mirror of
https://github.com/YunoHost-Apps/my_webapp_ynh.git
synced 2024-09-03 19:46:26 +02:00
Merge pull request #64 from YunoHost-Apps/testing
Testing: Use sftp.app group from 4.2 to manage sftp access, + fix permissions
This commit is contained in:
Alexandre Aubin
GitHub
commit
a56a7ba378
9 changed files with 64 additions and 111 deletions
10
README.md
10
README.md
|
|
@ -6,12 +6,12 @@
|
|||
*[Lire ce readme en français.](./README_fr.md)*
|
||||
|
||||
> *This package allow you to install Custom Webapp quickly and simply on a YunoHost server.
|
||||
If you don't have YunoHost, please see [here](https://yunohost.org/#/install) to know how to install and enjoy it.*
|
||||
If you don't have YunoHost, please see [here](https://yunohost.org/install) to know how to install and enjoy it.*
|
||||
|
||||
## Overview
|
||||
|
||||
This application allows you to easily install a custom Web application,
|
||||
providing files access with [SFTP](https://yunohost.org/#/filezilla). It can also create a MySQL database -
|
||||
providing files access with [SFTP](https://yunohost.org/en/filezilla). It can also create a MySQL database -
|
||||
which will be backed up and restored with your application. The connection
|
||||
details will be stored in the file `db_accesss.txt` located in the root
|
||||
directory.
|
||||
|
|
@ -28,7 +28,7 @@ of your custom Web application inside.
|
|||
|
||||
## Documentation
|
||||
|
||||
* YunoHost documentation: https://github.com/YunoHost/doc/blob/master/app_my_webapp.md
|
||||
* YunoHost documentation: https://yunohost.org/en/app_my_webapp
|
||||
|
||||
## YunoHost specific features
|
||||
|
||||
|
|
@ -45,8 +45,8 @@ of your custom Web application inside.
|
|||
|
||||
#### SFTP port
|
||||
|
||||
You may have change the SSH port as described
|
||||
[here section "Modifier le port SSH"](https://yunohost.org/#/security_fr) ;
|
||||
You may have change the SSH port as described in this section:
|
||||
[Modify the SSH port](https://yunohost.org/en/security#modify-the-ssh-port);
|
||||
then you should use this port to update your website with SFTP.
|
||||
|
||||
## Links
|
||||
|
|
|
|||
12
README_fr.md
12
README_fr.md
|
|
@ -6,12 +6,12 @@
|
|||
*[Read this readme in english.](./README.md)*
|
||||
|
||||
> *Ce package vous permet d'installer une Application vide avec accès SFTP au répertoire Web personnalisé rapidement et simplement sur un serveur YunoHost.
|
||||
Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour savoir comment l'installer et en profiter.*
|
||||
Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/install) pour savoir comment l'installer et en profiter.*
|
||||
|
||||
## Vue d'ensemble
|
||||
|
||||
Cette application vous permet d'installer facilement une application vide personnalisée,
|
||||
fourni un accès aux fichiers avec [SFTP](https://yunohost.org/#/filezilla). Elle peut également créer une base de données MySQL -
|
||||
fourni un accès aux fichiers avec [SFTP](https://yunohost.org/fr/filezilla). Elle peut également créer une base de données MySQL -
|
||||
qui sera sauvegardée et restaurée avec votre application. Les détails de connexion
|
||||
seront stockés dans le fichier `db_accesss.txt` situé dans le répertoire racine.
|
||||
|
||||
|
|
@ -21,7 +21,7 @@ seront stockés dans le fichier `db_accesss.txt` situé dans le répertoire raci
|
|||
|
||||
## Documentation
|
||||
|
||||
* Documentation YunoHost : https://yunohost.org/#/app_my_webapp
|
||||
* Documentation YunoHost : https://yunohost.org/fr/app_my_webapp
|
||||
|
||||
## Caractéristiques spécifiques YunoHost
|
||||
|
||||
|
|
@ -36,6 +36,12 @@ seront stockés dans le fichier `db_accesss.txt` situé dans le répertoire raci
|
|||
|
||||
## Informations additionnelles
|
||||
|
||||
#### Port SFTP
|
||||
|
||||
Vous avez peut-être changé le port SSH comme décrit dans cette section :
|
||||
[Modifier le port SSH](https://yunohost.org/fr/security#modify-the-ssh-port) ;
|
||||
alors vous devriez utiliser ce port pour mettre à jour votre site Web avec SFTP.
