diff --git a/README.md b/README.md index 2311ba2..448aa87 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,17 @@ Custom Webapp ------------- -Empty App with a file access to the web directory. +Empty application with SFTP access to the Web directory. + +It can also create a MySQL database. In that case, the connection details +will be stored in the file `db_accesss.txt` located in the root folder of +the SFTP user. + +## TODO + + * Update `upgrade` script and manage upgrading from current official app + * Update `backup` and `restore` scripts + +## Links + +**YunoHost**: https://yunohost.org/ diff --git a/conf/nginx.conf b/conf/nginx.conf index a390085..b23a85b 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -1,45 +1,18 @@ -location LOCATIONTOCHANGE { - alias ALIASTOCHANGEfiles/; - index index.php index.html index.htm; - default_type text/html; - - client_max_body_size 1G; - +location {LOCATION} { + alias {DESTDIR}/www; + if ($scheme = http) { + rewrite ^ https://$server_name$request_uri? permanent; + } + index index.html index.php ; + try_files $uri $uri/ index.php; location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; - fastcgi_pass unix:/var/run/php5-fpm-NAMETOCHANGE.sock; + fastcgi_pass unix:/var/run/php5-fpm-{POOLNAME}.sock; fastcgi_index index.php; include fastcgi_params; - fastcgi_param REMOTE_USER $remote_user; - fastcgi_param PATH_INFO $fastcgi_path_info; - fastcgi_param SCRIPT_FILENAME $request_filename; - } - - # Include SSOWAT user panel. - include conf.d/yunohost_panel.conf.inc; -} - -# Admin location - DO NOT EDIT -location PATHTOCHANGE/admin/_assets { - alias /var/www/my_webapp/_assets/; -} - -location PATHTOCHANGE/admin { - alias /var/www/my_webapp/; - - client_max_body_size 10G; - - location ~ ^PATHTOCHANGE/admin$ { - rewrite ^(.*) $1/ redirect; - } - - location ~ ^PATHTOCHANGE/admin/ { - fastcgi_split_path_info ^(PATHTOCHANGE/admin)(/?.*)$; - fastcgi_pass unix:/var/run/php5-fpm-NAMETOCHANGE.sock; - include fastcgi_params; - fastcgi_param REMOTE_USER $remote_user; - fastcgi_param PATH_INFO $fastcgi_path_info; - fastcgi_param SCRIPT_FILENAME ALIASTOCHANGEadmin.php; + fastcgi_param REMOTE_USER $remote_user; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param SCRIPT_FILENAME $request_filename; } # Include SSOWAT user panel. diff --git a/conf/php-fpm.conf b/conf/php-fpm.conf index 09503f2..f3feeee 100644 --- a/conf/php-fpm.conf +++ b/conf/php-fpm.conf @@ -1,242 +1,71 @@ -; Start a new pool named 'www'. -; the variable $pool can we used in any directive and will be replaced by the -; pool name ('www' here) -[NAMETOCHANGE] - -; Per pool prefix -; It only applies on the following directives: -; - 'slowlog' -; - 'listen' (unixsocket) -; - 'chroot' -; - 'chdir' -; - 'php_values' -; - 'php_admin_values' -; When not set, the global prefix (or /usr) applies instead. -; Note: This directive can also be relative to the global prefix. -; Default Value: none -;prefix = /path/to/pools/$pool - +[{POOLNAME}] ; The address on which to accept FastCGI requests. -; Valid syntaxes are: -; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific address on -; a specific port; -; 'port' - to listen on a TCP socket to all addresses on a -; specific port; -; '/path/to/unix/socket' - to listen on a unix socket. -; Note: This value is mandatory. -listen = /var/run/php5-fpm-NAMETOCHANGE.sock +listen = /var/run/php5-fpm-{POOLNAME}.sock -; Set listen(2) backlog. A value of '-1' means unlimited. -; Default Value: 128 (-1 on FreeBSD and OpenBSD) -;listen.backlog = -1 - -; List of ipv4 addresses of FastCGI clients which are allowed to connect. -; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original -; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address -; must be separated by a comma. If this value is left blank, connections will be -; accepted from any ip address. -; Default Value: any -;listen.allowed_clients = 127.0.0.1 - -; Set permissions for unix socket, if one is used. In Linux, read/write -; permissions must be set in order to allow connections from a web server. Many -; BSD-derived systems allow connections regardless of permissions. -; Default Values: user and group are set as the running user -; mode is set to 0666 +; Set permissions for unix socket, if one is used. listen.owner = www-data listen.group = www-data listen.mode = 0600 -; Unix user/group of processes -; Note: The user is mandatory. If the group is not set, the default user's group -; will be used. -user = www-data +; Unix user/group of processes. +user = {USER} group = www-data ; Choose how the process manager will control the number of child processes. -; Possible Values: -; static - a fixed number (pm.max_children) of child processes; -; dynamic - the number of child processes are set dynamically based on the -; following directives: -; pm.max_children - the maximum number of children that can -; be alive at the same time. -; pm.start_servers - the number of children created on startup. -; pm.min_spare_servers - the minimum number of children in 'idle' -; state (waiting to process). If the number -; of 'idle' processes is less than this -; number then some children will be created. -; pm.max_spare_servers - the maximum number of children in 'idle' -; state (waiting to process). If the number -; of 'idle' processes is greater than this -; number then some children will be killed. -; Note: This value is mandatory. pm = dynamic ; The number of child processes to be created when pm is set to 'static' and the ; maximum number of child processes to be created when pm is set to 'dynamic'. -; This value sets the limit on the number of simultaneous requests that will be -; served. Equivalent to the ApacheMaxClients directive with mpm_prefork. -; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP -; CGI. -; Note: Used when pm is set to either 'static' or 'dynamic' -; Note: This value is mandatory. pm.max_children = 6 ; The number of child processes created on startup. -; Note: Used only when pm is set to 'dynamic' -; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2 pm.start_servers = 3 ; The desired minimum number of idle server processes. -; Note: Used only when pm is set to 'dynamic' -; Note: Mandatory when pm is set to 'dynamic' pm.min_spare_servers = 3 ; The desired maximum number of idle server processes. -; Note: Used only when pm is set to 'dynamic' -; Note: Mandatory when pm is set to 'dynamic' pm.max_spare_servers = 5 ; The number of requests each child process should execute before respawning. -; This can be useful to work around memory leaks in 3rd party libraries. For -; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. -; Default Value: 0 pm.max_requests = 500 ; The URI to view the FPM status page. If this value is not set, no URI will be -; recognized as a status page. By default, the status page shows the following -; information: -; accepted conn - the number of request accepted by the pool; -; pool - the name of the pool; -; process manager - static or dynamic; -; idle processes - the number of idle processes; -; active processes - the number of active processes; -; total processes - the number of idle + active processes. -; max children reached - number of times, the process limit has been reached, -; when pm tries to start more children (works only for -; pm 'dynamic') -; The values of 'idle