YunoHost-Apps/my_webapp_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/my_webapp_ynh.git synced 2024-09-03 19:46:26 +02:00
Code Issues Activity Actions

[enh] Rewrite scripts and app to offer an SFTP access instead

Browse source
This commit is contained in:
Jérôme Lebleu 2016-05-14 19:24:39 +02:00
parent ffb503f463
commit 66225a1fe5
7 changed files with 220 additions and 307 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
README.md
View file

@ -1,4 +1,17 @@
Custom Webapp
-------------
Empty App with a file access to the web directory.
Empty application with SFTP access to the Web directory.
It can also create a MySQL database. In that case, the connection details
will be stored in the file `db_accesss.txt` located in the root folder of
the SFTP user.
## TODO
* Update `upgrade` script and manage upgrading from current official app
* Update `backup` and `restore` scripts
## Links
**YunoHost**: https://yunohost.org/

49
conf/nginx.conf
View file

@ -1,45 +1,18 @@
location LOCATIONTOCHANGE {
alias ALIASTOCHANGEfiles/;
index index.php index.html index.htm;
default_type text/html;
client_max_body_size 1G;
location {LOCATION} {
alias {DESTDIR}/www;
if ($scheme = http) {
rewrite ^ https://$server_name$request_uri? permanent;
}
index index.html index.php ;
try_files $uri $uri/ index.php;
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
fastcgi_pass unix:/var/run/php5-fpm-NAMETOCHANGE.sock;
fastcgi_pass unix:/var/run/php5-fpm-{POOLNAME}.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $request_filename;
}
# Include SSOWAT user panel.
include conf.d/yunohost_panel.conf.inc;
}
# Admin location - DO NOT EDIT
location PATHTOCHANGE/admin/_assets {
alias /var/www/my_webapp/_assets/;
}
location PATHTOCHANGE/admin {
alias /var/www/my_webapp/;
client_max_body_size 10G;
location ~ ^PATHTOCHANGE/admin$ {
rewrite ^(.*) $1/ redirect;
}
location ~ ^PATHTOCHANGE/admin/ {
fastcgi_split_path_info ^(PATHTOCHANGE/admin)(/?.*)$;
fastcgi_pass unix:/var/run/php5-fpm-NAMETOCHANGE.sock;
include fastcgi_params;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME ALIASTOCHANGEadmin.php;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $request_filename;
}
# Include SSOWAT user panel.

209
conf/php-fpm.conf
View file

@ -1,242 +1,71 @@
; Start a new pool named 'www'.
; the variable $pool can we used in any directive and will be replaced by the
; pool name ('www' here)
[NAMETOCHANGE]
; Per pool prefix
; It only applies on the following directives:
; - 'slowlog'
; - 'listen' (unixsocket)
; - 'chroot'
; - 'chdir'
; - 'php_values'
; - 'php_admin_values'
; When not set, the global prefix (or /usr) applies instead.
; Note: This directive can also be relative to the global prefix.
; Default Value: none
;prefix = /path/to/pools/$pool
[{POOLNAME}]
; The address on which to accept FastCGI requests.
; Valid syntaxes are:
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific address on
; a specific port;
; 'port' - to listen on a TCP socket to all addresses on a
; specific port;
; '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = /var/run/php5-fpm-NAMETOCHANGE.sock
listen = /var/run/php5-fpm-{POOLNAME}.sock
; Set listen(2) backlog. A value of '-1' means unlimited.
; Default Value: 128 (-1 on FreeBSD and OpenBSD)
;listen.backlog = -1
; List of ipv4 addresses of FastCGI clients which are allowed to connect.
; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
; must be separated by a comma. If this value is left blank, connections will be
; accepted from any ip address.
; Default Value: any
;listen.allowed_clients = 127.0.0.1
; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server. Many
; BSD-derived systems allow connections regardless of permissions.
; Default Values: user and group are set as the running user
; mode is set to 0666
; Set permissions for unix socket, if one is used.
listen.owner = www-data
listen.group = www-data
listen.mode = 0600
; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
; will be used.
user = www-data
; Unix user/group of processes.
user = {USER}
group = www-data
; Choose how the process manager will control the number of child processes.
; Possible Values:
; static - a fixed number (pm.max_children) of child processes;
; dynamic - the number of child processes are set dynamically based on the
; following directives:
; pm.max_children - the maximum number of children that can
; be alive at the same time.
; pm.start_servers - the number of children created on startup.
; pm.min_spare_servers - the minimum number of children in 'idle'
; state (waiting to process). If the number
; of 'idle' processes is less than this
; number then some children will be created.
; pm.max_spare_servers - the maximum number of children in 'idle'
; state (waiting to process). If the number
; of 'idle' processes is greater than this
; number then some children will be killed.
; Note: This value is mandatory.
pm = dynamic
; The number of child processes to be created when pm is set to 'static' and the
; maximum number of child processes to be created when pm is set to 'dynamic'.
; This value sets the limit on the number of simultaneous requests that will be
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
; CGI.
; Note: Used when pm is set to either 'static' or 'dynamic'
; Note: This value is mandatory.
pm.max_children = 6
; The number of child processes created on startup.
; Note: Used only when pm is set to 'dynamic'
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
pm.start_servers = 3
; The desired minimum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.min_spare_servers = 3
; The desired maximum number of idle server processes.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
pm.max_spare_servers = 5
; The number of requests each child process should execute before respawning.
; This can be useful to work around memory leaks in 3rd party libraries. For
; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
; Default Value: 0
pm.max_requests = 500
; The URI to view the FPM status page. If this value is not set, no URI will be
; recognized as a status page. By default, the status page shows the following
; information:
; accepted conn - the number of request accepted by the pool;
; pool - the name of the pool;
; process manager - static or dynamic;
; idle processes - the number of idle processes;
; active processes - the number of active processes;
; total processes - the number of idle + active processes.
; max children reached - number of times, the process limit has been reached,
; when pm tries to start more children (works only for
; pm 'dynamic')
; The values of 'idle processes', 'active processes' and 'total processes' are
; updated each second. The value of 'accepted conn' is updated in real time.
; Example output:
; accepted conn: 12073
; pool: www
; process manager: static
; idle processes: 35
; active processes: 65
; total processes: 100
; max children reached: 1
; By default the status page output is formatted as text/plain. Passing either
; 'html' or 'json' as a query string will return the corresponding output
; syntax. Example:
; http://www.foo.bar/status
; http://www.foo.bar/status?json
; http://www.foo.bar/status?html
; Note: The value must start with a leading slash (/). The value can be
; anything, but it may not be a good idea to use the .php extension or it
; may conflict with a real PHP file.
; Default Value: not set
; recognized as a status page.
pm.status_path = /fpm-status
; The ping URI to call the monitoring page of FPM. If this value is not set, no
; URI will be recognized as a ping page. This could be used to test from outside
; that FPM is alive and responding, or to
; - create a graph of FPM availability (rrd or such);
; - remove a server from a group if it is not responding (load balancing);
; - trigger alerts for the operating team (24/7).
; Note: The value must start with a leading slash (/). The value can be
; anything, but it may not be a good idea to use the .php extension or it
; may conflict with a real PHP file.
; Default Value: not set
; URI will be recognized as a ping page.
ping.path = /ping
; This directive may be used to customize the response of a ping request. The
; response is formatted as text/plain with a 200 response code.
; Default Value: pong
;ping.response = pong
; The timeout for serving a single request after which the worker process will
; be killed. This option should be used when the 'max_execution_time' ini option
; does not stop script execution for some reason. A value of '0' means 'off'.
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
; Default Value: 0
; be killed.
request_terminate_timeout = 1d
; The timeout for serving a single request after which a PHP backtrace will be
; dumped to the 'slowlog' file. A value of '0s' means 'off'.
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
; Default Value: 0
request_slowlog_timeout = 5s
; The log file for slow requests
; Default Value: not set
; Note: slowlog is mandatory if request_slowlog_timeout is set
slowlog = /var/log/nginx/NAMETOCHANGE.slow.log
; The log file for slow requests.
slowlog = /var/log/nginx/{POOLNAME}.slow.log
; Set open file descriptor rlimit.
; Default Value: system defined value
rlimit_files = 4096
; Set max core size rlimit.
; Possible Values: 'unlimited' or an integer greater or equal to 0
; Default Value: system defined value
rlimit_core = 0
; Chroot to this directory at the start. This value must be defined as an
; absolute path. When this value is not set, chroot is not used.
; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
; of its subdirectories. If the pool prefix is not set, the global prefix
; will be used instead.
; Note: chrooting is a great security feature and should be used whenever
; possible. However, all PHP paths will be relative to the chroot
; (error_log, sessions.save_path, ...).
; Default Value: not set
;chroot =
; Chdir to this directory at the start.
; Note: relative path can be used.
; Default Value: current directory or / when chroot
chdir = /var/www/NAMETOCHANGE
chdir = {DESTDIR}
; Redirect worker stdout and stderr into main error log. If not set, stdout and
; stderr will be redirected to /dev/null according to FastCGI specs.
; Note: on highloaded environement, this can cause some delay in the page
; process time (several ms).
; Default Value: no
; Redirect worker stdout and stderr into main error log.
catch_workers_output = yes
; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
; the current environment.
; Default Value: clean env
;env[HOSTNAME] = $HOSTNAME
;env[PATH] = /usr/local/bin:/usr/bin:/bin
;env[TMP] = /tmp
;env[TMPDIR] = /tmp
;env[TEMP] = /tmp
; Do not clear environment in FPM workers.
clear_env = no
; Additional php.ini defines, specific to this pool of workers. These settings
; overwrite the values previously defined in the php.ini. The directives are the
; same as the PHP SAPI:
; php_value/php_flag - you can set classic ini defines which can
; be overwritten from PHP call 'ini_set'.
; php_admin_value/php_admin_flag - these directives won't be overwritten by
; PHP call 'ini_set'
; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
; Defining 'extension' will load the corresponding shared extension from
; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
; overwrite previously defined php.ini values, but will append the new value
; instead.
; Note: path INI options can be relative and will be expanded with the prefix
; (pool, global or /usr)
; Default Value: nothing is defined by default except the values in php.ini and
; specified at startup with the -d argument
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
;php_flag[display_errors] = off
;php_admin_value[error_log] = /var/log/fpm-php.www.log
;php_admin_flag[log_errors] = on
;php_admin_value[memory_limit] = 32M
php_value[upload_max_filesize] = 10G
php_value[post_max_size] = 10G
; Additional php.ini defines, specific to this pool of workers.
php_value[upload_max_filesize] = 1G
php_value[post_max_size] = 1G
php_value[default_charset] = UTF-8
php_value[always_populate_raw_post_data] = -1

