Merge pull request #5 from YunoHost-Apps/fix-data

Move data directory to appropriate location

README.md

@@ -17,7 +17,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in
 
 A movie collection manager for Usenet and BitTorrent users.
 
-**Shipped version:** 3.2.2.5080~ynh1
+**Shipped version:** 3.2.2.5080~ynh3
 
 
 

README_fr.md

@@ -13,7 +13,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour
 
 Un gestionnaire de filmothèque pour utilisateurs de Usenet et BitTorrent.
 
-**Version incluse :** 3.2.2.5080~ynh1
+**Version incluse :** 3.2.2.5080~ynh3
 
 
 

check_process

@@ -8,7 +8,6 @@
 		domain="domain.tld"
 		path="/path"
 		admin="john"
-		port="666"
 	; Checks
 		pkg_linter=1
 		setup_sub_dir=1
@@ -19,6 +18,7 @@
 		upgrade=1
 		#upgrade=1	from_commit=CommitHash
 		upgrade=1	from_commit=164fa2341225bc8ce7671d0f70cc696ed8ab58a7
+		upgrade=1	from_commit=35c7ebe40c8893321c39570608ac0deacc9407c0
 		backup_restore=1
 		multi_instance=1
 		port_already_use=0
@@ -29,4 +29,7 @@ Notification=none
 ;;; Upgrade options
 	; commit=164fa2341225bc8ce7671d0f70cc696ed8ab58a7
 		name=2021-06-03 v3.2.0.5048
-		manifest_arg=domain=DOMAIN&path=PATH&admin=USER&port=666&
+		manifest_arg=domain=DOMAIN&path=PATH&admin=USER&
+	; commit=35c7ebe40c8893321c39570608ac0deacc9407c0
+		name=2021-06-13 3.2.2.5080~ynh1
+		manifest_arg=domain=DOMAIN&path=PATH&admin=USER&

conf/config.xml

@@ -0,0 +1,16 @@
+<Config>
+  <LogLevel>info</LogLevel>
+  <BindAddress>127.0.0.1</BindAddress>
+  <EnableSsl>False</EnableSsl>
+  <SslCertPath></SslCertPath>
+  <Port>__PORT__</Port>
+  <UrlBase>__PATH__</UrlBase>
+  <ApiKey>__API_KEY__</ApiKey>
+  <AuthenticationMethod>None</AuthenticationMethod>
+  <UpdateMechanism>BuiltIn</UpdateMechanism>
+  <Branch>master</Branch>
+  <SslPort>__PORT__</SslPort>
+  <LaunchBrowser>False</LaunchBrowser>
+  <SslCertPassword></SslCertPassword>
+  <AnalyticsEnabled>False</AnalyticsEnabled>
+</Config>

conf/nginx.conf

@@ -1,11 +1,6 @@
 #sub_path_only rewrite ^__PATH__$ __PATH__/ permanent;
 location __PATH__ {
 
-  # Force usage of https
-  if ($scheme = http) {
-    rewrite ^ https://$server_name$request_uri? permanent;
-  }
-
   proxy_pass http://127.0.0.1:__PORT____PATH__;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

conf/systemd.service

@@ -7,11 +7,41 @@ Type=simple
 User=__APP__
 Group=__APP__
 WorkingDirectory=__FINALPATH__/
-ExecStart=__FINALPATH__/Radarr -nobrowser -data=__FINALPATH__/.data
+ExecStart=__FINALPATH__/Radarr -nobrowser -data=__DATA_PATH__
 
 TimeoutStopSec=20
 KillMode=process
 Restart=always
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target

manifest.json

@@ -6,7 +6,7 @@
         "en": "A movie collection manager for Usenet and BitTorrent users.",
         "fr": "Un gestionnaire de filmothèque pour utilisateurs de Usenet et BitTorrent."
     },
-    "version": "3.2.2.5080~ynh1",
+    "version": "3.2.2.5080~ynh3",
     "url": "https://radarr.video",
     "upstream": {
         "license": "GPL-3.0-only",
@@ -20,7 +20,7 @@
         "email": "tituspijean@outlook.com"
     },
     "requirements": {
-        "yunohost": ">= 4.2"
+        "yunohost": ">= 4.3"
     },
     "multi_instance": true,
     "services": [
@@ -32,19 +32,17 @@
         "install" : [
             {
                 "name": "domain",
-                "type": "domain",
+                "type": "domain"
-                "example": "example.com"
             },
             {
                 "name": "path",
                 "type": "path",
-                "example": "/radarr",
+                "default": "/radarr",
-                "default": "/radarr"
+                "example": "/radarr"
             },
             {
                 "name": "admin",
-                "type": "user",
+                "type": "user"
-                "example": "johndoe"
             }
         ]
     }

scripts/backup

@@ -29,6 +29,7 @@ ynh_print_info --message="Loading installation settings..."
 app=$YNH_APP_INSTANCE_NAME
 
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+data_path=$(ynh_app_setting_get --app=$app --key=data_path)
 domain=$(ynh_app_setting_get --app=$app --key=domain)
 
 #=================================================
@@ -47,6 +48,12 @@ ynh_print_info --message="Declaring files to be backed up..."
 
 ynh_backup --src_path="$final_path"
 
+#=================================================
+# BACKUP THE APP DATA DIR
+#=================================================
+
+ynh_backup --src_path="$data_path"
+
 #=================================================
 # BACKUP THE NGINX CONFIGURATION
 #=================================================

scripts/change_url

@@ -24,16 +24,18 @@ app=$YNH_APP_INSTANCE_NAME
 #=================================================
 # LOAD SETTINGS
 #=================================================
-ynh_script_progression --message="Loading installation settings..." --time --weight=1
+ynh_script_progression --message="Loading installation settings..." --weight=1
 
 # Needed for helper "ynh_add_nginx_config"
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+data_path=$(ynh_app_setting_get --app=$app --key=data_path)
 port=$(ynh_app_setting_get --app=$app --key=port)
+api_key=$(ynh_app_setting_get --app=$app --key=api_key)
 
 #=================================================
 # BACKUP BEFORE CHANGE URL THEN ACTIVE TRAP
 #=================================================
-ynh_script_progression --message="Backing up the app before changing its URL (may take a while)..." --time --weight=1
+ynh_script_progression --message="Backing up the app before changing its URL (may take a while)..." --weight=3
 
 # Backup the current version of the app
 ynh_backup_before_upgrade
@@ -68,14 +70,14 @@ fi
 #=================================================
 # STOP SYSTEMD SERVICE
 #=================================================
-ynh_script_progression --message="Stopping a systemd service..." --time --weight=1
+ynh_script_progression --message="Stopping a systemd service..." --weight=1
 
 ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd"
 
 #=================================================
 # MODIFY URL IN NGINX CONF
 #=================================================
-ynh_script_progression --message="Updating NGINX web server configuration..." --time --weight=1
+ynh_script_progression --message="Updating NGINX web server configuration..." --weight=1
 
 nginx_conf_path=/etc/nginx/conf.d/$old_domain.d/$app.conf
 
@@ -87,8 +89,11 @@ then
 	# Set global variables for NGINX helper
 	domain="$old_domain"
 	path_url="$new_path"
+	path="$new_path"
 	# Create a dedicated NGINX config
 	ynh_add_nginx_config
+else
+	path="$old_path"
 fi
 
 # Change the domain for NGINX
@@ -104,22 +109,28 @@ fi
 #=================================================
 # SPECIFIC MODIFICATIONS
 #=================================================
-# ...
+# UPDATE CONFIGURATION FILE
 #=================================================
 
+ynh_exec_warn_less 'ynh_add_config --template="../conf/config.xml" --destination="$data_path/config.xml"'
+
+chmod 750 "$data_path/config.xml"
+chmod o-rwx "$data_path/config.xml"
+chown $app "$data_path/config.xml"
+
 #=================================================
 # GENERIC FINALISATION
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
-ynh_script_progression --message="Starting a systemd service..." --time --weight=1
+ynh_script_progression --message="Starting a systemd service..." --weight=2
 
-ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server"
+ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server" --timeout=30
 
 #=================================================
 # RELOAD NGINX
 #=================================================
-ynh_script_progression --message="Reloading NGINX web server..." --time --weight=1
+ynh_script_progression --message="Reloading NGINX web server..." --weight=1
 
 ynh_systemd_action --service_name=nginx --action=reload
 
@@ -127,4 +138,4 @@ ynh_systemd_action --service_name=nginx --action=reload
 # END OF SCRIPT
 #=================================================
 
-ynh_script_progression --message="Change of URL completed for $app" --time --last
+ynh_script_progression --message="Change of URL completed for $app" --last

scripts/install

@@ -35,8 +35,11 @@ app=$YNH_APP_INSTANCE_NAME
 #=================================================
 ynh_script_progression --message="Validating installation parameters..." --weight=1
 
-final_path=/opt/yunohost.app/$app
+final_path=/opt/yunohost/$app
-test ! -e "$final_path" || ynh_die --message="This path already contains a folder"
+test ! -e "$final_path" || ynh_die --message="Installation path ($final_path) already exists"
+
+data_path=/home/yunohost.app/$app
+test ! -e "$data_path" || ynh_die --message="Data directory ($data_path) already exists"
 
 # Register (book) web path
 ynh_webpath_register --app=$app --domain=$domain --path_url=$path_url
@@ -87,10 +90,8 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
 # Download, check integrity, uncompress and patch the source from app.src
 ynh_setup_source --dest_dir="$final_path" --source_id="app.$architecture"
 
-mkdir -p "$final_path/.data/logs"
+ynh_app_setting_set --app=$app --key=data_path --value=$data_path
-chmod 750 "$final_path"
+mkdir -p "$data_path/logs"
-chmod -R o-rwx "$final_path"
-chown -R $app:$app "$final_path"
 
 #=================================================
 # NGINX CONFIGURATION
@@ -115,14 +116,23 @@ ynh_add_systemd_config
 #=================================================
 ynh_script_progression --message="Configuring Radarr..." --weight=2
 
-# Start a systemd service
+api_key=$(ynh_string_random --length=32)
-ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server"
+ynh_app_setting_set --app=$app --key=api_key --value=$api_key
-# Start a systemd service
-ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd"
 
-ynh_replace_string --match_string="<Port>7878</Port>" --replace_string="<Port>$port</Port>" --target_file="$final_path/.data/config.xml"
+ynh_add_config --template="../conf/config.xml" --destination="$data_path/config.xml"
-ynh_replace_string --match_string="<UrlBase></UrlBase>" --replace_string="<UrlBase>$path_url</UrlBase>" --target_file="$final_path/.data/config.xml"
+
-ynh_replace_string --match_string="<BindAddress>\*</BindAddress>" --replace_string="<BindAddress>127.0.0.1</BindAddress>" --target_file="$final_path/.data/config.xml"
+#=================================================
+# SETUP FILE PERMISSIONS
+#=================================================
+ynh_script_progression --message="Setting files permissions and ownership..." --weight=1
+
+chmod 750 "$final_path"
+chmod -R o-rwx "$final_path"
+chown -R $app: "$final_path"
+
+chmod 750 "$data_path"
+chmod -R o-rwx "$data_path"
+chown -R $app: "$data_path"
 
 #=================================================
 # YUNOHOST MULTIMEDIA INTEGRATION
@@ -143,14 +153,14 @@ ynh_script_progression --message="Configuring log rotation..." --weight=1
 
 # Use logrotate to manage application logfile(s)
 ynh_use_logrotate
-ynh_use_logrotate --logfile="$final_path/.data/logs"
+ynh_use_logrotate --logfile="$data_path/logs"
 
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
 ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
 
-yunohost service add $app --description="Radarr daemon" --log="$final_path/.data/logs/radarr.txt"
+yunohost service add $app --description="Radarr daemon" --log="$data_path/logs/radarr.txt"
 
 #=================================================
 # START SYSTEMD SERVICE
@@ -158,7 +168,7 @@ yunohost service add $app --description="Radarr daemon" --log="$final_path/.data
 ynh_script_progression --message="Starting a systemd service..." --weight=2
 
 # Start a systemd service
-ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server"
+ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server" --timeout=30
 
 #=================================================
 # SETUP SSOWAT

scripts/remove

@@ -19,6 +19,7 @@ app=$YNH_APP_INSTANCE_NAME
 domain=$(ynh_app_setting_get --app=$app --key=domain)
 port=$(ynh_app_setting_get --app=$app --key=port)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+data_path=$(ynh_app_setting_get --app=$app --key=data_path)
 
 #=================================================
 # STANDARD REMOVE
@@ -57,6 +58,14 @@ ynh_script_progression --message="Removing app main directory..." --weight=1
 # Remove the app directory securely
 ynh_secure_remove --file="$final_path"
 
+#=================================================
+# REMOVE APP DATA DIR
+#=================================================
+ynh_script_progression --message="Removing app data directory..." --weight=1
+
+# Remove the app directory securely
+ynh_secure_remove --file="$data_path"
+
 #=================================================
 # REMOVE NGINX CONFIGURATION
 #=================================================

scripts/restore

@@ -31,17 +31,19 @@ app=$YNH_APP_INSTANCE_NAME
 domain=$(ynh_app_setting_get --app=$app --key=domain)
 path_url=$(ynh_app_setting_get --app=$app --key=path)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+data_path=$(ynh_app_setting_get --app=$app --key=data_path)
 
 #=================================================
 # CHECK IF THE APP CAN BE RESTORED
 #=================================================
 ynh_script_progression --message="Validating restoration parameters..." --weight=1
 
-ynh_webpath_available --domain=$domain --path_url=$path_url \
-	|| ynh_die --message="Path not available: ${domain}${path_url}"
 test ! -d $final_path \
 	|| ynh_die --message="There is already a directory: $final_path "
 
+test ! -d $data_path \
+        || ynh_die --message="There is already a directory: $data_path "
+
 #=================================================
 # STANDARD RESTORATION STEPS
 #=================================================
@@ -66,16 +68,21 @@ ynh_script_progression --message="Restoring the app main directory..." --weight=
 
 ynh_restore_file --origin_path="$final_path"
 
-# FIXME: this should be managed by the core in the future
-# Here, as a packager, you may have to tweak the ownerhsip/permissions
-# such that the appropriate users (e.g. maybe www-data) can access
-# files in some cases.
-# But FOR THE LOVE OF GOD, do not allow r/x for "others" on the entire folder -
-# this will be treated as a security issue.
 chmod 750 "$final_path"
 chmod -R o-rwx "$final_path"
 chown -R $app:$app "$final_path"
 
+#=================================================
+# RESTORE THE APP DATA DIR
+#=================================================
+ynh_script_progression --message="Restoring the app data directory..." --weight=2
+
+ynh_restore_file --origin_path="$data_path"
+
+chmod 750 "$data_path"
+chmod -R o-rwx "$data_path"
+chown -R $app: "$data_path"
+
 #=================================================
 # YUNOHOST MULTIMEDIA INTEGRATION
 #=================================================
@@ -109,14 +116,14 @@ systemctl enable $app.service --quiet
 #=================================================
 ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
 
-yunohost service add $app --description="Radarr daemon" --log="$final_path/.data/logs/radarr.txt"
+yunohost service add $app --description="Radarr daemon" --log="$data_path/logs/radarr.txt"
 
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --weight=2
 
-ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server"
+ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server" --timeout=30
 
 #=================================================
 # RESTORE THE LOGROTATE CONFIGURATION

scripts/upgrade

@@ -21,6 +21,7 @@ path_url=$(ynh_app_setting_get --app=$app --key=path)
 admin=$(ynh_app_setting_get --app=$app --key=admin)
 port=$(ynh_app_setting_get --app=$app --key=port)
 final_path=$(ynh_app_setting_get --app=$app --key=final_path)
+data_path=$(ynh_app_setting_get --app=$app --key=data_path)
 
 #=================================================
 # CHECK VERSION
@@ -67,6 +68,13 @@ if ! ynh_permission_exists --permission="api"; then
 	ynh_permission_create --permission="api" --url="/api" --allowed="visitors" --show_tile="false" --protected="true"
 fi
 
+# Move data directory if needed
+if [ -z "$data_path" ]; then
+        data_path=/home/yunohost.app/$app
+        ynh_app_setting_set --app=$app --key=data_path --value=$data_path
+        mv "$final_path/.data" "/home/yunohost.app/$app"
+fi
+
 #=================================================
 # CREATE DEDICATED USER
 #=================================================
@@ -89,10 +97,14 @@ then
 	ynh_setup_source --dest_dir="$final_path" --source_id="app.$architecture"
 fi
 
-mkdir -p "$final_path/.data/logs"
 chmod 750 "$final_path"
 chmod -R o-rwx "$final_path"
-chown -R $app:www-data "$final_path"
+chown -R $app: "$final_path"
+
+mkdir -p "$data_path/logs"
+chmod 750 "$data_path"
+chmod -R o-rwx "$data_path"
+chown -R $app: "$data_path"
 
 #=================================================
 # NGINX CONFIGURATION
@@ -128,21 +140,21 @@ ynh_script_progression --message="Upgrading logrotate configuration..." --weight
 
 # Use logrotate to manage app-specific logfile(s)
 ynh_use_logrotate --non-append
-ynh_use_logrotate --non-append --logfile="$final_path/.data/logs"
+ynh_use_logrotate --non-append --logfile="$data_path/logs"
 
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
 ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
 
-yunohost service add $app --description="Radarr daemon" --log="$final_path/.data/logs/radarr.txt"
+yunohost service add $app --description="Radarr daemon" --log="$data_path/logs/radarr.txt"
 
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --weight=2
 
-ynh_systemd_action --service_name=$app --action="start" --log_path="systemd"
+ynh_systemd_action --service_name=$app --action="start" --log_path="systemd" --line_match="Starting Web Server" --timeout=30
 
 #=================================================
 # RELOAD NGINX