mirror of
https://github.com/YunoHost-Apps/synapse_ynh.git
synced 2024-09-03 20:26:38 +02:00
390 lines
15 KiB
Bash
390 lines
15 KiB
Bash
#!/bin/bash
|
|
|
|
source _common.sh
|
|
source experimental_helper.sh
|
|
source /usr/share/yunohost/helpers
|
|
|
|
ynh_app_setting_set_default --key=php_upload_max_filesize --value=100M
|
|
|
|
#=================================================
|
|
# SET ALL CONSTANT
|
|
#=================================================
|
|
|
|
#=================================================
|
|
# MIGRATION 5 : Manage old settings
|
|
#=================================================
|
|
|
|
# Migrate from settings 'special_domain' to 'domain' and 'special_path' to 'path'
|
|
if [ -z "${domain:-}" ]; then
|
|
domain=$(ynh_app_setting_get --key=special_domain)
|
|
path=$(ynh_app_setting_get --key=special_path)
|
|
ynh_app_setting_set --key=domain --value=$domain
|
|
ynh_app_setting_set --key=path --value=$path
|
|
ynh_app_setting_delete --key=special_domain
|
|
ynh_app_setting_delete --key=special_path
|
|
ynh_app_setting_set --key=no_sso --value=true
|
|
fi
|
|
|
|
ensure_vars_set
|
|
|
|
# Define $server_name if not already defined
|
|
ynh_app_setting_set_default --app="$app" --key=server_name --value="$domain"
|
|
|
|
# Define $jitsi_server if not already defined
|
|
ynh_app_setting_set_default --app="$app" --key=jitsi_server --value='jitsi.riot.im'
|
|
|
|
if [ "$e2e_enabled_by_default" = "true" ] ; then
|
|
e2e_enabled_by_default="all"
|
|
ynh_app_setting_set --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
|
|
fi
|
|
if [ "$e2e_enabled_by_default" = "false" ]; then
|
|
e2e_enabled_by_default="off"
|
|
ynh_app_setting_set --key=e2e_enabled_by_default --value=$e2e_enabled_by_default
|
|
fi
|
|
|
|
if [ "${registrations_require_3pid}" == none ]
|
|
then
|
|
registrations_require_3pid=email
|
|
ynh_app_setting_set --key=registrations_require_3pid --value=$registrations_require_3pid
|
|
fi
|
|
if [[ "${allowed_local_3pids_email}" =~ \'.*\' ]] # Also remove shit value from previous config panel
|
|
then
|
|
allowed_local_3pids_email=''
|
|
ynh_app_setting_set --key=allowed_local_3pids_email --value=$allowed_local_3pids_email
|
|
fi
|
|
if [[ "${allowed_local_3pids_msisdn}" =~ \'.*\' ]] # Also remove shit value from previous config panel
|
|
then
|
|
allowed_local_3pids_msisdn=''
|
|
ynh_app_setting_set --key=allowed_local_3pids_msisdn --value=$allowed_local_3pids_msisdn
|
|
fi
|
|
|
|
if [ -z "${enable_registration:-}" ]
|
|
then
|
|
if [ -z "${is_free_registration:-}" ]; then
|
|
is_free_registration=$(ynh_app_setting_get --key=is_""public)
|
|
fi
|
|
|
|
if [ "$is_free_registration" -eq "0" ]
|
|
then
|
|
enable_registration="false"
|
|
password_enabled="false"
|
|
|
|
else
|
|
enable_registration="true"
|
|
password_enabled="true"
|
|
fi
|
|
ynh_app_setting_set --key=enable_registration --value=$enable_registration
|
|
ynh_app_setting_set --key=password_enabled --value=$password_enabled
|
|
fi
|
|
|
|
# remove legacy env file into /etc/default
|
|
ynh_safe_rm /etc/default/coturn-$app
|
|
|
|
#=================================================
|
|
# MIGRATION 7 : STANDARDIZE SYSTEMD UNIT
|
|
#=================================================
|
|
|
|
if [ -e /etc/systemd/system/matrix-$app.service ]
|
|
then
|
|
ynh_script_progression 'Migrating systemd unit to standard name...'
