synapse_ynh/scripts/install

#!/bin/bash

#=================================================
# IMPORT GENERIC HELPERS
#=================================================

source _common.sh
source experimental_helper.sh
source /usr/share/yunohost/helpers

#=================================================
# RETRIEVE ARGUMENTS FROM THE MANIFEST
#=================================================

if [ "$server_name" == "Same than the domain" ]; then
    server_name=$domain
    ynh_app_setting_set --app=$app --key=server_name --value=$server_name
fi

#=================================================
## SET STANDARD SETTINGS FROM DEFAULT CONFIG
#=================================================

ynh_script_progression --message="Storing installation settings..." --weight=1

report_stats="false"
e2e_enabled_by_default="off"
allow_public_rooms_without_auth="false"
allow_public_rooms_over_federation="false"
max_upload_size="100M"
disable_msisdn_registration="true"
registrations_require_3pid="none"
allowed_local_3pids_email=""
allowed_local_3pids_msisdn=""
allow_guest_access="false"
account_threepid_delegates_msisdn=""
default_identity_server="https://matrix.org"
auto_join_rooms=""
autocreate_auto_join_rooms="false"
auto_join_rooms_for_guests="true"
enable_notifs="true"
notif_for_new_users="true"
enable_group_creation="true"
push_include_content="true"

if [ "$is_free_registration" -eq 0 ]
then
    enable_registration="false"
    turn_allow_guests="false"
    sso_enabled="true"
    password_enabled="false"
    enable_3pid_lookup="false"
else
    enable_registration="true"
    turn_allow_guests="true"
    sso_enabled="false"
    password_enabled="true"
    enable_3pid_lookup="true"
fi

element_ynh_url="https://matrix.to/"
# Get app name of first Element Instance (can be changed later in Config Panel)
element_instance="element"
if yunohost --output-as plain app list | grep -q "^$element_instance$"; then
    element_domain=$(ynh_app_setting_get --app $element_instance --key domain)
    element_path=$(ynh_app_setting_get --app $element_instance --key path)
    element_ynh_url="https://""$element_domain""$element_path"
fi
web_client_location=$element_ynh_url
client_base_url=$element_ynh_url
invite_client_location=$element_ynh_url

ynh_app_setting_set --app=$app --key=report_stats --value=$report_stats
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
ynh_app_setting_set --app=$app --key=web_client_location --value=$web_client_location
ynh_app_setting_set --app=$app --key=client_base_url --value=$client_base_url
ynh_app_setting_set --app=$app --key=invite_client_location --value=$invite_client_location
ynh_app_setting_set --app=$app --key=allow_public_rooms_without_auth --value=$allow_public_rooms_without_auth
ynh_app_setting_set --app=$app --key=allow_public_rooms_over_federation --value=$allow_public_rooms_over_federation
ynh_app_setting_set --app=$app --key=max_upload_size --value=$max_upload_size
ynh_app_setting_set --app=$app --key=disable_msisdn_registration --value=$disable_msisdn_registration
ynh_app_setting_set --app=$app --key=registrations_require_3pid --value=$registrations_require_3pid
ynh_app_setting_set --app=$app --key=allowed_local_3pids_email --value=$allowed_local_3pids_email
ynh_app_setting_set --app=$app --key=allowed_local_3pids_msisdn --value=$allowed_local_3pids_msisdn
ynh_app_setting_set --app=$app --key=account_threepid_delegates_msisdn --value=$account_threepid_delegates_msisdn
ynh_app_setting_set --app=$app --key=allow_guest_access --value=$allow_guest_access
ynh_app_setting_set --app=$app --key=default_identity_server --value=$default_identity_server
ynh_app_setting_set --app=$app --key=auto_join_rooms --value=$auto_join_rooms
ynh_app_setting_set --app=$app --key=autocreate_auto_join_rooms --value=$autocreate_auto_join_rooms
ynh_app_setting_set --app=$app --key=auto_join_rooms_for_guests --value=$auto_join_rooms_for_guests
ynh_app_setting_set --app=$app --key=password_enabled --value=$password_enabled
ynh_app_setting_set --app=$app --key=enable_notifs --value=$enable_notifs
ynh_app_setting_set --app=$app --key=notif_for_new_users --value=$notif_for_new_users
ynh_app_setting_set --app=$app --key=enable_group_creation --value=$enable_group_creation
ynh_app_setting_set --app=$app --key=push_include_content --value=$push_include_content
ynh_app_setting_set --app=$app --key=enable_registration --value=$enable_registration
ynh_app_setting_set --app=$app --key=turn_allow_guests --value=$turn_allow_guests
ynh_app_setting_set --app=$app --key=sso_enabled --value=$sso_enabled
ynh_app_setting_set --app=$app --key=password_enabled --value=$password_enabled
ynh_app_setting_set --app=$app --key=enable_3pid_lookup --value=$enable_3pid_lookup