|
||||
|
||||
## Liens
|
||||
|
||||
* Signaler un bug : https://github.com/YunoHost-Apps/my_webapp_ynh/issues
|
||||
|
|
|
|||
|
|
@ -1,21 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
action=$1
|
||||
pending_dir=$4
|
||||
ssh_conf=$pending_dir/../ssh/etc/ssh/sshd_config
|
||||
|
||||
[[ $action == "pre" ]] || exit 0
|
||||
[[ -e $ssh_conf ]] || exit 0
|
||||
|
||||
echo "
|
||||
|
||||
##-> __APP__
|
||||
# Hardening user connection
|
||||
Match User __APP__
|
||||
ChrootDirectory %h
|
||||
ForceCommand internal-sftp
|
||||
AllowTcpForwarding no
|
||||
PermitTunnel no
|
||||
X11Forwarding no
|
||||
PasswordAuthentication yes
|
||||
##<- __APP__" >> $ssh_conf
|
||||
|
|
@ -6,7 +6,7 @@
|
|||
"en": "Custom Web app with SFTP access",
|
||||
"fr": "Application Web personnalisée avec accès SFTP"
|
||||
},
|
||||
"version": "1.0~ynh4",
|
||||
"version": "1.0~ynh5",
|
||||
"url": "https://github.com/YunoHost-Apps/my_webapp_ynh",
|
||||
"license": "GPL-3.0-only",
|
||||
"maintainer": {
|
||||
|
|
@ -18,7 +18,7 @@
|
|||
"email": "maniackc_dev@crudelis.fr"
|
||||
}],
|
||||
"requirements": {
|
||||
"yunohost": ">= 4.1.7"
|
||||
"yunohost": ">= 4.2.3"
|
||||
},
|
||||
"multi_instance": true,
|
||||
"services": [
|
||||
|
|
|
|||
|
|
@ -63,17 +63,6 @@ then
|
|||
ynh_mysql_dump_db --database="$db_name" > db.sql
|
||||
fi
|
||||
|
||||
#=================================================
|
||||
# BACKUP SPECIFIC FILES
|
||||
#=================================================
|
||||
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
ynh_print_info --message="Backup specific files..."
|
||||
|
||||
ynh_backup "/usr/share/yunohost/hooks/conf_regen/90-ssh_$app"
|
||||
fi
|
||||
|
||||
#=================================================
|
||||
# END OF SCRIPT
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -85,7 +85,14 @@ ynh_add_nginx_config
|
|||
#=================================================
|
||||
ynh_script_progression --message="Configuring system user..."
|
||||
|
||||
ynh_system_user_create --username=$app --home_dir="$final_path"
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
groups="sftp.app"
|
||||
else
|
||||
groups=""
|
||||
fi
|
||||
|
||||
ynh_system_user_create --username=$app --home_dir="$final_path" --groups="$groups"
|
||||
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
|
|
@ -96,18 +103,6 @@ fi
|
|||
|
||||
#=================================================
|
||||
# SPECIFIC SETUP
|
||||
#=================================================
|
||||
# CONFIGURE SSH
|
||||
#=================================================
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
ynh_script_progression --message="Configuring SSH..."
|
||||
|
||||
ynh_add_config --template="../conf/ssh_regenconf_hook" --destination="/usr/share/yunohost/hooks/conf_regen/90-ssh_$app"
|
||||
|
||||
yunohost tools regen-conf ssh
|
||||
fi
|
||||
|
||||
#=================================================
|
||||
# MODIFY A CONFIG FILE
|
||||
#=================================================
|
||||
|
|
@ -133,6 +128,14 @@ name: ${db_name}\nuser: ${db_name}\npass: ${db_pwd}" > ../sources/db_access.txt
|
|||
cp -r "../sources/db_access.txt" "$final_path/db_access.txt"
|
||||
fi
|
||||
|
||||
chown -R $app:www-data "$final_path"
|
||||
# Home directory of the user needs to be owned by root to allow
|
||||
# SFTP connections
|
||||
chown root:root "$final_path"
|
||||
setfacl -m g:$app:r-x "$final_path"
|
||||
setfacl -m g:www-data:r-x "$final_path"
|
||||
chmod o-rwx "$final_path"
|
||||
|
||||
#=================================================
|
||||
# PHP-FPM CONFIGURATION
|
||||
#=================================================
|
||||
|
|
@ -144,15 +147,6 @@ phpversion=$(ynh_app_setting_get --app=$app --key=phpversion)
|
|||
|
||||
#=================================================
|
||||
# GENERIC FINALIZATION
|
||||
#=================================================
|
||||
# SECURE FILES AND DIRECTORIES
|
||||
#=================================================
|
||||
|
||||
chown -R $app: "$final_path"
|
||||
# Home directory of the user needs to be owned by root to allow
|
||||
# SFTP connections
|
||||
chown root: "$final_path"
|
||||
|
||||
#=================================================
|
||||
# SETUP SSOWAT
|
||||
#=================================================
|
||||
|
|
|
|||
|
|
@ -64,15 +64,6 @@ ynh_remove_fpm_config
|
|||
#=================================================
|
||||
# SPECIFIC REMOVE
|
||||
#=================================================
|
||||
# REMOVE THE CUSTOM SSH CONFIG
|
||||
#=================================================
|
||||
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
ynh_script_progression --message="Removing the custom SSH config..."