47
manifest.json
View file

@ -1,20 +1,20 @@
{
"name": "Custom Webapp",
"id": "my_webapp",
"packaging_format": 1,
"id": "my_webapp",
"name": "Custom Webapp",
"description": {
"en": "Empty App with a file access to the web directory",
"fr": "Répertoire Web vide avec un accès fichier"
"en": "Custom Web app with SFTP access",
"fr": "Application Web personnalisée avec accès SFTP"
},
"licence": "AGPL-3",
"maintainer": {
"name": "kload",
"email": "kload@kload.fr"
"name": "YunoHost Contributors",
"email": "apps@yunohost.org"
},
"multi_instance": true,
"requirements": {
"yunohost": ">= 2.4.0"
},
"multi_instance": "true",
"services": [
"nginx",
"php5-fpm"
],
"arguments": {
"install" : [
{
@ -37,22 +37,31 @@
"default": "/site"
},
{
"name": "admin",
"type": "user",
"name": "password",
"type": "password",
"ask": {
"en": "Choose the YunoHost user who will be able to upload documents to this directory",
"fr": "Choisissez l'utilisateur YunoHost qui sera capable d'envoyer des documents dans ce répertoire web"
"en": "Set the password for the SFTP access",
"fr": "Définissez le mot de passe pour l'accès SFTP"
},
"example": "johndoe"
"example": "myreallystrengthpassword"
},
{
"name": "is_public",
"type": "boolean",
"ask": {
"en": "Is it a public website ?",
"en": "Is it a public website?",
"fr": "Est-ce un site public ?"
},
"choices": ["Yes", "No"],
"default": "Yes"
"default": true
},
{
"name": "mysql_db",
"type": "boolean",
"ask": {
"en": "Do you need a MySQL database?",
"fr": "Avez-vous besoin d'une base de données MySQL ?"
},
"default": false
}
]
}