|
|
|
|
systemctl stop matrix-$app.service || true
|
|
systemctl stop coturn-$app.service || true
|
|
|
|
yunohost service remove matrix-$app || true
|
|
yunohost service remove coturn-$app || true
|
|
|
|
ynh_safe_rm /etc/systemd/system/matrix-$app.service
|
|
ynh_safe_rm /etc/systemd/system/coturn-$app.service
|
|
|
|
touch /etc/systemd/system/$app.service
|
|
systemctl daemon-reload || true
|
|
fi
|
|
|
|
#=================================================
|
|
# STOP SERVICES
|
|
#=================================================
|
|
|
|
# We stop the service
|
|
ynh_systemctl --service=$app.service --action=stop
|
|
|
|
ynh_script_progression 'Managing migrations...'
|
|
|
|
#=================================================
|
|
# MIGRATION 6 : Migrate data directory
|
|
#=================================================
|
|
|
|
if [ -e "/var/lib/matrix-$app" ]; then
|
|
ynh_script_progression "Moving data directory to $data_dir..."
|
|
if [ -e "$data_dir" ]; then
|
|
old_data_dir_path="$data_dir$(date '+%Y%m%d.%H%M%S')"
|
|
ynh_print_warn "A data directory already exist. Data was renamed to $old_data_dir_path"
|
|
mv "$data_dir" "$old_data_dir_path"
|
|
fi
|
|
mv "/var/lib/matrix-$app" "$data_dir"
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 3 : USE STANDARD ACCESS FOR CERTIFCATE
|
|
#=================================================
|
|
|
|
# Fix issue about certificates access
|
|
if [ ! $(grep "ssl-cert:x:[0-9]*:.*$app" /etc/group) ]
|
|
then
|
|
ynh_script_progression "Use standard access for certificate..."
|
|
|
|
adduser $app ssl-cert
|
|
adduser turnserver ssl-cert
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 4 : CREATE A DH FILE
|
|
#=================================================
|
|
|
|
# WARNING : theses command are used in INSTALL, UPGRADE, RESTORE
|
|
# For any update do it in all files
|
|
|
|
# Make dh cert for synapse if it doesn't exist
|
|
if [ ! -e /etc/ssl/private/dh2048.pem ]
|
|
then
|
|
ynh_script_progression "Creating a dh file..."
|
|
|
|
ynh_hide_warnings openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -dsaparam 2048
|
|
chown root:ssl-cert /etc/ssl/private/dh2048.pem
|
|
chmod 640 /etc/ssl/private/dh2048.pem
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 2 : MULTINSTANCE SUPPORT
|
|
#=================================================
|
|
|
|
if [ ! -e /etc/matrix-$app/coturn.conf ]
|
|
then
|
|
ynh_script_progression "Creating an independant service for coturn..."
|
|
|
|
#=================================================
|
|
# CREATE AN INDEPENDANT SERVICE FOR COTURN
|
|
#=================================================
|
|
|
|
# Disable default config for turnserver and create a new service
|
|
systemctl stop coturn.service
|
|
|
|
#=================================================
|
|
# MAKE A CLEAN LOGROTATE CONFIG
|
|
#=================================================
|
|
|
|
ynh_config_add_logrotate /var/log/matrix-$app
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 8 : Migrate database to managed database (Migrate db name from matrix_$app to $app)
|
|
#=================================================
|
|
|
|
if ynh_psql_db_shell <<< '\list' | grep matrix_$app; then
|
|
ynh_''psql_remove_db --db_user="user_wich_must_dont_exist_and_keep_current_user" --db_name=$db_name
|
|
ynh_psql_db_shell <<< "ALTER DATABASE matrix_$app RENAME TO $db_name;"
|
|
ynh_psql_db_shell <<< "REASSIGN OWNED BY matrix_$app TO $db_user;"
|
|
ynh_psql_db_shell <<< "UPDATE pg_database SET datcollate='C', datctype='C' WHERE datname='$db_name';"
|
|
ynh_psql_db_shell <<< "DROP USER matrix_$app;"
|
|
# for unknown reason we need to set again the password for synapse user. Without this synapse can't authenticate to postgresql
|
|
ynh_psql_db_shell <<< "ALTER USER $db_user WITH ENCRYPTED PASSWORD '$db_pwd';"
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 9 : migrate data path (from matrix-$app to $app)
|
|
#=================================================
|
|
|
|
if [ -e /home/yunohost.app/matrix-$app ]; then
|
|
mv -t $data_dir /home/yunohost.app/matrix-$app/*
|
|
ynh_safe_rm /home/yunohost.app/matrix-$app
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 11 : make this app using full domain
|
|
#=================================================
|
|
|
|
ynh_app_setting_set --key=path --value=/
|
|
|
|
if yunohost app map -r --output-as json | jq -r '."'$domain'" | select( . != null ) | .[] | .id' | grep -v "$app" -q; then
|
|
ynh_print_warn 'An other app is installed on this domain. Now synapse require to be alone on the domain.'