processes', 'active processes' and 'total processes' are -; updated each second. The value of 'accepted conn' is updated in real time. -; Example output: -; accepted conn: 12073 -; pool: www -; process manager: static -; idle processes: 35 -; active processes: 65 -; total processes: 100 -; max children reached: 1 -; By default the status page output is formatted as text/plain. Passing either -; 'html' or 'json' as a query string will return the corresponding output -; syntax. Example: -; http://www.foo.bar/status -; http://www.foo.bar/status?json -; http://www.foo.bar/status?html -; Note: The value must start with a leading slash (/). The value can be -; anything, but it may not be a good idea to use the .php extension or it -; may conflict with a real PHP file. -; Default Value: not set +; recognized as a status page. pm.status_path = /fpm-status ; The ping URI to call the monitoring page of FPM. If this value is not set, no -; URI will be recognized as a ping page. This could be used to test from outside -; that FPM is alive and responding, or to -; - create a graph of FPM availability (rrd or such); -; - remove a server from a group if it is not responding (load balancing); -; - trigger alerts for the operating team (24/7). -; Note: The value must start with a leading slash (/). The value can be -; anything, but it may not be a good idea to use the .php extension or it -; may conflict with a real PHP file. -; Default Value: not set +; URI will be recognized as a ping page. ping.path = /ping -; This directive may be used to customize the response of a ping request. The -; response is formatted as text/plain with a 200 response code. -; Default Value: pong -;ping.response = pong - ; The timeout for serving a single request after which the worker process will -; be killed. This option should be used when the 'max_execution_time' ini option -; does not stop script execution for some reason. A value of '0' means 'off'. -; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) -; Default Value: 0 +; be killed. request_terminate_timeout = 1d ; The timeout for serving a single request after which a PHP backtrace will be ; dumped to the 'slowlog' file. A value of '0s' means 'off'. -; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) -; Default Value: 0 request_slowlog_timeout = 5s -; The log file for slow requests -; Default Value: not set -; Note: slowlog is mandatory if request_slowlog_timeout is set -slowlog = /var/log/nginx/NAMETOCHANGE.slow.log +; The log file for slow requests. +slowlog = /var/log/nginx/{POOLNAME}.slow.log ; Set open file descriptor rlimit. -; Default Value: system defined value rlimit_files = 4096 ; Set max core size rlimit. -; Possible Values: 'unlimited' or an integer greater or equal to 0 -; Default Value: system defined value rlimit_core = 0 -; Chroot to this directory at the start. This value must be defined as an -; absolute path. When this value is not set, chroot is not used. -; Note: you can prefix with '$prefix' to chroot to the pool prefix or one -; of its subdirectories. If the pool prefix is not set, the global prefix -; will be used instead. -; Note: chrooting is a great security feature and should be used whenever -; possible. However, all PHP paths will be relative to the chroot -; (error_log, sessions.save_path, ...). -; Default Value: not set -;chroot = - ; Chdir to this directory at the start. -; Note: relative path can be used. -; Default Value: current directory or / when chroot -chdir = /var/www/NAMETOCHANGE +chdir = {DESTDIR} -; Redirect worker stdout and stderr into main error log. If not set, stdout and -; stderr will be redirected to /dev/null according to FastCGI