|
||||
ynh_secure_remove --file="/usr/share/yunohost/hooks/conf_regen/90-ssh_$app"
|
||||
yunohost tools regen-conf ssh
|
||||
fi
|
||||
|
||||
#=================================================
|
||||
# GENERIC FINALIZATION
|
||||
|
|
|
|||
|
|
@ -50,13 +50,6 @@ test ! -d $final_path \
|
|||
|
||||
ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
|
||||
|
||||
#=================================================
|
||||
# RESTORE THE APP MAIN DIR
|
||||
#=================================================
|
||||
ynh_script_progression --message="Restoring the app main directory..."
|
||||
|
||||
ynh_restore_file --origin_path="$final_path"
|
||||
|
||||
#=================================================
|
||||
# RESTORE THE MYSQL DATABASE
|
||||
#=================================================
|
||||
|
|
@ -74,7 +67,14 @@ fi
|
|||
#=================================================
|
||||
ynh_script_progression --message="Recreating the dedicated system user..." --weight=2
|
||||
|
||||
ynh_system_user_create --username=$app --home_dir="$final_path"
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
groups="sftp.app"
|
||||
else
|
||||
groups=""
|
||||
fi
|
||||
|
||||
ynh_system_user_create --username=$app --home_dir="$final_path" --groups="$groups"
|
||||
|
||||
if [ -n "$password" ]
|
||||
then
|
||||
|
|
@ -83,14 +83,20 @@ then
|
|||
fi
|
||||
|
||||
#=================================================
|
||||
# RESTORE USER RIGHTS
|
||||
# RESTORE THE APP MAIN DIR
|
||||
#=================================================
|
||||
ynh_script_progression --message="Restoring the app main directory..."
|
||||
|
||||
ynh_restore_file --origin_path="$final_path"
|
||||
|
||||
# Restore permissions on app files
|
||||
chown -R $app: "$final_path"
|
||||
# Home directory of the user need to be owned by root to allow
|
||||
chown -R $app:www-data "$final_path"
|
||||
# Home directory of the user needs to be owned by root to allow
|
||||
# SFTP connections
|
||||
chown root: "$final_path"
|
||||
chown root:root "$final_path"
|
||||
setfacl -m g:$app:r-x "$final_path"
|
||||
setfacl -m g:www-data:r-x "$final_path"
|
||||
chmod o-rwx "$final_path"
|
||||
|
||||
#=================================================
|
||||
# RESTORE THE PHP-FPM CONFIGURATION
|
||||
|
|
@ -101,17 +107,6 @@ ynh_restore_file --origin_path="/etc/php/$phpversion/fpm/pool.d/$app.conf"
|
|||
#=================================================
|
||||
# SPECIFIC RESTORATION
|
||||
#=================================================
|
||||
# CONFIGURE SSH
|
||||
#=================================================
|
||||
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
ynh_script_progression --message="Configuring SSH..."
|
||||
|
||||
ynh_restore_file "/usr/share/yunohost/hooks/conf_regen/90-ssh_$app"
|
||||
|
||||
yunohost tools regen-conf ssh
|
||||
fi
|
||||
|
||||
#=================================================
|
||||
# GENERIC FINALIZATION
|
||||
|
|
|
|||
|
|
@ -145,9 +145,16 @@ fi
|
|||
#=================================================
|
||||
ynh_script_progression --message="Making sure dedicated system user exists..." --weight=2
|
||||
|
||||
ynh_system_user_create --username=$app --home_dir="$final_path"
|
||||
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
groups="sftp.app"
|
||||
else
|
||||
groups=""
|
||||
fi
|
||||
|
||||
ynh_system_user_create --username=$app --home_dir="$final_path" --groups="$groups"
|
||||
|
||||
if [ -n "$password" ]
|
||||
then
|
||||
# Add the password to this user
|
||||
chpasswd <<< "${app}:${password}"
|
||||
|
|
@ -173,17 +180,6 @@ fi
|
|||
#=================================================
|
||||
# SPECIFIC UPGRADE
|
||||
#=================================================
|
||||
# CONFIGURE SSH
|
||||
#=================================================
|
||||
|
||||
if [ $with_sftp -eq 1 ]
|
||||
then
|
||||
ynh_script_progression --message="Configuring SSH..." --weight=1
|
||||
|
||||
ynh_add_config --template="../conf/ssh_regenconf_hook" --destination="/usr/share/yunohost/hooks/conf_regen/90-ssh_$app"
|
||||
|
||||
yunohost tools regen-conf ssh
|
||||
fi
|
||||
|
||||
#=================================================
|
||||
# GENERIC FINALIZATION
|
||||
|
|
@ -191,10 +187,13 @@ fi
|
|||
# SECURE FILES AND DIRECTORIES
|
||||
#=================================================
|
||||
|
||||
chown -R $app: "$final_path"
|
||||
chown -R $app:www-data "$final_path"
|
||||
# Home directory of the user needs to be owned by root to allow
|
||||
# SFTP connections
|
||||
chown root: "$final_path"
|
||||
chown root:root "$final_path"
|
||||
setfacl -m g:$app:r-x "$final_path"
|
||||
setfacl -m g:www-data:r-x "$final_path"
|
||||
chmod o-rwx "$final_path"
|
||||
|
||||
#=================================================
|
||||
# RELOAD NGINX
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue