Merge pull request #128 from YunoHost-Apps/testing

Testing

README.md

@@ -20,13 +20,13 @@ Rocket.Chat is an open-source fully customizable communications platform develop
 ### Features
 
 - End to End Encryption
-- LDAP/Active Directory
+- LDAP/Active Directory (manual setup)
 - Multifactor Authentication
 - Customizable User Permission
 - Mobile Apps for [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) and [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)
 - Desktop Apps for [macOS](https://apps.apple.com/br/app/rocket-chat/id1086818840), [Linux](https://snapcraft.io/rocketchat-desktop) and [Windows](https://releases.rocket.chat/desktop/latest/download)
 
-**Shipped version:** 4.8.1~ynh3
+**Shipped version:** 4.8.1~ynh4
 
 **Demo:** https://cloud.rocket.chat/trial
 
@@ -38,7 +38,7 @@ Rocket.Chat is an open-source fully customizable communications platform develop
 
 ### E-mail Configuration
 
-To enable E-mail for address verification, go to Rocket.Chat Administration panel under E-mail -> SMTP and set as follow:
+To enable E-mail for address verification, go to Rocket.Chat Administration panel under Settings -> E-mail -> SMTP and set as follow:
 
 - Protocole: `smtp`
 - Host: `localhost`

README_fr.md

@@ -20,13 +20,13 @@ Rocket.Chat est une plate-forme de communication open source entièrement person
 ### Fonctionnalités
 
 - Chiffrement de bout en bout
-- LDAP
+- LDAP (configuration manuelle)
 - Authentification multifacteur
 - Autorisation utilisateur personnalisable
 - Applications mobiles pour [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) et [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)
 - Applications de bureau pour [macOS](https://apps.apple.com/br/app/rocket-chat/id1086818840), [Linux](https://snapcraft.io/rocketchat-desktop) et [Windows](https://releases.rocket.chat/desktop/latest/download)
 
-**Version incluse :** 4.8.1~ynh3
+**Version incluse :** 4.8.1~ynh4
 
 **Démo :** https://cloud.rocket.chat/trial
 
@@ -38,7 +38,7 @@ Rocket.Chat est une plate-forme de communication open source entièrement person
 
 ### Configuration de l'e-mail
 
-Pour activer l'e-mail pour la vérification des adresses, accédez au panneau d'administration de Rocketchat sous E-mail -> SMTP et définissez comme suit : 
+Pour activer l'e-mail pour la vérification des adresses, accédez au panneau d'administration de Rocket.Chat sous Paramètres -> E-mail -> SMTP et définissez comme suit : 
 
 - Protocole : `smtp`
 - Hôte : `localhost`

check_process

@@ -14,7 +14,7 @@
 		setup_public=1
 		upgrade=1
 		#4.7.2~ynh2
-		upgrade=1	from_commit=9280c034e8843e7e69622f0daa02ee74c916faa1
+		upgrade=1	from_commit=78312cfb3e6fc6b7bff47843ee8209aba07498c0
 		backup_restore=1
 		multi_instance=1
 		port_already_use=0
@@ -22,3 +22,7 @@
 ;;; Options
 Email=
 Notification=none
+;;; Upgrade options
+	; commit=78312cfb3e6fc6b7bff47843ee8209aba07498c0
+		name=Merge pull request #125
+		manifest_arg=domain=DOMAIN&path=PATH&is_public=1&language=fr&admin=USER&password=pass&port=666&

conf/systemd.service

@@ -20,5 +20,35 @@ Environment=ADMIN_PASS=__PASSWORD__
 Environment=ADMIN_EMAIL=__EMAIL__
 Environment=OVERWRITE_SETTING_Show_Setup_Wizard=completed
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG
+
 [Install]
 WantedBy=multi-user.target

doc/DESCRIPTION.md

@@ -3,7 +3,7 @@ Rocket.Chat is an open-source fully customizable communications platform develop
 ### Features
 
 - End to End Encryption
-- LDAP/Active Directory
+- LDAP/Active Directory (manual setup)
 - Multifactor Authentication
 - Customizable User Permission
 - Mobile Apps for [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) and [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)

doc/DESCRIPTION_fr.md

@@ -3,7 +3,7 @@ Rocket.Chat est une plate-forme de communication open source entièrement person
 ### Fonctionnalités
 
