Update changelog for 11.2.30

Fix ynh_restore_everything

.codeclimate.yml

@@ -0,0 +1,24 @@
+---
+version: "2"
+plugins:
+  duplication:
+    enabled: true
+    config:
+      languages:
+        python:
+          python_version: 3
+  shellcheck:
+    enabled: true
+  pep8:
+    enabled: true
+  fixme:
+    enabled: true
+  sonar-python:
+    enabled: true
+    config:
+      tests_patterns:
+        - bin/*
+        - data/**
+        - doc/*
+        - src/**
+        - tests/**

.coveragerc

@@ -0,0 +1,2 @@
+[report]
+omit=src/tests/*,src/vendor/*,/usr/lib/moulinette/yunohost/*,/usr/lib/python3/dist-packages/yunohost/tests/*,/usr/lib/python3/dist-packages/yunohost/vendor/*

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,10 +13,3 @@
 ## How to test
 
 ...
-
-## Validation
-
-- [ ] Principle agreement 0/2 : 
-- [ ] Quick review 0/1 : 
-- [ ] Simple test 0/1 : 
-- [ ] Deep review 0/1 : 

.github/workflows/autoblack.yml

@@ -0,0 +1,30 @@
+name: Check / auto apply Black
+
+on:
+  push:
+    branches: [ "dev" ]
+
+jobs:
+  black:
+    name: Check / auto apply black
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check files using the black formatter
+        uses: psf/black@stable
+        id: black
+        with:
+          options: "."
+        continue-on-error: true
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          title: "Format Python code with Black"
+          commit-message: ":art: Format Python code with Black"
+          body: |
+            This pull request uses the [psf/black](https://github.com/psf/black) formatter.
+          base: ${{ github.head_ref }} # Creates pull request onto pull request or commit branch
+          branch: actions/black

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "dev" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "dev" ]
+    paths-ignore:
+      - 'src/tests/**'
+  schedule:
+    - cron: '43 12 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/n_updater.yml

@@ -0,0 +1,39 @@
+# This workflow allows GitHub Actions to automagically update YunoHost NodeJS helper whenever a new release of n is detected.
+name: Check for new n releases
+on:
+  # Allow to manually trigger the workflow
+  workflow_dispatch:
+  # Run it every day at 5:00 UTC
+  schedule:
+    - cron:  '0 5 * * *'
+jobs:
+  updater:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch the source code
+        uses: actions/checkout@v4
+
+      - name: Run the updater script
+        id: run_updater
+        run: |
+          # Download n
+          wget https://raw.githubusercontent.com/tj/n/master/bin/n --output-document=helpers/vendor/n/n
+
+          echo "VERSION=$(sed -n 's/^VERSION=\"\(.*\)\"/\1/p' < helpers/vendor/n/n)" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        id: cpr
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Update n to ${{ env.VERSION }}
+          committer: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
+          author: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
+          signoff: false
+          base: dev
+          branch: ci-auto-update-n-${{ env.VERSION }}
+          delete-branch: true
+          title: 'Upgrade n to ${{ env.VERSION }}'
+          body: |
+            Upgrade `n` to ${{ env.VERSION }}
+          draft: false

.gitignore

@@ -31,7 +31,14 @@ pip-log.txt
 .mr.developer.cfg
 
 # moulinette lib
-src/yunohost/locales
+src/locales
 
 # Test
-src/yunohost/tests/apps
+src/tests/apps
+
+# Tmp/local doc stuff
+doc/bash-completion.sh
+doc/bash_completion.d
+doc/openapi.js
+doc/openapi.json
+doc/swagger

.gitlab-ci.yml

@@ -1,9 +1,11 @@
+---
 stages:
   - build
   - install
-  - tests
+  - test
   - lint
   - doc
+  - translation
 
 default:
   tags:
@@ -11,12 +13,43 @@ default:
   # All jobs are interruptible by default
   interruptible: true
 
+code_quality:
+  tags:
+    - docker
+  rules:
+    - if: $CI_COMMIT_TAG # Only for tags
+
+
+code_quality_html:
+  extends: code_quality
+  variables:
+    REPORT_FORMAT: html
+  artifacts:
+    paths: [gl-code-quality-report.html]
+  rules:
+    - if: $CI_COMMIT_TAG # Only for tags
+
+
+# see: https://docs.gitlab.com/ee/ci/yaml/#switch-between-branch-pipelines-and-merge-request-pipelines
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" # If we move to gitlab one day
+    - if: $CI_PIPELINE_SOURCE == "external_pull_request_event" # For github PR
+    - if: $CI_COMMIT_TAG # For tags
+    - if: $CI_COMMIT_REF_NAME == "ci-format-$CI_DEFAULT_BRANCH"  # Ignore black formatting branch created by the CI
+      when: never
+    - if: $CI_COMMIT_REF_NAME == "actions/black"  # Ignore black formatting branch created by the CI
+      when: never
+    - if: $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH  && $CI_PIPELINE_SOURCE == "push" # If it's not the default branch and if it's a push, then do not trigger a build
+      when: never
+    - when: always
+
 variables:
-    YNH_BUILD_DIR: "ynh-build"
+  GIT_CLONE_PATH: '$CI_BUILDS_DIR/$CI_COMMIT_SHA/$CI_JOB_ID'
+  YNH_SOURCE: "https://github.com/yunohost"
+  YNH_DEBIAN: "bullseye"
+  YNH_SKIP_DIAGNOSIS_DURING_UPGRADE: "true"
 
 include:
-  - local: .gitlab/ci/build.gitlab-ci.yml
-  - local: .gitlab/ci/install.gitlab-ci.yml
-  - local: .gitlab/ci/test.gitlab-ci.yml
-  - local: .gitlab/ci/lint.gitlab-ci.yml
-  - local: .gitlab/ci/doc.gitlab-ci.yml
+  - template: Code-Quality.gitlab-ci.yml
+  - local: .gitlab/ci/*.gitlab-ci.yml

.gitlab/ci/build.gitlab-ci.yml

@@ -1,20 +1,22 @@
 .build-stage:
   stage: build
-  image: "before-install"
+  image: "build-and-lint"
   variables:
-    YNH_SOURCE: "https://github.com/yunohost"
+    YNH_BUILD_DIR: "$GIT_CLONE_PATH/build"
   before_script:
     - mkdir -p $YNH_BUILD_DIR
   artifacts:
     paths:
-      - $YNH_BUILD_DIR/*.deb
+      - ./*.deb
 
 .build_script: &build_script
   - cd $YNH_BUILD_DIR/$PACKAGE
   - VERSION=$(dpkg-parsechangelog -S Version 2>/dev/null)
-  - VERSION_NIGHTLY="${VERSION}+$(date +%Y%m%d%H%M)"
-  - dch --package "${PACKAGE}" --force-bad-version -v "${VERSION_NIGHTLY}" -D "unstable" --force-distribution "Daily build."
+  - VERSION_TIMESTAMPED="${VERSION}+$(date +%Y%m%d%H%M)"
+  - dch --package "${PACKAGE}" --force-bad-version -v "${VERSION_TIMESTAMPED}" -D "unstable" --force-distribution "CI build."
   - debuild --no-lintian -us -uc
+  - cp $YNH_BUILD_DIR/*.deb ${CI_PROJECT_DIR}/
+  - cd ${CI_PROJECT_DIR}
 
 ########################################
 # BUILD DEB
@@ -29,17 +31,16 @@ build-yunohost:
     - mkdir -p $YNH_BUILD_DIR/$PACKAGE
     - cat archive.tar.gz | tar -xz -C $YNH_BUILD_DIR/$PACKAGE
     - rm archive.tar.gz
-    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $(pwd)/$YNH_BUILD_DIR/$PACKAGE
+    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $YNH_BUILD_DIR/$PACKAGE
     - *build_script
 
-
 build-ssowat:
   extends: .build-stage
   variables:
     PACKAGE: "ssowat"
   script:
-    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE
-    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $(pwd)/$YNH_BUILD_DIR/$PACKAGE
+    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE -b $YNH_DEBIAN $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE --depth 1
+    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $YNH_BUILD_DIR/$PACKAGE
     - *build_script
 
 build-moulinette:
@@ -47,6 +48,6 @@ build-moulinette:
   variables:
     PACKAGE: "moulinette"
   script:
-    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE
-    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $(pwd)/$YNH_BUILD_DIR/$PACKAGE
+    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE -b $YNH_DEBIAN $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE --depth 1
+    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $YNH_BUILD_DIR/$PACKAGE
     - *build_script

.gitlab/ci/doc.gitlab-ci.yml

@@ -4,11 +4,28 @@
 
 generate-helpers-doc:
   stage: doc
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
+  before_script:
+    - git config --global user.email "yunohost@yunohost.org"
+    - git config --global user.name "$GITHUB_USER"
   script:
     - cd doc
-    - python generate_helper_doc.py
+    - python3 generate_helper_doc.py 2
+    - python3 generate_helper_doc.py 2.1
+    - python3 generate_resource_doc.py > resources.md
+    - hub clone https://$GITHUB_TOKEN:x-oauth-basic@github.com/YunoHost/doc.git doc_repo
+    - cp helpers.v2.md doc_repo/pages/06.contribute/10.packaging_apps/20.scripts/10.helpers/packaging_app_scripts_helpers.md
+    - cp helpers.v2.1.md doc_repo/pages/06.contribute/10.packaging_apps/20.scripts/12.helpers21/packaging_app_scripts_helpers_v21.md
+    - cp resources.md doc_repo/pages/06.contribute/10.packaging_apps/10.manifest/10.appresources/packaging_app_manifest_resources.md
+    - cd doc_repo
+    # replace ${CI_COMMIT_REF_NAME} with ${CI_COMMIT_TAG} ?
+    - hub checkout -b "${CI_COMMIT_REF_NAME}"
+    - hub commit -am "[CI] Update app helpers/resources for ${CI_COMMIT_REF_NAME}"
+    - hub pull-request -m "[CI] Update app helpers/resources for ${CI_COMMIT_REF_NAME}" -p # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
   artifacts:
     paths:
-      - doc/helpers.html
+      - doc/helpers.md
+      - doc/resources.md
+  only:
+    - tags

.gitlab/ci/install.gitlab-ci.yml

@@ -14,24 +14,14 @@
 
 upgrade:
   extends: .install-stage
-  image: "after-install"
+  image: "core-tests"
   script:
-    - apt-get update -o Acquire::Retries=3
-    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb
+    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ${CI_PROJECT_DIR}/*.deb
 
 
 install-postinstall:
   extends: .install-stage
   image: "before-install"
   script:
-    - apt-get update -o Acquire::Retries=3
-    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb
-    - systemctl -q stop apt-daily.timer
-    - systemctl -q stop apt-daily-upgrade.timer
-    - systemctl -q stop apt-daily.service
-    - systemctl -q stop apt-daily-upgrade.service
-    - systemctl -q disable apt-daily.timer
-    - systemctl -q disable apt-daily-upgrade.timer
-    - systemctl -q disable apt-daily.service
-    - systemctl -q disable apt-daily-upgrade.service
-    - yunohost tools postinstall -d domain.tld -p the_password --ignore-dyndns
+    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ${CI_PROJECT_DIR}/*.deb
+    - yunohost tools postinstall -d domain.tld -u syssa -F 'Syssa Mine' -p the_password --ignore-dyndns --force-diskspace

.gitlab/ci/lint.gitlab-ci.yml

@@ -1,24 +1,26 @@
 ########################################
 # LINTER
 ########################################
+# later we must fix lint and format-check jobs and remove "allow_failure"
 
-lint:
+lint39:
   stage: lint
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   allow_failure: true
   script:
-    - tox -e lint
+    - tox -e py39-lint
 
-invalidcode:
+invalidcode39:
   stage: lint
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   script:
-    - tox -e invalidcode
+    - tox -e py39-invalidcode
 
-# Disabled, waiting for buster
-#format-check:
-#  extends: .lint-stage
-#  script:
-#    - black --check --diff
+mypy:
+  stage: lint
+  image: "build-and-lint"
+  needs: []
+  script:
+    - tox -e py39-mypy

.gitlab/ci/test.gitlab-ci.yml

@@ -1,25 +1,16 @@
 .install_debs: &install_debs
-    - systemctl -q stop apt-daily.timer
-    - systemctl -q stop apt-daily-upgrade.timer
-    - systemctl -q stop apt-daily.service
-    - systemctl -q stop apt-daily-upgrade.service
-    - systemctl -q disable apt-daily.timer
-    - systemctl -q disable apt-daily-upgrade.timer
-    - systemctl -q disable apt-daily.service
-    - systemctl -q disable apt-daily-upgrade.service
-    - apt-get update -o Acquire::Retries=3
-    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb
+    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ${CI_PROJECT_DIR}/*.deb
 
 .test-stage:
-  stage: tests
-  image: "after-install"
+  stage: test
+  image: "core-tests"
   variables:
     PYTEST_ADDOPTS: "--color=yes"
   before_script:
     - *install_debs
   cache:
     paths: 
-      - src/yunohost/tests/apps
+      - src/tests/apps
     key: "$CI_JOB_STAGE-$CI_COMMIT_REF_SLUG"
   needs:
       - job: build-yunohost
@@ -30,21 +21,21 @@
         artifacts: true
       - job: upgrade
 
-
 ########################################
 # TESTS
 ########################################
 
 full-tests:
-  stage: tests
+  stage: test
   image: "before-install"
   variables:
     PYTEST_ADDOPTS: "--color=yes"
   before_script:
     - *install_debs
-    - yunohost tools postinstall -d domain.tld -p the_password --ignore-dyndns
+    - pip install mock pip pyOpenSSL pytest pytest-cov pytest-mock pytest-sugar requests-mock "packaging<22"
+    - yunohost tools postinstall -d domain.tld -u syssa -F 'Syssa Mine' -p the_password --ignore-dyndns --force-diskspace
   script:
-    - pytest --cov=yunohost tests/ src/yunohost/tests/ --junitxml=report.xml
+    - python3 -m pytest --cov=yunohost tests/ src/tests/ --junitxml=report.xml
   needs:
       - job: build-yunohost
         artifacts: true
@@ -52,77 +43,158 @@ full-tests:
         artifacts: true
       - job: build-moulinette
         artifacts: true
+  coverage: '/TOTAL.*\s+(\d+%)/'
   artifacts:
     reports:
       junit: report.xml
 
-root-tests:
+test-actionmap:
   extends: .test-stage
   script:
-    - py.test tests
+    - python3 -m pytest tests/test_actionmap.py
+  only:
+    changes:
+      - share/actionsmap.yml
+
+test-helpers2:
+  extends: .test-stage
+  script:
+    - cd tests
+    - bash test_helpers.sh
+
+test-helpers2.1:
+  extends: .test-stage
+  script:
+    - cd tests
+    - bash test_helpers.sh 2.1
+
+test-domains:
+  extends: .test-stage
+  script:
+    - python3 -m pytest src/tests/test_domains.py
+  only:
+    changes:
+      - src/domain.py
+
+test-dns:
+  extends: .test-stage
+  script:
+    - python3 -m pytest src/tests/test_dns.py
+  only:
+    changes:
+      - src/dns.py
+      - src/utils/dns.py
 
 test-apps:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_apps.py
+    - python3 -m pytest src/tests/test_apps.py
+  only:
+    changes:
+      - src/app.py
 
 test-appscatalog:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_appscatalog.py
+    - python3 -m pytest src/tests/test_app_catalog.py
+  only:
+    changes:
+      - src/app_calalog.py
 
 test-appurl:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_appurl.py
+    - python3 -m pytest src/tests/test_appurl.py
+  only:
+    changes:
+      - src/app.py
 
-test-apps-arguments-parsing:
+test-questions:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_apps_arguments_parsing.py
+    - python3 -m pytest src/tests/test_questions.py
+  only:
+    changes:
+      - src/utils/config.py
 
-test-backuprestore:
+test-app-config:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_backuprestore.py
+    - python3 -m pytest src/tests/test_app_config.py
+  only:
+    changes:
+      - src/app.py
+      - src/utils/config.py
+
+test-app-resources:
+  extends: .test-stage
+  script:
+    - python3 -m pytest src/tests/test_app_resources.py
+  only:
+    changes:
+      - src/app.py
+      - src/utils/resources.py
 
 test-changeurl:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_changeurl.py
+    - python3 -m pytest src/tests/test_changeurl.py
+  only:
+    changes:
+      - src/app.py
+
+test-backuprestore:
+  extends: .test-stage
+  script:
+    - python3 -m pytest src/tests/test_backuprestore.py
+  only:
+    changes:
+      - src/backup.py
 
 test-permission:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_permission.py
+    - python3 -m pytest src/tests/test_permission.py
+  only:
+    changes:
+      - src/permission.py
 
 test-settings:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_settings.py
+    - python3 -m pytest src/tests/test_settings.py
+  only:
+    changes:
+      - src/settings.py
 
 test-user-group:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_user-group.py
-    
+    - python3 -m pytest src/tests/test_user-group.py
+  only:
+    changes:
+      - src/user.py
+
 test-regenconf:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_regenconf.py
+    - python3 -m pytest src/tests/test_regenconf.py
+  only:
+    changes:
+      - src/regenconf.py
 
 test-service:
   extends: .test-stage
   script:
-    - cd src/yunohost
-    - py.test tests/test_service.py
+    - python3 -m pytest src/tests/test_service.py
+  only:
+    changes:
+      - src/service.py
+
+test-ldapauth:
+  extends: .test-stage
+  script:
+    - python3 -m pytest src/tests/test_ldapauth.py
+  only:
+    changes:
+      - src/authenticators/*.py

.gitlab/ci/translation.gitlab-ci.yml

@@ -0,0 +1,36 @@
+########################################
+# TRANSLATION
+########################################
+test-i18n-keys:
+  stage: translation
+  script:
+    - python3 maintenance/missing_i18n_keys.py --check
+  only:
+    changes:
+      - locales/en.json
+      - src/*.py
+      - src/diagnosers/*.py
+
+autofix-translated-strings:
+  stage: translation
+  image: "build-and-lint"
+  needs: []
+  before_script:
+    - git config --global user.email "yunohost@yunohost.org"
+    - git config --global user.name "$GITHUB_USER"
+    - hub clone --branch ${CI_COMMIT_REF_NAME} "https://$GITHUB_TOKEN:x-oauth-basic@github.com/YunoHost/yunohost.git" github_repo
+    - cd github_repo
+  script:
+    # create a local branch that will overwrite distant one
+    - git checkout -b "ci-autofix-translated-strings-${CI_COMMIT_REF_NAME}" --no-track
+    - python3 maintenance/missing_i18n_keys.py --fix
+    - python3 maintenance/autofix_locale_format.py
+    - '[ $(git diff --ignore-blank-lines --ignore-all-space --ignore-space-at-eol --ignore-cr-at-eol | wc -l) != 0 ] || exit 0'  # stop if there is nothing to commit
+    - git commit -am "[CI] Reformat / remove stale translated strings" || true
+    - git push -f origin "ci-autofix-translated-strings-${CI_COMMIT_REF_NAME}":"ci-remove-stale-translated-strings-${CI_COMMIT_REF_NAME}"
+    - hub pull-request -m "[CI] Reformat / remove stale translated strings" -b Yunohost:$CI_COMMIT_REF_NAME -p || true # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
+  only:
+    variables:
+      - $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
+    changes:
+      - locales/*

.travis.yml

@@ -1,16 +0,0 @@
-language: python
-
-matrix:
-  allow_failures:
-    - env: TOXENV=lint
-  include:
-    - python: 2.7
-      env: TOXENV=py27
-    - python: 2.7
-      env: TOXENV=lint
-
-install:
-  - pip install tox
-
-script:
-  - tox

CONTRIBUTORS.md

@@ -1,101 +0,0 @@
-YunoHost core contributors
-==========================
-
-YunoHost is built and maintained by the YunoHost project community.
-Everyone is encouraged to submit issues and changes, and to contribute in other ways -- see https://yunohost.org/contribute to find out how.
-
---
-
-Initial YunoHost core was built by Kload & beudbeud, for YunoHost v2.
-
-Most of code was written by Kload and jerome, with help of numerous contributors.
-
-Translation is made by a bunch of lovely people all over the world.
-
-We would like to thank anyone who ever helped the YunoHost project <3
-
-
-YunoHost core Contributors
---------------------------
-
-- Jérôme Lebleu
-- Kload
-- Laurent 'Bram' Peuch
-- Julien 'ju' Malik
-- opi
-- Aleks
-- Adrien 'beudbeud' Beudin
-- M5oul
-- Valentin 'zamentur' / 'ljf' Grimaud
-- Jocelyn Delalande
-- infertux
-- Taziden
-- ZeHiro
-- Josue-T
-- nahoj
-- a1ex
-- JimboJoe
-- vetetix
-- jellium
-- Sebastien 'sebian' Badia
-- lmangani
-- Julien Vaubourg
-- thardev
-- zimo2001
-
-
-YunoHost core Translators
--------------------------
-
-If you want to help translation, please visit https://translate.yunohost.org/projects/yunohost/yunohost/
-
-
-### Dutch
-
-- DUBWiSE
-- Jeroen Keerl
-- marut
-
-### English
-
-- Bugsbane
-- rokaz
-
-### French
-
-- aoz roon
-- Genma
-- Jean-Baptiste Holcroft
-- Jean P.
-- Jérôme Lebleu
-- Lapineige
-- paddy
-
-
-### German
-
-- david.bartke
-- Fabian Gruber
-- Felix Bartels
-- Jeroen Keerl
-- martin kistner
-- Philip Gatzka
-
-### Hindi
-
-- Anmol
-
-### Italian
-
-- bricabrac
-- Thomas Bille
-
-### Portuguese
-
-- Deleted User
-- Trollken
-
-### Spanish
-
-- Juanu
-

README.md

@@ -5,9 +5,12 @@
 <h1 align="center">YunoHost</h1>
 
 <div align="center">
-
-[![Build status](https://travis-ci.org/YunoHost/yunohost.svg?branch=stretch-unstable)](https://travis-ci.org/YunoHost/yunohost)
-[![GitHub license](https://img.shields.io/github/license/YunoHost/yunohost)](https://github.com/YunoHost/yunohost/blob/stretch-unstable/LICENSE)
+    
+![Version](https://img.shields.io/github/v/tag/yunohost/yunohost?label=version&sort=semver)
+[![Pipeline status](https://gitlab.com/yunohost/yunohost/badges/dev/pipeline.svg)](https://gitlab.com/yunohost/yunohost/-/pipelines)
+![Test coverage](https://gitlab.com/yunohost/yunohost/badges/dev/coverage.svg)
+[![Project license](https://img.shields.io/gitlab/license/yunohost/yunohost)](https://github.com/YunoHost/yunohost/blob/dev/LICENSE)
+[![CodeQL](https://github.com/yunohost/yunohost/workflows/CodeQL/badge.svg)](https://github.com/YunoHost/yunohost/security/code-scanning)
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/28084)](https://mastodon.social/@yunohost)
 
 </div>
@@ -16,28 +19,49 @@ YunoHost is an operating system aiming to simplify as much as possible the admin
 
 This repository corresponds to the core code of YunoHost, mainly written in Python and Bash.
 
