1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/synapse_ynh.git synced 2024-09-03 20:26:38 +02:00
synapse_ynh/scripts/upgrade
2024-03-13 21:33:01 +01:00

537 lines
21 KiB
Bash

#!/bin/bash
#=================================================
# GENERIC START
#=================================================
# IMPORT GENERIC HELPERS
#=================================================
source _common.sh
source experimental_helper.sh
source /usr/share/yunohost/helpers
#=================================================
# SET ALL CONSTANT
#=================================================
upgrade_type=$(ynh_check_app_version_changed)
#=================================================
# STANDARD UPGRADE STEPS
#=================================================
# MIGRATION 5 : Manage old settings
#=================================================
# Migrate from settings 'special_domain' to 'domain' and 'special_path' to 'path'
if [ -z "${domain:-}" ]; then
domain=$(ynh_app_setting_get --app=$app --key=special_domain)
path=$(ynh_app_setting_get --app=$app --key=special_path)
ynh_app_setting_set --app=$app --key=domain --value=$domain
ynh_app_setting_set --app=$app --key=path --value=$path
ynh_app_setting_delete --app=$app --key=special_domain
ynh_app_setting_delete --app=$app --key=special_path
ynh_app_setting_set --app=$app --key=no_sso --value true
fi
# Define $server_name if not already defined
if [ -z "${server_name:-}" ]; then
server_name=$domain
ynh_app_setting_set --app=$app --key=server_name --value=$domain
fi
# Define $jitsi_server if not already defined
if [ -z "${jitsi_server:-}" ]; then
jitsi_server='jitsi.riot.im'
ynh_app_setting_set --app=$app --key=jitsi_server --value=$jitsi_server
fi
# Define $e2e_enabled_by_default if not already defined
if [ -z "${e2e_enabled_by_default:-}" ] ; then
e2e_enabled_by_default="invite"
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
fi
if [ "$e2e_enabled_by_default" = "true" ] ; then
e2e_enabled_by_default="all"
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
fi
if [ "$e2e_enabled_by_default" = "false" ]; then
e2e_enabled_by_default="off"
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
fi
if [ -z "${report_stats:-}" ]; then
report_stats="false"
ynh_app_setting_set --app=$app --key=report_stats --value=$report_stats
fi
if [ -z "${web_client_location:-}" ]
then
web_client_location="https://matrix.to/"
element_instance="element"
if yunohost --output-as plain app list | grep -q "^$element_instance"'$'; then
element_domain=$(ynh_app_setting_get --app $element_instance --key domain)
element_path=$(ynh_app_setting_get --app $element_instance --key path)
web_client_location="https://""$element_domain""$element_path"
fi
ynh_app_setting_set --app=$app --key=web_client_location --value=$web_client_location
fi
if [ -z "${client_base_url:-}" ]
then
client_base_url=$web_client_location
ynh_app_setting_set --app=$app --key=client_base_url --value=$client_base_url
fi
if [ -z "${invite_client_location:-}" ]
then
invite_client_location=$web_client_location
ynh_app_setting_set --app=$app --key=invite_client_location --value=$invite_client_location
fi
if [ -z "${allow_public_rooms_without_auth:-}" ]
then
allow_public_rooms_without_auth=${allow_public_rooms:-false}
ynh_app_setting_set --app=$app --key=allow_public_rooms_without_auth --value=$allow_public_rooms_without_auth
fi
if [ -z "${allow_public_rooms_over_federation:-}" ]
then
allow_public_rooms_over_federation=${allow_public_rooms:-false}
ynh_app_setting_set --app=$app --key=allow_public_rooms_over_federation --value=$allow_public_rooms_over_federation
fi
if [ -z "${max_upload_size:-}" ]
then
max_upload_size="100M"
ynh_app_setting_set --app=$app --key=max_upload_size --value=$max_upload_size
fi
if [ -z "${disable_msisdn_registration:-}" ]
then
disable_msisdn_registration="true"
