mirror of
https://github.com/YunoHost-Apps/synapse_ynh.git
synced 2024-09-03 20:26:38 +02:00
501 lines
18 KiB
Bash
501 lines
18 KiB
Bash
#!/bin/bash
|
|
|
|
#=================================================
|
|
# GENERIC START
|
|
#=================================================
|
|
# IMPORT GENERIC HELPERS
|
|
#=================================================
|
|
|
|
source _common.sh
|
|
source experimental_helper.sh
|
|
source /usr/share/yunohost/helpers
|
|
|
|
#=================================================
|
|
# SET ALL CONSTANT
|
|
#=================================================
|
|
|
|
upgrade_type=$(ynh_check_app_version_changed)
|
|
|
|
#=================================================
|
|
# ENSURE DOWNWARD COMPATIBILITY
|
|
#=================================================
|
|
ynh_script_progression --message="Ensuring downward compatibility..." --weight=1
|
|
|
|
# Following the discussion here https://github.com/YunoHost-Apps/synapse_ynh/pull/51 we decided to remove definitely the support of the old package migration.
|
|
if [ -z "$synapse_old_version" ]
|
|
then
|
|
ynh_die --message="Update from this synapse version is not available. You need to remove this package and reinstall the new package version."
|
|
fi
|
|
|
|
#=================================================
|
|
# STANDARD UPGRADE STEPS
|
|
#=================================================
|
|
# MIGRATION 5 : Manage old settings
|
|
#=================================================
|
|
|
|
# Migrate from settings 'special_domain' to 'domain' and 'special_path' to 'path'
|
|
if [ -z $domain ]; then
|
|
domain=$(ynh_app_setting_get --app=$app --key=special_domain)
|
|
path=$(ynh_app_setting_get --app=$app --key=special_path)
|
|
ynh_app_setting_set --app=$app --key=domain --value=$domain
|
|
ynh_app_setting_set --app=$app --key=path --value=$path
|
|
ynh_app_setting_delete --app=$app --key=special_domain
|
|
ynh_app_setting_delete --app=$app --key=special_path
|
|
ynh_app_setting_set --app=$app --key=no_sso --value true
|
|
fi
|
|
|
|
# Define $server_name if not already defined
|
|
if [ -z $server_name ]; then
|
|
server_name=$domain
|
|
ynh_app_setting_set --app=$app --key=server_name --value=$domain
|
|
fi
|
|
|
|
# Define $jitsi_server if not already defined
|
|
if [ -z $jitsi_server ]; then
|
|
jitsi_server='jitsi.riot.im'
|
|
ynh_app_setting_set --app=$app --key=jitsi_server --value=$jitsi_server
|
|
fi
|
|
|
|
# Define $e2e_enabled_by_default if not already defined
|
|
if [ -z $e2e_enabled_by_default ] ; then
|
|
e2e_enabled_by_default="invite"
|
|
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
|
|
fi
|
|
|
|
if [ "$e2e_enabled_by_default" = "true" ] ; then
|
|
e2e_enabled_by_default="all"
|
|
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
|
|
fi
|
|
|
|
if [ "$e2e_enabled_by_default" = "false" ]; then
|
|
e2e_enabled_by_default="off"
|
|
ynh_app_setting_set --app=$app --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
|
|
fi
|
|
|
|
if [ -z $report_stats ]; then
|
|
report_stats="false"
|
|
ynh_app_setting_set --app=$app --key=report_stats --value=$report_stats
|
|
fi
|
|
|
|
# Get app name of first Element Instance
|
|
element_ynh_url="https://matrix.to/"
|
|
web_client_location=$element_ynh_url
|
|
client_base_url=$element_ynh_url
|
|
invite_client_location=$element_ynh_url
|
|
|
|
if [ -z "$web_client_location" ]
|
|
then
|
|
element_instance="element"
|
|
if yunohost --output-as plain app list | grep -q "^$element_instance"'$'; then
|
|
element_domain=$(ynh_app_setting_get --app $element_instance --key domain)
|
|
element_path=$(ynh_app_setting_get --app $element_instance --key path)
|
|
element_ynh_url="https://""$element_domain""$element_path"
|
|
fi
|
|
web_client_location=$element_ynh_url