132
scripts/install
View file

@ -1,68 +1,100 @@
#!/bin/bash
set -e
# Exit on command errors and treat unset variables as an error
set -eu
# Get multi-instances specific variables
app=$YNH_APP_INSTANCE_NAME
app_nb=$YNH_APP_INSTANCE_NUMBER
# Retrieve arguments
domain=$1
path=$2
user=$3
path=${2%/}
password=$3
is_public=$4
final_path=/var/www/my_webapp
mysql_db=$5
# Source app helpers
. /usr/share/yunohost/helpers
# Check domain/path availability
sudo yunohost app checkurl $domain$path -a my_webapp
path=${path%/}
sudo yunohost app checkurl "${domain}${path}" -a "$app" \
|| exit 1
# Check user
sudo yunohost user list --json | grep -q "\"username\": \"$user\"" \
|| (echo "User '$user' does not exist" && exit 1)
sudo yunohost app setting my_webapp allowed_users -v "$user"
# Check destination directory
DESTDIR="/var/www/${app}"
[[ -d "$DESTDIR" ]] && ynh_die \
"The destination directory '${DESTDIR}' already exists.\
You should safely delete it before installing this app."
# Update the salt in the admin.php file
salt=$(dd if=/dev/urandom bs=1 count=200 2> /dev/null | tr -c -d 'A-Za-z0-9' | sed -n 's/\(.\{24\}\).*/\1/p')
sed -i "s@SALTTOCHANGE@$salt@g" ../sources/admin.php
# Create the user account
user="webapp${app_nb}"
sudo useradd -c "${app} user account" \
-d "$DESTDIR" -M -g www-data "$user" \
|| ynh_die "Unable to create user account"
sudo chpasswd <<< "${user}:${password}"
# Modify the index.html instruction file
sed -i "s@USER@$user@g" ../sources/files/index.html
sed -i "s@URL@https://$domain$path/admin/@g" ../sources/files/index.html
# Harden SSH connection for the user
echo "##-> ${app}
# Hardening user connection
Match User ${user}
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
PermitTunnel no
X11Forwarding no
##<- ${app}" | sudo tee -a /etc/ssh/sshd_config
# Copy files to the right place
sudo mkdir -p $final_path
sudo cp ../sources/admin.php $final_path/
sudo cp -r ../sources/_assets $final_path/
sudo cp -r ../sources/files $final_path/
# Specify the user and the domain in the home page
sed -i "s@{DOMAIN}@${domain}@g" ../sources/www/index.html
sed -i "s@{USER}@${user}@g" ../sources/www/index.html
# Set permissions
sudo chmod 775 -R $final_path/files
sudo chown -hR www-data:www-data $final_path/files
# Initialize database as needed
if [[ $mysql_db -eq 1 ]]; then
dbname=$app
dbuser=$app
dbpass=$(ynh_string_random)
ynh_mysql_create_db "$dbname" "$dbuser" "$dbpass"
# Modify Nginx configuration file and copy it to Nginx conf directory
if [[ "$path" == "" ]]; then
sed -i "s@LOCATIONTOCHANGE@/@g" ../conf/nginx.conf
else
sed -i "s@LOCATIONTOCHANGE@$path@g" ../conf/nginx.conf
fi
sed -i "s@PATHTOCHANGE@$path@g" ../conf/nginx.conf
sed -i "s@ALIASTOCHANGE@$final_path/@g" ../conf/nginx.conf
sed -i "s@NAMETOCHANGE@my_webapp@g" ../conf/nginx.conf
sudo cp ../conf/nginx.conf /etc/nginx/conf.d/$domain.d/my_webapp.conf
# Same goes for PHP-FPM configuration
sed -i "s@NAMETOCHANGE@my_webapp@g" ../conf/php-fpm.conf
sudo cp ../conf/php-fpm.conf /etc/php5/fpm/pool.d/my_webapp.conf
# Make app public if necessary
sudo yunohost app setting my_webapp is_public -v "$is_public"
if [ "$is_public" = "Yes" ];
then
sudo yunohost app setting my_webapp unprotected_uris -v "/"
# Store the database access
echo -e "# MySQL Database
name: ${dbname}\nuser: ${dbuser}\npass: ${dbpass}" > ../sources/db_access.txt
ynh_app_setting_set "$app" mysqlpwd "$dbpass"
fi
# Protect the file manager
sudo yunohost app setting my_webapp protected_uris -v "/admin"
# Copy files to the right place and set permissions
sudo cp -r ../sources "$DESTDIR"
sudo chown -hR "${user}:" "$DESTDIR"
# Reload Nginx, php5-fpm and regenerate SSOwat conf
# Home directory of the user need to be owned by root to allow
# SFTP connections
sudo chown root: "$DESTDIR"
# Save app settings
ynh_app_setting_set "$app" is_public "$is_public"
ynh_app_setting_set "$app" mysql_db "$mysql_db"
ynh_app_setting_set "$app" password "$password"
ynh_app_setting_set "$app" user "$user"
# Set SSOwat rules
[[ $is_public -eq 1 ]] \
&& ynh_app_setting_set "$app" skipped_uris "/"
# Copy and set nginx configuration
nginx_conf="/etc/nginx/conf.d/${domain}.d/${app}.conf"
sed -i "s@{LOCATION}@${path:-/}@g" ../conf/nginx.conf
sed -i "s@{DESTDIR}@${DESTDIR}@g" ../conf/nginx.conf
sed -i "s@{POOLNAME}@${app}@g" ../conf/nginx.conf
sudo cp ../conf/nginx.conf "$nginx_conf"
# Copy and set php-fpm configuration
phpfpm_conf="/etc/php5/fpm/pool.d/${app}.conf"
sed -i "s@{USER}@${user}@g" ../conf/php-fpm.conf
sed -i "s@{POOLNAME}@${app}@g" ../conf/php-fpm.conf
sed -i "s@{DESTDIR}@${DESTDIR}@g" ../conf/php-fpm.conf
sudo cp ../conf/php-fpm.conf "$phpfpm_conf"
# Reload services
sudo service php5-fpm reload
sudo service nginx reload
sudo killall php5-fpm || echo "PHP-FPM already killed"
sudo service php5-fpm start
sudo yunohost app ssowatconf
sudo service sshd reload

