From 5f2ee05c4cca61a4e44b75fe114a6efd466b64ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Josu=C3=A9=20Tille?= Date: Tue, 15 Dec 2020 22:25:29 +0100 Subject: [PATCH] Implement group permission support and use new helper for config file --- conf/add_sso_conf.py | 28 ----- conf/homeserver.yaml | 8 +- conf/server_name.conf | 4 +- conf/turnserver.conf | 6 +- manifest.json | 4 +- scripts/_common.sh | 1 - scripts/change_url | 60 +++------- scripts/config | 51 +++----- scripts/install | 87 ++++---------- .../remove_sso_conf_persistent.py | 6 +- scripts/restore | 31 +---- scripts/upgrade | 110 ++++++------------ 12 files changed, 112 insertions(+), 284 deletions(-) delete mode 100644 conf/add_sso_conf.py rename conf/remove_sso_conf.py => scripts/remove_sso_conf_persistent.py (62%) diff --git a/conf/add_sso_conf.py b/conf/add_sso_conf.py deleted file mode 100644 index f6b7d41..0000000 --- a/conf/add_sso_conf.py +++ /dev/null @@ -1,28 +0,0 @@ -import json -import sys - -domain = sys.argv[1] -server_name = sys.argv[2] - -with open("/etc/ssowat/conf.json.persistent", "r", encoding='utf-8') as jsonFile: - data = json.load(jsonFile) - - if "skipped_urls" not in data: - data["skipped_urls"] = [] - if "protected_urls" not in data: - data["protected_urls"] = [] - - # Remove entry without the domain specified - if "/_matrix" in data["skipped_urls"]: - data["skipped_urls"].remove("/_matrix") - - if domain + "/_matrix" not in data["skipped_urls"]: - data["skipped_urls"].append(domain + "/_matrix") - if server_name + "/.well-known/matrix/" not in data["skipped_urls"]: - data["skipped_urls"].append(server_name + "/.well-known/matrix/") - - if domain + "/_matrix/cas_server.php/login" not in data["protected_urls"]: - data["protected_urls"].append(domain + "/_matrix/cas_server.php/login") - -with open("/etc/ssowat/conf.json.persistent", "w", encoding='utf-8') as jsonFile: - jsonFile.write(json.dumps(data, indent=4, sort_keys=True)) diff --git a/conf/homeserver.yaml b/conf/homeserver.yaml index abb6e15..b8d1823 100644 --- a/conf/homeserver.yaml +++ b/conf/homeserver.yaml @@ -184,7 +184,7 @@ listeners: # will also need to give Synapse a TLS key and certificate: see the TLS section # below.) # - - port: __TLS_PORT__ + - port: __TURNSERVER_TLS_PORT__ type: http tls: true resources: @@ -768,7 +768,7 @@ turn_uris: [ "turn:__DOMAIN__:__TURNSERVER_TLS_PORT__?transport=udp", "turn:__DO # The shared secret used to compute passwords for the TURN server # -turn_shared_secret: "__TURNPWD__" +turn_shared_secret: "__TURNSERVER_PWD__" # The Username and password if the TURN server needs them and # does not use a token @@ -884,7 +884,7 @@ enable_registration: __ALLOWED_ACCESS__ # If set, allows registration of standard or admin accounts by anyone who # has the shared secret, even if registration is otherwise disabled. # -registration_shared_secret: "__REGISTRATION_SECRET__" +registration_shared_secret: "__REGISTRATION_SHARED_SECRET__" # Set the number of bcrypt rounds used to generate password hash. # Larger numbers increase the work factor needed to generate the hash. @@ -1030,7 +1030,7 @@ report_stats: __REPORT_STATS__ # the registration_shared_secret is used, if one is given; otherwise, # a secret key is derived from the signing key. # -macaroon_secret_key: "__MACAROON_SECRET_KEY__" +__MACAROON_SECRET_KEY_PARAM__ # a secret which is used to calculate HMACs for form values, to stop # falsification of values. Must be specified for the User Consent diff --git a/conf/server_name.conf b/conf/server_name.conf index 783927b..4cb77de 100644 --- a/conf/server_name.conf +++ b/conf/server_name.conf @@ -1,5 +1,5 @@ location /.well-known/matrix/server { - return 200 '{"m.server": "__DOMAIN__:__PORT__"}'; + return 200 '{"m.server": "__DOMAIN__:__SYNAPSE_TLS_PORT__"}'; add_header Content-Type application/json; add_header Access-Control-Allow-Origin '*'; } @@ -7,7 +7,7 @@ location /.well-known/matrix/server { location /.well-known/matrix/client { return 200 '{ "m.homeserver": { "base_url": "https://__DOMAIN__" }, - "im.vector.riot.jitsi": {"preferredDomain": "__JITSI_SERVER_ADDR__"}, + "im.vector.riot.jitsi": {"preferredDomain": "__JITSI_SERVER__"}, "im.vector.riot.e2ee": {"default": __E2E_ENABLED_BY_DEFAULT__ } }'; add_header Content-Type application/json; diff --git a/conf/turnserver.conf b/conf/turnserver.conf index 7483e7d..3d3440f 100644 --- a/conf/turnserver.conf +++ b/conf/turnserver.conf @@ -1,9 +1,9 @@ lt-cred-mech use-auth-secret -static-auth-secret=__TURNPWD__ +static-auth-secret=__TURNSERVER_PWD__ realm=__DOMAIN__ -tls-listening-port=__TLS_PORT__ +tls-listening-port=__TURNSERVER_TLS_PORT__ alt-tls-listening-port=__TLS_ALT_PORT__ min-port=49153 max-port=49193 @@ -26,3 +26,5 @@ no-cli log-file=/var/log/matrix-__APP__/turnserver.log pidfile=/run/coturn-__APP__/turnserver.pid simple-log + +__TURN_EXTERNAL_IP__ diff --git a/manifest.json b/manifest.json index 3b48db4..e943ad0 100644 --- a/manifest.json +++ b/manifest.json @@ -6,7 +6,7 @@ "en": "Instant