-- [Project features](https://yunohost.org/#/whatsyunohost)
+- [Project features](https://yunohost.org/whatsyunohost)
 - [Project website](https://yunohost.org)
 - [Install documentation](https://yunohost.org/install)
 - [Issue tracker](https://github.com/YunoHost/issues)
 
-# Screenshots
+## Screenshots
 
 Webadmin ([Yunohost-Admin](https://github.com/YunoHost/yunohost-admin)) | Single sign-on user portal ([SSOwat](https://github.com/YunoHost/ssowat))
---- |  ---
-![](https://raw.githubusercontent.com/YunoHost/doc/master/images/webadmin.png) | ![](https://raw.githubusercontent.com/YunoHost/doc/master/images/user_panel.png)
+--- | ---
+![Web admin insterface screenshot](https://raw.githubusercontent.com/YunoHost/doc/master/images/webadmin.png) | ![User portal screenshot](https://raw.githubusercontent.com/YunoHost/doc/master/images/user_panel.png)
 
 
 ## Contributing
 
 - You can learn how to get started with developing on YunoHost by reading [this piece of documentation](https://yunohost.org/dev).
-- Come chat with us on the [dev chatroom](https://yunohost.org/#/chat_rooms) !
-- You can help translate YunoHost on our [translation platform](https://translate.yunohost.org/engage/yunohost/?utm_source=widget)
+- Come chat with us on the [dev chatroom](https://yunohost.org/chat_rooms)!
+- You can help translate YunoHost on our [translation platform](https://translate.yunohost.org/engage/yunohost/?utm_source=widget).
 
 <p align="center">
-<img src="https://translate.yunohost.org/widgets/yunohost/-/multi-auto.svg" alt="Translation status" />
+<img alt="View of the translation rate for the different languages available in YunoHost" src="https://translate.yunohost.org/widgets/yunohost/-/core/horizontal-auto.svg" alt="Translation status" />
 </p>
 
 ## License
 
-As [other components of YunoHost](https://yunohost.org/#/faq_en), this repository is licensed under GNU AGPL v3.
+As [other components of YunoHost](https://yunohost.org/faq), this repository is licensed under GNU AGPL v3.
+
+## They support us <3
+
+We are thankful for our sponsors providing us with infrastructure and grants!
+
+<div align="center">
+<p style="margin-left:auto;margin-right:auto;">
+<a style="padding: 5px;" href="https://nlnet.nl"><img alt="NLnet Foundation" src="https://user-images.githubusercontent.com/36127788/198088570-823c40bd-7ac3-44e3-a8ee-e7a9f14b47ac.png" width="150px"/></a>
+<a style="padding: 5px;" href="https://www.ngi.eu"><img alt="Next Generation Internet" src="https://user-images.githubusercontent.com/36127788/198088663-daf587b9-fd09-4c00-aaf2-37c803939c94.png" width="130px"/></a>
+<a style="padding: 5px;" href="https://www.codelutin.com"><img alt="Code Lutin" src="https://user-images.githubusercontent.com/36127788/198088737-d37b6674-379c-4be4-9d74-b93b6ad318d1.png" width="100px"/></a>
+</p>
+<p style="margin-left:auto;margin-right:auto;">
+<a style="padding: 5px;" href="https://www.globenet.org"><img alt="Globenet" src="https://user-images.githubusercontent.com/36127788/198088794-751129ab-737d-4d99-9f35-5e01845dcdfe.png" width="150px"/></a>
+<a style="padding: 5px;" href="https://www.gitoyen.net"><img alt="Gitoyen" src="https://user-images.githubusercontent.com/36127788/198088931-f16f4af4-57ae-42e9-8d42-fb3e2d8d7ee3.png" width="150px"/></a>
+<a style="padding: 5px;" href="https://tetaneutral.net"><img alt="tetaneutral.net" src="https://user-images.githubusercontent.com/36127788/198088995-3ad9c34d-9807-4ead-934b-44df97d3c552.png" width="90px"/></a>
+<a style="padding: 5px;" href="https://ldn-fai.net"><img alt="LDN (Lorraine Data Network)" src="https://user-images.githubusercontent.com/36127788/198089086-a4089d51-9173-4081-bd2e-fa1ac3378e49.png" width="120px"/></a>
+<a style="padding: 5px;" href="https://www.nbs-system.com"><img alt="NBS System" src="https://user-images.githubusercontent.com/36127788/198089161-4cc0b7b7-bf56-4798-892e-a76112497921.png" width="130px"/></a>
+</p>
+</div>
+
+This project was funded through the [NGI0 PET](https://nlnet.nl/PET) Fund, a fund established by NLnet with financial support from the European Commission's [Next Generation Internet](https://ngi.eu/) programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310. If you're interested, [check out how to apply in this video](https://media.ccc.de/v/36c3-10795-ngi_zero_a_treasure_trove_of_it_innovation)! 

bin/yunohost

@@ -1,220 +1,84 @@
-#! /usr/bin/python
-# -*- coding: utf-8 -*-
+#! /usr/bin/python3
 
 import os
 import sys
 import argparse
+import yunohost
 
-# Either we are in a development environment or not
-IN_DEVEL = False
-
-# Level for which loggers will log
-LOGGERS_LEVEL = 'DEBUG'
-TTY_LOG_LEVEL = 'INFO'
-
-# Handlers that will be used by loggers
-#  - file: log to the file LOG_DIR/LOG_FILE
-#  - tty: log to current tty
-LOGGERS_HANDLERS = ['file', 'tty']
-
-# Directory and file to be used by logging
-LOG_DIR = '/var/log/yunohost'
-LOG_FILE = 'yunohost-cli.log'
-
-# Check and load - as needed - development environment
-if not __file__.startswith('/usr/'):
-    IN_DEVEL = True
-if IN_DEVEL:
-    basedir = os.path.abspath('%s/../' % os.path.dirname(__file__))
-    if os.path.isdir(os.path.join(basedir, 'moulinette')):
-        sys.path.insert(0, basedir)
-    LOG_DIR = os.path.join(basedir, 'log')
-
-
-import moulinette
-from moulinette.actionsmap import ActionsMap
-from moulinette.interfaces.cli import colorize, get_locale
-
-
-# Initialization & helpers functions -----------------------------------
-
-def _die(message, title='Error:'):
-    """Print error message and exit"""
-    print('%s %s' % (colorize(title, 'red'), message))
-    sys.exit(1)
 
 def _parse_cli_args():
     """Parse additional arguments for the cli"""
     parser = argparse.ArgumentParser(add_help=False)
-    parser.add_argument('--no-cache',
-        action='store_false', default=True, dest='use_cache',
-        help="Don't use actions map cache",
-    )
-    parser.add_argument('--output-as',
-        choices=['json', 'plain', 'none'], default=None,
+    parser.add_argument(
+        "--output-as",
+        choices=["json", "plain", "none"],
+        default=None,
         help="Output result in another format",
     )
-    parser.add_argument('--debug',
-        action='store_true', default=False,
+    parser.add_argument(
+        "--debug",
+        action="store_true",
+        default=False,
         help="Log and print debug messages",
     )
-    parser.add_argument('--quiet',
-        action='store_true', default=False,
-        help="Don't produce any output",
+    parser.add_argument(
+        "--quiet", action="store_true", default=False, help="Don't produce any output"
     )
-    parser.add_argument('--timeout',
-        type=int, default=None,
+    parser.add_argument(
+        "--version", action="store_true", default=False, help="Display YunoHost packages versions (alias to 'yunohost tools versions')"
+    )
+    parser.add_argument(
+        "--timeout",
+        type=int,
+        default=None,
         help="Number of seconds before this command will timeout because it can't acquire the lock (meaning that another command is currently running), by default there is no timeout and the command will wait until it can get the lock",
     )
-    parser.add_argument('--admin-password',
-        default=None, dest='password', metavar='PASSWORD',
-        help="The admin password to use to authenticate",
-    )
     # deprecated arguments
-    parser.add_argument('--plain',
-        action='store_true', default=False, help=argparse.SUPPRESS
+    parser.add_argument(
+        "--plain", action="store_true", default=False, help=argparse.SUPPRESS
     )
-    parser.add_argument('--json',
-        action='store_true', default=False, help=argparse.SUPPRESS
+    parser.add_argument(
+        "--json", action="store_true", default=False, help=argparse.SUPPRESS
     )
 
     opts, args = parser.parse_known_args()
 
     # output compatibility
     if opts.plain:
-        opts.output_as = 'plain'
+        opts.output_as = "plain"
     elif opts.json:
-        opts.output_as = 'json'
+        opts.output_as = "json"
 
     return (parser, opts, args)
 
-def _init_moulinette(debug=False, quiet=False):
-    """Configure logging and initialize the moulinette"""
-    # Define loggers handlers
-    handlers = set(LOGGERS_HANDLERS)
-    if quiet and 'tty' in handlers:
-        handlers.remove('tty')
-    elif 'tty' not in handlers:
-        handlers.append('tty')
-
-    root_handlers = set(handlers)
-    if not debug and 'tty' in root_handlers:
-        root_handlers.remove('tty')
-
-    # Define loggers level
-    level = LOGGERS_LEVEL
-    tty_level = TTY_LOG_LEVEL
-    if debug:
-        tty_level = 'DEBUG'
-
-    # Custom logging configuration
-    logging = {
-        'version': 1,
-        'disable_existing_loggers': True,
-        'formatters': {
-            'tty-debug': {
-                'format': '%(relativeCreated)-4d %(fmessage)s'
-            },
-            'precise': {
-                'format': '%(asctime)-15s %(levelname)-8s %(name)s %(funcName)s - %(fmessage)s'
-            },
-        },
-        'filters': {
-            'action': {
-                '()': 'moulinette.utils.log.ActionFilter',
-            },
-        },
-        'handlers': {
-            'tty': {
-                'level': tty_level,
-                'class': 'moulinette.interfaces.cli.TTYHandler',
-                'formatter': 'tty-debug' if debug else '',
-            },
-            'file': {
-                'class': 'logging.FileHandler',
-                'formatter': 'precise',
-                'filename': '%s/%s' % (LOG_DIR, LOG_FILE),
-                'filters': ['action'],
-            },
-        },
-        'loggers': {
-            'yunohost': {
-                'level': level,
-                'handlers': handlers,
-                'propagate': False,
-            },
-            'moulinette': {
-                'level': level,
-                'handlers': [],
-                'propagate': True,
-            },
-            'moulinette.interface': {
-                'level': level,
-                'handlers': handlers,
-                'propagate': False,
-            },
-        },
-        'root': {
-            'level': level,
-            'handlers': root_handlers,
-        },
-    }
-
-    # Create log directory
-    if not os.path.isdir(LOG_DIR):
-        try:
-            os.makedirs(LOG_DIR, 0750)
-        except os.error as e:
-            _die(str(e))
-
-    # Initialize moulinette
-    moulinette.init(logging_config=logging, _from_source=IN_DEVEL)
-
-def _retrieve_namespaces():
-    """Return the list of namespaces to load"""
-    ret = ['yunohost']
-    for n in ActionsMap.get_namespaces():
-        # Append YunoHost modules
-        if n.startswith('ynh_'):
-            ret.append(n)
-    return ret
 
 # Stupid PATH management because sometimes (e.g. some cron job) PATH is only /usr/bin:/bin ...
+
 default_path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 if os.environ["PATH"] != default_path:
     os.environ["PATH"] = default_path + ":" + os.environ["PATH"]
 
 # Main action ----------------------------------------------------------
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     if os.geteuid() != 0:
-        # since moulinette isn't initialized, we can't use m18n here
-        sys.stderr.write("\033[1;31mError:\033[0m yunohost command must be " \
-                         "run as root or with sudo.\n")
+        sys.stderr.write(
+            "\033[1;31mError:\033[0m yunohost command must be "
+            "run as root or with sudo.\n"
+        )
         sys.exit(1)
 
     parser, opts, args = _parse_cli_args()
-    _init_moulinette(opts.debug, opts.quiet)
 
-    # Check that YunoHost is installed
-    if not os.path.isfile('/etc/yunohost/installed') and \
-       (len(args) < 2 or (args[0] +' '+ args[1] != 'tools postinstall' and \
-                          args[0] +' '+ args[1] != 'backup restore' and \
-                          args[0] +' '+ args[1] != 'log display')):
-
-        from moulinette import m18n
-        # Init i18n
-        m18n.load_namespace('yunohost')
-        m18n.set_locale(get_locale())
-
-        # Print error and exit
-        _die(m18n.n('yunohost_not_installed'), m18n.g('error'))
+    if opts.version:
+        args = ["tools", "versions"]
 
     # Execute the action
-    ret = moulinette.cli(
-        _retrieve_namespaces(), args,
-        use_cache=opts.use_cache, output_as=opts.output_as,
-        password=opts.password, parser_kwargs={'top_parser': parser},
+    yunohost.cli(
+        debug=opts.debug,
+        quiet=opts.quiet,
+        output_as=opts.output_as,
         timeout=opts.timeout,
+        args=args,
+        parser=parser,
     )
-    sys.exit(ret)

bin/yunohost-api

@@ -1,210 +1,52 @@
-#! /usr/bin/python
-# -*- coding: utf-8 -*-
+#! /usr/bin/python3
 
-import os
-import sys
 import argparse
-
-# Either we are in a development environment or not
-IN_DEVEL = False
+import yunohost
 
 # Default server configuration
-DEFAULT_HOST = 'localhost'
+DEFAULT_HOST = "localhost"
 DEFAULT_PORT = 6787
 
-# Level for which loggers will log
-LOGGERS_LEVEL = 'DEBUG'
-API_LOGGER_LEVEL = 'INFO'
-
-# Handlers that will be used by loggers
-#  - file: log to the file LOG_DIR/LOG_FILE
-#  - api: serve logs through the api
-#  - console: log to stderr
-LOGGERS_HANDLERS = ['file', 'api']
-
-# Directory and file to be used by logging
-LOG_DIR = '/var/log/yunohost'
-LOG_FILE = 'yunohost-api.log'
-
-# Check and load - as needed - development environment
-if not __file__.startswith('/usr/'):
-    IN_DEVEL = True
-if IN_DEVEL:
-    basedir = os.path.abspath('%s/../' % os.path.dirname(__file__))
-    if os.path.isdir(os.path.join(basedir, 'moulinette')):
-        sys.path.insert(0, basedir)
-    LOG_DIR = os.path.join(basedir, 'log')
-
-
-import moulinette
-from moulinette.actionsmap import ActionsMap
-from moulinette.interfaces.cli import colorize
-
-
-# Initialization & helpers functions -----------------------------------
-
-def _die(message, title='Error:'):
-    """Print error message and exit"""
-    print('%s %s' % (colorize(title, 'red'), message))
-    sys.exit(1)
 
 def _parse_api_args():
     """Parse main arguments for the api"""
-    parser = argparse.ArgumentParser(add_help=False,
+    parser = argparse.ArgumentParser(
+        add_help=False,
         description="Run the YunoHost API to manage your server.",
     )
-    srv_group = parser.add_argument_group('server configuration')
-    srv_group.add_argument('-h', '--host',
-        action='store', default=DEFAULT_HOST,
+    srv_group = parser.add_argument_group("server configuration")
+    srv_group.add_argument(
+        "-h",
+        "--host",
+        action="store",
+        default=DEFAULT_HOST,
         help="Host to listen on (default: %s)" % DEFAULT_HOST,
     )
-    srv_group.add_argument('-p', '--port',
-        action='store', default=DEFAULT_PORT, type=int,
+    srv_group.add_argument(
+        "-p",
+        "--port",
+        action="store",
+        default=DEFAULT_PORT,
+        type=int,
         help="Port to listen on (default: %d)" % DEFAULT_PORT,
     )
-    srv_group.add_argument('--no-websocket',
-        action='store_true', default=True, dest='use_websocket',
-        help="Serve without WebSocket support, used to handle "
-        "asynchronous responses such as the messages",
-    )
-    glob_group = parser.add_argument_group('global arguments')
-    glob_group.add_argument('--no-cache',
-        action='store_false', default=True, dest='use_cache',
-        help="Don't use actions map cache",
-    )
-    glob_group.add_argument('--debug',
-        action='store_true', default=False,
+    glob_group = parser.add_argument_group("global arguments")
+    glob_group.add_argument(
+        "--debug",
+        action="store_true",
+        default=False,
         help="Set log level to DEBUG",
     )
-    glob_group.add_argument('--verbose',
-        action='store_true', default=False,
-        help="Be verbose in the output",
-    )
-    glob_group.add_argument('--help',
-        action='help', help="Show this help message and exit",
+    glob_group.add_argument(
+        "--help",
+        action="help",
+        help="Show this help message and exit",
     )
 
     return parser.parse_args()
 
-def _init_moulinette(use_websocket=True, debug=False, verbose=False):
-    """Configure logging and initialize the moulinette"""
-    # Define loggers handlers
-    handlers = set(LOGGERS_HANDLERS)
-    if not use_websocket and 'api' in handlers:
-        handlers.remove('api')
-    if verbose and 'console' not in handlers:
-        handlers.add('console')
-    root_handlers = handlers - set(['api'])
 