|
|
client_base_url=$element_ynh_url
|
|
invite_client_location=$element_ynh_url
|
|
ynh_app_setting_set --app=$app --key=web_client_location --value=$web_client_location
|
|
ynh_app_setting_set --app=$app --key=client_base_url --value=$client_base_url
|
|
ynh_app_setting_set --app=$app --key=invite_client_location --value=$invite_client_location
|
|
fi
|
|
|
|
if [ -z "$allow_public_rooms_without_auth" ]
|
|
then
|
|
allow_public_rooms_without_auth=${allow_public_rooms:-false}
|
|
ynh_app_setting_set --app=$app --key=allow_public_rooms_without_auth --value=$allow_public_rooms_without_auth
|
|
fi
|
|
if [ -z "$allow_public_rooms_over_federation" ]
|
|
then
|
|
allow_public_rooms_over_federation=${allow_public_rooms:-false}
|
|
ynh_app_setting_set --app=$app --key=allow_public_rooms_over_federation --value=$allow_public_rooms_over_federation
|
|
fi
|
|
if [ -z "$max_upload_size" ]
|
|
then
|
|
max_upload_size="100M"
|
|
ynh_app_setting_set --app=$app --key=max_upload_size --value=$max_upload_size
|
|
fi
|
|
if [ -z "$disable_msisdn_registration" ]
|
|
then
|
|
disable_msisdn_registration="true"
|
|
ynh_app_setting_set --app=$app --key=disable_msisdn_registration --value=$disable_msisdn_registration
|
|
fi
|
|
if [ -z "$registrations_require_3pid" ]
|
|
then
|
|
registrations_require_3pid="none"
|
|
ynh_app_setting_set --app=$app --key=registrations_require_3pid --value=$registrations_require_3pid
|
|
fi
|
|
if [ -z "$allowed_local_3pids_email" ]
|
|
then
|
|
allowed_local_3pids_email="'^[^@]+@""matrix""\.org$'"
|
|
ynh_app_setting_set --app=$app --key=allowed_local_3pids_email --value=$allowed_local_3pids_email
|
|
fi
|
|
if [ -z "$allowed_local_3pids_msisdn" ]
|
|
then
|
|
allowed_local_3pids_msisdn="'\+33'"
|
|
ynh_app_setting_set --app=$app --key=allowed_local_3pids_msisdn --value=$allowed_local_3pids_msisdn
|
|
fi
|
|
if [ -z "$account_threepid_delegates_msisdn" ]
|
|
then
|
|
account_threepid_delegates_msisdn=""
|
|
ynh_app_setting_set --app=$app --key=account_threepid_delegates_msisdn --value=$account_threepid_delegates_msisdn
|
|
fi
|
|
if [ -z "$allow_guest_access" ]
|
|
then
|
|
allow_guest_access="false"
|
|
ynh_app_setting_set --app=$app --key=allow_guest_access --value=$allow_guest_access
|
|
fi
|
|
if [ -z "$default_identity_server" ]
|
|
then
|
|
default_identity_server="https://matrix.org"
|
|
ynh_app_setting_set --app=$app --key=default_identity_server --value=$default_identity_server
|
|
fi
|
|
if [ -z "$auto_join_rooms" ]
|
|
then
|
|
auto_join_rooms="#auto_join_room:""$server_name"
|
|
ynh_app_setting_set --app=$app --key=auto_join_rooms --value=$auto_join_rooms
|
|
fi
|
|
if [ -z "$autocreate_auto_join_rooms" ]
|
|
then
|
|
autocreate_auto_join_rooms="false"
|
|
ynh_app_setting_set --app=$app --key=autocreate_auto_join_rooms --value=$autocreate_auto_join_rooms
|
|
fi
|
|
if [ -z "$auto_join_rooms_for_guests" ]
|
|
then
|
|
auto_join_rooms_for_guests="true"
|
|
ynh_app_setting_set --app=$app --key=auto_join_rooms_for_guests --value=$auto_join_rooms_for_guests
|
|
fi
|
|
if [ -z "$enable_notifs" ]
|
|
then
|
|
enable_notifs="true"
|
|
ynh_app_setting_set --app=$app --key=enable_notifs --value=$enable_notifs
|
|
fi
|
|
if [ -z "$notif_for_new_users" ]
|
|
then
|
|
notif_for_new_users="true"
|
|
ynh_app_setting_set --app=$app --key=notif_for_new_users --value=$notif_for_new_users
|
|
fi
|
|
if [ -z "$enable_group_creation" ]
|
|
then
|
|
enable_group_creation="true"
|
|
ynh_app_setting_set --app=$app --key=enable_group_creation --value=$enable_group_creation
|
|
fi
|
|
|
|
if [ -z "$enable_registration" ]
|
|
then
|
|
if [ -z $is_free_registration ]; then
|
|
is_free_registration=$(ynh_app_setting_get --app=$app --key=is_""public)
|
|
fi
|
|
|
|
if [ "$is_free_registration" -eq "0" ]
|
|
then
|