|
|
ynh_print_warn 'To solve this you can:'
|
|
ynh_print_warn " - Remove or move all other app which use '$domain'"
|
|
ynh_print_warn ' - Change the domain of synapse. You can find more informations here: https://github.com/YunoHost-Apps/synapse_ynh/tree/testing/doc/ADMIN.md#change-url'
|
|
ynh_print_warn 'For more information you can see this issue: https://github.com/YunoHost-Apps/synapse_ynh/issues/443'
|
|
fi
|
|
|
|
#=================================================
|
|
# MIGRATION 12 : update system user and drop yunohost user
|
|
#=================================================
|
|
|
|
if grep -q "^matrix-$app" /etc/passwd; then
|
|
# Must stop php before remove user as user is used by php
|
|
systemctl stop php$YNH_PHP_VERSION-fpm.service
|
|
|
|
ynh_''system_user_delete --username=matrix-"$app" || true
|
|
yunohost user delete $app || true
|
|
ynh_''system_user_create --username=$app --home_dir=$code_dir
|
|
adduser $app ssl-cert
|
|
fi
|
|
|
|
#=================================================
|
|
# DOWNLOAD, CHECK AND UNPACK SOURCE
|
|
#=================================================
|
|
|
|
ynh_script_progression "Upgrading source files..."
|
|
install_sources
|
|
|
|
#=================================================
|
|
# MIGRATION 1 : GENERATE SYNAPSE SECRET
|
|
#=================================================
|
|
|
|
if [ -z "${registration_shared_secret:-}" ] || [ "$form_secret" == "form_secret: " ]
|
|
then
|
|
ynh_script_progression "Generating synapse secret..."
|
|
|
|
# Generate config and keys
|
|
"$code_dir"/bin/python -m synapse.app.homeserver --keys-directory /etc/matrix-"$app"/ --generate-config --generate-keys --server-name "$server_name" --report-stats=no -c homeserver.yml
|
|
|
|
# Get random values from config
|
|
registration_shared_secret=$(egrep "^registration_shared_secret:" homeserver.yml | cut -d'"' -f2)
|
|
form_secret=$(egrep "^form_secret:" homeserver.yml | cut -d'"' -f2)
|
|
|
|
# store in yunohost settings
|
|
ynh_app_setting_set --key=registration_shared_secret --value="$registration_shared_secret"
|
|
ynh_app_setting_set --key=form_secret --value="$form_secret"
|
|
fi
|
|
|
|
#=================================================
|
|
|
|
#=================================================
|
|
# UPDATE SYNAPSE CONFIG
|
|
#=================================================
|
|
ynh_script_progression "Updating synapse config..."
|
|
ynh_config_add --jinja --template="homeserver.yaml" --destination="/etc/matrix-$app/homeserver.yaml"
|
|
ynh_config_add --template="log.yaml" --destination="/etc/matrix-$app/log.yaml"
|
|
|
|
#=================================================
|
|
# CREATE SMALL CAS SERVER
|
|
#=================================================
|
|
# WARNING : theses command are used in INSTALL, UPGRADE
|
|
# For any update do it in all files
|
|
|
|
mkdir -p "$install_dir"
|
|
cp ../sources/cas_server.php "$install_dir"/
|
|
chmod u=rwX,g=rX,o= -R "$install_dir"
|
|
chown "$app":root -R "$install_dir"
|
|
|
|
#=================================================
|
|
# NGINX CONFIGURATION
|
|
#=================================================
|
|
ynh_script_progression "Upgrading NGINX web server configuration..."
|
|
|
|
# Create a dedicated php-fpm config
|
|
ynh_script_progression "Configuring application..."
|
|
|
|
ynh_config_add_phpfpm
|
|
|
|
configure_nginx
|
|
|
|
#=================================================
|
|
# UPDATE COTURN CONFIG
|
|
#=================================================
|
|
ynh_script_progression "Updating Coturn config..."