-    # Define loggers level
-    level = LOGGERS_LEVEL
-    api_level = API_LOGGER_LEVEL
-    if debug:
-        level = 'DEBUG'
-        api_level = 'DEBUG'
-
-    # Custom logging configuration
-    logging = {
-        'version': 1,
-        'disable_existing_loggers': True,
-        'formatters': {
-            'console': {
-                'format': '%(relativeCreated)-5d %(levelname)-8s %(name)s %(funcName)s - %(fmessage)s'
-            },
-            'precise': {
-                'format': '%(asctime)-15s %(levelname)-8s %(name)s %(funcName)s - %(fmessage)s'
-            },
-        },
-        'filters': {
-            'action': {
-                '()': 'moulinette.utils.log.ActionFilter',
-            },
-        },
-        'handlers': {
-            'api': {
-                'level': api_level,
-                'class': 'moulinette.interfaces.api.APIQueueHandler',
-            },
-            'file': {
-                'class': 'logging.handlers.WatchedFileHandler',
-                'formatter': 'precise',
-                'filename': '%s/%s' % (LOG_DIR, LOG_FILE),
-                'filters': ['action'],
-            },
-            'console': {
-                'class': 'logging.StreamHandler',
-                'formatter': 'console',
-                'stream': 'ext://sys.stdout',
-                'filters': ['action'],
-            },
-        },
-        'loggers': {
-            'yunohost': {
-                'level': level,
-                'handlers': handlers,
-                'propagate': False,
-            },
-            'moulinette': {
-                'level': level,
-                'handlers': [],
-                'propagate': True,
-            },
-            'gnupg': {
-                'level': 'INFO',
-                'handlers': [],
-                'propagate': False,
-            },
-        },
-        'root': {
-            'level': level,
-            'handlers': root_handlers,
-        },
-    }
-
-    # Create log directory
-    if not os.path.isdir(LOG_DIR):
-        try:
-            os.makedirs(LOG_DIR, 0750)
-        except os.error as e:
-            _die(str(e))
-
-    # Initialize moulinette
-    moulinette.init(logging_config=logging, _from_source=IN_DEVEL)
-
-def _retrieve_namespaces():
-    """Return the list of namespaces to load"""
-    ret = ['yunohost']
-    for n in ActionsMap.get_namespaces():
-        # Append YunoHost modules
-        if n.startswith('ynh_'):
-            ret.append(n)
-    return ret
-
-
-# Callbacks for additional routes --------------------------------------
-
-def is_installed():
-    """
-    Check whether YunoHost is installed or not
-
-    """
-    installed = False
-    if os.path.isfile('/etc/yunohost/installed'):
-        installed = True
-    return { 'installed': installed }
-
-
-# Main action ----------------------------------------------------------
-
-if __name__ == '__main__':
+if __name__ == "__main__":
     opts = _parse_api_args()
-    _init_moulinette(opts.use_websocket, opts.debug, opts.verbose)
-
     # Run the server
-    ret = moulinette.api(
-        _retrieve_namespaces(),
-        host=opts.host, port=opts.port, routes={
-            ('GET', '/installed'): is_installed,
-        }, use_cache=opts.use_cache, use_websocket=opts.use_websocket
-    )
-    sys.exit(ret)
+    yunohost.api(debug=opts.debug, host=opts.host, port=opts.port)

bin/yunomdns

@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+
+"""
+Pythonic declaration of mDNS .local domains for YunoHost
+"""
+
+import sys
+import yaml
+from time import sleep
+from typing import List, Dict
+
+import ifaddr
+from ipaddress import ip_address
+from zeroconf import Zeroconf, ServiceInfo, ServiceBrowser
+
+
+def get_network_local_interfaces() -> Dict[str, Dict[str, List[str]]]:
+    """
+    Returns interfaces with their associated local IPs
+    """
+
+    interfaces = {
+        adapter.name: {
+            "ipv4": [
+                ip.ip
+                for ip in adapter.ips
+                if ip.is_IPv4
+                and ip_address(ip.ip).is_private
+                and not ip_address(ip.ip).is_link_local
+            ],
+            "ipv6": [
+                ip.ip[0]
+                for ip in adapter.ips
+                if ip.is_IPv6
+                and ip_address(ip.ip[0]).is_private
+                and not ip_address(ip.ip[0]).is_link_local
+            ],
+        }
+        for adapter in ifaddr.get_adapters()
+        if adapter.name != "lo"
+    }
+    return interfaces
+
+
+# Listener class, to detect duplicates on the network
+# Stores the list of servers in its list property
+class Listener:
+    def __init__(self):
+        self.list = []
+
+    def remove_service(self, zeroconf, type, name):
+        info = zeroconf.get_service_info(type, name)
+        self.list.remove(info.server)
+
+    def update_service(self, zeroconf, type, name):
+        pass
+
+    def add_service(self, zeroconf, type, name):
+        info = zeroconf.get_service_info(type, name)
+        self.list.append(info.server[:-1])
+
+
+def main() -> bool:
+    ###
+    #  CONFIG
+    ###
+
+    with open("/etc/yunohost/mdns.yml", "r") as f:
+        config = yaml.safe_load(f) or {}
+
+    required_fields = ["domains"]
+    missing_fields = [field for field in required_fields if field not in config]
+    interfaces = get_network_local_interfaces()
+
+    if missing_fields:
+        print(f"The fields {missing_fields} are required in mdns.yml")
+        return False
+
+    if "interfaces" not in config:
+        config["interfaces"] = [
+            interface
+            for interface, local_ips in interfaces.items()
+            if local_ips["ipv4"]
+        ]
+
+    if "ban_interfaces" in config:
+        config["interfaces"] = [
+            interface
+            for interface in config["interfaces"]
+            if interface not in config["ban_interfaces"]
+        ]
+
+    # Let's discover currently published .local domains accross the network
+    zc = Zeroconf()
+    listener = Listener()
+    browser = ServiceBrowser(zc, "_device-info._tcp.local.", listener)
+    sleep(2)
+    browser.cancel()
+    zc.close()
+
+    # Always attempt to publish yunohost.local
+    if "yunohost.local" not in config["domains"]:
+        config["domains"].append("yunohost.local")
+
+    def find_domain_not_already_published(domain):
+
+        # Try domain.local ... but if it's already published by another entity,
+        # try domain-2.local, domain-3.local, ...
+
+        i = 1
+        domain_i = domain
+
+        while domain_i in listener.list:
+            print(f"Uh oh, {domain_i} already exists on the network...")
+
+            i += 1
+            domain_i = domain.replace(".local", f"-{i}.local")
+
+        return domain_i
+
+    config["domains"] = [
+        find_domain_not_already_published(domain) for domain in config["domains"]
+    ]
+
+    zcs: Dict[Zeroconf, List[ServiceInfo]] = {}
+
+    for interface in config["interfaces"]:
+
+        if interface not in interfaces:
+            print(
+                f"Interface {interface} listed in config file is not present on system."
+            )
+            continue
+
+        # Only broadcast IPv4 because IPv6 is buggy ... because we ain't using python3-ifaddr >= 0.1.7
+        # Buster only ships 0.1.6
+        # Bullseye ships 0.1.7
+        # To be re-enabled once we're on bullseye...
+        # ips: List[str] = interfaces[interface]["ipv4"] + interfaces[interface]["ipv6"]
+        ips: List[str] = interfaces[interface]["ipv4"]
+
+        # If at least one IP is listed
+        if not ips:
+            continue
+
+        # Create a Zeroconf object, and store the ServiceInfos
+        zc = Zeroconf(interfaces=ips)  # type: ignore
+        zcs[zc] = []
+
+        for d in config["domains"]:
+            d_domain = d.replace(".local", "")
+            if "." in d_domain:
+                print(f"{d_domain}.local: subdomains are not supported.")
+                continue
+            # Create a ServiceInfo object for each .local domain
+            zcs[zc].append(
+                ServiceInfo(
+                    type_="_device-info._tcp.local.",
+                    name=f"{interface}: {d_domain}._device-info._tcp.local.",
+                    parsed_addresses=ips,
+                    port=80,
+                    server=f"{d}.",
+                )
+            )
+            print(f"Adding {d} with addresses {ips} on interface {interface}")
+
+    # Run registration
+    print("Registering...")
+    for zc, infos in zcs.items():
+        for info in infos:
+            zc.register_service(
+                info, allow_name_change=True, cooperating_responders=True
+            )
+
+    try:
+        print("Registered. Press Ctrl+C or stop service to stop.")
+        while True:
+            sleep(1)
+    except KeyboardInterrupt:
+        pass
+    finally:
+        print("Unregistering...")
+        for zc, infos in zcs.items():
+            zc.unregister_all_services()
+            zc.close()
+
+    return True
+
+
+if __name__ == "__main__":
+    sys.exit(0 if main() else 1)

bin/yunopaste

@@ -1,77 +1,34 @@
-#!/bin/bash
+#!/usr/bin/env python3
 
-set -e
-set -u
+import sys
+import requests
+import json
 
-PASTE_URL="https://paste.yunohost.org"
+SERVER_URL = "https://paste.yunohost.org"
+TIMEOUT = 3
 
-_die() {
-  printf "Error: %s\n" "$*"
-  exit 1
-}
+def create_snippet(data):
+    try:
+        url = SERVER_URL + "/documents"
+        response = requests.post(url, data=data.encode('utf-8'), timeout=TIMEOUT)
+        response.raise_for_status()
+        dockey = json.loads(response.text)['key']
+        return SERVER_URL + "/raw/" + dockey
+    except requests.exceptions.RequestException as e:
+        print("\033[31mError: {}\033[0m".format(e))
+        sys.exit(1)
 
-check_dependencies() {
-  curl -V > /dev/null 2>&1 || _die "This script requires curl."
-}
 
-paste_data() {
-  json=$(curl -X POST -s -d "$1" "${PASTE_URL}/documents")
-  [[ -z "$json" ]] && _die "Unable to post the data to the server."
+def main():
+    output = sys.stdin.read()
 
-  key=$(echo "$json" \
-    | python -c 'import json,sys;o=json.load(sys.stdin);print o["key"]' \
-        2>/dev/null)
-  [[ -z "$key" ]] && _die "Unable to parse the server response."
+    if not output:
+        print("\033[31mError: No input received from stdin.\033[0m")
+        sys.exit(1)
 
-  echo "${PASTE_URL}/${key}"
-}
+    url = create_snippet(output)
 
-usage() {
-  printf "Usage: ${0} [OPTION]...
+    print("\033[32mURL: {}\033[0m".format(url))
 
-Read from input stream and paste the data to the YunoHost
-Haste server.
-
-For example, to paste the output of the YunoHost diagnosis, you
-can simply execute the following:
-  yunohost tools diagnosis | ${0}
-
-It will return the URL where you can access the pasted data.
-
-Options:
-  -h, --help   show this help message and exit
-"
-}
-
-main() {
-  # parse options
-  while (( ${#} )); do
-    case "${1}" in
-      --help|-h)
-        usage
-        exit 0
-        ;;
-      *)
-        echo "Unknown parameter detected: ${1}" >&2
-        echo >&2
-        usage >&2
-        exit 1
-        ;;
-    esac
-
-    shift 1
-  done
-
-  # check input stream
-  read -t 0 || {
-    echo -e "Invalid usage: No input is provided.\n" >&2
-    usage
-    exit 1
-  }
-
-  paste_data "$(cat)"
-}
-
-check_dependencies
-
-main "${@}"
+if __name__ == "__main__":
+    main()

bin/yunoprompt

@@ -1,8 +1,12 @@
 #!/bin/bash
 
+# Fetch x509 fingerprint
+x509_fingerprint=$(openssl x509  -in /etc/yunohost/certs/yunohost.org/crt.pem -noout -fingerprint -sha256 | cut -d= -f2)
+
+
 # Fetch SSH fingerprints
 i=0
-for key in $(ls /etc/ssh/ssh_host_{ed25519,rsa,ecdsa}_key.pub 2> /dev/null) ; do 
+for key in $(ls /etc/ssh/ssh_host_{ed25519,rsa,ecdsa}_key.pub 2> /dev/null) ; do
     output=$(ssh-keygen -l -f $key)
     fingerprint[$i]=" - $(echo $output | cut -d' ' -f2) $(echo $output| cut -d' ' -f4)"
     i=$(($i + 1))
@@ -39,21 +43,21 @@ LOGO_AND_FINGERPRINTS=$(cat << EOF
 
 $LOGO
 
- IP: ${local_ip}
+ Local IP: ${local_ip:-(no ip detected?)}
+ Local SSL CA X509 fingerprint:
+   ${x509_fingerprint}
  SSH fingerprints:
  ${fingerprint[0]}
  ${fingerprint[1]}
  ${fingerprint[2]}
- ${fingerprint[3]}
- ${fingerprint[4]}
 
 EOF
 )
 
-if [[ -f /etc/yunohost/installed ]]
+echo "$LOGO_AND_FINGERPRINTS" > /etc/issue
+
+if ! groups | grep -q all_users && [[ ! -f /etc/yunohost/installed ]]
 then
-    echo "$LOGO_AND_FINGERPRINTS" > /etc/issue
-else
     chvt 2
 
     # Formatting
@@ -62,19 +66,19 @@ else
     echo "$LOGO_AND_FINGERPRINTS"
     cat << EOF
 ===============================================================================
-You should now proceed with Yunohost post-installation. This is where you will
-be asked for :
-  - the main domain of your server ;
-  - the administration password.
+You should now proceed with YunoHost post-installation. This is where you will
+be asked for:
+  - the main domain of your server;
+  - the username and password for the first admin
 
-You can perform this step :
-  - from your web browser, by accessing : ${local_ip}
+You can perform this step:
+  - from your web browser, by accessing: https://yunohost.local/ or ${local_ip}
   - or in this terminal by answering 'yes' to the following question
 
 If this is your first time with YunoHost, it is strongly recommended to take
 time to read the administator documentation and in particular the sections
 'Finalizing your setup' and 'Getting to know YunoHost'. It is available at
-the following URL : https://yunohost.org/admindoc
+the following URL: https://yunohost.org/admindoc
 ===============================================================================
 EOF
 

conf/dnsmasq/dnsmasq.conf.tpl

@@ -0,0 +1,10 @@
+domain-needed
+expand-hosts
+localise-queries
+
+{% set interfaces = wireless_interfaces.strip().split(' ') %}
+{% for interface in interfaces %}
+interface={{ interface }}
+{% endfor %}
+resolv-file=/etc/resolv.dnsmasq.conf
+cache-size=256

conf/dnsmasq/domain.tpl

@@ -0,0 +1,13 @@
+{% set interfaces_list = interfaces.split(' ') %}
+{% for interface in interfaces_list %}
+interface-name={{ domain }},{{ interface }}
+interface-name=xmpp-upload.{{ domain }},{{ interface }}
+{% endfor %}
+{% if ipv6 %}
+host-record={{ domain }},{{ ipv6 }}
+host-record=xmpp-upload.{{ domain }},{{ ipv6 }}
+{% endif %}
+txt-record={{ domain }},"v=spf1 mx a -all"
+mx-host={{ domain }},{{ domain }},5
+srv-host=_xmpp-client._tcp.{{ domain }},{{ domain }},5222,0,5
+srv-host=_xmpp-server._tcp.{{ domain }},{{ domain }},5269,0,5

conf/dnsmasq/plain/resolv.dnsmasq.conf

@@ -12,9 +12,6 @@ nameserver 80.67.169.12
 nameserver 2001:910:800::12
 nameserver 80.67.169.40
 nameserver 2001:910:800::40
-# (FR) LDN
-nameserver 80.67.188.188
-nameserver 2001:913::8
 # (FR) ARN
 nameserver 89.234.141.66
 nameserver 2a00:5881:8100:1000::3
@@ -23,11 +20,6 @@ nameserver 185.233.100.100
 nameserver 2a0c:e300::100
 nameserver 185.233.100.101
 nameserver 2a0c:e300::101
-# (FR) gozmail / grifon
-nameserver 80.67.190.200
-nameserver 2a00:5884:8218::1
-# (DE) FoeBud / Digital Courage
-nameserver 85.214.20.141
 # (DE) CCC Berlin
 nameserver 195.160.173.53
 # (DE) AS250

conf/dovecot/dovecot.conf

@@ -10,36 +10,54 @@ mail_uid = 500
 
 protocols = imap sieve {% if pop3_enabled == "True" %}pop3{% endif %}
 
-mail_plugins = $mail_plugins quota
+mail_plugins = $mail_plugins quota notify push_notification
 
 ###############################################################################
 
-# generated 2020-04-03, Mozilla Guideline v5.4, Dovecot 2.2.27, OpenSSL 1.1.0l, intermediate configuration
-# https://ssl-config.mozilla.org/#server=dovecot&version=2.2.27&config=intermediate&openssl=1.1.0l&guideline=5.4
+# generated 2020-08-18, Mozilla Guideline v5.6, Dovecot 2.3.4, OpenSSL 1.1.1d, intermediate configuration
+# https://ssl-config.mozilla.org/#server=dovecot&version=2.3.4&config=intermediate&openssl=1.1.1d&guideline=5.6
 
 ssl = required
 
 ssl_cert = </etc/yunohost/certs/{{ main_domain }}/crt.pem
 ssl_key = </etc/yunohost/certs/{{ main_domain }}/key.pem
+{% for domain in domain_list.split() %}{% if domain != main_domain %}
+local_name {{ domain }} {
+  ssl_cert = </etc/yunohost/certs/{{ domain }}/crt.pem
+  ssl_key = </etc/yunohost/certs/{{ domain }}/key.pem
+}{% endif %}{% endfor %}
 
-ssl_dh_parameters_length = 2048
+# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
+ssl_dh = </usr/share/yunohost/ffdhe2048.pem
 
 # intermediate configuration
-ssl_protocols = TLSv1.2
+ssl_min_protocol = TLSv1.2
 ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
 ssl_prefer_server_ciphers = no
 
 ###############################################################################
 
 
+# Regular Yunohost accounts
 passdb {
   args = /etc/dovecot/dovecot-ldap.conf
   driver = ldap
 }
 
+# Internally, allow authentication from apps system user who have "enable_email = true"
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/app-senders-passwd
+}
+
 userdb {
-  args = /etc/dovecot/dovecot-ldap.conf
   driver = ldap
+  args = /etc/dovecot/dovecot-ldap.conf
+}
+
+userdb {
+  driver = passwd-file
+  args = username_format=%n /etc/dovecot/app-senders-passwd
 }
 
 protocol imap {
@@ -47,13 +65,40 @@ protocol imap {
   mail_plugins = $mail_plugins imap_quota antispam
 }
 
-
 protocol lda {
   auth_socket_path = /var/run/dovecot/auth-master
   mail_plugins = quota sieve
   postmaster_address = postmaster@{{ main_domain }}
 }
 
+namespace inbox {
+  inbox = yes
+
+  mailbox Drafts {
+    special_use = \Drafts
+    auto = subscribe
+  }
+  mailbox Junk {
+    special_use = \Junk
+    auto = subscribe
+  }
+  mailbox Trash {
+    special_use = \Trash
+    auto = subscribe
+  }
+  mailbox Sent {
+    special_use = \Sent
+    auto = subscribe
+  }
+  mailbox "Sent Messages" {
+    special_use = \Sent
+  }
+  mailbox "Archive" {
+    special_use = \Archive
+    auto = subscribe
+  }
+}
+
 protocol sieve {
 }
 
@@ -77,6 +122,20 @@ service quota-warning {
   }
 }
 
+service stats {
+    unix_listener stats-reader {
+        user = vmail
+        group = mail
+        mode = 0660
+    }
+
+    unix_listener stats-writer {
+        user = vmail
+        group = mail
+        mode = 0660
+    }
+}
+
 plugin {
   sieve = /var/mail/sievescript/%n/.dovecot.sieve
   sieve_dir = /var/mail/sievescript/%n/scripts/
@@ -87,8 +146,8 @@ plugin {
   antispam_debug_target = syslog
   antispam_verbose_debug = 0
   antispam_backend = pipe
-  antispam_spam = Junk;SPAM
-  antispam_trash = Trash
+  antispam_spam_pattern_ignorecase = junk;spam
+  antispam_trash_pattern_ignorecase = trash;papierkorb;deleted messages
   antispam_pipe_program = /usr/bin/rspamc
   antispam_pipe_program_args = -h;localhost:11334;-P;q1
   antispam_pipe_program_spam_arg = learn_spam

conf/dovecot/dovecot.sieve

@@ -1,4 +1,4 @@
 require "fileinto"; 
-    if header :contains "X-Spam-Flag" "YES" { 
+    if header :contains "X-Spam-Flag" "Yes" { 
         fileinto "Junk"; 
     }

conf/fail2ban/postfix-sasl.conf

@@ -0,0 +1,6 @@
+# Fail2Ban filter for postfix authentication failures
+[INCLUDES]
+before = common.conf
+[Definition]
+_daemon = postfix/smtpd
+failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$

conf/fail2ban/yunohost-jails.conf

@@ -1,7 +1,5 @@
 [sshd]
-enabled = true
-
-[sshd-ddos]
+port = {{ssh_port}}
 enabled = true
 
 [nginx-http-auth]
@@ -10,10 +8,14 @@ enabled = true
 [postfix]
 enabled = true
 
-[dovecot]
-enabled = true
+[sasl]
+enabled  = true
+port     = smtp
+filter   = postfix-sasl
+logpath  = /var/log/mail.log
+maxretry = 5
 
-[postfix-sasl]
+[dovecot]
 enabled = true
 
 [recidive]

conf/fail2ban/yunohost.conf

@@ -15,7 +15,7 @@
 # Values:  TEXT
 #
 failregex = helpers.lua:[0-9]+: authenticate\(\): Connection failed for: .*, client: <HOST>
-            ^<HOST> -.*\"POST /yunohost/api/login HTTP/1.1\" 401
+            ^<HOST> -.*\"POST /yunohost/api/login HTTP/\d.\d\" 401
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

conf/mdns/yunomdns.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=YunoHost mDNS service
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+User=mdns
+Group=mdns
+Type=simple
+Environment=PYTHONUNBUFFERED=1
+ExecStart=/usr/bin/yunomdns
+StandardOutput=journal
+
+[Install]
+WantedBy=default.target

conf/metronome/domain.tpl.cfg.lua

@@ -0,0 +1,75 @@
+VirtualHost "{{ domain }}"
+    enable = true
+    ssl = {
+                key = "/etc/yunohost/certs/{{ domain }}/key.pem";
+                certificate = "/etc/yunohost/certs/{{ domain }}/crt.pem";
+    }
+    authentication = "ldap2"
+    ldap = {
+         hostname      = "localhost",
+         user = {
+             basedn        = "ou=users,dc=yunohost,dc=org",
+             filter        = "(&(objectClass=posixAccount)(mail=*@{{ domain }})(permission=cn=xmpp.main,ou=permission,dc=yunohost,dc=org))",
+             usernamefield = "mail",
+             namefield     = "cn",
+             },
+    }
+
+    -- Discovery items
+    disco_items = {
+        { "muc.{{ domain }}" },
+        { "pubsub.{{ domain }}" },
+        { "jabber.{{ domain }}" },
+        { "vjud.{{ domain }}" },
+        { "xmpp-upload.{{ domain }}" },
+    };
+
+--  contact_info = {
+--    abuse = { "mailto:abuse@{{ domain }}", "xmpp:admin@{{ domain }}" };
+--    admin = { "mailto:root@{{ domain }}", "xmpp:admin@{{ domain }}" };
+--  };
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+
+---Set up a MUC (multi-user chat) room server
+Component "muc.{{ domain }}" "muc"
+    name = "{{ domain }} Chatrooms"
+
+    modules_enabled = {
+        "muc_limits";
+        "muc_log";
+        "muc_log_mam";
+        "muc_log_http";
+        "muc_vcard";
+    }
+
+    muc_event_rate = 0.5
+    muc_burst_factor = 10
+    room_default_config = {
+        logging = true,
+        persistent = true
+    };
+
+---Set up a PubSub server
+Component "pubsub.{{ domain }}" "pubsub"
+    name = "{{ domain }} Publish/Subscribe"
+
+    unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server)
+
+---Set up a HTTP Upload service
+Component "xmpp-upload.{{ domain }}" "http_upload"
+    name = "{{ domain }} Sharing Service"
+
+    http_file_path = "/var/xmpp-upload/{{ domain }}/upload"
+    http_external_url = "https://xmpp-upload.{{ domain }}:443"
+    http_file_base_path = "/upload"
+    http_file_size_limit = 6*1024*1024
+    http_file_quota = 60*1024*1024
+    http_upload_file_size_limit = 100 * 1024 * 1024 -- bytes
+    http_upload_quota = 10 * 1024 * 1024 * 1024 -- bytes
+
+---Set up a VJUD service
+Component "vjud.{{ domain }}" "vjud"
+    vjud_disco_name = "{{ domain }} User Directory"

conf/metronome/metronome.cfg.lua

@@ -0,0 +1,123 @@
+-- ** Metronome's config file example **
+--
+-- The format is exactly equal to Prosody's:
+--
+-- Lists are written { "like", "this", "one" }
+-- Lists can also be of { 1, 2, 3 } numbers, etc.
+-- Either commas, or semi-colons; may be used as seperators.
+--
+-- A table is a list of values, except each value has a name. An
+-- example would be:
+--
+-- ssl = { key = "keyfile.key", certificate = "certificate.cert" }
+--
+-- Tip: You can check that the syntax of this file is correct when you have finished
+-- by running: luac -p metronome.cfg.lua
+-- If there are any errors, it will let you know what and where they are, otherwise it
+-- will keep quiet.
+
+-- Global settings go in this section
+
+-- This is the list of modules Metronome will load on startup.
+-- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
+
+modules_enabled = {
+    -- Generally required
+        "roster"; -- Allow users to have a roster. Recommended.
+        "saslauth"; -- Authentication for clients. Recommended if you want to log in.
+        "tls"; -- Add support for secure TLS on c2s/s2s connections
+        "disco"; -- Service discovery
+
+    -- Not essential, but recommended
+        "private"; -- Private XML storage (for room bookmarks, etc.)
+        "vcard"; -- Allow users to set vCards
+        "pep"; -- Allows setting of mood, tune, etc.
+        "pubsub";  -- Publish-subscribe XEP-0060
+        "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
+        "bidi"; -- Enables Bidirectional Server-to-Server Streams.
+
+    -- Nice to have
+        "version"; -- Replies to server version requests
+        "uptime"; -- Report how long server has been running
+        "time"; -- Let others know the time here on this server
+        "ping"; -- Replies to XMPP pings with pongs
+        "register"; -- Allow users to register on this server using a client and change passwords
+        "stream_management"; -- Allows clients and servers to use Stream Management
+        "stanza_optimizations"; -- Allows clients to use Client State Indication and SIFT
+        "message_carbons"; -- Allows clients to enable carbon copies of messages
+        "mam"; -- Enable server-side message archives using Message Archive Management
+        "push"; -- Enable Push Notifications via PubSub using XEP-0357
+        "lastactivity"; -- Enables clients to know the last presence status of an user
+        "adhoc_cm"; -- Allow to set client certificates to login through SASL External via adhoc
+        "admin_adhoc"; -- administration adhoc commands
+        "bookmarks"; -- XEP-0048 Bookmarks synchronization between PEP and Private Storage
+        "sec_labels"; -- Allows to use a simplified version XEP-0258 Security Labels and related ACDFs.
+        "privacy"; -- Add privacy lists and simple blocking command support
+
+        -- Other specific functionality
+        --"admin_telnet"; -- administration console, telnet to port 5582
+        --"admin_web"; -- administration web interface
+        "bosh"; -- Enable support for BOSH clients, aka "XMPP over Bidirectional Streams over Synchronous HTTP"
+        --"compression"; -- Allow clients to enable Stream Compression
+        --"spim_block"; -- Require authorization via OOB form for messages from non-contacts and block unsollicited messages
+        --"gate_guard"; -- Enable config-based blacklisting and hit-based auto-banning features
+        --"incidents_handling"; -- Enable Incidents Handling support (can be administered via adhoc commands)
+        --"server_presence"; -- Enables Server Buddies extension support
+        --"service_directory"; -- Enables Service Directories extension support
+        --"public_service"; -- Enables Server vCard support for public services in directories and advertises in features
+        --"register_api"; -- Provides secure API for both Out-Of-Band and In-Band registration for E-Mail verification
+        "websocket"; -- Enable support for WebSocket clients, aka "XMPP over WebSockets"
+};
+
+-- Server PID
+pidfile = "/var/run/metronome/metronome.pid"
+
+-- HTTP server
+http_ports = { 5290 }
+http_interfaces = { "127.0.0.1", "::1" }
+
+--https_ports = { 5291 }
+--https_interfaces = { "127.0.0.1", "::1" }
+
+-- Enable IPv6
+use_ipv6 = true
+
+-- BOSH configuration (mod_bosh)
+consider_bosh_secure = true
+cross_domain_bosh = true
+
+-- WebSocket configuration (mod_websocket)
+consider_websocket_secure = true
+cross_domain_websocket = true
+
+-- Disable account creation by default, for security
+allow_registration = false
+
+-- Use LDAP storage backend for all stores
+storage = "ldap"
+
+-- stanza optimization
+csi_config_queue_all_muc_messages_but_mentions = false;
+
+
+-- Logging configuration
+log = {
+    info = "/var/log/metronome/metronome.log"; -- Change 'info' to 'debug' for verbose logging
+    error = "/var/log/metronome/metronome.err";
+    -- "*syslog"; -- Uncomment this for logging to syslog
+    -- "*console"; -- Log to the console, useful for debugging with daemonize=false
+}
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+
+---Set up a local BOSH service
+Component "localhost" "http"
+    modules_enabled = { "bosh" }
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Metronome to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+Include "conf.d/*.cfg.lua"

conf/metronome/modules/mod_auth_ldap2.lua

@@ -0,0 +1,90 @@
+-- vim:sts=4 sw=4
+
+-- Metronome IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+-- Copyright (C) 2012 Rob Hoelz
+-- Copyright (C) 2015 YUNOHOST.ORG
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+--
+-- https://github.com/YunoHost/yunohost-config-metronome/blob/unstable/lib/modules/mod_auth_ldap2.lua
+-- adapted to use common LDAP store on Metronome
+
+local ldap     = module:require 'ldap';
+local new_sasl = require 'util.sasl'.new;
+local jsplit   = require 'util.jid'.split;
+
+local log = module._log
+
+if not ldap then
+    return;
+end
+
+function new_default_provider(host)
+    local provider = { name = "ldap2" };
+    log("debug", "initializing ldap2 authentication provider for host '%s'", host);
+
+    function provider.test_password(username, password)
+        return ldap.bind(username, password);
+    end
+
+    function provider.user_exists(username)
+        local params = ldap.getparams()
+
+        local filter = ldap.filter.combine_and(params.user.filter, params.user.usernamefield .. '=' .. username);
+        if params.user.usernamefield == 'mail' then
+            filter = ldap.filter.combine_and(params.user.filter, 'mail=' .. username .. '@*');
+        end
+
+        return ldap.singlematch {
+            base   = params.user.basedn,
+            filter = filter,
+        };
+    end
+
+    function provider.get_password(username)
+        return nil, "Passwords unavailable for LDAP.";
+    end
+
+    function provider.set_password(username, password)
+        return nil, "Passwords unavailable for LDAP.";
+    end
+
+    function provider.create_user(username, password)
+        return nil, "Account creation/modification not available with LDAP.";
+    end
+
+    function provider.get_sasl_handler(session)
+        local testpass_authentication_profile = {
+            session = session,
+            plain_test = function(sasl, username, password, realm)
+                return provider.test_password(username, password), true;
+            end,
+            order = { "plain_test" },
+        };
+        return new_sasl(module.host, testpass_authentication_profile);
+    end
+
+    function provider.is_admin(jid)
+        local admin_config = ldap.getparams().admin;
+
+        if not admin_config then
+            return;
+        end
+
+        local ld       = ldap:getconnection();
+        local username = jsplit(jid);
+        local filter   = ldap.filter.combine_and(admin_config.filter, admin_config.namefield .. '=' .. username);
+
+        return ldap.singlematch {
+            base   = admin_config.basedn,
+            filter = filter,
+        };
+    end
+
+    return provider;
+end
+
+module:add_item("auth-provider", new_default_provider(module.host));

conf/metronome/modules/mod_legacyauth.lua

@@ -0,0 +1,86 @@
+-- Prosody IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+--
+
+
+
+local st = require "util.stanza";
+local t_concat = table.concat;
+
+local secure_auth_only = module:get_option("c2s_require_encryption")
+    or module:get_option("require_encryption")
+    or not(module:get_option("allow_unencrypted_plain_auth"));
+
+local sessionmanager = require "core.sessionmanager";
+local usermanager = require "core.usermanager";
+local nodeprep = require "util.encodings".stringprep.nodeprep;
+local resourceprep = require "util.encodings".stringprep.resourceprep;
+
+module:add_feature("jabber:iq:auth");
+module:hook("stream-features", function(event)
+    local origin, features = event.origin, event.features;
+    if secure_auth_only and not origin.secure then
+        -- Sorry, not offering to insecure streams!
+        return;
+    elseif not origin.username then
+        features:tag("auth", {xmlns='http://jabber.org/features/iq-auth'}):up();
+    end
+end);
+
+module:hook("stanza/iq/jabber:iq:auth:query", function(event)
+    local session, stanza = event.origin, event.stanza;
+
+    if session.type ~= "c2s_unauthed" then
+        (session.sends2s or session.send)(st.error_reply(stanza, "cancel", "service-unavailable", "Legacy authentication is only allowed for unauthenticated client connections."));
+        return true;
+    end
+
+    if secure_auth_only and not session.secure then
+        session.send(st.error_reply(stanza, "modify", "not-acceptable", "Encryption (SSL or TLS) is required to connect to this server"));
+        return true;
+    end
+
+    local username = stanza.tags[1]:child_with_name("username");
+    local password = stanza.tags[1]:child_with_name("password");
+    local resource = stanza.tags[1]:child_with_name("resource");
+    if not (username and password and resource) then
+        local reply = st.reply(stanza);
+        session.send(reply:query("jabber:iq:auth")
+            :tag("username"):up()
+            :tag("password"):up()
+            :tag("resource"):up());
+    else
+        username, password, resource = t_concat(username), t_concat(password), t_concat(resource);
+        username = nodeprep(username);
+        resource = resourceprep(resource)
+        if not (username and resource) then
+            session.send(st.error_reply(stanza, "modify", "bad-request"));
+            return true;
+        end
+        if usermanager.test_password(username, session.host, password) then
+            -- Authentication successful!
+            local success, err = sessionmanager.make_authenticated(session, username);
+            if success then
+                local err_type, err_msg;
+                success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource);
+                if not success then
+                    session.send(st.error_reply(stanza, err_type, err, err_msg));
+                    session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager?
+                    return true;
+                elseif resource ~= session.resource then -- server changed resource, not supported by legacy auth
+                    session.send(st.error_reply(stanza, "cancel", "conflict", "The requested resource could not be assigned to this session."));
+                    session:close(); -- FIXME undo resource bind and auth instead of closing the session?
+                    return true;
+                end
+            end
+            session.send(st.reply(stanza));
+        else
+            session.send(st.error_reply(stanza, "auth", "not-authorized"));
+        end
+    end
+    return true;
+end);

conf/metronome/modules/mod_storage_ldap.lua

@@ -0,0 +1,243 @@
+-- vim:sts=4 sw=4
+
+-- Metronome IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+-- Copyright (C) 2012 Rob Hoelz
+-- Copyright (C) 2015 YUNOHOST.ORG
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+
+----------------------------------------
+-- Constants and such --
+----------------------------------------
+
+local setmetatable = setmetatable;
+
+local get_config = require "core.configmanager".get;
+local ldap       = module:require 'ldap';
+local vcardlib   = module:require 'vcard';
+local st         = require 'util.stanza';
+local gettime    = require 'socket'.gettime;
+
+local log = module._log
+
+if not ldap then
+    return;
+end
+
+local CACHE_EXPIRY = 300;
+
+----------------------------------------
+-- Utility Functions --
+----------------------------------------
+
+local function ldap_record_to_vcard(record, format)
+    return vcardlib.create {
+        record = record,
+        format = format,
+    }
+end
+
+local get_alias_for_user;
+
+do
+    local user_cache;
+    local last_fetch_time;
+
+    local function populate_user_cache()
+        local user_c = get_config(module.host, 'ldap').user;
+        if not user_c then return; end
+
+        local ld = ldap.getconnection();
+
+        local usernamefield = user_c.usernamefield;
+        local namefield     = user_c.namefield;
+
+        user_cache = {};
+
+        for _, attrs in ld:search { base = user_c.basedn, scope = 'onelevel', filter = user_c.filter } do
+            user_cache[attrs[usernamefield]] = attrs[namefield];
+        end
+        last_fetch_time = gettime();
+    end
+
+    function get_alias_for_user(user)
+        if last_fetch_time and last_fetch_time + CACHE_EXPIRY < gettime() then
+            user_cache = nil;
+        end
+        if not user_cache then
+            populate_user_cache();
+        end
+        return user_cache[user];
+    end
+end
+
+----------------------------------------
+-- Base LDAP store class --
+----------------------------------------
+
+local function ldap_store(config)
+    local self = {};
+    local config = config;
+
+    function self:get(username)
+        return nil, "Data getting is not available for this storage backend";
+    end
+
+    function self:set(username, data)
+        return nil, "Data setting is not available for this storage backend";
+    end
+
+    return self;
+end
+
+local adapters = {};
+
+----------------------------------------
+-- Roster Storage Implementation --
+----------------------------------------
+
+adapters.roster = function (config)
+    -- Validate configuration requirements
+    if not config.groups then return nil; end
+
+    local self = ldap_store(config)
+
+    function self:get(username)
+        local ld = ldap.getconnection();
+        local contacts = {};
+
+        local memberfield = config.groups.memberfield;
+        local namefield   = config.groups.namefield;
+        local filter      = memberfield .. '=' .. tostring(username);
+
+        local groups = {};
+        for _, config in ipairs(config.groups) do
+            groups[ config[namefield] ] = config.name;
+        end
+
+        log("debug", "Found %d group(s) for user %s", select('#', groups), username)
+
+        -- XXX this kind of relies on the way we do groups at INOC
+        for _, attrs in ld:search { base = config.groups.basedn, scope = 'onelevel', filter = filter } do
+            if groups[ attrs[namefield] ] then
+                local members = attrs[memberfield];
+
+                for _, user in ipairs(members) do
+                    if user ~= username then
+                        local jid    = user .. '@' .. module.host;
+                        local record = contacts[jid];
+
+                        if not record then
+                            record = {
+                                subscription = 'both',
+                                groups       = {},
+                                name         = get_alias_for_user(user),
+                            };
+                            contacts[jid] = record;
+                        end
+
+                        record.groups[ groups[ attrs[namefield] ] ] = true;
+                    end
+                end
+            end
+        end
+
+        return contacts;
+    end
+
+    function self:set(username, data)
+        log("warn", "Setting data in Roster LDAP storage is not supported yet")
+        return nil, "not supported";
+    end
+
+    return self;
+end
+
+----------------------------------------
+-- vCard Storage Implementation --
+----------------------------------------
+
+adapters.vcard = function (config)
+    -- Validate configuration requirements
+    if not config.vcard_format or not config.user then return nil; end
+
+    local self = ldap_store(config)
+
+    function self:get(username)
+        local ld     = ldap.getconnection();
+        local filter = config.user.usernamefield .. '=' .. tostring(username);
+
+        log("debug", "Retrieving vCard for user '%s'", username);
+
+        local match = ldap.singlematch {
+            base   = config.user.basedn,
+            filter = filter,
+        };
+        if match then
+            match.jid = username .. '@' .. module.host
+            return st.preserialize(ldap_record_to_vcard(match, config.vcard_format));
+        else
+            return nil, "username not found";
+        end
+    end
+
+    function self:set(username, data)
+        log("warn", "Setting data in vCard LDAP storage is not supported yet")
+        return nil, "not supported";
+    end
+
+    return self;
+end
+
+----------------------------------------
+-- Driver Definition --
+----------------------------------------
+
+cache = {};
+
+local driver = { name = "ldap" };
+
+function driver:open(store)
+    log("debug", "Opening ldap storage backend for host '%s' and store '%s'", module.host, store);
+
+    if not cache[module.host] then
+        log("debug", "Caching adapters for the host '%s'", module.host);
+
+        local ad_config = get_config(module.host, "ldap");
+        local ad_cache  = {};
+        for k, v in pairs(adapters) do
+            ad_cache[k] = v(ad_config);
+        end
+
+        cache[module.host] = ad_cache;
+    end
+
+    local adapter = cache[module.host][store];
+
+    if not adapter then
+        log("info", "Unavailable adapter for store '%s'", store);
+        return nil, "unsupported-store";
+    end
+    return adapter;
+end
+
+function driver:stores(username, type, pattern)
+    return nil, "not implemented";
+end
+
+function driver:store_exists(username, type)
+    return nil, "not implemented";
+end
+
+function driver:purge(username)
+    return nil, "not implemented";
+end
+
+function driver:nodes(type)
+    return nil, "not implemented";
+end
+
+module:add_item("data-driver", driver);

conf/metronome/modules/vcard.lib.lua

@@ -135,28 +135,28 @@ function builder_methods:build()
 end
 
 local function new_builder(params)
-  local vcard_tag = st.stanza('vCard', { xmlns = VCARD_NS });
+    local vcard_tag = st.stanza('vCard', { xmlns = VCARD_NS });
 
-  local object = {
-      vcard   = vcard_tag,
-      __index = builder_methods,
-  };
+    local object = {
+        vcard   = vcard_tag,
+        __index = builder_methods,
+    };
 
-  for k, v in pairs(params) do
-      object[k] = v;
-  end
+    for k, v in pairs(params) do
+        object[k] = v;
+    end
 
-  setmetatable(object, object);
+    setmetatable(object, object);
 
-  return object;
+    return object;
 end
 
 local _M = {};
 
 function _M.create(params)
-  local builder = new_builder(params);
+    local builder = new_builder(params);
 
-  return builder:build();
+    return builder:build();
 end
 
 return _M;

conf/nginx/plain/acme-challenge.conf.inc

@@ -1,5 +1,6 @@
 location ^~ '/.well-known/acme-challenge/'
 {
         default_type "text/plain";
-        alias /tmp/acme-challenge-public/;
+        alias /var/www/.well-known/acme-challenge-public/;
+        gzip off;
 }

conf/nginx/plain/yunohost_http_errors.conf.inc

@@ -0,0 +1,7 @@
+error_page 502 /502.html;
+
+location = /502.html {
+
+        root /usr/share/yunohost/html/;
+
+}

conf/nginx/plain/yunohost_panel.conf.inc

@@ -1,5 +1,5 @@
 # Insert YunoHost button + portal overlay
-sub_filter </head> '<script type="text/javascript" src="/ynh_portal.js"></script><link type="text/css" rel="stylesheet" href="/ynh_overlay.css"></link><script type="text/javascript" src="/ynhtheme/custom_portal.js"></script><link type="text/css" rel="stylesheet" href="/ynhtheme/custom_overlay.css"></link></head>';
+sub_filter </head> '<script type="text/javascript" src="/ynh_portal.js"></script><link type="text/css" rel="stylesheet" href="/ynh_overlay.css"><script type="text/javascript" src="/ynhtheme/custom_portal.js"></script><link type="text/css" rel="stylesheet" href="/ynhtheme/custom_overlay.css"></head>';
 sub_filter_once on;
 # Apply to other mime types than text/html
 sub_filter_types application/xhtml+xml;

conf/nginx/plain/yunohost_sso.conf.inc

@@ -0,0 +1,7 @@
+# Avoid the nginx path/alias traversal weakness ( #1037 )
+rewrite ^/yunohost/sso$ /yunohost/sso/ permanent;
+
+location /yunohost/sso/ {
+   # This is an empty location, only meant to avoid other locations
+   # from matching /yunohost/sso, such that it's correctly handled by ssowat
+}

conf/nginx/redirect_to_admin.conf

@@ -0,0 +1,3 @@
+location / {
+    return 302 https://$host/yunohost/admin;
+}

conf/nginx/security.conf.inc

@@ -0,0 +1,50 @@
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:50m;  # about 200000 sessions
+ssl_session_tickets off;
+
+{% if compatibility == "modern" %}
+# generated 2020-08-14, Mozilla Guideline v5.6, nginx 1.14.2, OpenSSL 1.1.1d, modern configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.14.2&config=modern&openssl=1.1.1d&guideline=5.6
+ssl_protocols TLSv1.3;
+ssl_prefer_server_ciphers off;
+{% else %}
+# Ciphers with intermediate compatibility
+# generated 2020-08-14, Mozilla Guideline v5.6, nginx 1.14.2, OpenSSL 1.1.1d, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.14.2&config=intermediate&openssl=1.1.1d&guideline=5.6
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_prefer_server_ciphers off;
+
+# Pre-defined FFDHE group (RFC 7919)
+# From https://ssl-config.mozilla.org/ffdhe2048.txt
+# https://security.stackexchange.com/a/149818
+ssl_dhparam /usr/share/yunohost/ffdhe2048.pem;
+{% endif %}
+
+
+# Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners
+# https://wiki.mozilla.org/Security/Guidelines/Web_Security
+# https://observatory.mozilla.org/
+{% if experimental == "True" %}
+more_set_headers "Content-Security-Policy : upgrade-insecure-requests; default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'; worker-src 'self' blob:;";
+{% else %}
+more_set_headers "Content-Security-Policy : upgrade-insecure-requests";
+{% endif %}
+more_set_headers "X-Content-Type-Options : nosniff";
+more_set_headers "X-XSS-Protection : 1; mode=block";
+more_set_headers "X-Download-Options : noopen";
+more_set_headers "X-Permitted-Cross-Domain-Policies : none";
+more_set_headers "X-Frame-Options : SAMEORIGIN";
+
+# Disable the disaster privacy thing that is FLoC
+{% if experimental == "True" %}
+more_set_headers "Permissions-Policy : fullscreen=(), geolocation=(), payment=(), accelerometer=(), battery=(), magnetometer=(), usb=(), interest-cohort=()";
+# Force HTTPOnly and Secure for all cookies
+proxy_cookie_path ~$ "; HTTPOnly; Secure;";
+{% else %}
+more_set_headers "Permissions-Policy : interest-cohort=()";
+{% endif %}
+
+# Disable gzip to protect against BREACH
+# Read https://trac.nginx.org/nginx/ticket/1720 (text/html cannot be disabled!)
+gzip off;

conf/nginx/server.tpl.conf

@@ -6,25 +6,33 @@ map $http_upgrade $connection_upgrade {
 server {
     listen 80;
     listen [::]:80;
-    server_name {{ domain }} xmpp-upload.{{ domain }};
+    server_name {{ domain }}{% if xmpp_enabled == "True" %} xmpp-upload.{{ domain }} muc.{{ domain }}{% endif %};
 
     access_by_lua_file /usr/share/ssowat/access.lua;
 
     include /etc/nginx/conf.d/acme-challenge.conf.inc;
 