#=================================================
# STANDARD MODIFICATIONS
#=================================================
# CREATE A DH FILE
#=================================================
ynh_script_progression --message="Creating a dh file..." --weight=3

# WARNING : theses command are used in INSTALL, UPGRADE, RESTORE
# For any update do it in all files

# Make dh cert for synapse if it doesn't exist
if [ ! -e /etc/ssl/private/dh2048.pem ]
then
    ynh_exec_warn_less openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 -dsaparam
    chown root:ssl-cert /etc/ssl/private/dh2048.pem
    chmod 640 /etc/ssl/private/dh2048.pem
fi

#=================================================
# CREATE DEDICATED USER
#=================================================
ynh_script_progression --message="Creating $app user..." --weight=1

synapse_user_app_pwd="$(ynh_string_random --length=30)"
ynh_app_setting_set --app=$app --key=synapse_user_app_pwd --value=$synapse_user_app_pwd
# yunohost user create $YNH_APP_ID -F "Synapse Application" -d $domain -p "$synapse_user_app_pwd"

adduser $YNH_APP_ID ssl-cert
adduser turnserver ssl-cert

#=================================================
# FIX DB CONFIG
#=================================================
ynh_script_progression --message="Fixing database type..." --weight=1

ynh_psql_execute_as_root \
    --sql="update pg_database set datcollate='C', datctype='C' where datname='$db_name';"

#=================================================
# DOWNLOAD, CHECK AND UNPACK SOURCE
#=================================================
ynh_script_progression --message="Setting up source files..." --weight=50

# Create empty dir for synapse

# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files
mkdir -p /var/log/matrix-$app
mkdir -p /etc/matrix-$app/conf.d
mkdir -p /etc/matrix-$app/app-service
touch /etc/matrix-$app/conf.d/app_service.yaml

# Install synapse in virtualenv
install_sources

#=================================================
# CREATE SMALL CAS SERVER
#=================================================
# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files

cp ../sources/cas_server.php $install_dir/
chmod u=rwX,g=rX,o= -R $install_dir
chown $YNH_APP_ID:$YNH_APP_ID -R $install_dir

#=================================================
# CREATE SYNAPSE CONFIG
#=================================================

ynh_script_progression --message="Creating Synapse config..." --weight=3

# Go in virtualenvironnement
u_arg='u'
set +$u_arg;
source $code_dir/bin/activate
set -$u_arg;

# Generate config
python -m synapse.app.homeserver --keys-directory /etc/matrix-$app/ --generate-config --server-name $server_name --report-stats=no -c homeserver.yml

# This function was defined when we called "source $code_dir/bin/activate". With this function we undo what "$code_dir/bin/activate" does
set +$u_arg;
deactivate
set -$u_arg;

# Get random values from config
registration_shared_secret=$(egrep "^registration_shared_secret:" homeserver.yml | cut -d'"' -f2)
form_secret=$(egrep "^form_secret:" homeserver.yml | cut -d'"' -f2)
macaroon_secret_key=$(egrep "^macaroon_secret_key:" homeserver.yml | cut -d'"' -f2)

