BACKUP
@@ -26,8 +28,12 @@ ynh_print_info --message="Declaring files to be backed up..."
 # BACKUP THE NGINX CONFIGURATION
 #=================================================
 
+ynh_backup --src_path="/etc/$app/"
 ynh_backup --src_path "/etc/nginx/conf.d/$domain.d/$app.conf"
-ynh_backup --src_path "/etc/nginx/conf.d/monitorix_status.conf"
+ynh_backup --src_path "$nginx_status_conf"
+
+ynh_print_info --message="Backing up code..."
+ynh_backup --src_path $install_dir
 
 #=================================================
 # SPECIFIC BACKUP
@@ -41,26 +47,7 @@ ynh_backup --src_path "/etc/systemd/system/$app.service"
 # BACKUP VARIOUS FILES
 #=================================================
 
-ynh_backup --src_path "/var/lib/$app" --is_big=1
+ynh_backup --src_path="$data_dir" --is_big=1
-
-ynh_backup --src_path="/etc/$app/"
-
-#=================================================
-# BACKUP THE MYSQL DATABASE
-#=================================================
-ynh_print_info --message="Backing up the MySQL database..."
-
-### (However, things like MySQL dumps *do* take some time to run, though the
-### copy of the generated dump to the archive still happens later)
-
-ynh_mysql_dump_db --database="$db_name" > db.sql
-
-#=================================================
-# RESTART APP
-#=================================================
-ynh_script_progression --message="Starting a systemd service..." --weight=1
-
-_ynh_systemd_restart_monitorix
 
 #=================================================
 # END OF SCRIPT

scripts/change_url

@@ -7,7 +7,9 @@
 #=================================================
 
 source _common.sh
+source experimental_helper.sh
 source /usr/share/yunohost/helpers
+load_vars
 
 #=================================================
 # STANDARD MODIFICATIONS
@@ -29,8 +31,7 @@ ynh_change_url_nginx_config
 # SPECIFIC MODIFICATIONS
 #=================================================
 ynh_script_progression --message="Updating a configuration file..." --weight=1
-
+ynh_add_jinja_config --template=monitorix.conf --destination=/etc/monitorix/monitorix.conf
-config_monitorix
 
 #=================================================
 # GENERIC FINALISATION
@@ -38,8 +39,7 @@ config_monitorix
 # START SYSTEMD SERVICE
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --weight=1
-
+ynh_systemd_action --service_name="$app" --action=start --log_path 'systemd' --line_match ' - Ok, ready.'
-_ynh_systemd_restart_monitorix
 
 #=================================================
 # END OF SCRIPT

scripts/config

@@ -0,0 +1,24 @@
+#!/bin/bash
+# In simple cases, you don't need a config script.
+
+#=================================================
+# IMPORT GENERIC HELPERS
+#=================================================
+
+source ./_common.sh
+source /usr/share/yunohost/helpers
+source ./experimental_helper.sh
+
+ynh_abort_if_errors
+
+ynh_app_config_apply() {
+    _ynh_app_config_apply
+    load_vars
+    ynh_add_jinja_config --template=monitorix.conf --destination="/etc/monitorix/monitorix.conf"
+    save_vars_current_value
+}
+
+#=================================================
+# GENERIC FINALIZATION
+#=================================================
+ynh_app_config_run "$1"

