Secure config file

README.md

@@ -28,7 +28,7 @@ You can extend - or even override - the Roundcube configuration which is coming
 ## Documentation
 
  * Official documentation: https://github.com/roundcube/roundcubemail/wiki
- * YunoHost documentation: https://github.com/YunoHost/doc/blob/master/app_roundcube.md:
+ * YunoHost documentation: https://yunohost.org/en/app_roundcube
 
 ## YunoHost specific features
 

README_fr.md

@@ -28,7 +28,7 @@ Vous pouvez étendre (ou même remplacer) la configuration de Roundcube fournie
 ## Documentation
 
  * Documentation officielle : https://github.com/roundcube/roundcubemail/wiki
- * Documentation YunoHost : https://github.com/YunoHost/doc/blob/master/app_roundcube.md:
+ * Documentation YunoHost : https://yunohost.org/fr/app_roundcube
 
 ## Caractéristiques spécifiques YunoHost
 

scripts/install

@@ -61,6 +61,14 @@ db_name=$(ynh_sanitize_dbid --db_name=$app)
 ynh_app_setting_set --app=$app --key=db_name --value=$db_name
 ynh_mysql_setup_db --db_user=$db_name --db_name=$db_name
 
+#=================================================
+# CREATE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Configuring system user..." --weight=3
+
+# Create a system user
+ynh_system_user_create --username=$app --home_dir="$final_path"
+
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
 #=================================================
@@ -78,14 +86,6 @@ ynh_script_progression --message="Configuring NGINX web server..." --weight=2
 # Create a dedicated NGINX config
 ynh_add_nginx_config
 
-#=================================================
-# CREATE DEDICATED USER
-#=================================================
-ynh_script_progression --message="Configuring system user..." --weight=3
-
-# Create a system user
-ynh_system_user_create --username=$app
-
 #=================================================
 # PHP-FPM CONFIGURATION
 #=================================================
@@ -121,15 +121,19 @@ ynh_mysql_connect_as --user="$db_name" --password="$db_pwd" --database="$db_name
 #=================================================
 ynh_script_progression --message="Configuring Roundcube..."
 
-rc_conf="$final_path/config/config.inc.php"
+#rc_conf="$final_path/config/config.inc.php"
 
-cp ../conf/config.inc.php "$rc_conf"
+deskey=$(ynh_string_random --length=24)
 
-ynh_replace_string --match_string="__DESKEY__" --replace_string="$(ynh_string_random --length=24)" --target_file="$rc_conf"
+# cp ../conf/config.inc.php "$rc_conf"
-ynh_replace_string --match_string="__DB_USER__" --replace_string="$db_name" --target_file="$rc_conf"
+
-ynh_replace_string --match_string="__DB_PWD__" --replace_string="$db_pwd" --target_file="$rc_conf"
+# ynh_replace_string --match_string="__DESKEY__" --replace_string="$(ynh_string_random --length=24)" --target_file="$rc_conf"
-ynh_replace_string --match_string="__DB_NAME__" --replace_string="$db_name" --target_file="$rc_conf"
+# ynh_replace_string --match_string="__DB_USER__" --replace_string="$db_name" --target_file="$rc_conf"
-ynh_replace_string --match_string="__LANGUAGE__" --replace_string="$language" --target_file="$rc_conf"
+# ynh_replace_string --match_string="__DB_PWD__" --replace_string="$db_pwd" --target_file="$rc_conf"
+# ynh_replace_string --match_string="__DB_NAME__" --replace_string="$db_name" --target_file="$rc_conf"
+# ynh_replace_string --match_string="__LANGUAGE__" --replace_string="$language" --target_file="$rc_conf"
+
+ynh_add_config --template="../conf/config.inc.php" --destination="$final_path/config/config.inc.php"
 
 #=================================================
 # INSTALL ADDITIONAL PLUGINS
@@ -204,14 +208,14 @@ fi
 #=================================================
 ynh_script_progression --message="Updating Roundcube configuration..." --weight=3
 
-ynh_replace_string --match_string="^\s*// installed plugins" --replace_string="&\n $installed_plugins" --target_file="$rc_conf"
+ynh_replace_string --match_string="^\s*// installed plugins" --replace_string="&\n $installed_plugins" --target_file="$final_path/config/config.inc.php"
 
 # Update javascript dependencies
 (cd "$final_path"
 /usr/bin/php -q ./bin/install-jsdeps.sh)
 
 # Store the config file checksum into the app settings
-ynh_store_file_checksum --file="$rc_conf"
+ynh_store_file_checksum --file="$final_path/config/config.inc.php"
 
 #=================================================
 # GENERIC FINALIZATION
@@ -224,6 +228,9 @@ chown -R root: "$final_path"
 mkdir -p "$final_path/plugins/enigma/home"
 chown -R $app: "$final_path/"{temp,logs,plugins/enigma/home}
 
+chmod 600 "$final_path/config/config.inc.php"
+chown $app:$app "$final_path/some_config_file"
+
 #=================================================
 # RELOAD NGINX
 #=================================================

scripts/restore

@@ -46,6 +46,13 @@ test ! -d $final_path \
 #=================================================
 
 ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
+#=================================================
+# RECREATE THE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Recreating the dedicated system user..." --weight=4
+
+# Create the dedicated user (if not existing)
+ynh_system_user_create --username=$app --home_dir="$final_path"
 
 #=================================================
 # RESTORE THE APP MAIN DIR
@@ -54,14 +61,6 @@ ynh_script_progression --message="Restoring $app main directory..."
 
 ynh_restore_file --origin_path="$final_path"
 
-#=================================================
-# RECREATE THE DEDICATED USER
-#=================================================
-ynh_script_progression --message="Recreating the dedicated system user..." --weight=4
-
-# Create the dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
 #=================================================
 # RESTORE USER RIGHTS
 #=================================================
@@ -71,6 +70,9 @@ chown -R root: "$final_path"
 mkdir -p "$final_path/plugins/enigma/home"
 chown -R $app: "$final_path/"{temp,logs,plugins/enigma/home}
 
+chmod 600 "$final_path/config/config.inc.php"
+chown $app:$app "$final_path/some_config_file"
+
 #=================================================
 # RESTORE THE PHP-FPM CONFIGURATION
 #=================================================

scripts/upgrade

@@ -91,6 +91,14 @@ ynh_clean_setup () {
 # Exit if an error occurs during the execution of the script
 ynh_abort_if_errors
 
+#=================================================
+# CREATE DEDICATED USER
+#=================================================
+ynh_script_progression --message="Making sure dedicated system user exists..."
+
+# Create a dedicated user (if not existing)
+ynh_system_user_create --username=$app --home_dir="$final_path"
+
 #=================================================
 # STANDARD UPGRADE STEPS
 #=================================================
@@ -116,14 +124,6 @@ ynh_script_progression --message="Upgrading NGINX web server configuration..."
 # Create a dedicated NGINX config
 ynh_add_nginx_config
 
-#=================================================
-# CREATE DEDICATED USER
-#=================================================
-ynh_script_progression --message="Making sure dedicated system user exists..."
-
-# Create a dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
 #=================================================
 # PHP-FPM CONFIGURATION
 #=================================================
@@ -145,15 +145,18 @@ then
     rc_conf="$final_path/config/config.inc.php"
 
     # Verify the checksum and backup the file if it's different
-    ynh_backup_if_checksum_is_different "$rc_conf"
+    # ynh_backup_if_checksum_is_different "$rc_conf"
 
-    cp ../conf/config.inc.php "$rc_conf"
+    # cp ../conf/config.inc.php "$rc_conf"
 
-    ynh_replace_string --match_string="__DESKEY__" --replace_string="$(ynh_string_random --length=24)" --target_file="$rc_conf"
+    # ynh_replace_string --match_string="__DESKEY__" --replace_string="$(ynh_string_random --length=24)" --target_file="$rc_conf"
-    ynh_replace_string --match_string="__DB_USER__" --replace_string="$db_name" --target_file="$rc_conf"
+    # ynh_replace_string --match_string="__DB_USER__" --replace_string="$db_name" --target_file="$rc_conf"
-    ynh_replace_string --match_string="__DB_PWD__" --replace_string="$db_pwd" --target_file="$rc_conf"
+    # ynh_replace_string --match_string="__DB_PWD__" --replace_string="$db_pwd" --target_file="$rc_conf"
-    ynh_replace_string --match_string="__DB_NAME__" --replace_string="$db_name" --target_file="$rc_conf"
+    # ynh_replace_string --match_string="__DB_NAME__" --replace_string="$db_name" --target_file="$rc_conf"
-    ynh_replace_string --match_string="__LANGUAGE__" --replace_string="$language" --target_file="$rc_conf"
+    # ynh_replace_string --match_string="__LANGUAGE__" --replace_string="$language" --target_file="$rc_conf"
+
+    deskey=$(ynh_string_random --length=24)
+    ynh_add_config --template="../conf/config.inc.php" --destination="$final_path/config/config.inc.php"
 
     #=================================================
     # UPDATE DEPENDENCIES WITH COMPOSER
@@ -245,14 +248,14 @@ then
     #=================================================
     ynh_script_progression --message="Updating $app configuration..." --weight=4
 
-    ynh_replace_string --match_string="^\s*// installed plugins" --replace_string="&\n $installed_plugins" --target_file="$rc_conf"
+    ynh_replace_string --match_string="^\s*// installed plugins" --replace_string="&\n $installed_plugins" --target_file="$final_path/config/config.inc.php"
 
     # Update JavaScript dependencies
     (cd "$final_path"
     /usr/bin/php -q ./bin/install-jsdeps.sh)
 
     # Store the config file checksum into the app settings
-    ynh_store_file_checksum --file="$rc_conf"
+    ynh_store_file_checksum --file="$final_path/config/config.inc.php"
 
     #=================================================
     # UPDATE ROUNDCUBE CORE
@@ -274,6 +277,9 @@ chown -R root: "$final_path"
 mkdir -p "$final_path/plugins/enigma/home"
 chown -R $app: "$final_path/"{temp,logs,plugins/enigma/home}
 
+chmod 600 "$final_path/config/config.inc.php"
+chown $app:$app "$final_path/some_config_file"
+
 #=================================================
 # RELOAD NGINX
 #=================================================