|
|
|
|
configure_coturn
|
|
|
|
#=================================================
|
|
# ADD SCRIPT FOR COTURN CRON AND APP SERVICE
|
|
#=================================================
|
|
|
|
# WARNING : theses command are used in INSTALL, UPGRADE
|
|
# For any update do it in all files
|
|
|
|
ynh_config_add --template="../sources/Coturn_config_rotate.sh" --destination="$code_dir/Coturn_config_rotate.sh"
|
|
ynh_config_add --template="../sources/update_synapse_for_appservice.sh" --destination="$code_dir/update_synapse_for_appservice.sh"
|
|
ynh_config_add --template=../sources/set_admin_user.sh --destination=$code_dir/set_admin_user.sh
|
|
|
|
# Ensure app-service folder has exists and the config file exit (Migration)
|
|
mkdir -p /etc/matrix-$app/app-service
|
|
if [ -e /etc/matrix-$app/conf.d/app_service.yaml ]; then
|
|
# ensure that the file is empty if no app service are installed (fix issue #385)
|
|
if [ ! "$(ls -A /etc/matrix-$app/app-service)" ]; then
|
|
echo "" > /etc/matrix-$app/conf.d/app_service.yaml
|
|
fi
|
|
else
|
|
touch /etc/matrix-$app/conf.d/app_service.yaml
|
|
fi
|
|
|
|
#=================================================
|
|
# ADVERTISE SERVICE IN ADMIN PANEL
|
|
#=================================================
|
|
|
|
yunohost service add "$app" --log "/var/log/matrix-$app/homeserver.log" --needs_exposed_ports "$port_synapse_tls" --description 'Main matrix server service.'
|
|
yunohost service add "$app"-coturn --needs_exposed_ports "$port_turnserver_tls" --description 'Turn server for matrix server. Used for audio and video call.'
|
|
|
|
#=================================================
|
|
# UPDATE SYSTEMD
|
|
#=================================================
|
|
ynh_script_progression "Upgrading systemd configuration..."
|
|
|
|
# Create systemd service for synapse and turnserver
|
|
ynh_config_add_systemd --template=synapse.service
|
|
|
|
cp ../conf/default_coturn /etc/matrix-"$app"/coturn_env
|
|
ynh_config_add_systemd --service="$app"-coturn --template=synapse-coturn.service
|
|
|
|
#=================================================
|
|
# UPGRADE FAIL2BAN
|
|
#=================================================
|
|
ynh_script_progression "Reconfiguring Fail2Ban..."
|
|
|
|
ynh_config_add_fail2ban
|
|
|
|
#=================================================
|
|
# SETUP PERMISSIONS
|
|
#=================================================
|
|
|
|
ynh_script_progression "Configuring permissions..."
|
|
|
|
if yunohost --output-as plain domain list | grep -q "^$server_name"'$'; then
|
|
if ! ynh_""permission_exists --permission=server_client_infos; then
|
|
ynh_""permission_create --permission=server_client_infos --url="$server_name"/.well-known/matrix \
|
|
--label="Server info for clients. (well-known)" --show_tile=false --allowed=visitors \
|
|
--auth_header=false --protected=true
|
|
else yunohost --output-as plain domain list | grep -q "^$server_name"'$'
|
|
ynh_""permission_url --permission=server_client_infos --url="$server_name"/.well-known/matrix \
|
|
--auth_header=false
|
|
ynh_""permission_update --permission=server_client_infos --label="Server info for clients. (well-known)" --show_tile=false \
|
|
--protected=true
|
|
fi
|
|
fi
|
|
|
|
#=================================================
|
|
# SECURE FILES AND DIRECTORIES
|
|
#=================================================
|
|
|
|
ynh_script_progression "Protecting directories... (note that it could take a long time depending of your install size)"
|
|
set_permissions data
|
|
|
|
#=================================================
|
|
# UPDATE HOOKS
|
|
#=================================================
|
|
|
|
# WARNING : theses command are used in INSTALL, UPGRADE
|
|
# For any update do it in all files
|
|
ynh_replace --match=__APP__ --replace="$app" --file=../hooks/post_cert_update
|
|
ynh_replace --match=__DOMAIN__ --replace="$domain" --file=../hooks/post_cert_update
|
|
|
|
#=================================================
|
|
# RELOAD SERVICES
|
|
#=================================================
|
|
ynh_script_progression "Restarting Synapse services..."
|
|
|
|
ynh_systemctl --service="$app"-coturn.service --action=restart
|
|
ynh_systemctl --service="$app".service --action=restart --wait_until="Synapse now listening on TCP port $port_synapse_tls" --log_path="/var/log/matrix-$app/homeserver.log" --timeout=300
|
|
|
|
#=================================================
|
|
# END OF SCRIPT
|
|
#=================================================
|
|
|
|
ynh_script_progression "Upgrade of $app completed"
|