specs. -; Note: on highloaded environement, this can cause some delay in the page -; process time (several ms). -; Default Value: no +; Redirect worker stdout and stderr into main error log. catch_workers_output = yes -; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from -; the current environment. -; Default Value: clean env -;env[HOSTNAME] = $HOSTNAME -;env[PATH] = /usr/local/bin:/usr/bin:/bin -;env[TMP] = /tmp -;env[TMPDIR] = /tmp -;env[TEMP] = /tmp +; Do not clear environment in FPM workers. +clear_env = no -; Additional php.ini defines, specific to this pool of workers. These settings -; overwrite the values previously defined in the php.ini. The directives are the -; same as the PHP SAPI: -; php_value/php_flag - you can set classic ini defines which can -; be overwritten from PHP call 'ini_set'. -; php_admin_value/php_admin_flag - these directives won't be overwritten by -; PHP call 'ini_set' -; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. - -; Defining 'extension' will load the corresponding shared extension from -; extension_dir. Defining 'disable_functions' or 'disable_classes' will not -; overwrite previously defined php.ini values, but will append the new value -; instead. - -; Note: path INI options can be relative and will be expanded with the prefix -; (pool, global or /usr) - -; Default Value: nothing is defined by default except the values in php.ini and -; specified at startup with the -d argument -;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com -;php_flag[display_errors] = off -;php_admin_value[error_log] = /var/log/fpm-php.www.log -;php_admin_flag[log_errors] = on -;php_admin_value[memory_limit] = 32M - -php_value[upload_max_filesize] = 10G -php_value[post_max_size] = 10G +; Additional php.ini defines, specific to this pool of workers. +php_value[upload_max_filesize] = 1G +php_value[post_max_size] = 1G +php_value[default_charset] = UTF-8 +php_value[always_populate_raw_post_data] = -1 diff --git a/manifest.json b/manifest.json index 115da4d..786d3ef 100644 --- a/manifest.json +++ b/manifest.json @@ -1,20 +1,20 @@ { - "name": "Custom Webapp", - "id": "my_webapp", "packaging_format": 1, + "id": "my_webapp", + "name": "Custom Webapp", "description": { - "en": "Empty App with a file access to the web directory", - "fr": "Répertoire Web vide avec un accès fichier" + "en": "Custom Web app with SFTP access", + "fr": "Application Web personnalisée avec accès SFTP" }, + "licence": "AGPL-3", "maintainer": { - "name": "kload", - "email": "kload@kload.fr" + "name": "YunoHost Contributors", + "email": "apps@yunohost.org" + }, + "multi_instance": true, + "requirements": { + "yunohost": ">= 2.4.0" }, - "multi_instance": "true", - "services": [ - "nginx", - "php5-fpm" - ], "arguments": { "install" : [ { @@ -37,22 +37,31 @@ "default": "/site" }, { - "name": "admin", - "type": "user", + "name": "password", + "type": "password", "ask": { - "en": "Choose the YunoHost user who will be able to upload documents to this directory", - "fr": "Choisissez l'utilisateur YunoHost qui sera capable d'envoyer des documents dans ce répertoire web" + "en": "Set the password for the SFTP access", + "fr": "Définissez le mot de passe pour l'accès SFTP" }, - "example": "johndoe" + "example": "myreallystrengthpassword" }, { "name": "is_public", + "type": "boolean", "ask": { - "en": "Is it a public website ?", + "en": "Is it a public website?", "fr": "Est-ce un site public ?" }, - "choices": ["Yes", "No"], - "default": "Yes" + "default": true + }, + { + "name": "mysql_db", + "type": "boolean", + "ask": { + "en": "Do you need a MySQL database?", + "fr": "Avez-vous besoin d'une base de données MySQL ?" + }, + "default": false } ] } diff --git a/scripts/install b/scripts/install index a1033c2..e775328 100644 --- a/scripts/install +++ b/scripts/install @@ -1,68 +1,100 @@ #!