ynh_app_setting_set --app=$app --key=disable_msisdn_registration --value=$disable_msisdn_registration
fi
if [ -z "${registrations_require_3pid:-}" ] || [ "${registrations_require_3pid}" == none ]
then
registrations_require_3pid=email
ynh_app_setting_set --app=$app --key=registrations_require_3pid --value=$registrations_require_3pid
fi
if [ -z "${allowed_local_3pids_email:-}" ] || [[ "${allowed_local_3pids_email}" =~ \'.*\' ]] # Also remove shit value from previous config panel
then
allowed_local_3pids_email=''
ynh_app_setting_set --app=$app --key=allowed_local_3pids_email --value=$allowed_local_3pids_email
fi
if [ -z "${allowed_local_3pids_msisdn:-}" ] || [[ "${allowed_local_3pids_msisdn}" =~ \'.*\' ]] # Also remove shit value from previous config panel
then
allowed_local_3pids_msisdn=''
ynh_app_setting_set --app=$app --key=allowed_local_3pids_msisdn --value=$allowed_local_3pids_msisdn
fi
if [ -z "${account_threepid_delegates_msisdn:-}" ]
then
account_threepid_delegates_msisdn=""
ynh_app_setting_set --app=$app --key=account_threepid_delegates_msisdn --value=$account_threepid_delegates_msisdn
fi
if [ -z "${allow_guest_access:-}" ]
then
allow_guest_access="false"
ynh_app_setting_set --app=$app --key=allow_guest_access --value=$allow_guest_access
fi
if [ -z "${default_identity_server:-}" ]
then
default_identity_server="https://matrix.org"
ynh_app_setting_set --app=$app --key=default_identity_server --value=$default_identity_server
fi
if [ -z "${auto_join_rooms:-}" ]
then
auto_join_rooms=""
ynh_app_setting_set --app=$app --key=auto_join_rooms --value=$auto_join_rooms
fi
if [ -z "${autocreate_auto_join_rooms:-}" ]
then
autocreate_auto_join_rooms="false"
ynh_app_setting_set --app=$app --key=autocreate_auto_join_rooms --value=$autocreate_auto_join_rooms
fi
if [ -z "${auto_join_rooms_for_guests:-}" ]
then
auto_join_rooms_for_guests="true"
ynh_app_setting_set --app=$app --key=auto_join_rooms_for_guests --value=$auto_join_rooms_for_guests
fi
if [ -z "${enable_notifs:-}" ]
then
enable_notifs="true"
ynh_app_setting_set --app=$app --key=enable_notifs --value=$enable_notifs
fi
if [ -z "${notif_for_new_users:-}" ]
then
notif_for_new_users="true"
ynh_app_setting_set --app=$app --key=notif_for_new_users --value=$notif_for_new_users
fi
if [ -z "${enable_group_creation:-}" ]
then
enable_group_creation="true"
ynh_app_setting_set --app=$app --key=enable_group_creation --value=$enable_group_creation
fi
if [ -z "${enable_3pid_lookup:-}" ]
then
enable_3pid_lookup=false
ynh_app_setting_set --app=$app --key=enable_3pid_lookup --value=$enable_3pid_lookup
fi
if [ -z "${enable_registration:-}" ]
then
if [ -z "${is_free_registration:-}" ]; then
is_free_registration=$(ynh_app_setting_get --app=$app --key=is_""public)
fi
if [ "$is_free_registration" -eq "0" ]
then
enable_registration="false"
password_enabled="false"
else
enable_registration="true"
password_enabled="true"
fi
ynh_app_setting_set --app=$app --key=enable_registration --value=$enable_registration
ynh_app_setting_set --app=$app --key=password_enabled --value=$password_enabled
fi
if [ -z "${push_include_content:-}" ]
then
push_include_content="true"
ynh_app_setting_set --app=$app --key=push_include_content --value=$push_include_content
fi
if [ -z "${enable_dtls_for_audio_video_turn_call:-}" ]
then
enable_dtls_for_audio_video_turn_call=true
ynh_app_setting_set --app=$app --key=enable_dtls_for_audio_video_turn_call --value=$enable_dtls_for_audio_video_turn_call
fi
if [ -z "${presence_tracking:-}" ]
then
presence_tracking=true
ynh_app_setting_set --app=$app --key=presence_tracking --value=$presence_tracking
fi
#=================================================
# MIGRATION 7 : STANDARDIZE SYSTEMD UNIT
#=================================================
if [ -e /etc/systemd/system/matrix-$app.service ]
then
ynh_script_progression --message='Migrating systemd unit to standard name...'