scripts/experimental_helper.sh

@@ -0,0 +1,162 @@
+# Create a dedicated config file from a jinja template
+#
+# usage: ynh_add_jinja_config --template="template" --destination="destination"
+# | arg: -t, --template=     - Template config file to use
+# | arg: -d, --destination=  - Destination of the config file
+# | arg: -i, --ignore_vars=  - List separated by space of script variables to ignore and don't pass in the jinja context.
+# |                            This could be useful mainly for special share which can't be retried by reference name (like the array).
+#
+# examples:
+#    ynh_add_jinja_config --template="app.conf" --destination="$install_dir/app.conf"
+#    ynh_add_jinja_config --template="app-env" --destination="$install_dir/app-env" --ignore_vars="complex_array yolo"
+#
+# The template can be by default the name of a file in the conf directory
+#
+# The helper will verify the checksum and backup the destination file
+# if it's different before applying the new template.
+#
+# And it will calculate and store the destination file checksum
+# into the app settings when configuration is done.
+#
+##
+## About the variables passed to the template:
+##
+#
+# All variable defined in the script are available into the template (as string) except someone described below.
+# If a variable make crash the helper for some reason (by example if the variable is of type array)
+# or you just want to don't pass a specific variable for some other reason you can add it in the '--ignore_vars=' parameter as described above.
+# Here are the list of ignored variable and so there won't never be available in the template:
+# - All system environment variable like (TERM, USER, PATH, LANG, etc).
+#   If you need someone you just need to declare an other variable with the same value.
+#   Note that all Yunohost variable whose name begins by 'YNH_' are available and can be used in the template.
+# - This following list:
+#        legacy_args args_array template destination ignore_vars template_path python_env_var ignore_var_regex
+#        progress_scale progress_string0 progress_string1 progress_string2
+#        old changed binds types file_hash formats
+#
+##
+## Usage in templates:
+##
+#
+# For a full documentation of the template you can refer to: https://jinja.palletsprojects.com/en/3.1.x/templates/
+# In Yunohost context there are no really some specificity except that all variable passed are of type string.
+# So here are some example of recommended usage:
+#
+# If you need a conditional block
+#
+# {% if should_my_block_be_shown == 'true' %}
+# ...
+# {% endif %}
+#
+# or
+#
+# {% if should_my_block_be_shown == '1' %}
+# ...
+# {% endif %}
+#
+# If you need to iterate with loop:
+#
+# {% for yolo in var_with_multiline_value.splitlines() %}
+# ...
+# {% endfor %}
+#
+# or
+#
+# {% for jail in my_var_with_coma.split(',') %}
+# ...
+# {% endfor %}
+#
+ynh_add_jinja_config() {
+    # Declare an array to define the options of this helper.
+    local legacy_args=tdi
+    local -A args_array=([t]=template= [d]=destination= [i]=ignore_vars= )
+    local template
+    local destination
+    local ignore_vars
+    # Manage arguments with getopts
+    ynh_handle_getopts_args "$@"
+    local template_path
+
+    #
+    ## List of all vars ignored and not passed to the template
+    # WARNING Update the list on the helper documentation at the top of the helper, if you change this list
+    #
+
+    # local vars used in the helper
+    ignore_vars+=" legacy_args args_array template destination ignore_vars template_path python_env_var ignore_var_regex"
+    # yunohost helpers
+    ignore_vars+=" progress_scale progress_string0 progress_string1 progress_string2"
+    # Arrays used in config panel
+    ignore_vars+=" old changed binds types file_hash formats"
+
+    if [ -f "$YNH_APP_BASEDIR/conf/$template" ]; then
+        template_path="$YNH_APP_BASEDIR/conf/$template"
+    elif [ -f "$template" ]; then
+        template_path=$template
+    else
+        ynh_die --message="The provided template $template doesn't exist"
+    fi
+
+    ynh_backup_if_checksum_is_different --file="$destination"
+
+    # Make sure to set the permissions before we copy the file
+    # This is to cover a case where an attacker could have
+    # created a file beforehand to have control over it
+    # (cp won't overwrite ownership / modes by default...)
+    touch "$destination"
+    chown root:root "$destination"
+    chmod 640 "$destination"
+
+    local python_env_var=''
+    local ignore_var_regex
+    ignore_var_regex="$(echo "$ignore_vars" | sed -E 's@^\s*(.*\w)\s*$@\1@g' | sed -E 's@(\s+)@|@g')"
+    while read -r one_var; do
+        # Blacklist of var to not pass to template
+        if { [[ "$one_var" =~ ^[A-Z0-9_]+$ ]] && [[ "$one_var" != YNH_* ]]; } \
+            || [[ "$one_var" =~ ^($ignore_var_regex)$ ]]; then
+            continue
+        fi
+        # Well python is very bad for the last character on raw string
+        # https://stackoverflow.com/questions/647769/why-cant-pythons-raw-string-literals-end-with-a-single-backslash
+        # So the solution here is to add one last char '-' so we know what it is
+        # and we are sure that it not \ or ' or something else which will be problematic with python
+        # And then we remove it while we are processing
+        python_env_var+="$one_var=r'''${!one_var}-'''[:-1],"
+    done <<< "$(compgen -v)"
+
+    _ynh_apply_default_permissions "$destination"
+    (
+        python3 -c 'import os, sys, jinja2; sys.stdout.write(
+                    jinja2.Template(source=sys.stdin.read(),
+                                    undefined=jinja2.StrictUndefined,
+                    ).render('"$python_env_var"'));' <"$template_path" >"$destination"
+    )
+    ynh_store_file_checksum --file="$destination"
+}
+
+# Check either a package is installed or not
+#
+# example: ynh_package_is_installed --package=yunohost && echo "installed"
+#
+# usage: ynh_package_is_installed --package=name [--wait_dpkg_free]
+# | arg: -p, --package=          - the package name to check
+# | arg: -l, --wait_dpkg_free=   - wait for dpkg to be free.
+# |                                Note that waiting on dpkg free could take about 0.2s on quick platform
+# |                                and about 2 seconds on slow platform so in case of multiple call it could be slow
+# | ret: 0 if the package is installed, 1 else.
+ynh_package_is_installed() {
+    # Declare an array to define the options of this helper.
+    local legacy_args=pl
+    local -A args_array=([p]=package= [l]=wait_dpkg_free=)
+    local package
+    local wait_dpkg_free
+    # Manage arguments with getopts
+    ynh_handle_getopts_args "$@"
+    wait_dpkg_free="${wait_dpkg_free:-0}"
+
+    if [ "$wait_dpkg_free" -eq 1 ]; then
+        ynh_wait_dpkg_free
+    fi
+    dpkg-query --show --showformat='${Status}' "$package" 2>/dev/null \
+        | grep --count "ok installed" &>/dev/null
+}