|
enable_registration="false"
|
|
turn_allow_guests="false"
|
|
sso_enabled="true"
|
|
password_enabled="false"
|
|
enable_3pid_lookup="false"
|
|
else
|
|
enable_registration="true"
|
|
turn_allow_guests="true"
|
|
sso_enabled="false"
|
|
password_enabled="true"
|
|
enable_3pid_lookup="true"
|
|
fi
|
|
ynh_app_setting_set --app=$app --key=enable_registration --value=$enable_registration
|
|
ynh_app_setting_set --app=$app --key=turn_allow_guests --value=$turn_allow_guests
|
|
ynh_app_setting_set --app=$app --key=sso_enabled --value=$sso_enabled
|
|
ynh_app_setting_set --app=$app --key=password_enabled --value=$password_enabled
|
|
ynh_app_setting_set --app=$app --key=enable_3pid_lookup --value=$enable_3pid_lookup
|
|
fi
|
|
|
|
if [ -z "$push_include_content" ]
|
|
then
|
|
push_include_content="true"
|
|
ynh_app_setting_set --app=$app --key=push_include_content --value=$push_include_content
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 7 : STANDARDIZE SYSTEMD UNIT
|
|
#=================================================
|
|
|
|
if [ ! -e /etc/systemd/system/matrix-$app.service ]
|
|
then
|
|
ynh_script_progression --message="Migrating systemd unit to standard name..."
|
|
|
|
systemctl stop matrix-$app.service
|
|
systemctl stop synapse-coturn.service
|
|
|
|
yunohost service remove matrix-$app
|
|
yunohost service remove coturn-$app
|
|
|
|
ynh_secure_remove --file=/etc/systemd/system/matrix-$app.service
|
|
ynh_secure_remove --file=/etc/systemd/system/coturn-$app.service
|
|
|
|
touch /etc/systemd/system/$app.service
|
|
fi
|
|
|
|
#=================================================
|
|
# STOP SERVICES
|
|
#=================================================
|
|
|
|
# We stop the service
|
|
ynh_systemd_action --service_name=$app.service --action=stop
|
|
|
|
#=================================================
|
|
# MIGRATION 6 : Migrate data directory
|
|
#=================================================
|
|
|
|
if [ -e "/var/lib/matrix-$app" ]; then
|
|
ynh_script_progression --message="Moving data directory to $data_path..." --weight=1
|
|
if [ -e "$data_path" ]; then
|
|
old_data_dir_path="$data_path$(date '+%Y%m%d.%H%M%S')"
|
|
ynh_print_warn "A data directory already exist. Data was renamed to $old_data_dir_path"
|
|
mv "$data_path" "$old_data_dir_path"
|
|
fi
|
|
mv "/var/lib/matrix-$app" "$data_path"
|
|
fi
|
|
if ! grep -q "$code_dir" /etc/passwd; then
|
|
# matrix-synapse:x:994:994::/var/lib/matrix-synapse:/usr/sbin/nologin
|
|
sed --in-place -r "s@matrix-$app\:x\:([[:digit:]]+\:[[:digit:]]+)\:\:/.*/matrix-$app\:/usr/sbin/nologin@matrix-$app\:x\:\1\:\:$code_dir\:/usr/sbin/nologin@g" /etc/passwd
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 3 : USE STANDARD ACCESS FOR CERTIFCATE
|
|
#=================================================
|
|
|
|
# Fix issue about certificates access
|
|
if [ ! $(grep "ssl-cert:x:[0-9]*:.*matrix-$app" /etc/group) ]
|
|
then
|
|
ynh_script_progression --message="Use standard access for certificate..." --weight=1
|
|
|
|
adduser $app ssl-cert
|
|
adduser turnserver ssl-cert
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 4 : CREATE A DH FILE
|
|
#=================================================
|
|
|
|
# WARNING : theses command are used in INSTALL, UPGRADE, RESTORE
|
|
# For any update do it in all files
|
|
|
|
# Make dh cert for synapse if it doesn't exist
|
|
if [ ! -e /etc/ssl/private/dh2048.pem ]
|
|
then
|
|
ynh_script_progression --message="Creating a dh file..." --weight=1
|
|
|
|
openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 -dsaparam 2> /dev/null
|
|
chown root:ssl-cert /etc/ssl/private/dh2048.pem
|
|
chmod 640 /etc/ssl/private/dh2048.pem
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 2 : MULTINSTANCE SUPPORT
|
|