-    include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
-
-    location /yunohost/admin {
-        return 301 https://$http_host$request_uri;
-    }
-
     location ^~ '/.well-known/ynh-diagnosis/' {
-        alias /tmp/.well-known/ynh-diagnosis/;
+        alias /var/www/.well-known/ynh-diagnosis/;
     }
 
+    {% if mail_enabled == "True" %}
     location ^~ '/.well-known/autoconfig/mail/' {
         alias /var/www/.well-known/{{ domain }}/autoconfig/mail/;
     }
+    {% endif %}
+
+    {# Note that this != "False" is meant to be failure-safe, in the case the redrect_to_https would happen to contain empty string or whatever value. We absolutely don't want to disable the HTTPS redirect *except* when it's explicitly being asked to be disabled. #}
+    {% if redirect_to_https != "False" %}
+    location / {
+        return 301 https://$host$request_uri;
+    }
+    {# The app config snippets are not included in the HTTP conf unless HTTPS redirect is disabled, because app's location may blocks will conflict or bypass/ignore the HTTPS redirection. #}
+    {% else %}
+    include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
+    {% endif %}
+
+    include /etc/nginx/conf.d/yunohost_http_errors.conf.inc;
 
     access_log /var/log/nginx/{{ domain }}-access.log;
     error_log /var/log/nginx/{{ domain }}-error.log;
@@ -40,33 +48,38 @@ server {
     ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
     ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem;
 
-    {% if domain_cert_ca != "Self-signed" %}
+    {% if domain_cert_ca != "selfsigned" %}
     more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
     {% endif %}
-    {% if domain_cert_ca == "Let's Encrypt" %}
+    {% if domain_cert_ca == "letsencrypt" %}
     # OCSP settings
     ssl_stapling on;
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
-    resolver 127.0.0.1 127.0.1.1 valid=300s;
+    resolver 1.1.1.1 9.9.9.9 valid=300s;
     resolver_timeout 5s;
     {% endif %}
 
+    {% if mail_enabled == "True" %}
     location ^~ '/.well-known/autoconfig/mail/' {
         alias /var/www/.well-known/{{ domain }}/autoconfig/mail/;
     }
+    {% endif %}
 
     access_by_lua_file /usr/share/ssowat/access.lua;
 
     include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
 
+    include /etc/nginx/conf.d/yunohost_sso.conf.inc;
     include /etc/nginx/conf.d/yunohost_admin.conf.inc;
     include /etc/nginx/conf.d/yunohost_api.conf.inc;
+    include /etc/nginx/conf.d/yunohost_http_errors.conf.inc;
 
     access_log /var/log/nginx/{{ domain }}-access.log;
     error_log /var/log/nginx/{{ domain }}-error.log;
 }
 
+{% if xmpp_enabled == "True" %}
 # vhost dedicated to XMPP http_upload
 server {
     listen 443 ssl http2;
@@ -94,18 +107,19 @@ server {
     ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
     ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem;
 
-    {% if domain_cert_ca != "Self-signed" %}
+    {% if domain_cert_ca != "selfsigned" %}
     more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
     {% endif %}
-    {% if domain_cert_ca == "Let's Encrypt" %}
+    {% if domain_cert_ca == "letsencrypt" %}
     # OCSP settings
     ssl_stapling on;
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
-    resolver 127.0.0.1 127.0.1.1 valid=300s;
+    resolver 1.1.1.1 9.9.9.9 valid=300s;
     resolver_timeout 5s;
     {% endif %}
 
     access_log /var/log/nginx/xmpp-upload.{{ domain }}-access.log;
     error_log /var/log/nginx/xmpp-upload.{{ domain }}-error.log;
 }
+{% endif %}

conf/nginx/yunohost_admin.conf

@@ -2,13 +2,7 @@ server {
     listen 80 default_server;
     listen [::]:80 default_server;
 
-    location / {
-        return 302 https://$http_host/yunohost/admin;
-    }
-
-    location /yunohost/admin {
-        return 301 https://$http_host$request_uri;
-    }
+    include /etc/nginx/conf.d/default.d/*.conf;
 }
 
 server {
@@ -23,21 +17,12 @@ server {
     more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
     more_set_headers "Referrer-Policy : 'same-origin'";
 
-    location / {
-        return 302 https://$http_host/yunohost/admin;
-    }
-
     location /yunohost {
-        # Block crawlers bot
-        if ($http_user_agent ~ (crawl|Googlebot|Slurp|spider|bingbot|tracker|click|parser|spider|facebookexternalhit) ) {
-            return 403;
-        }
-        # X-Robots-Tag to precise the rules applied.
-        add_header  X-Robots-Tag "nofollow, noindex, noarchive, nosnippet";
         # Redirect most of 404 to maindomain.tld/yunohost/sso
         access_by_lua_file /usr/share/ssowat/access.lua;
     }
 
     include /etc/nginx/conf.d/yunohost_admin.conf.inc;
     include /etc/nginx/conf.d/yunohost_api.conf.inc;
+    include /etc/nginx/conf.d/default.d/*.conf;
 }

conf/nginx/yunohost_admin.conf.inc

@@ -0,0 +1,30 @@
+# Avoid the nginx path/alias traversal weakness ( #1037 )
+rewrite ^/yunohost/admin$ /yunohost/admin/ permanent;
+
+location /yunohost/admin/ {
+    alias /usr/share/yunohost/admin/;
+    default_type text/html;
+    index index.html;
+
+    {% if webadmin_allowlist_enabled == "True" %}
+    {% if webadmin_allowlist.strip() -%}
+    {% for ip in webadmin_allowlist.strip().split(',') -%}
+    allow {{ ip.strip() }};
+    {% endfor -%}
+    {% endif -%}
+    deny all;
+    {% endif %}
+
+    location = /yunohost/admin/index.html {
+        etag off;
+        expires off;
+        more_set_headers "Cache-Control: no-store, no-cache, must-revalidate";
+    }
+
+    location /yunohost/admin/applogos/ {
+        alias /usr/share/yunohost/applogos/;
+    }
+
+    more_set_headers "Content-Security-Policy: upgrade-insecure-requests; default-src 'self'; connect-src 'self' https://paste.yunohost.org wss://$host; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; object-src 'none'; img-src 'self' data:;";
+    more_set_headers "Content-Security-Policy-Report-Only:";
+}

conf/nginx/yunohost_api.conf.inc

@@ -4,7 +4,14 @@ location /yunohost/api/ {
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";
-    proxy_set_header Host $http_host;
+    proxy_set_header Host $host;
+
+    {% if webadmin_allowlist_enabled == "True" %}
+    {% for ip in webadmin_allowlist.split(',') %}
+    allow {{ ip }};
+    {% endfor %}
+    deny all;
+    {% endif %}
 
     # Custom 502 error page
     error_page 502 /yunohost/api/error/502;

conf/nslcd/nslcd.conf

@@ -15,6 +15,18 @@ base dc=yunohost,dc=org
 # The LDAP protocol version to use.
 #ldap_version 3
 
+# The DN to bind with for normal lookups.
+#binddn cn=annonymous,dc=example,dc=net
+#bindpw secret
+
+# The DN used for password modifications by root.
+#rootpwmoddn cn=admin,dc=example,dc=com
+
+# SSL options
+#ssl off
+#tls_reqcert never
+tls_cacertfile /etc/ssl/certs/ca-certificates.crt
+
 # The search scope.
 #scope sub
 

conf/nsswitch/nsswitch.conf

@@ -0,0 +1,17 @@
+# /etc/nsswitch.conf
+
+passwd:         files systemd ldap
+group:          files systemd ldap
+shadow:         files ldap
+gshadow:        files
+
+hosts:          files myhostname mdns4_minimal [NOTFOUND=return] dns
+networks:       files
+
+protocols:      db files
+services:       db files
+ethers:         db files
+rpc:            db files
+
+netgroup:       nis
+sudoers:	files ldap

conf/postfix/main.cf

@@ -19,41 +19,50 @@ readme_directory = no
 
 # -- TLS for incoming connections
 ###############################################################################
-# generated 2020-04-03, Mozilla Guideline v5.4, Postfix 3.1.14, OpenSSL 1.1.0l, intermediate configuration
-# https://ssl-config.mozilla.org/#server=postfix&version=3.1.14&config=intermediate&openssl=1.1.0l&guideline=5.4
-
-# (No modern conf support until we're on buster...)
-# {% if compatibility == "intermediate" %} {% else %} {% endif %}
-
 smtpd_use_tls = yes
 
 smtpd_tls_security_level = may
 smtpd_tls_auth_only = yes
-smtpd_tls_cert_file = /etc/yunohost/certs/{{ main_domain }}/crt.pem
-smtpd_tls_key_file = /etc/yunohost/certs/{{ main_domain }}/key.pem
+smtpd_tls_chain_files =
+    /etc/yunohost/certs/{{ main_domain }}/key.pem,
+    /etc/yunohost/certs/{{ main_domain }}/crt.pem
+
+tls_server_sni_maps = hash:/etc/postfix/sni
+
+{% if compatibility == "intermediate" %}
+# generated 2020-08-18, Mozilla Guideline v5.6, Postfix 3.4.14, OpenSSL 1.1.1d, intermediate configuration
+# https://ssl-config.mozilla.org/#server=postfix&version=3.4.14&config=intermediate&openssl=1.1.1d&guideline=5.6
+
 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
 smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-# smtpd_tls_mandatory_ciphers = medium # (c.f. below)
+smtpd_tls_mandatory_ciphers = medium
 
 # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
 # not actually 1024 bits, this applies to all DHE >= 1024 bits
-# smtpd_tls_dh1024_param_file = /path/to/dhparam.pem
+smtpd_tls_dh1024_param_file = /usr/share/yunohost/ffdhe2048.pem
+
+tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+{% else %}
+# generated 2020-08-18, Mozilla Guideline v5.6, Postfix 3.4.14, OpenSSL 1.1.1d, modern configuration
+# https://ssl-config.mozilla.org/#server=postfix&version=3.4.14&config=modern&openssl=1.1.1d&guideline=5.6
+
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1, !TLSv1.2
+smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1, !TLSv1.2
+{% endif %}
 
-# This custom medium cipherlist recommendation only works if we have a DH ... which we don't, c.f. https://github.com/YunoHost/issues/issues/93
-# On the other hand, the postfix doc strongly discourage tweaking this list ... So whatever, let's keep the mandatory_ciphers to high like we did before applying the Mozilla recommendation ...
-#tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
 tls_preempt_cipherlist = no
-
-# Custom Yunohost stuff ... because we can't use the recommendation about medium cipher list ...
-smtpd_tls_mandatory_ciphers=high
-smtpd_tls_eecdh_grade = ultra
 ###############################################################################
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtpd_tls_loglevel=1
 
 # -- TLS for outgoing connections
 # Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
-smtp_tls_security_level=may
+{% if relay_port == "465" %}
+smtp_tls_wrappermode = yes
+smtp_tls_security_level = encrypt
+{% else %}
+smtp_tls_security_level = may
+{% endif %}
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
 smtp_tls_exclude_ciphers = aNULL, MD5, DES, ADH, RC4, 3DES
 smtp_tls_mandatory_ciphers= high
@@ -72,26 +81,37 @@ alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
 mydomain = {{ main_domain }}
 mydestination = localhost
+{% if relay_enabled != "True" %}
 relayhost =
+{% else %}
+relayhost = [{{ relay_host }}]:{{ relay_port }}
+{% endif %}
 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
 mailbox_command = procmail -a "$EXTENSION"
 mailbox_size_limit = 0
 recipient_delimiter = +
 inet_interfaces = all
 
-#### Fit to the maximum message size to 30mb, more than allowed by GMail or Yahoo ####
-message_size_limit = 31457280
+#### Fit to the maximum message size to 25mb, more than allowed by GMail or Yahoo ####
+# /!\ This size is the size of the attachment in base64.
+# BASE64_SIZE_IN_BYTE = ORIGINAL_SIZE_IN_MEGABYTE * 1,37 *1024*1024 + 980
+# See https://serverfault.com/questions/346895/postfix-mail-size-counting
+message_size_limit = 35914708
 
 # Virtual Domains Control
 virtual_mailbox_domains = ldap:/etc/postfix/ldap-domains.cf
-virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf
+virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf,hash:/etc/postfix/app_senders_login_maps
 virtual_mailbox_base =
-virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf
+virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf,ldap:/etc/postfix/ldap-groups.cf
 virtual_alias_domains =
 virtual_minimum_uid = 100
 virtual_uid_maps = static:vmail
 virtual_gid_maps = static:mail
-smtpd_sender_login_maps= ldap:/etc/postfix/ldap-accounts.cf
+smtpd_sender_login_maps = unionmap:{
+   # Regular Yunohost accounts
+   ldap:/etc/postfix/ldap-accounts.cf,
+   # Extra maps for app system users who need to send emails
+   hash:/etc/postfix/app_senders_login_maps }
 
 # Dovecot LDA
 virtual_transport = dovecot
@@ -170,11 +190,32 @@ smtpd_milters = inet:localhost:11332
 milter_default_action = accept
 
 # Avoid to send simultaneously too many emails
-smtp_destination_concurrency_limit = 1
+smtp_destination_concurrency_limit = 2
 default_destination_rate_delay = 5s
 
+# Avoid to be blacklisted due to too many recipient
+smtpd_client_recipient_rate_limit=150
+
 # Avoid email adress scanning
 # By default it's possible to detect if the email adress exist
 # So it's easly possible to scan a server to know which email adress is valid
 # and after to send spam
 disable_vrfy_command = yes
+
+{% if relay_enabled == "True" %}
+# Relay email through an other smtp account
+# enable SASL authentication
+smtp_sasl_auth_enable = yes
+# disallow methods that allow anonymous authentication.
+smtp_sasl_security_options = noanonymous
+# where to find sasl_passwd
+smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
+{% endif %}
+
+{% if backup_mx_domains != "" %}
+# Backup MX (secondary MX)
+relay_domains = $mydestination {{backup_mx_domains}}
+relay_recipient_maps = hash:/etc/postfix/relay_recipients
+maximal_queue_lifetime = 20d
+{% endif %}
+

conf/postfix/plain/ldap-groups.cf

@@ -0,0 +1,7 @@
+server_host = localhost
+server_port = 389
+search_base = dc=yunohost,dc=org
+query_filter = (&(objectClass=groupOfNamesYnh)(mail=%s))
+scope = sub
+result_attribute = memberUid, mail
+terminal_result_attribute = memberUid

conf/postfix/sni

@@ -0,0 +1,4 @@
+# This maps domain to certificates to properly handle multi-domain context
+# (also we need a comment in this file such that it's never empty to prevent regenconf issues)
+{% for domain in domain_list.split() %}{{ domain }} /etc/yunohost/certs/{{ domain }}/key.pem /etc/yunohost/certs/{{ domain }}/crt.pem
+{% endfor %}

conf/rspamd/redis.conf

@@ -0,0 +1,2 @@
+# set redis server
+servers = "127.0.0.1";

conf/rspamd/rspamd.sieve

@@ -1,4 +1,4 @@
 require ["fileinto"];
-if header :is "X-Spam" "yes" {
+if header :is "X-Spam" "Yes" {
     fileinto "Junk";
 }

conf/slapd/config.ldif

@@ -0,0 +1,233 @@
+# OpenLDAP server configuration for YunoHost
+# ------------------------------------------
+#
+# Because of the YunoHost's regen-conf mechanism, it is NOT POSSIBLE to
+# edit the config database using an LDAP request.
+#
+# If you wish to edit the config database, you should edit THIS file
+# and update the config database based on this file.
+#
+# Config database customization:
+# 1. Edit this file as you want.
+# 2. Apply your modifications. For this just run this following command in a shell:
+#    $ /usr/share/yunohost/hooks/conf_regen/06-slapd post true
+#
+# Note that if you customize this file, YunoHost's regen-conf will NOT
+# overwrite this file. But that also means that you should be careful about
+# upgrades, because they may ship important/necessary changes to this
+# configuration that you will have to propagate yourself.
+
+#
+# Main configuration
+#
+dn: cn=config
+objectClass: olcGlobal
+cn: config
+olcConfigFile: /etc/ldap/slapd.conf
+olcConfigDir: /etc/ldap/slapd.d/
+# List of arguments that were passed to the server
+olcArgsFile: /var/run/slapd/slapd.args
+#
+olcAttributeOptions: lang-
+olcAuthzPolicy: none
+olcConcurrency: 0
+olcConnMaxPending: 100
+olcConnMaxPendingAuth: 1000
+olcSizeLimit: 50000
+olcIdleTimeout: 0
+olcIndexSubstrIfMaxLen: 4
+olcIndexSubstrIfMinLen: 2
+olcIndexSubstrAnyLen: 4
+olcIndexSubstrAnyStep: 2
+olcIndexIntLen: 4
+olcListenerThreads: 1
+olcLocalSSF: 71
+# Read slapd.conf(5) for possible values
+olcLogLevel: None
+# Where the pid file is put. The init.d script
+# will not stop the server if you change this.
+olcPidFile: /var/run/slapd/slapd.pid
+olcReverseLookup: FALSE
+olcThreads: 16
+# TLS Support
+olcTLSCertificateFile: /etc/yunohost/certs/yunohost.org/crt.pem
+olcTLSCertificateKeyFile: /etc/yunohost/certs/yunohost.org/key.pem
+olcTLSVerifyClient: never
+olcTLSProtocolMin: 0.0
+# The tool-threads parameter sets the actual amount of cpu's that is used
+# for indexing.
+olcToolThreads: 1
+structuralObjectClass: olcGlobal
+
+#
+# Schema and objectClass definitions
+#
+dn: cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: schema
+
+include: file:///etc/ldap/schema/core.ldif
+include: file:///etc/ldap/schema/cosine.ldif
+include: file:///etc/ldap/schema/nis.ldif
+include: file:///etc/ldap/schema/inetorgperson.ldif
+include: file:///etc/ldap/schema/mailserver.ldif
+include: file:///etc/ldap/schema/sudo.ldif
+include: file:///etc/ldap/schema/permission.ldif
+
+#
+# Module management
+#
+dn: cn=module{0},cn=config
+objectClass: olcModuleList
+cn: module{0}
+# Where the dynamically loaded modules are stored
+olcModulePath: /usr/lib/ldap
+olcModuleLoad: {0}back_mdb
+olcModuleLoad: {1}memberof
+structuralObjectClass: olcModuleList
+
+#
+# Frontend database
+#
+dn: olcDatabase={-1}frontend,cn=config
+objectClass: olcDatabaseConfig
+objectClass: olcFrontendConfig
+olcDatabase: {-1}frontend
+olcAddContentAcl: FALSE
+olcLastMod: TRUE
+olcSchemaDN: cn=Subschema
+# Hashes to be used in generation of user passwords
+olcPasswordHash: {SSHA}
+structuralObjectClass: olcDatabaseConfig
+
+#
+# Config database Configuration (#0)
+#
+dn: olcDatabase={0}config,cn=config
+objectClass: olcDatabaseConfig
+olcDatabase: {0}config
+# Give access to root user.
+# This give the possiblity to the admin to customize the LDAP configuration
+olcAccess: {0}to *  by * none
+olcAddContentAcl: TRUE
+olcLastMod: TRUE
+olcRootDN: cn=config
+structuralObjectClass: olcDatabaseConfig
+
+#
+# Main database Configuration (#1)
+#
+dn: olcDatabase={1}mdb,cn=config
+objectClass: olcDatabaseConfig
+objectClass: olcMdbConfig
+olcDatabase: {1}mdb
+# The base of your directory in database #1
+olcSuffix: dc=yunohost,dc=org
+#
+# The userPassword by default can be changed
+# by the entry owning it if they are authenticated.
+# Others should not be able to see it, except the
+# admin entry below
+# These access lines apply to database #1 only
+olcAccess: {0}to attrs=userPassword,shadowLastChange
+    by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
+    by anonymous auth
+    by self write
+    by * none
+#
+# Personnal information can be changed by the entry
+# owning it if they are authenticated.
+# Others should be able to see it.
+olcAccess: {1}to attrs=cn,gecos,givenName,mail,maildrop,displayName,sn
+    by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
+    by self write
+    by * read
+#
+# Ensure read access to the base for things like
+# supportedSASLMechanisms.  Without this you may
+# have problems with SASL not knowing what
+# mechanisms are available and the like.
+# Note that this is covered by the 'access to *'
+# ACL below too but if you change that as people
+# are wont to do you'll still need this if you
+# want SASL (and possible other things) to work
+# happily.
+olcAccess: {2}to dn.base=""
+    by * read
+#
+# The admin dn has full write access, everyone else
+# can read everything.
+olcAccess: {3}to *
+    by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
+    by group/groupOfNamesYnh/member.exact="cn=admins,ou=groups,dc=yunohost,dc=org" write
+    by * read
+#
+olcAddContentAcl: FALSE
+# Save the time that the entry gets modified, for database #1
+olcLastMod: TRUE
+# Where the database file are physically stored for database #1
+olcDbDirectory: /var/lib/ldap
+# Checkpoint the BerkeleyDB database periodically in case of system
+# failure and to speed slapd shutdown.
+olcDbCheckpoint: 512 30
+olcDbNoSync: FALSE
+# Indexing options for database #1
+olcDbIndex: objectClass eq
+olcDbIndex: entryUUID eq
+olcDbIndex: entryCSN eq
+olcDbIndex: cn eq
+olcDbIndex: uid eq,sub
+olcDbIndex: uidNumber eq
+olcDbIndex: gidNumber eq
+olcDbIndex: sudoUser eq,sub
+olcDbIndex: member eq
+olcDbIndex: mail eq
+olcDbIndex: memberUid eq
+olcDbIndex: uniqueMember eq
+olcDbIndex: virtualdomain eq
+olcDbIndex: permission eq
+olcDbMaxSize: 104857600
+structuralObjectClass: olcMdbConfig
+
+#
+# Configure Memberof Overlay (used for YunoHost permission)
+#
+
+# Link user <-> group
+dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcMemberOf
+olcOverlay: {0}memberof
+olcMemberOfDangling: error
+olcMemberOfDanglingError: constraintViolation
+olcMemberOfRefInt: TRUE
+olcMemberOfGroupOC: groupOfNamesYnh
+olcMemberOfMemberAD: member
+olcMemberOfMemberOfAD: memberOf
+structuralObjectClass: olcMemberOf
+
+# Link permission <-> groupes
+dn: olcOverlay={1}memberof,olcDatabase={1}mdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcMemberOf
+olcOverlay: {1}memberof
+olcMemberOfDangling: error
+olcMemberOfDanglingError: constraintViolation
+olcMemberOfRefInt: TRUE
+olcMemberOfGroupOC: permissionYnh
+olcMemberOfMemberAD: groupPermission
+olcMemberOfMemberOfAD: permission
+structuralObjectClass: olcMemberOf
+
+# Link permission <-> user
+dn: olcOverlay={2}memberof,olcDatabase={1}mdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcMemberOf
+olcOverlay: {2}memberof
+olcMemberOfDangling: error
+olcMemberOfDanglingError: constraintViolation
+olcMemberOfRefInt: TRUE
+olcMemberOfGroupOC: permissionYnh
+olcMemberOfMemberAD: inheritPermission
+olcMemberOfMemberOfAD: permission
+structuralObjectClass: olcMemberOf