scripts/install

@@ -7,16 +7,22 @@
 #=================================================
 
 source _common.sh
+source experimental_helper.sh
 source /usr/share/yunohost/helpers
+load_vars
+
+ensure_vars_set
 
 #=================================================
-# CHECK EXISTING DIRECTORIES
+# Check datadir empty
 #=================================================
 
-if [ -e "/var/lib/monitorix" ]; then
+if [ -n "$(ls -A $data_dir)" ]; then
-    old_data_dir_path="/var/lib/monitorix$(date '+%Y%m%d.%H%M%S')"
+    old_data_dir_path="${data_dir}_$(date '+%Y%m%d.%H%M%S')"
-    ynh_print_warn "A data directory already exist. Data was renamed to $old_data_dir_path"
+    ynh_print_warn --message="Data directory was not empty. Data was moved to $old_data_dir_path"
-    mv "/var/lib/monitorix" "$old_data_dir_path"
+    mkdir -p $old_data_dir_path
+    mv -t "$old_data_dir_path" "$data_dir"/*
+    app_data_dirs="$(echo /home/yunohost.app/*)"
 fi
 
 #=================================================
@@ -27,27 +33,34 @@ ynh_script_progression --message="Installing packages..." --weight=1
 # Download package and install it
 install_monitorix_package
 
-ynh_systemd_action --service_name="$app" --action="stop" --log_path="systemd" --timeout=15
+ynh_systemd_action --service_name="$app" --action=stop --log_path=systemd --timeout=15
+mkdir -p /var/log/new_"${app}"
+mv -t /var/log/new_"${app}" /var/log/monitorix*
+mv /var/log/new_"${app}" /var/log/"${app}"
 
 #=================================================
 # SYSTEM CONFIGURATION
 #=================================================ç
-ynh_script_progression --message="Adding system configurations related to $app..." --weight=1
+ynh_script_progression --message="Adding configurations related to $app..." --weight=1
 
-ynh_add_systemd_config
+ynh_add_jinja_config --template=monitorix.conf --destination="/etc/monitorix/monitorix.conf"
-yunohost service add "$app" --description="Monitorix" --log=systemd
+ynh_add_jinja_config --template=nginx_status.conf --destination "$nginx_status_conf"
 
-ynh_add_config --template "nginx_status.conf" --destination "$nginx_status_conf"
 ynh_add_nginx_config
+ynh_add_systemd_config
 
-#=================================================
+yunohost service add "$app" --description=Monitorix --log=systemd
-# SPECIFIC SETUP
-#=================================================
-# ADD A CONFIGURATION
-#=================================================
-ynh_script_progression --message="Adding a configuration file..." --weight=1
 