#=================================================
|
|
|
|
if [ ! -e /etc/matrix-$app/coturn.conf ]
|
|
then
|
|
ynh_script_progression --message="Creating an independant service for coturn..." --weight=1
|
|
|
|
#=================================================
|
|
# CREATE AN INDEPENDANT SERVICE FOR COTURN
|
|
#=================================================
|
|
|
|
# Disable default config for turnserver and create a new service
|
|
systemctl stop coturn.service
|
|
|
|
#=================================================
|
|
# MAKE A CLEAN LOGROTATE CONFIG
|
|
#=================================================
|
|
|
|
ynh_use_logrotate --logfile /var/log/matrix-$app --nonappend
|
|
fi
|
|
|
|
######################################### WARNING ################################
|
|
|
|
# TODO manage of migration of data path
|
|
# TODO manage of migration of db name
|
|
# TODO delete legacy user matrix-synapse
|
|
# TODO maybe need to close port to leave managed port to manage this
|
|
|
|
#=================================================
|
|
# DOWNLOAD, CHECK AND UNPACK SOURCE
|
|
#=================================================
|
|
|
|
if [ "$upgrade_type" == "UPGRADE_APP" ] || [ ! -e $code_dir/bin/python3 ] || [ ! -e $code_dir/lib/python$python_version ]
|
|
then
|
|
ynh_script_progression --message="Upgrading source files..." --weight=6
|
|
install_sources
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 1 : GENERATE SYNAPSE SECRET
|
|
#=================================================
|
|
|
|
if [ -z "$registration_shared_secret" ] || [ "$form_secret" == "form_secret: " ]
|
|
then
|
|
ynh_script_progression --message="Generating synapse secret..." --weight=1
|
|
|
|
# Go in virtualenvironnement
|
|
u_arg='u'
|
|
set +$u_arg;
|
|
source $code_dir/bin/activate
|
|
set -$u_arg;
|
|
|
|
# Generate config and keys
|
|
python -m synapse.app.homeserver --keys-directory /etc/matrix-$app/ --generate-config --generate-keys --server-name $server_name --report-stats=no -c homeserver.yml
|
|
|
|
# This function was defined when we called "source $code_dir/bin/activate". With this function we undo what "$code_dir/bin/activate" does
|
|
set +$u_arg;
|
|
deactivate
|
|
set -$u_arg;
|
|
|
|
# Get random values from config
|
|
registration_shared_secret=$(egrep "^registration_shared_secret:" homeserver.yml | cut -d'"' -f2)
|
|
form_secret=$(egrep "^form_secret:" homeserver.yml | cut -d'"' -f2)
|
|
|
|
# store in yunohost settings
|
|
ynh_app_setting_set --app=$app --key=registration_shared_secret --value="$registration_shared_secret"
|
|
ynh_app_setting_set --app=$app --key=form_secret --value="$form_secret"
|
|
fi
|
|
|
|
#=================================================
|
|
# STANDARD UPGRADE STEPS
|
|
#=================================================
|
|
|
|
#=================================================
|
|
# UPDATE SYNAPSE CONFIG
|
|
#=================================================
|
|
ynh_script_progression --message="Updating synapse config..." --weight=2
|
|
|
|
configure_synapse
|
|
|
|
#=================================================
|
|
# CREATE SMALL CAS SERVER
|
|
#=================================================
|
|
# WARNING : theses command are used in INSTALL, UPGRADE
|
|
# For any update do it in all files
|
|
|
|
mkdir -p $install_dir
|
|
cp ../sources/cas_server.php $install_dir/
|
|
chmod u=rwX,g=rX,o= -R $install_dir
|
|
chown $app:root -R $install_dir
|
|
|
|
|
|
#=================================================
|
|
# NGINX CONFIGURATION
|
|
#=================================================
|
|
ynh_script_progression --message="Upgrading NGINX web server configuration..." --weight=2
|
|
|
|
# Create a dedicated php-fpm config
|
|
ynh_script_progression --message="Configuring application..."