systemctl stop matrix-$app.service || true
systemctl stop coturn-$app.service || true
yunohost service remove matrix-$app || true
yunohost service remove coturn-$app || true
ynh_secure_remove --file=/etc/systemd/system/matrix-$app.service
ynh_secure_remove --file=/etc/systemd/system/coturn-$app.service
touch /etc/systemd/system/$app.service
systemctl daemon-reload || true
fi
#=================================================
# STOP SERVICES
#=================================================
# We stop the service
ynh_systemd_action --service_name=$app.service --action=stop
ynh_script_progression --message='Managing migrations...'
#=================================================
# MIGRATION 6 : Migrate data directory
#=================================================
if [ -e "/var/lib/matrix-$app" ]; then
ynh_script_progression --message="Moving data directory to $data_dir..." --weight=1
if [ -e "$data_dir" ]; then
old_data_dir_path="$data_dir$(date '+%Y%m%d.%H%M%S')"
ynh_print_warn "A data directory already exist. Data was renamed to $old_data_dir_path"
mv "$data_dir" "$old_data_dir_path"
fi
mv "/var/lib/matrix-$app" "$data_dir"
fi
#=================================================
# MIGRATION 3 : USE STANDARD ACCESS FOR CERTIFCATE
#=================================================
# Fix issue about certificates access
if [ ! $(grep "ssl-cert:x:[0-9]*:.*$app" /etc/group) ]
then
ynh_script_progression --message="Use standard access for certificate..." --weight=1
adduser $app ssl-cert
adduser turnserver ssl-cert
fi
#=================================================
# MIGRATION 4 : CREATE A DH FILE
#=================================================
# WARNING : theses command are used in INSTALL, UPGRADE, RESTORE
# For any update do it in all files
# Make dh cert for synapse if it doesn't exist
if [ ! -e /etc/ssl/private/dh2048.pem ]
then
ynh_script_progression --message="Creating a dh file..." --weight=1
ynh_exec_warn_less openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048
chown root:ssl-cert /etc/ssl/private/dh2048.pem
chmod 640 /etc/ssl/private/dh2048.pem
fi
#=================================================
# MIGRATION 2 : MULTINSTANCE SUPPORT
#=================================================
if [ ! -e /etc/matrix-$app/coturn.conf ]
then
ynh_script_progression --message="Creating an independant service for coturn..." --weight=1
#=================================================
# CREATE AN INDEPENDANT SERVICE FOR COTURN
#=================================================
# Disable default config for turnserver and create a new service
systemctl stop coturn.service
#=================================================
# MAKE A CLEAN LOGROTATE CONFIG
#=================================================
ynh_use_logrotate --logfile /var/log/matrix-$app --nonappend
fi
#=================================================
# MIGRATION 8 : Migrate database to managed database (Migrate db name from matrix_$app to $app)
#=================================================
if ynh_psql_execute_as_root --sql='\list' | grep matrix_$app; then
ynh_''psql_remove_db --db_user="user_wich_must_dont_exist_and_keep_current_user" --db_name=$db_name
ynh_psql_execute_as_root --sql="ALTER DATABASE matrix_$app RENAME TO $db_name;"
ynh_psql_execute_as_root --database=$db_name --sql="REASSIGN OWNED BY matrix_$app TO $db_user;"
ynh_psql_execute_as_root --sql="UPDATE pg_database SET datcollate='C', datctype='C' WHERE datname='$db_name';"
ynh_psql_execute_as_root --sql="DROP USER matrix_$app;"
# for unknown reason we need to set again the password for synapse user. Without this synapse can't authenticate to postgresql
ynh_psql_execute_as_root --sql="ALTER USER $db_user WITH ENCRYPTED PASSWORD '$db_pwd';"
fi
#=================================================
# MIGRATION 9 : migrate data path (from matrix-$app to $app)
#=================================================
if [ -e /home/yunohost.app/matrix-$app ]; then
mv -t $data_dir /home/yunohost.app/matrix-$app/*
ynh_secure_remove --file=/home/yunohost.app/matrix-$app
fi
#=================================================
# MIGRATION 11 : make this app using full domain
#=================================================
ynh_app_setting_set --app=$app --key=path --value=/
if yunohost app map -r --output-as json | jq -r '."'$domain'" | select( . != null ) | .[] | .id' | grep -v "$app" -q; then
ynh_print_warn 'An other app is installed on this domain. Now synapse require to be alone on the domain.'