conf/slapd/db_init.ldif

@@ -0,0 +1,107 @@
+dn: dc=yunohost,dc=org
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+o: yunohost.org
+dc: yunohost
+
+dn: ou=users,dc=yunohost,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: users
+
+dn: ou=domains,dc=yunohost,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: domains
+
+dn: ou=apps,dc=yunohost,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: apps
+
+dn: ou=permission,dc=yunohost,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: permission
+
+dn: ou=groups,dc=yunohost,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: groups
+
+dn: cn=admins,ou=sudo,dc=yunohost,dc=org
+cn: admins
+objectClass: sudoRole
+objectClass: top
+sudoCommand: ALL
+sudoUser: %admins
+sudoHost: ALL
+
+dn: ou=sudo,dc=yunohost,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: sudo
+
+dn: cn=admins,ou=groups,dc=yunohost,dc=org
+objectClass: posixGroup
+objectClass: top
+objectClass: groupOfNamesYnh
+gidNumber: 4001
+cn: admins
+
+dn: cn=all_users,ou=groups,dc=yunohost,dc=org
+objectClass: posixGroup
+objectClass: groupOfNamesYnh
+gidNumber: 4002
+cn: all_users
+permission: cn=mail.main,ou=permission,dc=yunohost,dc=org
+permission: cn=xmpp.main,ou=permission,dc=yunohost,dc=org
+
+dn: cn=visitors,ou=groups,dc=yunohost,dc=org
+objectClass: posixGroup
+objectClass: groupOfNamesYnh
+gidNumber: 4003
+cn: visitors
+
+dn: cn=mail.main,ou=permission,dc=yunohost,dc=org
+groupPermission: cn=all_users,ou=groups,dc=yunohost,dc=org
+cn: mail.main
+objectClass: posixGroup
+objectClass: permissionYnh
+isProtected: TRUE
+label: E-mail
+gidNumber: 5001
+showTile: FALSE
+authHeader: FALSE
+
+dn: cn=xmpp.main,ou=permission,dc=yunohost,dc=org
+groupPermission: cn=all_users,ou=groups,dc=yunohost,dc=org
+cn: xmpp.main
+objectClass: posixGroup
+objectClass: permissionYnh
+isProtected: TRUE
+label: XMPP
+gidNumber: 5002
+showTile: FALSE
+authHeader: FALSE
+
+dn: cn=ssh.main,ou=permission,dc=yunohost,dc=org
+cn: ssh.main
+objectClass: posixGroup
+objectClass: permissionYnh
+isProtected: TRUE
+label: SSH
+gidNumber: 5003
+showTile: FALSE
+authHeader: FALSE
+
+dn: cn=sftp.main,ou=permission,dc=yunohost,dc=org
+cn: sftp.main
+objectClass: posixGroup
+objectClass: permissionYnh
+isProtected: TRUE
+label: SFTP
+gidNumber: 5004
+showTile: FALSE
+authHeader: FALSE

conf/slapd/ldap.conf

@@ -8,7 +8,7 @@
 BASE   dc=yunohost,dc=org
 URI    ldap://localhost:389
 
-#SIZELIMIT	12
+SIZELIMIT	10000
 #TIMELIMIT	15
 #DEREF		never
 

conf/slapd/mailserver.ldif

@@ -2,58 +2,62 @@
 ## Version 0.1
 ## Adrien Beudin
 
+dn: cn=mailserver,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: mailserver
+#
 # Attributes
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.1
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.1
         NAME 'maildrop'
         DESC 'Mail addresses where mails are forwarded -- ie forwards'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{512})
-
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.2
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.2
         NAME 'mailalias'
         DESC 'Mail addresses accepted by this account -- ie aliases'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{512})
-
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.3
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.3
         NAME 'mailenable'
         DESC 'Mail Account validity'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8})
-
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.4
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.4
         NAME 'mailbox'
         DESC 'Mailbox path where mails are delivered'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{512})
-
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.5
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.5
         NAME 'virtualdomain'
         DESC 'A mail domain name'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{512})
-
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.6
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.6
         NAME 'virtualdomaindescription'
         DESC 'Virtual domain description'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{512})
-
-attributetype ( 1.3.6.1.4.1.40328.1.20.2.7
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.40328.1.20.2.7
         NAME 'mailuserquota'
         DESC 'Mailbox quota for a user'
         EQUALITY caseIgnoreMatch
         SUBSTR caseIgnoreSubstringsMatch
         SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{16} SINGLE-VALUE )
-
+#
 # Mail Account Objectclass
-objectclass ( 1.3.6.1.4.1.40328.1.1.2.1
+olcObjectClasses: ( 1.3.6.1.4.1.40328.1.1.2.1
         NAME 'mailAccount'
         DESC 'Mail Account'
         SUP top
@@ -65,9 +69,9 @@ objectclass ( 1.3.6.1.4.1.40328.1.1.2.1
             mailalias $ maildrop $ mailenable $ mailbox $ mailuserquota 
             )
         )
-
+#
 # Mail Domain Objectclass
-objectclass ( 1.3.6.1.4.1.40328.1.1.2.2
+olcObjectClasses: ( 1.3.6.1.4.1.40328.1.1.2.2
         NAME 'mailDomain'
         DESC 'Domain mail entry'
         SUP top
@@ -79,10 +83,13 @@ objectclass ( 1.3.6.1.4.1.40328.1.1.2.2
             virtualdomaindescription $ mailuserquota
             )
         )
-
+#
 # Mail Group Objectclass
-objectclass ( 1.3.6.1.4.1.40328.1.1.2.3
+olcObjectClasses: ( 1.3.6.1.4.1.40328.1.1.2.3
         NAME 'mailGroup' SUP top AUXILIARY
         DESC 'Mail Group'
         MUST ( mail )
+        MAY (
+            mailalias $ maildrop 
+            )
         )

conf/slapd/permission.ldif

@@ -0,0 +1,50 @@
+# YunoHost schema for group and permission support
+
+dn: cn=yunohost,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: yunohost
+# ATTRIBUTES
+# For Permission
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.1 NAME 'permission'
+  DESC 'YunoHost permission on user and group side'
+  SUP distinguishedName )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.2 NAME 'groupPermission'
+  DESC 'YunoHost permission for a group on permission side'
+  SUP distinguishedName )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.3 NAME 'inheritPermission'
+  DESC 'YunoHost permission for user on permission side'
+  SUP distinguishedName )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.4 NAME 'URL'
+  DESC 'YunoHost permission main URL'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.5 NAME 'additionalUrls'
+  DESC 'YunoHost permission additionnal URL'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.6 NAME 'authHeader'
+  DESC 'YunoHost application, enable authentication header'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.7 NAME 'label'
+  DESC 'YunoHost permission label, also used for the tile name in the SSO'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.8 NAME 'showTile'
+  DESC 'YunoHost application, show/hide the tile in the SSO for this permission'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.9 NAME 'isProtected'
+  DESC 'YunoHost application permission protection'
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
+# OBJECTCLASS
+# For Applications
+olcObjectClasses: ( 1.3.6.1.4.1.17953.9.2.1 NAME 'groupOfNamesYnh'
+  DESC 'YunoHost user group'
+  SUP top AUXILIARY
+  MAY ( member $ businessCategory $ seeAlso $ owner $ ou $ o $ permission ) )
+olcObjectClasses: ( 1.3.6.1.4.1.17953.9.2.2 NAME 'permissionYnh'
+  DESC 'a YunoHost application'
+  SUP top AUXILIARY
+  MUST ( cn $ authHeader $ label $ showTile $ isProtected )
+  MAY ( groupPermission $ inheritPermission $ URL $ additionalUrls ) )
+# For User
+olcObjectClasses: ( 1.3.6.1.4.1.17953.9.2.3 NAME 'userPermissionYnh'
+  DESC 'a YunoHost application'
+  SUP top AUXILIARY
+  MAY ( permission ) )

conf/slapd/slapd.default

@@ -21,7 +21,7 @@ SLAPD_PIDFILE=
 # sockets.
 # Example usage:
 # SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
-SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
+SLAPD_SERVICES="ldap://localhost:389/ ldaps:/// ldapi:///"
 
 # If SLAPD_NO_START is set, the init script will not start or restart
 # slapd (but stop will still work).  Uncomment this if you are

conf/slapd/sudo.ldif

@@ -1,76 +1,78 @@
 #
 # OpenLDAP schema file for Sudo
-# Save as /etc/openldap/schema/sudo.schema
+# Save as /etc/openldap/schema/sudo.ldif
 #
 
-attributetype ( 1.3.6.1.4.1.15953.9.1.1
+dn: cn=sudo,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: sudo
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.1
     NAME 'sudoUser'
     DESC 'User(s) who may  run sudo'
     EQUALITY caseExactIA5Match
     SUBSTR caseExactIA5SubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.2
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.2
     NAME 'sudoHost'
     DESC 'Host(s) who may run sudo'
     EQUALITY caseExactIA5Match
     SUBSTR caseExactIA5SubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.3
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.3
     NAME 'sudoCommand'
     DESC 'Command(s) to be executed by sudo'
     EQUALITY caseExactIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.4
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.4
     NAME 'sudoRunAs'
     DESC 'User(s) impersonated by sudo (deprecated)'
     EQUALITY caseExactIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.5
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.5
     NAME 'sudoOption'
     DESC 'Options(s) followed by sudo'
     EQUALITY caseExactIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.6
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.6
     NAME 'sudoRunAsUser'
     DESC 'User(s) impersonated by sudo'
     EQUALITY caseExactIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.7
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.7
     NAME 'sudoRunAsGroup'
     DESC 'Group(s) impersonated by sudo'
     EQUALITY caseExactIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.8
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.8
     NAME 'sudoNotBefore'
     DESC 'Start of time interval for which the entry is valid'
     EQUALITY generalizedTimeMatch
     ORDERING generalizedTimeOrderingMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
-
-attributetype ( 1.3.6.1.4.1.15953.9.1.9
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.9
     NAME 'sudoNotAfter'
     DESC 'End of time interval for which the entry is valid'
     EQUALITY generalizedTimeMatch
     ORDERING generalizedTimeOrderingMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
-
-attributeTypes ( 1.3.6.1.4.1.15953.9.1.10
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.10
     NAME 'sudoOrder'
     DESC 'an integer to order the sudoRole entries'
     EQUALITY integerMatch
     ORDERING integerOrderingMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
-
-objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
+#
+olcObjectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
     DESC 'Sudoer Entries'
     MUST ( cn )
-    MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotBefore $ sudoNotAfter $
-	    description )
+    MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotBefore $ sudoNotAfter $ description )
     )

conf/ssh/sshd_config

@@ -2,7 +2,9 @@
 # by YunoHost
 
 Protocol 2
-Port 22
+# PLEASE: if you wish to change the ssh port properly in YunoHost, use this command:
+# yunohost settings set security.ssh.ssh_port -v <port>
+Port {{ port }}
 
 {% if ipv6_enabled == "true" %}ListenAddress ::{% endif %}
 ListenAddress 0.0.0.0
@@ -27,9 +29,6 @@ HostKey {{ key }}{% endfor %}
   MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
 {% endif %}
 
-# Use kernel sandbox mechanisms where possible in unprivileged processes
-UsePrivilegeSeparation sandbox
-
 # LogLevel VERBOSE logs user's key fingerprint on login.
 # Needed to have a clear audit track of which key was using to log in.
 SyslogFacility AUTH
@@ -56,25 +55,55 @@ PermitEmptyPasswords no
 ChallengeResponseAuthentication no
 UsePAM yes
 
-# Change to no to disable tunnelled clear text passwords
-# (i.e. everybody will need to authenticate using ssh keys)
+# PLEASE: if you wish to force everybody to authenticate using ssh keys, run this command:
+# yunohost settings set security.ssh.ssh_password_authentication -v no
+{% if password_authentication == "False" %}
+PasswordAuthentication no
+{% else %}
 #PasswordAuthentication yes
+{% endif %}
 
 # Post-login stuff
-Banner /etc/issue.net
+# Banner none
 PrintMotd no
 PrintLastLog yes
 ClientAliveInterval 60
 AcceptEnv LANG LC_*
 
+# Disallow user without ssh or sftp permissions
+AllowGroups ssh.main sftp.main ssh.app sftp.app admins root
+
+# Allow users to create tunnels or forwarding
+AllowTcpForwarding yes
+AllowStreamLocalForwarding yes
+PermitTunnel yes
+PermitUserRC yes
+
 # SFTP stuff
 Subsystem sftp internal-sftp
-Match User sftpusers
-        ForceCommand internal-sftp
-        ChrootDirectory /home/%u
-        AllowTcpForwarding no
-        GatewayPorts no
-        X11Forwarding no
+
+# Apply following instructions to user with sftp perm only
+Match Group sftp.main,!ssh.main
+    ForceCommand internal-sftp -u 0002
+    # We can't restrict to /home/%u because the chroot base must be owned by root
+    # So we chroot only on /home
+    # See https://serverfault.com/questions/584986/bad-ownership-or-modes-for-chroot-directory-component
+    ChrootDirectory /home
+    # Forbid SFTP users from using their account SSH as a VPN (even if SSH login is disabled)
+    AllowTcpForwarding no
+    AllowStreamLocalForwarding no
+    PermitTunnel no
+    # Disable .ssh/rc, which could be edited (e.g. from Nextcloud or whatever) by users to execute arbitrary commands even if SSH login is disabled
+    PermitUserRC no
+
+Match Group sftp.app,!ssh.app
+    ForceCommand internal-sftp -u 0002
+    ChrootDirectory %h
+    AllowTcpForwarding no
+    AllowStreamLocalForwarding no
+    PermitTunnel no
+    PermitUserRC no
+    PasswordAuthentication yes
 
 # root login is allowed on local networks
 # It's meant to be a backup solution in case LDAP is down and
@@ -82,4 +111,4 @@ Match User sftpusers
 # If the server is a VPS, it's expected that the owner of the
 # server has access to a web console through which to log in.
 Match Address 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,fe80::/10,fd00::/8
-        PermitRootLogin yes
+    PermitRootLogin yes

conf/ssl/openssl.cnf

@@ -5,7 +5,7 @@
 
 # This definition stops the following lines choking if HOME isn't
 # defined.
-HOME			= /usr/share/yunohost/yunohost-config/ssl
+HOME			= /usr/share/yunohost/ssl
 RANDFILE		= $ENV::HOME/.rnd
 
 # Extra OBJECT IDENTIFIER info:
@@ -34,7 +34,7 @@ default_ca	= Yunohost		# The default ca section
 ####################################################################
 [ Yunohost ]
 
-dir		= /usr/share/yunohost/yunohost-config/ssl/yunoCA		# Where everything is kept
+dir		= /usr/share/yunohost/ssl		# Where everything is kept
 certs		= $dir/certs		# Where the issued certs are kept
 crl_dir		= $dir/crl		# Where the issued crl are kept
 database	= $dir/index.txt	# database index file.

conf/yunohost/firewall.yml

@@ -2,6 +2,8 @@ uPnP:
     enabled: false
     TCP: [22, 25, 80, 443, 587, 993, 5222, 5269]
     UDP: []
+    TCP_TO_CLOSE: []
+    UDP_TO_CLOSE: []
 ipv4:
     TCP: [22, 25, 53, 80, 443, 587, 993, 5222, 5269]
     UDP: [53, 5353]

conf/yunohost/proc-hidepid.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Mounts /proc with hidepid=2
+DefaultDependencies=no
+Before=sysinit.target
+Requires=local-fs.target
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
+RemainAfterExit=yes
+
+[Install]
+WantedBy=sysinit.target

conf/yunohost/services.yml

@@ -1,5 +1,5 @@
-avahi-daemon: {}
-dnsmasq: {}
+dnsmasq:
+  test_conf: dnsmasq --test
 dovecot:
   log: [/var/log/mail.log,/var/log/mail.err]
   needs_exposed_ports: [993]
@@ -7,29 +7,36 @@ dovecot:
 fail2ban:
   log: /var/log/fail2ban.log
   category: security
+  test_conf: fail2ban-server --test
 metronome:
   log: [/var/log/metronome/metronome.log,/var/log/metronome/metronome.err]
   needs_exposed_ports: [5222, 5269]
   category: xmpp
+  ignore_if_package_is_not_installed: metronome
 mysql:
   log: [/var/log/mysql.log,/var/log/mysql.err,/var/log/mysql/error.log]
   actual_systemd_service: mariadb
   category: database
+  ignore_if_package_is_not_installed: mariadb-server
 nginx:
   log: /var/log/nginx
   test_conf: nginx -t
   needs_exposed_ports: [80, 443]
   category: web
-nslcd: {}
-php7.0-fpm:
-  log: /var/log/php7.0-fpm.log
-  test_conf: php-fpm7.0 --test
-  category: web
+# Yunohost will dynamically add installed php-fpm services (7.3, 7.4, 8.0, ...) in services.py
+#php7.4-fpm:
+#  log: /var/log/php7.4-fpm.log
+#  test_conf: php-fpm7.4 --test
+#  category: web
 postfix:
   log: [/var/log/mail.log,/var/log/mail.err]
   actual_systemd_service: postfix@-
   needs_exposed_ports: [25, 587]
   category: email
+postgresql:
+  actual_systemd_service: 'postgresql@13-main'
+  category: database
+  ignore_if_package_is_not_installed: postgresql-13
 redis-server:
   log: /var/log/redis/redis-server.log
   category: database
@@ -38,6 +45,7 @@ rspamd:
   category: email
 slapd:
   category: database
+  test_conf: slapd -Tt
 ssh:
   log: /var/log/auth.log
   test_conf: sshd -t
@@ -50,6 +58,8 @@ yunohost-firewall:
   need_lock: true
   test_status: iptables -S | grep "^-A INPUT" | grep " --dport" | grep -q ACCEPT
   category: security
+yunomdns:
+  category: mdns
 glances: null
 nsswitch: null
 ssl: null
@@ -64,3 +74,7 @@ postgrey: null
 spamassassin: null
 rmilter: null
 php5-fpm: null
+php7.0-fpm: null
+php7.3-fpm: null
+nslcd: null
+avahi-daemon: null

conf/yunohost/yunohost-api.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=YunoHost API Server
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/yunohost-api
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+
+[Install]
+WantedBy=multi-user.target

conf/yunohost/yunoprompt.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=YunoHost boot prompt
 After=getty@tty2.service
+After=network.target
 