-config_monitorix
+ynh_script_progression --message="Configuring databases access..."
+configure_db
+
+ynh_script_progression --message="Configuring php fpm access if needed..."
+if "$phpfpm_installed"; then
+    config_php_fpm
+fi
+
+configure_hooks
+configure_alerts_email
 
 #=================================================
 # GENERIC FINALIZATION
@@ -56,12 +69,15 @@ ynh_script_progression --message="Protecting directory..."
 
 set_permission
 
+ynh_use_logrotate --logfile "/var/log/$app"
+
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --weight=1
 
-_ynh_systemd_restart_monitorix
+ynh_systemd_action --service_name="$app" --action="start" --log_path 'systemd' --line_match ' - Ok, ready.'
+save_vars_current_value
 
 #=================================================
 # END OF SCRIPT

scripts/remove

@@ -7,7 +7,9 @@
 #=================================================
 
 source _common.sh
+source experimental_helper.sh
 source /usr/share/yunohost/helpers
+load_vars
 
 #=================================================
 # STANDARD REMOVE
@@ -18,8 +20,8 @@ source /usr/share/yunohost/helpers
 # Remove the service from the list of services known by YunoHost (added from `yunohost service add`)
 if ynh_exec_warn_less yunohost service status $app >/dev/null
 then
-	ynh_script_progression --message="Removing $app service integration..." --weight=3
+    ynh_script_progression --message="Removing $app service integration..." --weight=3
-	yunohost service remove "$app"
+    yunohost service remove "$app"
 fi
 
 #=================================================
@@ -34,9 +36,27 @@ ynh_remove_nginx_config
 
 ynh_remove_systemd_config
 
-#=================================================
+# Remove the app-specific logrotate config
-# END OF SCRIPT
+ynh_remove_logrotate
-#=================================================
+
-ynh_print_info --message="Due of the backup core only feature the data directory in '/var/lib/monitorix' was not removed. It need to be removed manually to purge app user data."
+for pool_dir_by_version in /etc/php/*; do
+    pool_version=$(echo "$pool_dir_by_version" | cut -d/ -f4)
+    pool_file="/etc/php/$pool_version/fpm/pool.d/${app}_status.conf"
+    ynh_secure_remove --file="$pool_file"
+    if ynh_package_is_installed --package="php$pool_version-fpm"; then
+        ynh_systemd_action --service_name="php$pool_version"-fpm.service --action=reload
+    fi
+done
+
+if ynh_psql_user_exists --user=$db_user; then
+    ynh_psql_drop_user $db_user
+fi
+if ynh_mysql_user_exists --user=$db_user; then
+    ynh_mysql_drop_user $db_user
+fi
+
+ynh_package_autopurge monitorix
+ynh_secure_remove --file=/var/log/"$app"
+ynh_secure_remove --file="$install_dir"
 
 ynh_script_progression --message="Removal of $app completed" --last

scripts/restore

@@ -8,8 +8,9 @@
 
 # Keep this path for calling _common.sh inside the execution's context of backup and restore scripts
 source ../settings/scripts/_common.sh
+source ../settings/scripts/experimental_helper.sh
 source /usr/share/yunohost/helpers
-
+load_vars
 
 #=================================================
 # RESTORE THE DEPENDENCIES
@@ -17,35 +18,30 @@ source /usr/share/yunohost/helpers
 ynh_script_progression --message="Restoring the dependencies..." --weight=1
 
 install_monitorix_package
-ynh_systemd_action --service_name="$app" --action="stop" --log_path="systemd" --timeout=15
+ynh_systemd_action --service_name="$app" --action=stop --log_path=systemd --timeout=15
+mkdir -p /var/log/new_"${app}"
+mv -t /var/log/new_"${app}" /var/log/monitorix*
+mv /var/log/new_"${app}" /var/log/"${app}"
 
-#=================================================
+ynh_script_progression --message="Configuring databases access..."
-# RESTORE THE MYSQL DATABASE
+configure_db
-#=================================================
-ynh_script_progression --message="Restoring the MySQL database..." --weight=1
-
-ynh_mysql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < ./db.sql
 