/bin/bash -set -e +# Exit on command errors and treat unset variables as an error +set -eu + +# Get multi-instances specific variables +app=$YNH_APP_INSTANCE_NAME +app_nb=$YNH_APP_INSTANCE_NUMBER # Retrieve arguments domain=$1 -path=$2 -user=$3 +path=${2%/} +password=$3 is_public=$4 -final_path=/var/www/my_webapp +mysql_db=$5 + +# Source app helpers +. /usr/share/yunohost/helpers # Check domain/path availability -sudo yunohost app checkurl $domain$path -a my_webapp -path=${path%/} +sudo yunohost app checkurl "${domain}${path}" -a "$app" \ + || exit 1 -# Check user -sudo yunohost user list --json | grep -q "\"username\": \"$user\"" \ - || (echo "User '$user' does not exist" && exit 1) -sudo yunohost app setting my_webapp allowed_users -v "$user" +# Check destination directory +DESTDIR="/var/www/${app}" +[[ -d "$DESTDIR" ]] && ynh_die \ +"The destination directory '${DESTDIR}' already exists.\ + You should safely delete it before installing this app." -# Update the salt in the admin.php file -salt=$(dd if=/dev/urandom bs=1 count=200 2> /dev/null | tr -c -d 'A-Za-z0-9' | sed -n 's/\(.\{24\}\).*/\1/p') -sed -i "s@SALTTOCHANGE@$salt@g" ../sources/admin.php +# Create the user account +user="webapp${app_nb}" +sudo useradd -c "${app} user account" \ + -d "$DESTDIR" -M -g www-data "$user" \ + || ynh_die "Unable to create user account" +sudo chpasswd <<< "${user}:${password}" -# Modify the index.html instruction file -sed -i "s@USER@$user@g" ../sources/files/index.html -sed -i "s@URL@https://$domain$path/admin/@g" ../sources/files/index.html +# Harden SSH connection for the user +echo "##-> ${app} +# Hardening user connection +Match User ${user} + ChrootDirectory %h + ForceCommand internal-sftp + AllowTcpForwarding no + PermitTunnel no + X11Forwarding no +##<- ${app}" | sudo tee -a /etc/ssh/sshd_config -# Copy files to the right place -sudo mkdir -p $final_path -sudo cp ../sources/admin.php $final_path/ -sudo cp -r ../sources/_assets $final_path/ -sudo cp -r ../sources/files $final_path/ +# Specify the user and the domain in the home page +sed -i "s@{DOMAIN}@${domain}@g" ../sources/www/index.html +sed -i "s@{USER}@${user}@g" ../sources/www/index.html -# Set permissions -sudo chmod 775 -R $final_path/files -sudo chown -hR www-data:www-data $final_path/files +# Initialize database as needed +if [[ $mysql_db -eq 1 ]]; then + dbname=$app + dbuser=$app + dbpass=$(ynh_string_random) + ynh_mysql_create_db "$dbname" "$dbuser" "$dbpass" -# Modify Nginx configuration file and copy it to Nginx conf directory -if [[ "$path" == "" ]]; then - sed -i "s@LOCATIONTOCHANGE@/@g" ../conf/nginx.conf -else - sed -i "s@LOCATIONTOCHANGE@$path@g" ../conf/nginx.conf -fi -sed -i "s@PATHTOCHANGE@$path@g" ../conf/nginx.conf -sed -i "s@ALIASTOCHANGE@$final_path/@g" ../conf/nginx.conf -sed -i "s@NAMETOCHANGE@my_webapp@g" ../conf/nginx.conf -sudo cp ../conf/nginx.conf /etc/nginx/conf.d/$domain.d/my_webapp.conf - -# Same goes for PHP-FPM configuration -sed -i "s@NAMETOCHANGE@my_webapp@g" ../conf/php-fpm.conf -sudo cp ../conf/php-fpm.conf /etc/php5/fpm/pool.d/my_webapp.conf - -# Make app public if necessary -sudo yunohost app setting my_webapp is_public -v "$is_public" -if [ "$is_public" = "Yes" ]; -then - sudo yunohost app setting my_webapp unprotected_uris -v "/" + # Store the database access + echo -e "# MySQL Database +name: ${dbname}\nuser: ${dbuser}\npass: ${dbpass}" > ../sources/db_access.txt + ynh_app_setting_set "$app" mysqlpwd "$dbpass" fi -# Protect the file manager -sudo