42
scripts/remove
View file

@ -1,14 +1,38 @@
#!/bin/bash
domain=$(sudo yunohost app setting my_webapp domain)
# Get multi-instances specific variables
app=$YNH_APP_INSTANCE_NAME
app_nb=$YNH_APP_INSTANCE_NUMBER
sudo service pure-ftpd-ldap stop
sudo apt-get remove -y -qq pure-ftpd-ldap pure-ftpd-common
sudo yunohost service remove pure-ftpd-ldap
# Source app helpers
. /usr/share/yunohost/helpers
sudo rm -rf /var/www/my_webapp
sudo rm -f /etc/nginx/conf.d/$domain.d/my_webapp.conf
sudo rm -f /etc/php5/fpm/pool.d/my_webapp.conf
# Retrieve app settings
domain=$(ynh_app_setting_get "$app" domain)
mysql_db=$(ynh_app_setting_get "$app" mysql_db)
sudo service nginx reload
sudo yunohost app ssowatconf
# Drop MySQL database and user as needed
if [[ $mysql_db -eq 1 ]]; then
dbname=$app
dbuser=$app
dbpass=$(ynh_app_setting_get "$app" mysqlpwd)
ynh_mysql_drop_db $dbname || true
ynh_mysql_drop_user $dbuser || true
fi
# Delete app directory and configurations
sudo rm -rf "/var/www/${app}"
sudo rm -f "/etc/php5/fpm/pool.d/${app}.conf"
[[ -n $domain ]] && sudo rm -f "/etc/nginx/conf.d/${domain}.d/${app}.conf"
# Remove custom SSH configuration
sudo sed -i "/##-> ${app}/,/##<- ${app}/d" /etc/ssh/sshd_config
# Reload services
sudo service php5-fpm restart || true
sudo service nginx reload || true
sudo service sshd reload
# Remove the user account
user="webapp${app_nb}"
sudo deluser --quiet --force "$user" >/dev/null

33
sources/www/index.html Normal file
View file

@ -0,0 +1,33 @@
<!DOCTYPE html>
<html>
<head>
<title>Custom Web App</title>
</head>
<body>
<h1>It works!</h1>
<p>Congratulation, you have just installed your custom web app.</p>
<h2>Access your site</h2>
<p>
You can access to your site - e.g. to put content, change this wonderful
page - using SFTP. You can use a client application for that such as
<a href="https://filezilla-project.org/download.php?type=client" target="_blank">FileZilla</a>.
Here are the SFTP connection details:
</p>
<dl>
<dt>Domain</dt>
<dd>{DOMAIN}</dd>
<dt>Port</dt>
<dd>22</dd>
<dt>User</dt>
<dd>{USER}</dd>
<dt>Password</dt>
<dd><i>the one you set at installation</i></dd>
</dl>
<hr/>
<p>As a reward, here is a random cat picture:</p>
<img src="https://thecatapi.com/api/images/get?format=src&type=gif">
</body>
</html>