 [Service]
 Type=simple

data/actionsmap/yunohost_completion.py

@@ -1,125 +0,0 @@
-"""
-Simple automated generation of a bash_completion file
-for yunohost command from the actionsmap.
-
-Generates a bash completion file assuming the structure
-`yunohost category action`
-adds `--help` at the end if one presses [tab] again.
-
-author: Christophe Vuillot
-"""
-import os
-import yaml
-
-THIS_SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
-ACTIONSMAP_FILE = THIS_SCRIPT_DIR + '/yunohost.yml'
-BASH_COMPLETION_FILE = THIS_SCRIPT_DIR + '/../bash-completion.d/yunohost'
-
-def get_dict_actions(OPTION_SUBTREE, category):
-    ACTIONS = [action for action in OPTION_SUBTREE[category]["actions"].keys()
-                if not action.startswith('_')]
-    ACTIONS_STR = '{}'.format(' '.join(ACTIONS))
-
-    DICT = { "actions_str": ACTIONS_STR }
-
-    return DICT
-
-with open(ACTIONSMAP_FILE, 'r') as stream:
-
-    # Getting the dictionary containning what actions are possible per category
-    OPTION_TREE = yaml.load(stream)
-
-    CATEGORY = [category for category in OPTION_TREE.keys() if not category.startswith('_')]
-
-    CATEGORY_STR = '{}'.format(' '.join(CATEGORY))
-    ACTIONS_DICT = {}
-    for category in CATEGORY:
-        ACTIONS_DICT[category] = get_dict_actions(OPTION_TREE, category)
-
-        ACTIONS_DICT[category]["subcategories"] = {}
-        ACTIONS_DICT[category]["subcategories_str"] = ""
-
-        if "subcategories" in OPTION_TREE[category].keys():
-            SUBCATEGORIES = [ subcategory for subcategory in OPTION_TREE[category]["subcategories"].keys() ]
-
-            SUBCATEGORIES_STR = '{}'.format(' '.join(SUBCATEGORIES))
-            
-            ACTIONS_DICT[category]["subcategories_str"] = SUBCATEGORIES_STR
-
-            for subcategory in SUBCATEGORIES:
-                ACTIONS_DICT[category]["subcategories"][subcategory] = get_dict_actions(OPTION_TREE[category]["subcategories"], subcategory)
-
-    with open(BASH_COMPLETION_FILE, 'w') as generated_file:
-
-        # header of the file
-        generated_file.write('#\n')
-        generated_file.write('# completion for yunohost\n')
-        generated_file.write('# automatically generated from the actionsmap\n')
-        generated_file.write('#\n\n')
-
-        # Start of the completion function
-        generated_file.write('_yunohost()\n')
-        generated_file.write('{\n')
-
-        # Defining local variable for previously and currently typed words
-        generated_file.write('\tlocal cur prev opts narg\n')
-        generated_file.write('\tCOMPREPLY=()\n\n')
-        generated_file.write('\t# the number of words already typed\n')
-        generated_file.write('\tnarg=${#COMP_WORDS[@]}\n\n')
-        generated_file.write('\t# the current word being typed\n')
-        generated_file.write('\tcur="${COMP_WORDS[COMP_CWORD]}"\n\n')
-
-        # If one is currently typing a category then match with the category list
-        generated_file.write('\t# If one is currently typing a category,\n')
-        generated_file.write('\t# match with categorys\n')
-        generated_file.write('\tif [[ $narg == 2 ]]; then\n')
-        generated_file.write('\t\topts="{}"\n'.format(CATEGORY_STR))
-        generated_file.write('\tfi\n\n')
-
-        # If one is currently typing an action then match with the action list
-        # of the previously typed category
-        generated_file.write('\t# If one already typed a category,\n')
-        generated_file.write('\t# match the actions or the subcategories of that category\n')
-        generated_file.write('\tif [[ $narg == 3 ]]; then\n')
-        generated_file.write('\t\t# the category typed\n')
-        generated_file.write('\t\tcategory="${COMP_WORDS[1]}"\n\n')
-        for category in CATEGORY:
-            generated_file.write('\t\tif [[ $category == "{}" ]]; then\n'.format(category))
-            generated_file.write('\t\t\topts="{} {}"\n'.format(ACTIONS_DICT[category]["actions_str"], ACTIONS_DICT[category]["subcategories_str"]))
-            generated_file.write('\t\tfi\n')
-        generated_file.write('\tfi\n\n')
-
-        generated_file.write('\t# If one already typed an action or a subcategory,\n')
-        generated_file.write('\t# match the actions of that subcategory\n')
-        generated_file.write('\tif [[ $narg == 4 ]]; then\n')
-        generated_file.write('\t\t# the category typed\n')
-        generated_file.write('\t\tcategory="${COMP_WORDS[1]}"\n\n')
-        generated_file.write('\t\t# the action or the subcategory typed\n')
-        generated_file.write('\t\taction_or_subcategory="${COMP_WORDS[2]}"\n\n')
-        for category in CATEGORY:
-            if len(ACTIONS_DICT[category]["subcategories"]):
-                generated_file.write('\t\tif [[ $category == "{}" ]]; then\n'.format(category))
-                for subcategory in ACTIONS_DICT[category]["subcategories"]:
-                    generated_file.write('\t\t\tif [[ $action_or_subcategory == "{}" ]]; then\n'.format(subcategory))
-                    generated_file.write('\t\t\t\topts="{}"\n'.format(ACTIONS_DICT[category]["subcategories"][subcategory]["actions_str"]))
-                    generated_file.write('\t\t\tfi\n')
-                generated_file.write('\t\tfi\n')
-        generated_file.write('\tfi\n\n')
-
-        # If both category and action have been typed or the category
-        # was not recognized propose --help (only once)
-        generated_file.write('\t# If no options were found propose --help\n')
-        generated_file.write('\tif [ -z "$opts" ]; then\n')
-        generated_file.write('\t\tprev="${COMP_WORDS[COMP_CWORD-1]}"\n\n')
-        generated_file.write('\t\tif [[ $prev != "--help" ]]; then\n')
-        generated_file.write('\t\t\topts=( --help )\n')
-        generated_file.write('\t\tfi\n')
-        generated_file.write('\tfi\n')
-
-        # generate the completion list from the possible options
-        generated_file.write('\tCOMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )\n')
-        generated_file.write('\treturn 0\n')
-        generated_file.write('}\n\n')
-
-        # Add the function to bash completion
-        generated_file.write('complete -F _yunohost yunohost')

data/bash-completion.d/yunohost

@@ -1,3 +0,0 @@
-# This file is automatically generated
-# during Debian's package build by the script
-# data/actionsmap/yunohost_completion.py

data/helpers

@@ -1,7 +0,0 @@
-# -*- shell-script -*-
-
-# TODO : use --regex to validate against a namespace
-for helper in $(run-parts --list /usr/share/yunohost/helpers.d 2>/dev/null) ; do
-    [ -r $helper ] && . $helper || true
-done
-

data/helpers.d/fail2ban

@@ -1,154 +0,0 @@
-#!/bin/bash
-
-# Create a dedicated fail2ban config (jail and filter conf files)
-#
-# usage 1: ynh_add_fail2ban_config --logpath=log_file --failregex=filter [--max_retry=max_retry] [--ports=ports]
-# | arg: -l, --logpath=   - Log file to be checked by fail2ban
-# | arg: -r, --failregex= - Failregex to be looked for by fail2ban
-# | arg: -m, --max_retry= - Maximum number of retries allowed before banning IP address - default: 3
-# | arg: -p, --ports=     - Ports blocked for a banned IP address - default: http,https
-#
-# -----------------------------------------------------------------------------
-#
-# usage 2: ynh_add_fail2ban_config --use_template [--others_var="list of others variables to replace"]
-# | arg: -t, --use_template - Use this helper in template mode
-# | arg: -v, --others_var=  - List of others variables to replace separeted by a space
-# |                           for example : 'var_1 var_2 ...'
-#
-# This will use a template in ../conf/f2b_jail.conf and ../conf/f2b_filter.conf
-#   __APP__      by  $app
-#
-#  You can dynamically replace others variables by example :
-#   __VAR_1__    by $var_1
-#   __VAR_2__    by $var_2
-#
-# Generally your template will look like that by example (for synapse):
-#
-# f2b_jail.conf:
-#     [__APP__]
-#     enabled = true
-#     port = http,https
-#     filter = __APP__
-#     logpath = /var/log/__APP__/logfile.log
-#     maxretry = 3
-#
-# f2b_filter.conf:
-#     [INCLUDES]
-#     before = common.conf
-#     [Definition]
-#
-#     # Part of regex definition (just used to make more easy to make the global regex)
-#     __synapse_start_line = .? \- synapse\..+ \-
-#
-#    # Regex definition.
-#    failregex = ^%(__synapse_start_line)s INFO \- POST\-(\d+)\- <HOST> \- \d+ \- Received request\: POST /_matrix/client/r0/login\??<SKIPLINES>%(__synapse_start_line)s INFO \- POST\-\1\- Got login request with identifier: \{u'type': u'm.id.user', u'user'\: u'(.+?)'\}, medium\: None, address: None, user\: u'\5'<SKIPLINES>%(__synapse_start_line)s WARNING \- \- (Attempted to login as @\5\:.+ but they do not exist|Failed password login for user @\5\:.+)$
-#
-#     ignoreregex =
-#
-# -----------------------------------------------------------------------------
-#
-# Note about the "failregex" option:
-#          regex to match the password failure messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-#
-#          You can find some more explainations about how to make a regex here :
-#          https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Filters
-#
-# Note that the logfile need to exist before to call this helper !!
-#
-# To validate your regex you can test with this command:
-# fail2ban-regex /var/log/YOUR_LOG_FILE_PATH /etc/fail2ban/filter.d/YOUR_APP.conf
-#
-# Requires YunoHost version 3.5.0 or higher.
-ynh_add_fail2ban_config () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=lrmptv
-    local -A args_array=( [l]=logpath= [r]=failregex= [m]=max_retry= [p]=ports= [t]=use_template [v]=others_var=)
-    local logpath
-    local failregex
-    local max_retry
-    local ports
-    local others_var
-    local use_template
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    max_retry=${max_retry:-3}
-    ports=${ports:-http,https}
-    others_var=${others_var:-}
-    use_template="${use_template:-0}"
-
-    finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf"
-    finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf"
-    ynh_backup_if_checksum_is_different "$finalfail2banjailconf"
-    ynh_backup_if_checksum_is_different "$finalfail2banfilterconf"
-
-    if [ $use_template -eq 1 ]
-    then
-        # Usage 2, templates
-        cp ../conf/f2b_jail.conf $finalfail2banjailconf
-        cp ../conf/f2b_filter.conf $finalfail2banfilterconf
-
-        if [ -n "${app:-}" ]
-        then
-            ynh_replace_string "__APP__" "$app" "$finalfail2banjailconf"
-            ynh_replace_string "__APP__" "$app" "$finalfail2banfilterconf"
-        fi
-
-        # Replace all other variable given as arguments
-        for var_to_replace in $others_var
-        do
-            # ${var_to_replace^^} make the content of the variable on upper-cases
-            # ${!var_to_replace} get the content of the variable named $var_to_replace
-            ynh_replace_string --match_string="__${var_to_replace^^}__" --replace_string="${!var_to_replace}" --target_file="$finalfail2banjailconf"
-            ynh_replace_string --match_string="__${var_to_replace^^}__" --replace_string="${!var_to_replace}" --target_file="$finalfail2banfilterconf"
-        done
-
-    else
-        # Usage 1, no template. Build a config file from scratch.
-        test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing."
-        test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing."
-
-        tee $finalfail2banjailconf <<EOF
-[$app]
-enabled = true
-port = $ports
-filter = $app
-logpath = $logpath
-maxretry = $max_retry
-EOF
-
-    tee $finalfail2banfilterconf <<EOF
-[INCLUDES]
-before = common.conf
-[Definition]
-failregex = $failregex
-ignoreregex =
-EOF
-    fi
-
-    # Common to usage 1 and 2.
-    ynh_store_file_checksum "$finalfail2banjailconf"
-    ynh_store_file_checksum "$finalfail2banfilterconf"
-
-    ynh_systemd_action --service_name=fail2ban --action=reload --line_match="(Started|Reloaded) Fail2Ban Service" --log_path=systemd
-
-    local fail2ban_error="$(journalctl --no-hostname --unit=fail2ban | tail --lines=50 | grep "WARNING.*$app.*")"
-    if [[ -n "$fail2ban_error" ]]
-    then
-        ynh_print_err --message="Fail2ban failed to load the jail for $app"
-        ynh_print_warn --message="${fail2ban_error#*WARNING}"
-    fi
-}
-
-# Remove the dedicated fail2ban config (jail and filter conf files)
-#
-# usage: ynh_remove_fail2ban_config
-#
-# Requires YunoHost version 3.5.0 or higher.
-ynh_remove_fail2ban_config () {
-    ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf"
-    ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf"
-    ynh_systemd_action --service_name=fail2ban --action=reload
-}

data/helpers.d/logrotate

@@ -1,112 +0,0 @@
-#!/bin/bash
-
-# Use logrotate to manage the logfile
-#
-# usage: ynh_use_logrotate [--logfile=/log/file] [--nonappend] [--specific_user=user/group]
-# | arg: -l, --logfile=         - absolute path of logfile
-# | arg: -n, --nonappend        - (optional) Replace the config file instead of appending this new config.
-# | arg: -u, --specific_user=   - run logrotate as the specified user and group. If not specified logrotate is runned as root.
-#
-# If no --logfile is provided, /var/log/${app} will be used as default.
-# logfile can be just a directory, or a full path to a logfile :
-# /parentdir/logdir
-# /parentdir/logdir/logfile.log
-#
-# It's possible to use this helper multiple times, each config will be added to
-# the same logrotate config file.  Unless you use the option --non-append
-#
-# Requires YunoHost version 2.6.4 or higher.
-# Requires YunoHost version 3.2.0 or higher for the argument --specific_user
-ynh_use_logrotate () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=lnuya
-    local -A args_array=( [l]=logfile= [n]=nonappend [u]=specific_user= [y]=non [a]=append )
-    # [y]=non [a]=append are only for legacy purpose, to not fail on the old option '--non-append'
-    local logfile
-    local nonappend
-    local specific_user
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    logfile="${logfile:-}"
-    nonappend="${nonappend:-0}"
-    specific_user="${specific_user:-}"
-
-    # LEGACY CODE - PRE GETOPTS
-    if [ $# -gt 0 ] && [ "$1" == "--non-append" ]
-    then
-        nonappend=1
-        # Destroy this argument for the next command.
-        shift
-    elif [ $# -gt 1 ] && [ "$2" == "--non-append" ]
-    then
-        nonappend=1
-    fi
-
-    if [ $# -gt 0 ] && [ "$(echo ${1:0:1})" != "-" ]
-    then
-        # If the given logfile parameter already exists as a file, or if it ends up with ".log",
-        # we just want to manage a single file
-        if [ -f "$1" ] || [ "$(echo ${1##*.})" == "log" ]
-        then
-            local logfile=$1
-        # Otherwise we assume we want to manage a directory and all its .log file inside
-        else
-            local logfile=$1/*.log
-        fi
-    fi
-    # LEGACY CODE
-
-    local customtee="tee --append"
-    if [ "$nonappend" -eq 1 ]; then
-        customtee="tee"
-    fi
-    if [ -n "$logfile" ]
-    then
-        if [ ! -f "$1" ] && [ "$(echo ${logfile##*.})" != "log" ]; then	# Keep only the extension to check if it's a logfile
-            local logfile="$logfile/*.log"	# Else, uses the directory and all logfile into it.
-        fi
-    else
-        logfile="/var/log/${app}/*.log" # Without argument, use a defaut directory in /var/log
-    fi
-    local su_directive=""
-    if [[ -n $specific_user ]]
-    then
-        su_directive="	# Run logorotate as specific user - group
-    su ${specific_user%/*} ${specific_user#*/}"
-    fi
-
-    cat > ./${app}-logrotate << EOF	# Build a config file for logrotate
-$logfile {
-        # Rotate if the logfile exceeds 100Mo
-    size 100M
-        # Keep 12 old log maximum
-    rotate 12
-        # Compress the logs with gzip
-    compress
-        # Compress the log at the next cycle. So keep always 2 non compressed logs
-    delaycompress
-        # Copy and truncate the log to allow to continue write on it. Instead of move the log.
-    copytruncate
-        # Do not do an error if the log is missing
-    missingok
-        # Not rotate if the log is empty
-    notifempty
-        # Keep old logs in the same dir
-    noolddir
-    $su_directive
-}
-EOF
-    mkdir --parents $(dirname "$logfile")	# Create the log directory, if not exist
-    cat ${app}-logrotate | $customtee /etc/logrotate.d/$app > /dev/null	# Append this config to the existing config file, or replace the whole config file (depending on $customtee)
-}
-
-# Remove the app's logrotate config.
-#
-# usage: ynh_remove_logrotate
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_remove_logrotate () {
-    if [ -e "/etc/logrotate.d/$app" ]; then
-        rm "/etc/logrotate.d/$app"
-    fi
-}

data/helpers.d/nginx

@@ -1,80 +0,0 @@
-#!/bin/bash
-
-# Create a dedicated nginx config
-#
-# usage: ynh_add_nginx_config "list of others variables to replace"
-#
-# | arg: list - (Optional) list of others variables to replace separated by spaces. For example : 'path_2 port_2 ...'
-#
-# This will use a template in ../conf/nginx.conf
-#   __PATH__      by  $path_url
-#   __DOMAIN__    by  $domain
-#   __PORT__      by  $port
-#   __NAME__      by  $app
-#   __FINALPATH__ by  $final_path
-#   __PHPVERSION__ by  $YNH_PHP_VERSION ($YNH_PHP_VERSION is either the default php version or the version defined for the app)
-#
-#  And dynamic variables (from the last example) :
-#   __PATH_2__    by $path_2
-#   __PORT_2__    by $port_2
-#
-# Requires YunoHost version 2.7.2 or higher.
-# Requires YunoHost version 2.7.13 or higher for dynamic variables
-ynh_add_nginx_config () {
-    finalnginxconf="/etc/nginx/conf.d/$domain.d/$app.conf"
-    local others_var=${1:-}
-    ynh_backup_if_checksum_is_different --file="$finalnginxconf"
-    cp ../conf/nginx.conf "$finalnginxconf"
-
-    # To avoid a break by set -u, use a void substitution ${var:-}. If the variable is not set, it's simply set with an empty variable.
-    # Substitute in a nginx config file only if the variable is not empty
-    if test -n "${path_url:-}"
-    then
-        # path_url_slash_less is path_url, or a blank value if path_url is only '/'
-        local path_url_slash_less=${path_url%/}
-        ynh_replace_string --match_string="__PATH__/" --replace_string="$path_url_slash_less/" --target_file="$finalnginxconf"
-        ynh_replace_string --match_string="__PATH__" --replace_string="$path_url" --target_file="$finalnginxconf"
-    fi
-    if test -n "${domain:-}"; then
-        ynh_replace_string --match_string="__DOMAIN__" --replace_string="$domain" --target_file="$finalnginxconf"
-    fi
-    if test -n "${port:-}"; then
-        ynh_replace_string --match_string="__PORT__" --replace_string="$port" --target_file="$finalnginxconf"
-    fi
-    if test -n "${app:-}"; then
-        ynh_replace_string --match_string="__NAME__" --replace_string="$app" --target_file="$finalnginxconf"
-    fi
-    if test -n "${final_path:-}"; then
-        ynh_replace_string --match_string="__FINALPATH__" --replace_string="$final_path" --target_file="$finalnginxconf"
-    fi
-    ynh_replace_string --match_string="__PHPVERSION__" --replace_string="$YNH_PHP_VERSION" --target_file="$finalnginxconf"
-
-    # Replace all other variable given as arguments
-    for var_to_replace in $others_var
-    do
-        # ${var_to_replace^^} make the content of the variable on upper-cases
-        # ${!var_to_replace} get the content of the variable named $var_to_replace 
-        ynh_replace_string --match_string="__${var_to_replace^^}__" --replace_string="${!var_to_replace}" --target_file="$finalnginxconf"
-    done
-
-    if [ "${path_url:-}" != "/" ]
-    then
-        ynh_replace_string --match_string="^#sub_path_only" --replace_string="" --target_file="$finalnginxconf"
-    else
-        ynh_replace_string --match_string="^#root_path_only" --replace_string="" --target_file="$finalnginxconf"
-    fi
-
-    ynh_store_file_checksum --file="$finalnginxconf"
-
-    ynh_systemd_action --service_name=nginx --action=reload
-}
-
-# Remove the dedicated nginx config
-#
-# usage: ynh_remove_nginx_config
-#
-# Requires YunoHost version 2.7.2 or higher.
-ynh_remove_nginx_config () {
-    ynh_secure_remove --file="/etc/nginx/conf.d/$domain.d/$app.conf"
-    ynh_systemd_action --service_name=nginx --action=reload
-}