messaging server which uses Matrix", "fr": "Un serveur de messagerie instantané basé sur Matrix" }, - "version": "1.25.0~ynh1", + "version": "1.25.0~ynh2", "url": "http://matrix.org", "license": "Apache-2.0", "maintainer": { @@ -14,7 +14,7 @@ "email": "josue@tille.ch" }, "requirements": { - "yunohost": ">= 3.7.0.4" + "yunohost": ">= 4.1" }, "multi_instance": true, "services": [ diff --git a/scripts/_common.sh b/scripts/_common.sh index f983ca9..4e6bd6f 100755 --- a/scripts/_common.sh +++ b/scripts/_common.sh @@ -32,7 +32,6 @@ install_sources() { test -e $final_path/bin/python3 || python3 -m venv $final_path # Install synapse in virtualenv - ynh_replace_string --match_string=__FINAL_PATH__ --replace_string=$final_path --target_file=$final_path/bin/activate # We set all necessary environement variable to create a python virtualenvironnement. set +u; diff --git a/scripts/change_url b/scripts/change_url index 51fde8e..8fddd7d 100644 --- a/scripts/change_url +++ b/scripts/change_url @@ -79,12 +79,7 @@ ynh_store_file_checksum --file "/etc/nginx/conf.d/$domain.d/$app.conf" # Create .well-known redirection for access by federation if yunohost --output-as plain domain list | grep -q "^$server_name$" then - cp ../conf/server_name.conf /etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf - ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__PORT__ --replace_string=$synapse_tls_port --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__JITSI_SERVER_ADDR__ --replace_string=$jitsi_server --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__E2E_ENABLED_BY_DEFAULT__ --replace_string=$e2e_enabled_by_default --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_store_file_checksum --file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" + ynh_add_config --template="server_name.conf" --destination="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" fi #================================================= @@ -96,59 +91,40 @@ ynh_script_progression --message="Updating synapse config..." --weight=2 # WARNING : theses command are used in INSTALL, UPGRADE, CONFIG, CHANGE-URL (4 times) # For any update do it in all files -homeserver_config_path="/etc/matrix-$app/homeserver.yaml" - -ynh_backup_if_checksum_is_different --file="$homeserver_config_path" -ynh_backup_if_checksum_is_different --file=/etc/matrix-$app/log.yaml - -cp ../conf/homeserver.yaml "$homeserver_config_path" -cp ../conf/log.yaml /etc/matrix-$app/log.yaml - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__SERVER_NAME__ --replace_string=$server_name --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__SYNAPSE_DB_USER__ --replace_string=$synapse_db_user --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__PORT__ --replace_string=$port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__TLS_PORT__ --replace_string=$synapse_tls_port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__TURNSERVER_TLS_PORT__ --replace_string=$turnserver_tls_port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__REPORT_STATS__ --replace_string="$report_stats" --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__ALLOW_PUBLIC_ROOMS__ --replace_string="$allow_public_rooms" --target_file="$homeserver_config_path" -ynh_print_OFF -ynh_replace_special_string --match_string=__SYNAPSE_DB_PWD__ --replace_string=$synapse_db_pwd --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__TURNPWD__ --replace_string=$turnserver_pwd --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__REGISTRATION_SECRET__ --replace_string="$registration_shared_secret" --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__FORM_SECRET__ --replace_string="$form_secret" --target_file="$homeserver_config_path" if [ -z $macaroon_secret_key ]; then # Well, in this package this value was not managed because it was not needed, synapse is able to generate this with some other secret in the config file but after some vulnerability was found with this practice. # For more detail about this issue you can see : https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/ # The problem is that we can't just say generate a new value if the package has not already defined a value. The reason is that changing this value logout all user. And in case of a user has enabled the encryption, the user might lost all conversation !! # So for the old install we just leave this as it is. And for the new install we use a real macaroon. - ynh_replace_special_string --match_string='macaroon_secret_key: "__MACAROON_SECRET_KEY__"' --replace_string='# macaroon_secret_key: "__MACAROON_SECRET_KEY__"' --target_file="$homeserver_config_path" + macaroon_secret_key_param='# macaroon_secret_key: ""' else - ynh_replace_special_string --match_string=__MACAROON_SECRET_KEY__ --replace_string="$macaroon_secret_key" --target_file="$homeserver_config_path" + macaroon_secret_key_param='macaroon_secret_key: "'$macaroon_secret_key'"' fi -ynh_print_ON - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="/etc/matrix-$app/log.yaml" if [ $is_public -eq 0 ] then - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=False --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=True --target_file="$homeserver_config_path" + allowed_access=False + sso_enabled=True else - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=True --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=False --target_file="$homeserver_config_path" + allowed_access=True + sso_enabled=False fi -ynh_store_file_checksum --file="$homeserver_config_path" -ynh_store_file_checksum --file="/etc/matrix-$app/log.yaml" +ynh_add_config --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" +ynh_add_config --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" #================================================= -# SETUP SSOWAT +# SETUP PERMISSIONS #================================================= -python3 ../conf/remove_sso_conf.py $domain $server_name -python3 ../conf/add_sso_conf.py $domain $server_name || ynh_die --message="Your file /etc/ssowat/conf.json.persistent doesn't respect the json syntax. Please fix the syntax to install this app. For more information see here: https://github.com/YunoHost-Apps/synapse_ynh/issues/32" +ynh_script_progression --message="Configuring permissions..." --weight=1 + +ynh_permission_url --permission=main --url=$domain/_matrix/cas_server.php/login --auth_header=true +ynh_permission_update --permission=main --label="Synapse server SSO authentication" --show_tile=false --protected=true + +ynh_permission_update --permission=server_api --url=$domain/_matrix --additional_urls=$server_name/.well-known/matrix \ + --label="Server access for client apps." --show_tile=false \ + --auth_header=false --protected=true #================================================= # RELOAD SERVICES diff --git a/scripts/config b/scripts/config index a52171e..6c1028c 100644 --- a/scripts/config +++ b/scripts/config @@ -114,53 +114,32 @@ apply_config() { # WARNING : theses command are used in INSTALL, UPGRADE, CONFIG, CHANGE-URL (4 times) # For any update do it in all files - homeserver_config_path="/etc/matrix-$app/homeserver.yaml" - - ynh_backup_if_checksum_is_different "$homeserver_config_path" - - cp ../conf/homeserver.yaml "$homeserver_config_path" - - ynh_replace_string --match_string __APP__ --replace_string $app --target_file "$homeserver_config_path" - ynh_replace_string --match_string __DOMAIN__ --replace_string $domain --target_file "$homeserver_config_path" - ynh_replace_string --match_string __SERVER_NAME__ --replace_string $server_name --target_file "$homeserver_config_path" - ynh_replace_string --match_string __SYNAPSE_DB_USER__ --replace_string $synapse_db_user --target_file "$homeserver_config_path" - ynh_replace_special_string --match_string __SYNAPSE_DB_PWD__ --replace_string $synapse_db_pwd --target_file "$homeserver_config_path" - ynh_replace_string --match_string __PORT__ --replace_string $port --target_file "$homeserver_config_path" - ynh_replace_string --match_string __TLS_PORT__ --replace_string $synapse_tls_port --target_file "$homeserver_config_path" - ynh_replace_string --match_string __TURNSERVER_TLS_PORT__ --replace_string $turnserver_tls_port --target_file "$homeserver_config_path" - ynh_replace_special_string --match_string __TURNPWD__ --replace_string $turnserver_pwd --target_file "$homeserver_config_path" - ynh_replace_special_string --match_string __REGISTRATION_SECRET__ --replace_string "$registration_shared_secret" --target_file "$homeserver_config_path" - ynh_replace_special_string --match_string __FORM_SECRET__ --replace_string "$form_secret" --target_file "$homeserver_config_path" - ynh_replace_string --match_string __REPORT_STATS__ --replace_string "$report_stats" --target_file "$homeserver_config_path" - ynh_replace_string --match_string=__ALLOW_PUBLIC_ROOMS__ --replace_string="$allow_public_rooms" --target_file="$homeserver_config_path" - if [ -n $macaroon_secret_key ]; then - # Well, in this package this value was not managed because it was not needed, synapse is able to generate this with some other secret in the config file but after some vulnerability was found with this practice. - # The problem is that we can't just say generate a new value if the package has not already defined a value. The reason is that changing this value logout all user. And in case of a user has enabled the encryption, the user might lost all conversation !! - # So for the old install we just leave this as it is. And for the new install we use a real macaroon. - # For more detail about this issue you can see : https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/ - ynh_replace_string --match_string='macaroon_secret_key: "__MACAROON_SECRET_KEY__"' --replace_string='# macaroon_secret_key: "__MACAROON_SECRET_KEY__"' --target_file="$homeserver_config_path" + if [ -z $macaroon_secret_key ]; then + # Well, in this package this value was not managed because it was not needed, synapse is able to generate this with some other