ynh_print_warn 'To solve this you can:'
ynh_print_warn " - Remove or move all other app which use '$domain'"
ynh_print_warn ' - Change the domain of synapse. You can find more informations here: https://github.com/YunoHost-Apps/synapse_ynh/tree/testing/doc/ADMIN.md#change-url'
ynh_print_warn 'For more information you can see this issue: https://github.com/YunoHost-Apps/synapse_ynh/issues/443'
fi
#=================================================
# MIGRATION 12 : update system user and drop yunohost user
#=================================================
if grep -q "^matrix-$app" /etc/passwd; then
# Must stop php before remove user as user is used by php
systemctl stop php$YNH_PHP_VERSION-fpm.service
ynh_''system_user_delete --username=matrix-$app
yunohost user delete $app || true
ynh_''system_user_create --username=$app --home_dir=$code_dir
adduser $app ssl-cert
fi
#=================================================
# DOWNLOAD, CHECK AND UNPACK SOURCE
#=================================================
if [ "$upgrade_type" == "UPGRADE_APP" ] || [ ! -e $code_dir/bin/python3 ] || [ ! -e $code_dir/lib/python$python_version ]
then
ynh_script_progression --message="Upgrading source files..." --weight=6
install_sources
fi
#=================================================
# MIGRATION 1 : GENERATE SYNAPSE SECRET
#=================================================
if [ -z "${registration_shared_secret:-}" ] || [ "$form_secret" == "form_secret: " ]
then
ynh_script_progression --message="Generating synapse secret..." --weight=1
# Generate config and keys
$code_dir/bin/python -m synapse.app.homeserver --keys-directory /etc/matrix-$app/ --generate-config --generate-keys --server-name $server_name --report-stats=no -c homeserver.yml
# Get random values from config
registration_shared_secret=$(egrep "^registration_shared_secret:" homeserver.yml | cut -d'"' -f2)
form_secret=$(egrep "^form_secret:" homeserver.yml | cut -d'"' -f2)
# store in yunohost settings
ynh_app_setting_set --app=$app --key=registration_shared_secret --value="$registration_shared_secret"
ynh_app_setting_set --app=$app --key=form_secret --value="$form_secret"
fi
#=================================================
# STANDARD UPGRADE STEPS
#=================================================
#=================================================
# UPDATE SYNAPSE CONFIG
#=================================================
ynh_script_progression --message="Updating synapse config..." --weight=2
configure_synapse
#=================================================
# CREATE SMALL CAS SERVER
#=================================================
# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files
mkdir -p $install_dir
cp ../sources/cas_server.php $install_dir/
chmod u=rwX,g=rX,o= -R $install_dir
chown $app:root -R $install_dir
#=================================================
# NGINX CONFIGURATION
#=================================================
ynh_script_progression --message="Upgrading NGINX web server configuration..." --weight=2
# Create a dedicated php-fpm config
ynh_script_progression --message="Configuring application..."