|
|
|
|
ynh_add_fpm_config --usage=low --footprint=low
|
|
|
|
configure_nginx
|
|
|
|
#=================================================
|
|
# SPECIFIC UPGRADE
|
|
#=================================================
|
|
# UPDATE COTURN CONFIG
|
|
#=================================================
|
|
ynh_script_progression --message="Updating Coturn config..." --weight=1
|
|
|
|
configure_coturn
|
|
|
|
#=================================================
|
|
# ADD SCRIPT FOR COTURN CRON AND APP SERVICE
|
|
#=================================================
|
|
|
|
# WARNING : theses command are used in INSTALL, UPGRADE
|
|
# For any update do it in all files
|
|
|
|
ynh_add_config --template="../sources/Coturn_config_rotate.sh" --destination="$code_dir/Coturn_config_rotate.sh"
|
|
ynh_add_config --template="../sources/update_synapse_for_appservice.sh" --destination="$code_dir/update_synapse_for_appservice.sh"
|
|
|
|
# Ensure app-service folder has exists and the config file exit (Migration)
|
|
mkdir -p /etc/matrix-$app/app-service
|
|
if [ -e /etc/matrix-$app/conf.d/app_service.yaml ]; then
|
|
# ensure that the file is empty if no app service are installed (fix issue #385)
|
|
if [ ! "$(ls -A /etc/matrix-$app/app-service)" ]; then
|
|
echo "" > /etc/matrix-$app/conf.d/app_service.yaml
|
|
fi
|
|
else
|
|
touch /etc/matrix-$app/conf.d/app_service.yaml
|
|
fi
|
|
|
|
#=================================================
|
|
# ADVERTISE SERVICE IN ADMIN PANEL
|
|
#=================================================
|
|
|
|
yunohost service add $app --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports $port_synapse_tls
|
|
yunohost service add $app-coturn --needs_exposed_ports $port_turnserver_tls
|
|
|
|
#=================================================
|
|
# UPDATE SYSTEMD
|
|
#=================================================
|
|
ynh_script_progression --message="Upgrading systemd configuration..." --weight=3
|
|
|
|
# Create systemd service for synapse and turnserver
|
|
cp ../conf/default_matrix-synapse /etc/default/matrix-$app
|
|
ynh_add_systemd_config --service=$app --template=synapse.service
|
|
|
|
cp ../conf/default_coturn /etc/default/coturn-$app
|
|
ynh_add_systemd_config --service=$app-coturn --template=synapse-coturn.service
|
|
|
|
#=================================================
|
|
# UPGRADE FAIL2BAN
|
|
#=================================================
|
|
ynh_script_progression --message="Reconfiguring Fail2Ban..." --weight=8
|
|
|
|
ynh_add_fail2ban_config --use_template
|
|
|
|
#=================================================
|
|
# GENERIC FINALIZATION
|
|
#=================================================
|
|
# SETUP PERMISSIONS
|
|
#=================================================
|
|
|
|
ynh_script_progression --message="Configuring permissions..." --weight=1
|
|
|
|
if yunohost --output-as plain domain list | grep -q "^$server_name"'$'; then
|
|
if ! ynh_""permission_exists --permission=server_client_infos; then
|
|
ynh_""permission_create --permission=server_client_infos --url=$server_name/.well-known/matrix \
|
|
--label="Server info for clients. (well-known)" --show_tile=false --allowed=visitors \
|
|
--auth_header=false --protected=true
|
|
else yunohost --output-as plain domain list | grep -q "^$server_name"'$'
|
|
ynh_""permission_url --permission=server_client_infos --url=$server_name/.well-known/matrix \
|
|
--auth_header=false
|
|
ynh_""permission_update --permission=server_client_infos --label="Server info for clients. (well-known)" --show_tile=false \
|
|
--protected=true
|
|
fi
|
|
fi
|
|
|
|
#=================================================
|
|
# SECURE FILES AND DIRECTORIES
|
|
#=================================================
|
|
|
|
ynh_script_progression --message="Protecting directories..." --weight=3
|
|
set_permissions
|
|
|
|
#=================================================
|
|
# UPDATE HOOKS
|
|
#=================================================
|
|
|
|
# WARNING : theses command are used in INSTALL, UPGRADE
|
|
# For any update do it in all files
|
|
ynh_replace_string __APP__ $app ../hooks/post_cert_update
|
|
ynh_replace_string __DOMAIN__ $domain ../hooks/post_cert_update
|
|
|
|
#=================================================
|
|
# RELOAD SERVICES
|
|
#=================================================
|
|
ynh_script_progression --message="Restarting Synapse services..." --weight=5
|
|
|
|
ynh_systemd_action --service_name=$app-coturn.service --action=restart
|
|
ynh_systemd_action --service_name=$app.service --action=restart --line_match="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300
|
|
|
|
#=================================================
|
|
# END OF SCRIPT
|
|
#=================================================
|
|
|
|
ynh_script_progression --message="Upgrade of $app completed" --last
|