yunohost app setting my_webapp protected_uris -v "/admin" +# Copy files to the right place and set permissions +sudo cp -r ../sources "$DESTDIR" +sudo chown -hR "${user}:" "$DESTDIR" -# Reload Nginx, php5-fpm and regenerate SSOwat conf +# Home directory of the user need to be owned by root to allow +# SFTP connections +sudo chown root: "$DESTDIR" + +# Save app settings +ynh_app_setting_set "$app" is_public "$is_public" +ynh_app_setting_set "$app" mysql_db "$mysql_db" +ynh_app_setting_set "$app" password "$password" +ynh_app_setting_set "$app" user "$user" + +# Set SSOwat rules +[[ $is_public -eq 1 ]] \ + && ynh_app_setting_set "$app" skipped_uris "/" + +# Copy and set nginx configuration +nginx_conf="/etc/nginx/conf.d/${domain}.d/${app}.conf" +sed -i "s@{LOCATION}@${path:-/}@g" ../conf/nginx.conf +sed -i "s@{DESTDIR}@${DESTDIR}@g" ../conf/nginx.conf +sed -i "s@{POOLNAME}@${app}@g" ../conf/nginx.conf +sudo cp ../conf/nginx.conf "$nginx_conf" + +# Copy and set php-fpm configuration +phpfpm_conf="/etc/php5/fpm/pool.d/${app}.conf" +sed -i "s@{USER}@${user}@g" ../conf/php-fpm.conf +sed -i "s@{POOLNAME}@${app}@g" ../conf/php-fpm.conf +sed -i "s@{DESTDIR}@${DESTDIR}@g" ../conf/php-fpm.conf +sudo cp ../conf/php-fpm.conf "$phpfpm_conf" + +# Reload services +sudo service php5-fpm reload sudo service nginx reload -sudo killall php5-fpm || echo "PHP-FPM already killed" -sudo service php5-fpm start -sudo yunohost app ssowatconf +sudo service sshd reload diff --git a/scripts/remove b/scripts/remove index 9aebf50..9a37e7c 100644 --- a/scripts/remove +++ b/scripts/remove @@ -1,14 +1,38 @@ #!/bin/bash -domain=$(sudo yunohost app setting my_webapp domain) +# Get multi-instances specific variables +app=$YNH_APP_INSTANCE_NAME +app_nb=$YNH_APP_INSTANCE_NUMBER -sudo service pure-ftpd-ldap stop -sudo apt-get remove -y -qq pure-ftpd-ldap pure-ftpd-common -sudo yunohost service remove pure-ftpd-ldap +# Source app helpers +. /usr/share/yunohost/helpers -sudo rm -rf /var/www/my_webapp -sudo rm -f /etc/nginx/conf.d/$domain.d/my_webapp.conf -sudo rm -f /etc/php5/fpm/pool.d/my_webapp.conf +# Retrieve app settings +domain=$(ynh_app_setting_get "$app" domain) +mysql_db=$(ynh_app_setting_get "$app" mysql_db) -sudo service nginx reload -sudo yunohost app ssowatconf +# Drop MySQL database and user as needed +if [[ $mysql_db -eq 1 ]]; then + dbname=$app + dbuser=$app + dbpass=$(ynh_app_setting_get "$app" mysqlpwd) + ynh_mysql_drop_db $dbname || true + ynh_mysql_drop_user $dbuser || true +fi + +# Delete app directory and configurations +sudo rm -rf "/var/www/${app}" +sudo rm -f "/etc/php5/fpm/pool.d/${app}.conf" +[[ -n $domain ]] && sudo rm -f "/etc/nginx/conf.d/${domain}.d/${app}.conf" + +# Remove custom SSH configuration +sudo sed -i "/##-> ${app}/,/##<- ${app}/d" /etc/ssh/sshd_config + +# Reload services +sudo service php5-fpm restart || true +sudo service nginx reload || true +sudo service sshd reload + +# Remove the user account +user="webapp${app_nb}" +sudo deluser --quiet --force "$user" >/dev/null diff --git a/sources/www/index.html b/sources/www/index.html new file mode 100644 index 0000000..a387bf8 --- /dev/null +++ b/sources/www/index.html @@ -0,0 +1,33 @@ + + + + Custom Web App + + +

It works!

+

Congratulation, you have just installed your custom web app.

+ +

Access your site

+

+ You can access to your site - e.g. to put content, change this wonderful + page - using SFTP. You can use a client application for that such as + FileZilla. + Here are the SFTP connection details: +

+
+
Domain
+
{DOMAIN}
+
Port
+
22
+
User
+
{USER}
+
Password
+
the one you set at installation
+
+ +
+ +

As a reward, here is a random cat picture:

+ + +