 #=================================================
 # RESTORE SYSTEM CONFIGURATIONS
 #=================================================
-ynh_script_progression --message="Restoring system configurations related to $app..." --weight=1
+ynh_script_progression --message="Restoring files" --weight=1
 
-ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
+ynh_restore
-ynh_restore_file --origin_path "/etc/nginx/conf.d/monitorix_status.conf"
+mkdir -p /var/log/$app
-
-ynh_restore_file --origin_path="/etc/systemd/system/$app.service"
 systemctl enable $app.service --quiet
 
+ynh_script_progression --message="Configuring php fpm access if needed..."
+if "$phpfpm_installed"; then
+    config_php_fpm
+fi
+
 yunohost service add $app --description="Monitorix" --log="systemd"
 
-# Directories created by the dep package
-ynh_secure_remove --file="/etc/$app"
-ynh_secure_remove --file="/var/lib/$app"
-
-ynh_restore_file --origin_path="/var/lib/$app" --not_mandatory
-ynh_restore_file --origin_path="/etc/$app/"
-
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
@@ -53,6 +49,8 @@ ynh_script_progression --message="Protecting directory..."
 
 set_permission
 
+ynh_use_logrotate --logfile "/var/log/$app"
+
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
@@ -60,7 +58,7 @@ set_permission
 #=================================================
 ynh_script_progression --message="Reloading NGINX web server and $app's service..." --weight=1
 
-_ynh_systemd_restart_monitorix
+ynh_systemd_action --service_name="$app" --action=start --log_path 'systemd' --line_match ' - Ok, ready.'
 
 ynh_systemd_action --service_name=nginx --action=reload
 

scripts/upgrade

@@ -7,12 +7,20 @@
 #=================================================
 
 source _common.sh
+source experimental_helper.sh
 source /usr/share/yunohost/helpers
+load_vars
 
 upgrade_type=$(ynh_check_app_version_changed)
 
 #=================================================
 # STANDARD UPGRADE STEPS
+#=================================================
+# MIGRATION 5 : Manage old settings
+#=================================================
+
+ensure_vars_set
+
 #=================================================
 # ENSURE DOWNWARD COMPATIBILITY
 #=================================================
@@ -29,7 +37,7 @@ ynh_secure_remove --file=/usr/share/yunohost/hooks/post_iptable_rules/50-$app
 #=================================================
 ynh_script_progression --message="Stopping a systemd service..." --weight=1
 
-ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name=$app --action=stop --log_path="/var/log/$app/$app.log"
 
 #=================================================
 # "REBUILD" THE APP (DEPLOY NEW SOURCES, RERUN NPM BUILD...)
@@ -37,36 +45,57 @@ ynh_systemd_action --service_name=$app --action="stop" --log_path="/var/log/$app
 # DOWNLOAD, CHECK AND UNPACK SOURCE
 #=================================================
 
-if [ "$upgrade_type" == "UPGRADE_APP" ]
+if [ "$upgrade_type" == UPGRADE_APP ]
 then
-	ynh_script_progression --message="Upgrading source files..." --weight=1
+    ynh_script_progression --message="Upgrading source files..." --weight=1
 
-	# Download, check integrity, uncompress and patch the source from manifest.toml
+    # Download, check integrity, uncompress and patch the source from manifest.toml
-	install_monitorix_package
+    install_monitorix_package
 fi
 
-ynh_systemd_action --service_name="$app" --action="stop" --log_path="systemd" --timeout=15
+ynh_systemd_action --service_name="$app" --action=stop --log_path=systemd --timeout=15
+
+#=================================================
+# MIGRATION 2
+#=================================================
+
+# Migrate log files
+if [ ! -d /var/log/"${app}" ]; then
+    mkdir -p /var/log/new_"${app}"
+    mv -t /var/log/new_"${app}" /var/log/monitorix*
+    mv /var/log/new_"${app}" /var/log/"${app}"
+fi
+
+# Migrate data directory
+if [ -e /var/lib/monitorix/system.rrd ] && [ ! -e "$data_dir"/system.rrd ] ; then
+    mv -tf "$data_dir/" /var/lib/monitorix/*
+fi
 
 #=================================================
 # REAPPLY SYSTEM CONFIGURATIONS
 #=================================================
-ynh_script_progression --message="Upgrading system configurations related to $app..." --weight=1
+ynh_script_progression --message="Upgrading configurations related to $app..." --weight=1
 