 - Chiffrement de bout en bout
-- LDAP
+- LDAP (configuration manuelle)
 - Authentification multifacteur
 - Autorisation utilisateur personnalisable
 - Applications mobiles pour [iOS](https://apps.apple.com/app/rocket-chat/id1148741252) et [Android](https://play.google.com/store/apps/details?id=chat.rocket.android)

doc/DISCLAIMER.md

@@ -1,6 +1,6 @@
 ### E-mail Configuration
 
-To enable E-mail for address verification, go to Rocket.Chat Administration panel under E-mail -> SMTP and set as follow:
+To enable E-mail for address verification, go to Rocket.Chat Administration panel under Settings -> E-mail -> SMTP and set as follow:
 
 - Protocole: `smtp`
 - Host: `localhost`

doc/DISCLAIMER_fr.md

@@ -1,6 +1,6 @@
 ### Configuration de l'e-mail
 
-Pour activer l'e-mail pour la vérification des adresses, accédez au panneau d'administration de Rocketchat sous E-mail -> SMTP et définissez comme suit : 
+Pour activer l'e-mail pour la vérification des adresses, accédez au panneau d'administration de Rocket.Chat sous Paramètres -> E-mail -> SMTP et définissez comme suit : 
 
 - Protocole : `smtp`
 - Hôte : `localhost`

manifest.json

@@ -6,7 +6,7 @@
         "en": "Team collaboration communication platform",
         "fr": "Plateforme de communication collaborative en équipe"
     },
-    "version": "4.8.1~ynh3",
+    "version": "4.8.1~ynh4",
     "url": "https://rocket.chat",
     "upstream": {
         "license": "GPL-3.0",

scripts/_common.sh

@@ -321,7 +321,7 @@ ynh_mongo_remove_db() {
 #
 #
 ynh_install_mongo() {
-    ynh_print_info --message="Installing MongoDB Community Edition..."
+    ynh_script_progression --message="Installing MongoDB Community Edition..."
     ynh_install_extra_app_dependencies --repo="$MONGO_CE_REPO" --package="$MONGO_CE_DEPENDENCIES" --key="$MONGO_CE_KEY"
     mongodb_servicename=$MONGO_CE_SERVICENAME
     

scripts/change_url

@@ -104,6 +104,14 @@ then
 	ynh_store_file_checksum --file="/etc/nginx/conf.d/$new_domain.d/$app.conf"
 fi
 
+#=================================================
+# SPECIFIC MODIFICATIONS
+#=================================================
+ynh_script_progression --message="Updating systemd service..." --weight=1
+
+ynh_replace_string --match_string="Environment=ROOT_URL=https://$old_domain$old_path" --replace_string="Environment=ROOT_URL=https://$new_domain$new_path" --target_file="/etc/systemd/system/$app.service"
+systemctl daemon-reload
+
 #=================================================
 # GENERIC FINALISATION
 #=================================================

scripts/install

@@ -92,7 +92,7 @@ ynh_system_user_create --username=$app --home_dir="$final_path"
 #=================================================
 # CREATE A MONGODB DATABASE
 #=================================================
-ynh_script_progression --message="Creating a MongoDB database..."
+ynh_script_progression --message="Creating a MongoDB database..." --weight=2
 
 db_name=$(ynh_sanitize_dbid --db_name=$app)
 db_user=$db_name
@@ -168,7 +168,7 @@ ynh_use_logrotate
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
-ynh_script_progression --message="Integrating service in YunoHost..."
+ynh_script_progression --message="Integrating service in YunoHost..." --weight=1
 
 yunohost service add $app --description="Team collaboration communication platform"
 

scripts/remove

@@ -54,7 +54,7 @@ ynh_remove_logrotate
 #=================================================
 # REMOVE THE MONGODB DATABASE
 #=================================================
-ynh_script_progression --message="Removing the MongoDB database..."
+ynh_script_progression --message="Removing the MongoDB database..." --weight=3
 
 ynh_replace_string --match_string="engine: wiredTiger" --replace_string="#  engine:" --target_file=$MONGO_CE_CONFIG
 ynh_replace_string --match_string="replication:" --replace_string="#replication:" --target_file=$MONGO_CE_CONFIG