ynh_add_fpm_config --usage=low --footprint=low
configure_nginx
#=================================================
# SPECIFIC UPGRADE
#=================================================
# UPDATE COTURN CONFIG
#=================================================
ynh_script_progression --message="Updating Coturn config..." --weight=1
configure_coturn
#=================================================
# ADD SCRIPT FOR COTURN CRON AND APP SERVICE
#=================================================
# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files
ynh_add_config --template="../sources/Coturn_config_rotate.sh" --destination="$code_dir/Coturn_config_rotate.sh"
ynh_add_config --template="../sources/update_synapse_for_appservice.sh" --destination="$code_dir/update_synapse_for_appservice.sh"
ynh_add_config --template=../sources/set_admin_user.sh --destination=$code_dir/set_admin_user.sh
# Ensure app-service folder has exists and the config file exit (Migration)
mkdir -p /etc/matrix-$app/app-service
if [ -e /etc/matrix-$app/conf.d/app_service.yaml ]; then
# ensure that the file is empty if no app service are installed (fix issue #385)
if [ ! "$(ls -A /etc/matrix-$app/app-service)" ]; then
echo "" > /etc/matrix-$app/conf.d/app_service.yaml
fi
else
touch /etc/matrix-$app/conf.d/app_service.yaml
fi
#=================================================
# ADVERTISE SERVICE IN ADMIN PANEL
#=================================================
yunohost service add $app --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports $port_synapse_tls --description 'Main matrix server service.'
yunohost service add $app-coturn --needs_exposed_ports $port_turnserver_tls --description 'Turn server for matrix server. Used for audio and video call.'
#=================================================
# UPDATE SYSTEMD
#=================================================
ynh_script_progression --message="Upgrading systemd configuration..." --weight=3
# Create systemd service for synapse and turnserver
ynh_add_systemd_config --service=$app --template=synapse.service
cp ../conf/default_coturn /etc/default/coturn-$app
ynh_add_systemd_config --service=$app-coturn --template=synapse-coturn.service
# if necessary, add libjemalloc.so to the matrix-synapse env file
if ! grep -q "libjemalloc" "/etc/default/matrix-$app"; then
libjemalloc_path=$(whereis libjemalloc | cut -d ' ' -f 3)
echo "LD_PRELOAD=$libjemalloc_path" >> "/etc/default/matrix-$app"
fi
#=================================================
# UPGRADE FAIL2BAN
#=================================================
ynh_script_progression --message="Reconfiguring Fail2Ban..." --weight=8
ynh_add_fail2ban_config --use_template
#=================================================
# GENERIC FINALIZATION
#=================================================
# SETUP PERMISSIONS
#=================================================
ynh_script_progression --message="Configuring permissions..." --weight=1
if yunohost --output-as plain domain list | grep -q "^$server_name"'$'; then
if ! ynh_""permission_exists --permission=server_client_infos; then
ynh_""permission_create --permission=server_client_infos --url=$server_name/.well-known/matrix \
--label="Server info for clients. (well-known)" --show_tile=false --allowed=visitors \
--auth_header=false --protected=true
else yunohost --output-as plain domain list | grep -q "^$server_name"'$'
ynh_""permission_url --permission=server_client_infos --url=$server_name/.well-known/matrix \
--auth_header=false
ynh_""permission_update --permission=server_client_infos --label="Server info for clients. (well-known)" --show_tile=false \
--protected=true
fi
fi
#=================================================
# SECURE FILES AND DIRECTORIES
#=================================================
ynh_script_progression --message="Protecting directories... (note that it could take a long time depending of your install size)" --weight=3
set_permissions data
#=================================================
# UPDATE HOOKS
#=================================================
# WARNING : theses command are used in INSTALL, UPGRADE
# For any update do it in all files
ynh_replace_string __APP__ $app ../hooks/post_cert_update
ynh_replace_string __DOMAIN__ $domain ../hooks/post_cert_update
#=================================================
# RELOAD SERVICES
#=================================================
ynh_script_progression --message="Restarting Synapse services..." --weight=5
ynh_systemd_action --service_name=$app-coturn.service --action=restart
ynh_systemd_action --service_name=$app.service --action=restart --line_match="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300
#=================================================
# END OF SCRIPT
#=================================================
ynh_script_progression --message="Upgrade of $app completed" --last