secret in the config file but after some vulnerability was found with this practice. + # For more detail about this issue you can see : https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/ + # The problem is that we can't just say generate a new value if the package has not already defined a value. The reason is that changing this value logout all user. And in case of a user has enabled the encryption, the user might lost all conversation !! + # So for the old install we just leave this as it is. And for the new install we use a real macaroon. + macaroon_secret_key_param='# macaroon_secret_key: ""' else - ynh_replace_special_string --match_string=__MACAROON_SECRET_KEY__ --replace_string="$macaroon_secret_key" --target_file="$homeserver_config_path" + macaroon_secret_key_param='macaroon_secret_key: "'$macaroon_secret_key'"' fi if [ $is_public -eq 0 ] then - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=False --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=True --target_file="$homeserver_config_path" + allowed_access=False + sso_enabled=True else - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=True --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=False --target_file="$homeserver_config_path" + allowed_access=True + sso_enabled=False fi + ynh_add_config --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" + ynh_add_config --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" + # Create .well-known redirection for access by federation if yunohost --output-as plain domain list | grep -q "^$server_name$" then - cp ../conf/server_name.conf /etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf - ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__PORT__ --replace_string=$synapse_tls_port --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__JITSI_SERVER_ADDR__ --replace_string=$jitsi_server --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__E2E_ENABLED_BY_DEFAULT__ --replace_string=$e2e_enabled_by_default --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_store_file_checksum --file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" + ynh_add_config --template="server_name.conf" --destination="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" fi ynh_store_file_checksum --file "$homeserver_config_path" diff --git a/scripts/install b/scripts/install index ceaf927..d625497 100644 --- a/scripts/install +++ b/scripts/install @@ -256,12 +256,7 @@ ynh_add_fpm_config # Create .well-known redirection for access by federation if yunohost --output-as plain domain list | grep -q "^$server_name$" then - cp ../conf/server_name.conf /etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf - ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__PORT__ --replace_string=$synapse_tls_port --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__JITSI_SERVER_ADDR__ --replace_string=$jitsi_server --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__E2E_ENABLED_BY_DEFAULT__ --replace_string=$e2e_enabled_by_default --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_store_file_checksum --file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" + ynh_add_config --template="server_name.conf" --destination="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" fi # Create a dedicated nginx config @@ -273,51 +268,27 @@ ynh_add_nginx_config app ynh_script_progression --message="Configuring synapse..." --weight=2 # Find password for turnserver and database -ynh_print_OFF turnserver_pwd=$(ynh_string_random --length=30) ynh_app_setting_set --app=$app --key=turnserver_pwd --value=$turnserver_pwd -ynh_print_ON # Configure Synapse # WARNING : theses command are used in INSTALL, UPGRADE, CONFIG, CHANGE-URL (4 times) # For any update do it in all files -homeserver_config_path="/etc/matrix-$app/homeserver.yaml" - -cp ../conf/homeserver.yaml "$homeserver_config_path" -cp ../conf/log.yaml /etc/matrix-$app/log.yaml - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__SERVER_NAME__ --replace_string=$server_name --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__SYNAPSE_DB_USER__ --replace_string=$synapse_db_user --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__PORT__ --replace_string=$port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__TLS_PORT__ --replace_string=$synapse_tls_port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__TURNSERVER_TLS_PORT__ --replace_string=$turnserver_tls_port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__REPORT_STATS__ --replace_string="$report_stats" --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__ALLOW_PUBLIC_ROOMS__ --replace_string="$allow_public_rooms" --target_file="$homeserver_config_path" -ynh_print_OFF -ynh_replace_special_string --match_string=__SYNAPSE_DB_PWD__ --replace_string=$synapse_db_pwd --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__TURNPWD__ --replace_string=$turnserver_pwd --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__REGISTRATION_SECRET__ --replace_string="$registration_shared_secret" --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__FORM_SECRET__ --replace_string="$form_secret" --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__MACAROON_SECRET_KEY__ --replace_string="$macaroon_secret_key" --target_file="$homeserver_config_path" -ynh_print_ON - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="/etc/matrix-$app/log.yaml" +macaroon_secret_key_param='macaroon_secret_key: "'$macaroon_secret_key'"' if [ $is_public -eq 0 ] then - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=False --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=True --target_file="$homeserver_config_path" + allowed_access=False + sso_enabled=True else - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=True --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=False --target_file="$homeserver_config_path" + allowed_access=True + sso_enabled=False fi -ynh_store_file_checksum --file="$homeserver_config_path" -ynh_store_file_checksum --file="/etc/matrix-$app/log.yaml" +ynh_add_config --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" +ynh_add_config --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" #================================================= # SET COTURN CONFIG @@ -327,35 +298,25 @@ ynh_script_progression --message="Configuring coturn..." --weight=1 # WARNING : theses command are used in INSTALL, UPGRADE # For any update do it in all files -coturn_config_path="/etc/matrix-$app/coturn.conf" - -cp ../conf/turnserver.conf "$coturn_config_path" - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$coturn_config_path" -ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="$coturn_config_path" -ynh_replace_string --match_string=__TLS_PORT__ --replace_string=$turnserver_tls_port --target_file="$coturn_config_path" -ynh_replace_string --match_string=__TLS_ALT_PORT__ --replace_string=$turnserver_alt_tls_port --target_file="$coturn_config_path" -ynh_replace_string --match_string=__CLI_PORT__ --replace_string=$cli_port --target_file="$coturn_config_path" -ynh_print_OFF -ynh_replace_string --match_string=__TURNPWD__ --replace_string=$turnserver_pwd --target_file="$coturn_config_path" -ynh_print_ON - # Get public IP and set as external IP for coturn # note : '|| true' is used to ignore the errors if we can't get the public ipv4 or ipv6 public_ip4="$(curl ip.yunohost.org)" || true public_ip6="$(curl ipv6.yunohost.org)" || true +turn_external_ip="" if [ -n "$public_ip4" ] && ynh_validate_ip4 --ip_address="$public_ip4" then - echo "external-ip=$public_ip4" >> "$coturn_config_path" + turn_external_ip+=" +external-ip=$public_ip4" fi if [ -n "$public_ip6" ] && ynh_validate_ip6 --ip_address="$public_ip6" then - echo "external-ip=$public_ip6" >> "$coturn_config_path" + turn_external_ip+=" +external-ip=$public_ip6" fi -ynh_store_file_checksum --file="$coturn_config_path" +ynh_add_config --template="turnserver.conf" --destination="/etc/matrix-$app/coturn.conf" #================================================= # SETUP LOGROTATE @@ -371,22 +332,22 @@ ynh_use_logrotate --logfile "/var/log/matrix-$app" # WARNING : theses command are used in INSTALL, UPGRADE # For any update do it in all files -cp ../sources/Coturn_config_rotate.sh $final_path/ -cp ../sources/update_synapse_for_appservice.sh $final_path/ -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$final_path/Coturn_config_rotate.sh" -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$final_path/update_synapse_for_appservice.sh" +ynh_add_config --template="../sources/Coturn_config_rotate.sh" --destination="$final_path/Coturn_config_rotate.sh" +ynh_add_config --template="../sources/update_synapse_for_appservice.sh" --destination="$final_path/update_synapse_for_appservice.sh" #================================================= # GENERIC FINALIZATION #================================================= -# SETUP SSOWAT +# SETUP PERMISSIONS #================================================= -ynh_script_progression --message="Configuring SSOwat..." --weight=1 +ynh_script_progression --message="Configuring permissions..." --weight=1 -# Open access to server without a button the home -# The script "add_sso_conf.py" will just add en entry for the path "/_matrix" in the sso conf.json.persistent file in the cathegory "skipped_urls". -python3 ../conf/add_sso_conf.py $domain $server_name || ynh_die --message="Your file /etc/ssowat/conf.json.persistent doesn't respect the json syntax. Please fix the syntax to install this app. For more information see here: https://github.com/YunoHost-Apps/synapse_ynh/issues/32" -ynh_permission_url --permission main --url $domain/_matrix/cas_server.php/login +ynh_permission_url --permission=main --url=$domain/_matrix/cas_server.php/login --auth_header=true +ynh_permission_update --permission=main --label="Synapse server SSO authentication" --show_tile=false --protected=true + +ynh_permission_create --permission=server_api --url=$domain/_matrix --additional_urls=$server_name/.well-known/matrix \ + --label="Server access for client apps." --show_tile=false \ + --auth_header=false --protected=true #================================================= # UPDATE HOOKS diff --git a/conf/remove_sso_conf.py b/scripts/remove_sso_conf_persistent.py similarity index 62% rename from conf/remove_sso_conf.py rename to scripts/remove_sso_conf_persistent.py index d1aca96..8708020 100644 --- a/conf/remove_sso_conf.py +++ b/scripts/remove_sso_conf_persistent.py @@ -7,9 +7,9 @@ server_name = sys.argv[2] with open("/etc/ssowat/conf.json.persistent", "r", encoding='utf-8') as jsonFile: data = json.load(jsonFile) - data["skipped_urls"].remove(domain + "/_matrix") - data["skipped_urls"].remove(server_name + "/.well-known/matrix/") - data["protected_urls"].remove(domain + "/_matrix/cas_server.php/login") + data["skipped_urls"].remove("/_matrix") + data["skipped_urls"].remove("/.well-known/matrix/") + data["protected_urls"].remove("/_matrix/cas_server.php/login") with open("/etc/ssowat/conf.json.persistent", "w", encoding='utf-8') as jsonFile: jsonFile.write(json.dumps(data, indent=4, sort_keys=True)) diff --git a/scripts/restore b/scripts/restore index 9b27ca4..c3517bb 100644 --- a/scripts/restore +++ b/scripts/restore @@ -172,35 +172,25 @@ ynh_print_ON # WARNING : these commands are used in INSTALL, UPGRADE # For any update do it in all files -coturn_config_path="/etc/matrix-$app/coturn.conf" - -cp ../settings/conf/turnserver.conf "$coturn_config_path" - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$coturn_config_path" -ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="$coturn_config_path" -ynh_replace_string --match_string=__TLS_PORT__ --replace_string=$turnserver_tls_port --target_file="$coturn_config_path" -ynh_replace_string --match_string=__TLS_ALT_PORT__ --replace_string=$turnserver_alt_tls_port --target_file="$coturn_config_path" -ynh_replace_string --match_string=__CLI_PORT__ --replace_string=$cli_port --target_file="$coturn_config_path" -ynh_print_OFF -ynh_replace_string --match_string=__TURNPWD__ --replace_string=$turnserver_pwd --target_file="$coturn_config_path" -ynh_print_ON - # Get public IP and set as external IP for coturn # note : '|| true' is used to ignore the errors if we can't get the public ipv4 or ipv6 public_ip4="$(curl ip.yunohost.org)" || true public_ip6="$(curl ipv6.yunohost.org)" || true +turn_external_ip="" if [ -n "$public_ip4" ] && ynh_validate_ip4 --ip_address="$public_ip4" then - echo "external-ip=$public_ip4" >> "$coturn_config_path" + turn_external_ip+=" +external-ip=$public_ip4" fi if [ -n "$public_ip6" ] && ynh_validate_ip6 --ip_address="$public_ip6" then - echo "external-ip=$public_ip6" >> "$coturn_config_path" + turn_external_ip+=" +external-ip=$public_ip6" fi -ynh_store_file_checksum --file="$coturn_config_path" +ynh_add_config --template="turnserver.conf" --destination="/etc/matrix-$app/coturn.conf" #================================================= # OPEN THE PORT @@ -211,15 +201,6 @@ ynh_exec_warn_less yunohost firewall allow TCP $synapse_tls_port ynh_exec_warn_less yunohost firewall allow Both $turnserver_tls_port ynh_exec_warn_less yunohost firewall allow Both $turnserver_alt_tls_port -#================================================= -# SETUP SSOWAT -#================================================= -ynh_script_progression --message="Configuring SSOwat..." - -# Open access to server without a button the home -# The script "add_sso_conf.py" will just add en entry for the path "/_matrix" in the sso conf.json.persistent file in the cathegory "skipped_urls". -python3 ../settings/conf/add_sso_conf.py $domain $server_name || ynh_die --message="Your file /etc/ssowat/conf.json.persistent doesn't respect the json syntax. Please fix the syntax to install this app. For more information see here: https://github.com/YunoHost-Apps/synapse_ynh/issues/32" - #================================================= # SETUP LOGROTATE #================================================= diff --git a/scripts/upgrade b/scripts/upgrade index b3682fd..eb74264 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -51,15 +51,10 @@ synapse_user="matrix-$app" synapse_db_name="matrix_$app" synapse_db_user="matrix_$app" upstream_version=$(ynh_app_upstream_version) +upgrade_type=$(ynh_check_app_version_changed) final_www_path="/var/www/$app" data_path="/home/yunohost.app/matrix-$app" -#================================================= -# CHECK VERSION -#================================================= - -upgrade_type=$(ynh_check_app_version_changed) - #================================================= # ENSURE DOWNWARD COMPATIBILITY #================================================= @@ -221,52 +216,27 @@ ynh_script_progression --message="Updating synapse config..." --weight=2 # WARNING : theses command are used in INSTALL, UPGRADE, CONFIG, CHANGE-URL (4 times) # For any update do it in all files -homeserver_config_path="/etc/matrix-$app/homeserver.yaml" - -ynh_backup_if_checksum_is_different --file="$homeserver_config_path" -ynh_backup_if_checksum_is_different --file=/etc/matrix-$app/log.yaml - -cp ../conf/homeserver.yaml "$homeserver_config_path" -cp ../conf/log.yaml /etc/matrix-$app/log.yaml - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__SERVER_NAME__ --replace_string=$server_name --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__SYNAPSE_DB_USER__ --replace_string=$synapse_db_user --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__PORT__ --replace_string=$port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__TLS_PORT__ --replace_string=$synapse_tls_port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__TURNSERVER_TLS_PORT__ --replace_string=$turnserver_tls_port --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__REPORT_STATS__ --replace_string="$report_stats" --target_file="$homeserver_config_path" -ynh_replace_string --match_string=__ALLOW_PUBLIC_ROOMS__ --replace_string="$allow_public_rooms" --target_file="$homeserver_config_path" -ynh_print_OFF -ynh_replace_special_string --match_string=__SYNAPSE_DB_PWD__ --replace_string=$synapse_db_pwd --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__TURNPWD__ --replace_string=$turnserver_pwd --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__REGISTRATION_SECRET__ --replace_string="$registration_shared_secret" --target_file="$homeserver_config_path" -ynh_replace_special_string --match_string=__FORM_SECRET__ --replace_string="$form_secret" --target_file="$homeserver_config_path" if [ -z $macaroon_secret_key ]; then # Well, in this package this value was not managed because it was not needed, synapse is able to generate this with some other secret in the config file but after some vulnerability was found with this practice. # For more detail about this issue you can see : https://matrix.org/blog/2019/01/15/further-details-on-critical-security-update-in-synapse-affecting-all-versions-prior-to-0-34-1-cve-2019-5885/ # The problem is that we can't just say generate a new value if the package has not already defined a value. The reason is that changing this value logout all user. And in case of a user has enabled the encryption, the user might lost all conversation !! # So for the old install we just leave this as it is. And for the new install we use a real macaroon. - ynh_replace_special_string --match_string='macaroon_secret_key: "__MACAROON_SECRET_KEY__"' --replace_string='# macaroon_secret_key: "__MACAROON_SECRET_KEY__"' --target_file="$homeserver_config_path" + macaroon_secret_key_param='# macaroon_secret_key: ""' else - ynh_replace_special_string --match_string=__MACAROON_SECRET_KEY__ --replace_string="$macaroon_secret_key" --target_file="$homeserver_config_path" + macaroon_secret_key_param='macaroon_secret_key: "'$macaroon_secret_key'"' fi -ynh_print_ON - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="/etc/matrix-$app/log.yaml" if [ $is_public -eq 0 ] then - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=False --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=True --target_file="$homeserver_config_path" + allowed_access=False + sso_enabled=True else - ynh_replace_string --match_string=__ALLOWED_ACCESS__ --replace_string=True --target_file="$homeserver_config_path" - ynh_replace_string --match_string=__SSO_ENABLED__ --replace_string=False --target_file="$homeserver_config_path" + allowed_access=True + sso_enabled=False fi -ynh_store_file_checksum --file="$homeserver_config_path" -ynh_store_file_checksum --file="/etc/matrix-$app/log.yaml" +ynh_add_config --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml" +ynh_add_config --template="log.yaml" --destination="/etc/matrix-$app/log.yaml" #================================================= # MIGRATION 2 : MULTINSTANCE SUPPORT @@ -283,10 +253,6 @@ then # Disable default config for turnserver and create a new service systemctl stop coturn.service - # Set by default the system config for coturn - echo "" > /etc/turnserver.conf - ynh_replace_string --match_string="TURNSERVER_ENABLED=1" --replace_string="TURNSERVER_ENABLED=0" --target_file=/etc/default/coturn - # Set a port for each service in turnserver turnserver_alt_tls_port=$(ynh_find_port --port=$((turnserver_tls_port+1))) cli_port=$(ynh_find_port --port=5766) @@ -347,13 +313,7 @@ ynh_add_fpm_config # Create .well-known redirection for access by federation if yunohost --output-as plain domain list | grep -q "^$server_name$" then - ynh_backup_if_checksum_is_different --file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - cp ../conf/server_name.conf /etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf - ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__PORT__ --replace_string=$synapse_tls_port --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__JITSI_SERVER_ADDR__ --replace_string=$jitsi_server --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_replace_string --match_string=__E2E_ENABLED_BY_DEFAULT__ --replace_string=$e2e_enabled_by_default --target_file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" - ynh_store_file_checksum --file="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" + ynh_add_config --template="server_name.conf" --destination="/etc/nginx/conf.d/${server_name}.d/${app}_server_name.conf" fi # Create a dedicated nginx config @@ -369,35 +329,25 @@ ynh_script_progression --message="Updating coturn config..." --weight=1 # WARNING : theses command are used in INSTALL, UPGRADE # For any update do it in all files -coturn_config_path="/etc/matrix-$app/coturn.conf" - -cp ../conf/turnserver.conf "$coturn_config_path" - -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$coturn_config_path" -ynh_replace_string --match_string=__DOMAIN__ --replace_string=$domain --target_file="$coturn_config_path" -ynh_replace_string --match_string=__TLS_PORT__ --replace_string=$turnserver_tls_port --target_file="$coturn_config_path" -ynh_replace_string --match_string=__TLS_ALT_PORT__ --replace_string=$turnserver_alt_tls_port --target_file="$coturn_config_path" -ynh_replace_string --match_string=__CLI_PORT__ --replace_string=$cli_port --target_file="$coturn_config_path" -ynh_print_OFF -ynh_replace_string --match_string=__TURNPWD__ --replace_string=$turnserver_pwd --target_file="$coturn_config_path" -ynh_print_ON - # Get public IP and set as external IP for coturn # note : '|| true' is used to ignore the errors if we can't get the public ipv4 or ipv6 public_ip4="$(curl ip.yunohost.org)" || true public_ip6="$(curl ipv6.yunohost.org)" || true +turn_external_ip="" if [ -n "$public_ip4" ] && ynh_validate_ip4 --ip_address="$public_ip4" then - echo "external-ip=$public_ip4" >> "$coturn_config_path" + turn_external_ip+=" +external-ip=$public_ip4" fi if [ -n "$public_ip6" ] && ynh_validate_ip6 --ip_address="$public_ip6" then - echo "external-ip=$public_ip6" >> "$coturn_config_path" + turn_external_ip+=" +external-ip=$public_ip6" fi -ynh_store_file_checksum --file="$coturn_config_path" +ynh_add_config --template="turnserver.conf" --destination="/etc/matrix-$app/coturn.conf" #================================================= # ADD SCRIPT FOR COTURN CRON AND APP SERVICE @@ -406,10 +356,8 @@ ynh_store_file_checksum --file="$coturn_config_path" # WARNING : theses command are used in INSTALL, UPGRADE # For any update do it in all files -cp ../sources/Coturn_config_rotate.sh $final_path/ -cp ../sources/update_synapse_for_appservice.sh $final_path/ -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$final_path/Coturn_config_rotate.sh" -ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$final_path/update_synapse_for_appservice.sh" +ynh_add_config --template="../sources/Coturn_config_rotate.sh" --destination="$final_path/Coturn_config_rotate.sh" +ynh_add_config --template="../sources/update_synapse_for_appservice.sh" --destination="$final_path/update_synapse_for_appservice.sh" # Ensure app-service folder has exists and the config file exit (Migration) mkdir -p /etc/matrix-$app/app-service @@ -447,14 +395,24 @@ ynh_add_fail2ban_config --use_template #================================================= # GENERIC FINALIZATION #================================================= -# SETUP SSOWAT +# SETUP PERMISSIONS #================================================= -ynh_script_progression --message="Configuring SSOwat..." --weight=1 +ynh_script_progression --message="Configuring permissions..." --weight=1 -# Open access to server without a button the home -# The script "add_sso_conf.py" will just add en entry for the path "/_matrix" in the sso conf.json.persistent file in the cathegory "skipped_urls". -python3 ../conf/add_sso_conf.py $domain $server_name || ynh_die --message="Your file /etc/ssowat/conf.json.persistent doesn't respect the json syntax. Please fix the syntax to install this app. For more information see here: https://github.com/YunoHost-Apps/synapse_ynh/issues/32" -ynh_permission_url --permission main --url $domain/_matrix/cas_server.php/login +ynh_permission_url --permission=main --url=$domain/_matrix/cas_server.php/login --auth_header=true +ynh_permission_update --permission=main --label="Synapse server SSO authentication" --show_tile=false --protected=true + +if !ynh_permission_exists --permission=server_api; then + ynh_permission_create --permission=server_api --url=$domain/_matrix --additional_urls=$server_name/.well-known/matrix \ + --label="Server access for client apps." --show_tile=false \ + --auth_header=false --protected=true + python3 remove_sso_conf_persistent.py $domain $server_name \ + || ynh_print_warn --message="Your file /etc/ssowat/conf.json.persistent doesn't respect the json syntax. The config file wasn't cleaned. Please clean it manually." +else + ynh_permission_update --permission=server_api --url=$domain/_matrix --additional_urls=$server_name/.well-known/matrix \ + --label="Server access for client apps." --show_tile=false \ + --auth_header=false --protected=true +fi #================================================= # SECURE FILES AND DIRECTORIES