-ynh_add_config --template "nginx_status.conf" --destination "$nginx_status_conf"
+ynh_add_jinja_config --template=monitorix.conf --destination=/etc/monitorix/monitorix.conf
+ynh_add_jinja_config --template=nginx_status.conf --destination "$nginx_status_conf"
+if "$phpfpm_installed"; then
+    config_php_fpm
+fi
 ynh_add_nginx_config
-
 ynh_add_systemd_config
 
-yunohost service add $app --description="Monitorix" --log="systemd"
+yunohost service add "$app" --description=Monitorix --log=systemd
 
-#=================================================
+ynh_script_progression --message="Configuring databases access..."
-# RECONFIGURE THE APP (UPDATE CONF, APPLY MIGRATIONS...)
+configure_db
-#=================================================
-# UPDATE A CONFIG FILE
-#=================================================
-ynh_script_progression --message="Updating a configuration file..." --weight=1
 
-config_monitorix
+ynh_script_progression --message="Configuring php fpm access if needed..."
+if "$phpfpm_installed"; then
+    config_php_fpm
+fi
+
+configure_hooks
+configure_alerts_email
 
 #=================================================
 # GENERIC FINALIZATION
@@ -75,12 +104,15 @@ ynh_script_progression --message="Protecting directory..."
 
 set_permission
 
+ynh_use_logrotate --logfile "/var/log/$app"
+
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --weight=1
 
-_ynh_systemd_restart_monitorix
+ynh_systemd_action --service_name="$app" --action=restart --log_path=systemd --line_match ' - Ok, ready.'
+save_vars_current_value
 