# store in yunohost settings
ynh_app_setting_set --app=$app --key=registration_shared_secret --value="$registration_shared_secret"
ynh_app_setting_set --app=$app --key=form_secret --value="$form_secret"
ynh_app_setting_set --app=$app --key=macaroon_secret_key --value="$macaroon_secret_key"

#=================================================
# SETUP SYSTEMD
#=================================================
ynh_script_progression --message="Configuring a systemd service..." --weight=2

# Create systemd service for synapse and turnserver
cp ../conf/default_matrix-synapse /etc/default/matrix-$app
ynh_add_systemd_config --service=matrix-$app --template=matrix-synapse.service

cp ../conf/default_coturn /etc/default/coturn-$app
ynh_add_systemd_config --service=coturn-$app --template=coturn-synapse.service

#=================================================
# NGINX CONFIGURATION
#=================================================
ynh_script_progression --message="Configuring NGINX web server..." --weight=2

# Create a dedicated php-fpm config
ynh_script_progression --message="Configuring application..."

ynh_add_fpm_config --usage=low --footprint=low

configure_nginx

#=================================================
# SET SYNAPSE CONFIG
#=================================================
ynh_script_progression --message="Configuring Synapse..." --weight=2

# Find password for turnserver and database
turnserver_pwd=$(ynh_string_random --length=30)
ynh_app_setting_set --app=$app --key=turnserver_pwd --value=$turnserver_pwd

configure_synapse

#=================================================
# SET COTURN CONFIG
#=================================================
ynh_script_progression --message="Configuring Coturn..." --weight=1

configure_coturn

#=================================================
# SETUP LOGROTATE
#=================================================
ynh_script_progression --message="Configuring log rotation..." --weight=2

ynh_use_logrotate --logfile "/var/log/matrix-$app"

#=================================================
# ADD SCRIPT FOR COTURN CRON AND APP SERVICE
#=================================================

# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files

ynh_add_config --template="../sources/Coturn_config_rotate.sh" --destination="$code_dir/Coturn_config_rotate.sh"
ynh_add_config --template="../sources/update_synapse_for_appservice.sh" --destination="$code_dir/update_synapse_for_appservice.sh"

#=================================================
# GENERIC FINALIZATION
#=================================================
# SETUP PERMISSIONS
#=================================================

ynh_script_progression --message="Configuring permissions..." --weight=1

if yunohost --output-as plain domain list | grep -q "^$server_name$"; then
    ynh_""permission_create --permission=server_client_infos --url=$server_name/.well-known/matrix \
                          --label="Server info for clients. (well-known)" --show_tile=false --allowed=visitors \
                          --auth_header=false --protected=true
fi

#=================================================
# UPDATE HOOKS
#=================================================

# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files
ynh_replace_string __APP__ $app ../hooks/post_cert_update
ynh_replace_string __DOMAIN__ $domain ../hooks/post_cert_update

#=================================================
# SECURE FILES AND DIRECTORIES
#=================================================

ynh_script_progression --message="Protecting directories..." --weight=3
set_permissions

#=================================================
# ADVERTISE SERVICE IN ADMIN PANEL
#=================================================

yunohost service add matrix-$app --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports $port_synapse_tls
yunohost service add coturn-$app --needs_exposed_ports $port_turnserver_tls

#=================================================
# RELOAD SERVICES
#=================================================
ynh_script_progression --message="Restarting Synapse services..." --weight=11

ynh_systemd_action --service_name=coturn-$app.service --action=restart
ynh_systemd_action --service_name=matrix-$app --action=restart --line_match="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300

#=================================================
# SETUP FAIL2BAN
#=================================================
ynh_script_progression --message="Configuring Fail2Ban..." --weight=10

ynh_add_fail2ban_config --use_template

#=================================================
# END OF SCRIPT
#=================================================

ynh_script_progression --message="Installation of $app completed" --last