 #=================================================
 # END OF SCRIPT

sources/update_config_if_needed.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+
+set -eu
+
+app=__APP__
+YNH_APP_BASEDIR=/etc/yunohost/apps/"$app"
+
+pushd /etc/yunohost/apps/$app/conf
+source ../scripts/_common.sh
+source /usr/share/yunohost/helpers
+# Must load experimental helper after because we need the patched version of ynh_package_is_installed
+# To make the hook not too slow. It's mainly for optimization.
+source ../scripts/experimental_helper.sh
+load_vars
+
+status_dirty=false
+for var in $var_list_to_manage; do
+    value="$(ynh_app_setting_get --app="$app" --key=previous_$var)"
+    if [ "${!var}" != "$value" ]; then
+        status_dirty=true
+        break
+    fi
+done
+
+if "$status_dirty"; then
+    install_dir="$(ynh_app_setting_get --app="$app" --key=install_dir)"
+    data_dir="$(ynh_app_setting_get --app="$app" --key=data_dir)"
+    db_pwd="$(ynh_app_setting_get --app="$app" --key=db_pwd)"
+    domain="$(ynh_app_setting_get --app="$app" --key=domain)"
+    path="$(ynh_app_setting_get --app="$app" --key=path)"
+    port="$(ynh_app_setting_get --app="$app" --key=port)"
+    port_nginx_status="$(ynh_app_setting_get --app="$app" --key=port_nginx_status)"
+    port_nginx_status="$(ynh_app_setting_get --app="$app" --key=port_nginx_status)"
+
+    alerts_email="$(ynh_app_setting_get --app="$app" --key=alerts_email)"
+    enable_hourly_view="$(ynh_app_setting_get --app="$app" --key=enable_hourly_view)"
+    image_format="$(ynh_app_setting_get --app="$app" --key=image_format)"
+    theme_color="$(ynh_app_setting_get --app="$app" --key=theme_color)"
+    max_historic_years="$(ynh_app_setting_get --app="$app" --key=max_historic_years)"
+    process_priority="$(ynh_app_setting_get --app="$app" --key=process_priority)"
+
+    system_alerts_loadavg_enabled="$(ynh_app_setting_get --app="$app" --key=system_alerts_loadavg_enabled)"
+    system_alerts_loadavg_timeintvl="$(ynh_app_setting_get --app="$app" --key=system_alerts_loadavg_timeintvl)"
+    system_alerts_loadavg_threshold="$(ynh_app_setting_get --app="$app" --key=system_alerts_loadavg_threshold)"
+
+    disk_alerts_loadavg_enabled="$(ynh_app_setting_get --app="$app" --key=disk_alerts_loadavg_enabled)"
+    disk_alerts_loadavg_timeintvl="$(ynh_app_setting_get --app="$app" --key=disk_alerts_loadavg_timeintvl)"
+    disk_alerts_loadavg_threshold="$(ynh_app_setting_get --app="$app" --key=disk_alerts_loadavg_threshold)"
+
+    mail_delvd_enabled="$(ynh_app_setting_get --app="$app" --key=mail_delvd_enabled)"
+    mail_delvd_timeintvl="$(ynh_app_setting_get --app="$app" --key=mail_delvd_timeintvl)"
+    mail_delvd_threshold="$(ynh_app_setting_get --app="$app" --key=mail_delvd_threshold)"
+    mail_mqueued_enabled="$(ynh_app_setting_get --app="$app" --key=mail_mqueued_enabled)"
+    mail_mqueued_timeintvl="$(ynh_app_setting_get --app="$app" --key=mail_mqueued_timeintvl)"
+    mail_mqueued_threshold="$(ynh_app_setting_get --app="$app" --key=mail_mqueued_threshold)"
+
+    emailreports_enabled="$(ynh_app_setting_get --app="$app" --key=emailreports_enabled)"
+    emailreports_subject_prefix="$(ynh_app_setting_get --app="$app" --key=emailreports_subject_prefix)"
+    emailreports_hour="$(ynh_app_setting_get --app="$app" --key=emailreports_hour)"
+    emailreports_minute="$(ynh_app_setting_get --app="$app" --key=emailreports_minute)"
+
+    emailreports_daily_enabled="$(ynh_app_setting_get --app="$app" --key=emailreports_daily_enabled)"
+    emailreports_daily_graphs="$(ynh_app_setting_get --app="$app" --key=emailreports_daily_graphs)"
+    emailreports_daily_to="$(ynh_app_setting_get --app="$app" --key=emailreports_daily_to)"
+
+    emailreports_weekly_enabled="$(ynh_app_setting_get --app="$app" --key=emailreports_weekly_enabled)"
+    emailreports_weekly_graphs="$(ynh_app_setting_get --app="$app" --key=emailreports_weekly_graphs)"
+    emailreports_weekly_to="$(ynh_app_setting_get --app="$app" --key=emailreports_weekly_to)"
+
+    emailreports_monthly_enabled="$(ynh_app_setting_get --app="$app" --key=emailreports_monthly_enabled)"
+    emailreports_monthly_graphs="$(ynh_app_setting_get --app="$app" --key=emailreports_monthly_graphs)"
+    emailreports_monthly_to="$(ynh_app_setting_get --app="$app" --key=emailreports_monthly_to)"
+
+    emailreports_yearly_enabled="$(ynh_app_setting_get --app="$app" --key=emailreports_yearly_enabled)"
+    emailreports_yearly_graphs="$(ynh_app_setting_get --app="$app" --key=emailreports_yearly_graphs)"
+    emailreports_yearly_to="$(ynh_app_setting_get --app="$app" --key=emailreports_yearly_to)"
+
+    ynh_add_jinja_config --template=monitorix.conf --destination="/etc/monitorix/monitorix.conf"
+    ynh_add_jinja_config --template=nginx_status.conf --destination "$nginx_status_conf"
+    configure_db
+
+    if "$phpfpm_installed"; then
+        config_php_fpm
+    fi
+    ynh_systemd_action --service_name="$app" --action=restart --log_path 'systemd' --line_match ' - Ok, ready.'
+    ynh_systemd_action --service_name=nginx --action=reload
+    save_vars_current_value
+fi

tests.toml

@@ -6,5 +6,6 @@ test_format = 1.0
 
     exclude = []
 
-    [default.test_upgrade_from.6ea6f67f5d3b7a3303a5ff2f4640e6e01cb6bdae]
+    test_upgrade_from.6ea6f67f5d3b7a3303a5ff2f4640e6e01cb6bdae.name = "v3.15.0~ynh3 (manifestv1)"
-    name = "v3.15.0~ynh3 (manifestv1)"
+
+    test_upgrade_from.9b82e772d59aa586dd2e0d5c7e9adac09f2d030e.name = "v3.15.0~ynh4 (pre refactoring)"