data/helpers.d/php

@@ -1,568 +0,0 @@
-#!/bin/bash
-
-readonly YNH_DEFAULT_PHP_VERSION=7.0
-# Declare the actual php version to use.
-# A packager willing to use another version of php can override the variable into its _common.sh.
-YNH_PHP_VERSION=${YNH_PHP_VERSION:-$YNH_DEFAULT_PHP_VERSION}
-
-# Create a dedicated php-fpm config
-#
-# usage 1: ynh_add_fpm_config [--phpversion=7.X] [--use_template] [--package=packages] [--dedicated_service]
-# | arg: -v, --phpversion=          - Version of php to use.
-# | arg: -t, --use_template         - Use this helper in template mode.
-# | arg: -p, --package=             - Additionnal php packages to install
-# | arg: -d, --dedicated_service    - Use a dedicated php-fpm service instead of the common one.
-#
-# -----------------------------------------------------------------------------
-#
-# usage 2: ynh_add_fpm_config [--phpversion=7.X] --usage=usage --footprint=footprint [--package=packages] [--dedicated_service]
-# | arg: -v, --phpversion=          - Version of php to use.
-# | arg: -f, --footprint=           - Memory footprint of the service (low/medium/high).
-# low    - Less than 20Mb of ram by pool.
-# medium - Between 20Mb and 40Mb of ram by pool.
-# high   - More than 40Mb of ram by pool.
-# Or specify exactly the footprint, the load of the service as Mb by pool instead of having a standard value.
-# To have this value, use the following command and stress the service.
-# watch -n0.5 ps -o user,cmd,%cpu,rss -u APP
-#
-# | arg: -u, --usage=               - Expected usage of the service (low/medium/high).
-# low    - Personal usage, behind the sso.
-# medium - Low usage, few people or/and publicly accessible.
-# high   - High usage, frequently visited website.
-#
-# | arg: -p, --package=             - Additionnal php packages to install for a specific version of php
-# | arg: -d, --dedicated_service    - Use a dedicated php-fpm service instead of the common one.
-#
-#
-# The footprint of the service will be used to defined the maximum footprint we can allow, which is half the maximum RAM.
-# So it will be used to defined 'pm.max_children'
-# A lower value for the footprint will allow more children for 'pm.max_children'. And so for
-#    'pm.start_servers', 'pm.min_spare_servers' and 'pm.max_spare_servers' which are defined from the
-#    value of 'pm.max_children'
-# NOTE: 'pm.max_children' can't exceed 4 times the number of processor's cores.
-#
-# The usage value will defined the way php will handle the children for the pool.
-# A value set as 'low' will set the process manager to 'ondemand'. Children will start only if the
-#   service is used, otherwise no child will stay alive. This config gives the lower footprint when the
-#   service is idle. But will use more proc since it has to start a child as soon it's used.
-# Set as 'medium', the process manager will be at dynamic. If the service is idle, a number of children
-#   equal to pm.min_spare_servers will stay alive. So the service can be quick to answer to any request.
-#   The number of children can grow if needed. The footprint can stay low if the service is idle, but
-#   not null. The impact on the proc is a little bit less than 'ondemand' as there's always a few
-#   children already available.
-# Set as 'high', the process manager will be set at 'static'. There will be always as many children as
-#   'pm.max_children', the footprint is important (but will be set as maximum a quarter of the maximum
-#   RAM) but the impact on the proc is lower. The service will be quick to answer as there's always many
-#   children ready to answer.
-#
-# Requires YunoHost version 2.7.2 or higher.
-# Requires YunoHost version 3.5.1 or higher for the argument --phpversion
-# Requires YunoHost version 3.8.1 or higher for the arguments --use_template, --usage, --footprint, --package and --dedicated_service
-ynh_add_fpm_config () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=vtufpd
-    local -A args_array=( [v]=phpversion= [t]=use_template [u]=usage= [f]=footprint= [p]=package= [d]=dedicated_service )
-    local phpversion
-    local use_template
-    local usage
-    local footprint
-    local package
-    local dedicated_service
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    package=${package:-}
-
-    # The default behaviour is to use the template.
-    use_template="${use_template:-1}"
-    usage="${usage:-}"
-    footprint="${footprint:-}"
-    if [ -n "$usage" ] || [ -n "$footprint" ]; then
-        use_template=0
-    fi
-    # Do not use a dedicated service by default
-    dedicated_service=${dedicated_service:-0}
-
-    # Set the default PHP-FPM version by default
-    phpversion="${phpversion:-$YNH_PHP_VERSION}"
-
-    # If the requested php version is not the default version for YunoHost
-    if [ "$phpversion" != "$YNH_DEFAULT_PHP_VERSION" ]
-    then
-        # If the argument --package is used, add the packages to ynh_install_php to install them from sury
-        if [ -n "$package" ]
-        then
-            local additionnal_packages="--package=$package"
-        else
-            local additionnal_packages=""
-        fi
-        # Install this specific version of php.
-        ynh_install_php --phpversion="$phpversion" "$additionnal_packages"
-    elif [ -n "$package" ]
-    then
-        # Install the additionnal packages from the default repository
-        ynh_add_app_dependencies --package="$package"
-    fi
-
-    if [ $dedicated_service -eq 1 ]
-    then
-        local fpm_service="${app}-phpfpm"
-        local fpm_config_dir="/etc/php/$phpversion/dedicated-fpm"
-    else
-        local fpm_service="php${phpversion}-fpm"
-        local fpm_config_dir="/etc/php/$phpversion/fpm"
-    fi
-    # Configure PHP-FPM 5 on Debian Jessie
-    if [ "$(ynh_get_debian_release)" == "jessie" ]
-    then
-        fpm_config_dir="/etc/php5/fpm"
-        fpm_service="php5-fpm"
-    fi
-
-    # Create the directory for fpm pools
-    mkdir --parents "$fpm_config_dir/pool.d"
-
-    ynh_app_setting_set --app=$app --key=fpm_config_dir --value="$fpm_config_dir"
-    ynh_app_setting_set --app=$app --key=fpm_service --value="$fpm_service"
-    ynh_app_setting_set --app=$app --key=fpm_dedicated_service --value="$dedicated_service"
-    ynh_app_setting_set --app=$app --key=phpversion --value=$phpversion
-    finalphpconf="$fpm_config_dir/pool.d/$app.conf"
-
-    # Migrate from mutual php service to dedicated one.
-    if [ $dedicated_service -eq 1 ]
-    then
-        local old_fpm_config_dir="/etc/php/$phpversion/fpm"
-        # If a config file exist in the common pool, move it.
-        if [ -e "$old_fpm_config_dir/pool.d/$app.conf" ]
-        then
-            ynh_print_info --message="Migrate to a dedicated php-fpm service for $app."
-            # Create a backup of the old file before migration
-            ynh_backup_if_checksum_is_different --file="$old_fpm_config_dir/pool.d/$app.conf"
-            # Remove the old php config file
-            ynh_secure_remove --file="$old_fpm_config_dir/pool.d/$app.conf"
-            # Reload php to release the socket and allow the dedicated service to use it
-            ynh_systemd_action --service_name=php${phpversion}-fpm --action=reload
-        fi
-    fi
-
-    ynh_backup_if_checksum_is_different --file="$finalphpconf"
-
-    if [ $use_template -eq 1 ]
-    then
-        # Usage 1, use the template in conf/php-fpm.conf
-        local phpfpm_path="../conf/php-fpm.conf"
-        if [ ! -e "$phpfpm_path" ]; then
-            phpfpm_path="../settings/conf/php-fpm.conf"	# Into the restore script, the php-fpm template is not at the same place
-        fi
-        # Make sure now that the template indeed exists
-        [ -e "$phpfpm_path" ] || ynh_die --message="Unable to find template to configure php-fpm."
-        cp "$phpfpm_path" "$finalphpconf"
-        ynh_replace_string --match_string="__NAMETOCHANGE__" --replace_string="$app" --target_file="$finalphpconf"
-        ynh_replace_string --match_string="__FINALPATH__" --replace_string="$final_path" --target_file="$finalphpconf"
-        ynh_replace_string --match_string="__USER__" --replace_string="$app" --target_file="$finalphpconf"
-        ynh_replace_string --match_string="__PHPVERSION__" --replace_string="$phpversion" --target_file="$finalphpconf"
-
-    else
-        # Usage 2, generate a php-fpm config file with ynh_get_scalable_phpfpm
-
-        # Store settings
-        ynh_app_setting_set --app=$app --key=fpm_footprint --value=$footprint
-        ynh_app_setting_set --app=$app --key=fpm_usage --value=$usage
-
-        # Define the values to use for the configuration of php.
-        ynh_get_scalable_phpfpm --usage=$usage --footprint=$footprint
-
-        # Copy the default file
-        cp "/etc/php/$phpversion/fpm/pool.d/www.conf" "$finalphpconf"
-
-        # Replace standard variables into the default file
-        ynh_replace_string --match_string="^\[www\]" --replace_string="[$app]" --target_file="$finalphpconf"
-        ynh_replace_string --match_string=".*listen = .*" --replace_string="listen = /var/run/php/php$phpversion-fpm-$app.sock" --target_file="$finalphpconf"
-        ynh_replace_string --match_string="^user = .*" --replace_string="user = $app" --target_file="$finalphpconf"
-        ynh_replace_string --match_string="^group = .*" --replace_string="group = $app" --target_file="$finalphpconf"
-        ynh_replace_string --match_string=".*chdir = .*" --replace_string="chdir = $final_path" --target_file="$finalphpconf"
-
-        # Configure fpm children
-        ynh_replace_string --match_string=".*pm = .*" --replace_string="pm = $php_pm" --target_file="$finalphpconf"
-        ynh_replace_string --match_string=".*pm.max_children = .*" --replace_string="pm.max_children = $php_max_children" --target_file="$finalphpconf"
-        ynh_replace_string --match_string=".*pm.max_requests = .*" --replace_string="pm.max_requests = 500" --target_file="$finalphpconf"
-        ynh_replace_string --match_string=".*request_terminate_timeout = .*" --replace_string="request_terminate_timeout = 1d" --target_file="$finalphpconf"
-        if [ "$php_pm" = "dynamic" ]
-        then
-            ynh_replace_string --match_string=".*pm.start_servers = .*" --replace_string="pm.start_servers = $php_start_servers" --target_file="$finalphpconf"
-            ynh_replace_string --match_string=".*pm.min_spare_servers = .*" --replace_string="pm.min_spare_servers = $php_min_spare_servers" --target_file="$finalphpconf"
-            ynh_replace_string --match_string=".*pm.max_spare_servers = .*" --replace_string="pm.max_spare_servers = $php_max_spare_servers" --target_file="$finalphpconf"
-        elif [ "$php_pm" = "ondemand" ]
-        then
-            ynh_replace_string --match_string=".*pm.process_idle_timeout = .*" --replace_string="pm.process_idle_timeout = 10s" --target_file="$finalphpconf"
-        fi
-
-        # Comment unused parameters
-        if [ "$php_pm" != "dynamic" ]
-        then
-            ynh_replace_string --match_string=".*\(pm.start_servers = .*\)" --replace_string=";\1" --target_file="$finalphpconf"
-            ynh_replace_string --match_string=".*\(pm.min_spare_servers = .*\)" --replace_string=";\1" --target_file="$finalphpconf"
-            ynh_replace_string --match_string=".*\(pm.max_spare_servers = .*\)" --replace_string=";\1" --target_file="$finalphpconf"
-        fi
-        if [ "$php_pm" != "ondemand" ]
-        then
-            ynh_replace_string --match_string=".*\(pm.process_idle_timeout = .*\)" --replace_string=";\1" --target_file="$finalphpconf"
-        fi
-
-        # Concatene the extra config.
-        if [ -e ../conf/extra_php-fpm.conf ]; then
-            cat ../conf/extra_php-fpm.conf >> "$finalphpconf"
-        fi
-    fi
-
-    chown root: "$finalphpconf"
-    ynh_store_file_checksum --file="$finalphpconf"
-
-    if [ -e "../conf/php-fpm.ini" ]
-    then
-        ynh_print_warn -message="Packagers ! Please do not use a separate php ini file, merge your directives in the pool file instead."
-        finalphpini="$fpm_config_dir/conf.d/20-$app.ini"
-        ynh_backup_if_checksum_is_different "$finalphpini"
-        cp ../conf/php-fpm.ini "$finalphpini"
-        chown root: "$finalphpini"
-        ynh_store_file_checksum "$finalphpini"
-    fi
-
-    if [ $dedicated_service -eq 1 ]
-    then
-        # Create a dedicated php-fpm.conf for the service
-        local globalphpconf=$fpm_config_dir/php-fpm-$app.conf
-        cp /etc/php/${phpversion}/fpm/php-fpm.conf $globalphpconf
-
-        ynh_replace_string --match_string="^[; ]*pid *=.*" --replace_string="pid = /run/php/php${phpversion}-fpm-$app.pid" --target_file="$globalphpconf"
-        ynh_replace_string --match_string="^[; ]*error_log *=.*" --replace_string="error_log = /var/log/php/fpm-php.$app.log" --target_file="$globalphpconf"
-        ynh_replace_string --match_string="^[; ]*syslog.ident *=.*" --replace_string="syslog.ident = php-fpm-$app" --target_file="$globalphpconf"
-        ynh_replace_string --match_string="^[; ]*include *=.*" --replace_string="include = $finalphpconf" --target_file="$globalphpconf"
-
-        # Create a config for a dedicated php-fpm service for the app
-        echo "[Unit]
-Description=PHP $phpversion FastCGI Process Manager for $app
-After=network.target
-
-[Service] 
-Type=notify
-PIDFile=/run/php/php${phpversion}-fpm-$app.pid
-ExecStart=/usr/sbin/php-fpm$phpversion --nodaemonize --fpm-config $globalphpconf
-ExecReload=/bin/kill -USR2 \$MAINPID
-
-[Install]
-WantedBy=multi-user.target
-" > ../conf/$fpm_service
-
-        # Create this dedicated php-fpm service
-        ynh_add_systemd_config --service=$fpm_service --template=$fpm_service
-        # Integrate the service in YunoHost admin panel
-        yunohost service add $fpm_service --log /var/log/php/fpm-php.$app.log --log_type file --description "Php-fpm dedicated to $app"
-        # Configure log rotate
-        ynh_use_logrotate --logfile=/var/log/php
-        # Restart the service, as this service is either stopped or only for this app
-        ynh_systemd_action --service_name=$fpm_service --action=restart
-    else
-        # Reload php, to not impact other parts of the system using php
-        ynh_systemd_action --service_name=$fpm_service --action=reload
-    fi
-}
-
-# Remove the dedicated php-fpm config
-#
-# usage: ynh_remove_fpm_config
-#
-# Requires YunoHost version 2.7.2 or higher.
-ynh_remove_fpm_config () {
-    local fpm_config_dir=$(ynh_app_setting_get --app=$app --key=fpm_config_dir)
-    local fpm_service=$(ynh_app_setting_get --app=$app --key=fpm_service)
-    local dedicated_service=$(ynh_app_setting_get --app=$app --key=fpm_dedicated_service)
-    dedicated_service=${dedicated_service:-0}
-    # Get the version of php used by this app
-    local phpversion=$(ynh_app_setting_get $app phpversion)
-
-    # Assume default PHP-FPM version by default
-    phpversion="${phpversion:-$YNH_DEFAULT_PHP_VERSION}"
-
-    # Assume default php files if not set
-    if [ -z "$fpm_config_dir" ]
-    then
-        fpm_config_dir="/etc/php/$YNH_DEFAULT_PHP_VERSION/fpm"
-        fpm_service="php$YNH_DEFAULT_PHP_VERSION-fpm"
-    fi
-
-    if [ $dedicated_service -eq 1 ]
-    then
-        # Remove the dedicated service php-fpm service for the app
-        ynh_remove_systemd_config --service=$fpm_service
-        # Remove the global php-fpm conf
-        ynh_secure_remove --file="$fpm_config_dir/php-fpm-$app.conf"
-        # Remove the service from the list of services known by Yunohost
-        yunohost service remove $fpm_service
-    elif ynh_package_is_installed --package="php${phpversion}-fpm"; then
-        ynh_systemd_action --service_name=$fpm_service --action=reload
-    fi
-
-    ynh_secure_remove --file="$fpm_config_dir/pool.d/$app.conf"
-    if [ -e $fpm_config_dir/conf.d/20-$app.ini ]
-    then
-        ynh_secure_remove --file="$fpm_config_dir/conf.d/20-$app.ini"
-    fi
-
-    # If the php version used is not the default version for YunoHost
-    if [ "$phpversion" != "$YNH_DEFAULT_PHP_VERSION" ]
-    then
-        # Remove this specific version of php
-        ynh_remove_php
-    fi
-}
-
-# Install another version of php.
-#
-# [internal]
-#
-# usage: ynh_install_php --phpversion=phpversion [--package=packages]
-# | arg: -v, --phpversion=  - Version of php to install.
-# | arg: -p, --package=     - Additionnal php packages to install
-#
-# Requires YunoHost version 3.8.1 or higher.
-ynh_install_php () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=vp
-    local -A args_array=( [v]=phpversion= [p]=package= )
-    local phpversion
-    local package
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    package=${package:-}
-
-    # Store phpversion into the config of this app
-    ynh_app_setting_set $app phpversion $phpversion
-
-    if [ "$phpversion" == "$YNH_DEFAULT_PHP_VERSION" ]
-    then
-        ynh_die "Do not use ynh_install_php to install php$YNH_DEFAULT_PHP_VERSION"
-    fi
-
-    # Create the file if doesn't exist already
-    touch /etc/php/ynh_app_version
-
-    # Do not add twice the same line
-    if ! grep --quiet "$YNH_APP_INSTANCE_NAME:" "/etc/php/ynh_app_version"
-    then
-        # Store the ID of this app and the version of php requested for it
-        echo "$YNH_APP_INSTANCE_NAME:$phpversion" | tee --append "/etc/php/ynh_app_version"
-    fi
-
-    # Add an extra repository for those packages
-    ynh_install_extra_repo --repo="https://packages.sury.org/php/ $(ynh_get_debian_release) main" --key="https://packages.sury.org/php/apt.gpg" --priority=995 --name=extra_php_version
-
-    # Install requested dependencies from this extra repository.
-    # Install php-fpm first, otherwise php will install apache as a dependency.
-    ynh_add_app_dependencies --package="php${phpversion}-fpm"
-    ynh_add_app_dependencies --package="php$phpversion php${phpversion}-common $package"
-
-    # Set the default php version back as the default version for php-cli.
-    update-alternatives --set php /usr/bin/php$YNH_DEFAULT_PHP_VERSION
-
-    # Pin this extra repository after packages are installed to prevent sury of doing shit
-    for package_to_not_upgrade in "php" "php-fpm" "php-mysql" "php-xml" "php-zip" "php-mbstring" "php-ldap" "php-gd" "php-curl" "php-bz2" "php-json" "php-sqlite3" "php-intl" "openssl" "libssl1.1" "libssl-dev"
-    do
-        ynh_pin_repo --package="$package_to_not_upgrade" --pin="origin \"packages.sury.org\"" --priority="-1" --name=extra_php_version --append
-    done
-
-    # Advertise service in admin panel
-    yunohost service add php${phpversion}-fpm --log "/var/log/php${phpversion}-fpm.log"
-}
-
-# Remove the specific version of php used by the app.
-#
-# [internal]
-#
-# usage: ynh_install_php
-#
-# Requires YunoHost version 3.8.1 or higher.
-ynh_remove_php () {
-    # Get the version of php used by this app
-    local phpversion=$(ynh_app_setting_get $app phpversion)
-
-    if [ "$phpversion" == "$YNH_DEFAULT_PHP_VERSION" ] || [ -z "$phpversion" ]
-    then
-        if [ "$phpversion" == "$YNH_DEFAULT_PHP_VERSION" ]
-        then
-            ynh_print_err "Do not use ynh_remove_php to remove php$YNH_DEFAULT_PHP_VERSION !"
-        fi
-        return 0
-    fi
-
-    # Create the file if doesn't exist already
-    touch /etc/php/ynh_app_version
-
-    # Remove the line for this app
-    sed --in-place "/$YNH_APP_INSTANCE_NAME:$phpversion/d" "/etc/php/ynh_app_version"
-
-    # If no other app uses this version of php, remove it.
-    if ! grep --quiet "$phpversion" "/etc/php/ynh_app_version"
-    then
-        # Remove the service from the admin panel
-        if ynh_package_is_installed --package="php${phpversion}-fpm"; then
-            yunohost service remove php${phpversion}-fpm
-        fi
-
-        # Purge php dependencies for this version.
-        ynh_package_autopurge "php$phpversion php${phpversion}-fpm php${phpversion}-common"
-    fi
-}
-
-# Define the values to configure php-fpm
-#
-# [internal]
-#
-# usage: ynh_get_scalable_phpfpm --usage=usage --footprint=footprint [--print]
-# | arg: -f, --footprint=       - Memory footprint of the service (low/medium/high).
-# low    - Less than 20Mb of ram by pool.
-# medium - Between 20Mb and 40Mb of ram by pool.
-# high   - More than 40Mb of ram by pool.
-# Or specify exactly the footprint, the load of the service as Mb by pool instead of having a standard value.
-# To have this value, use the following command and stress the service.
-# watch -n0.5 ps -o user,cmd,%cpu,rss -u APP
-#
-# | arg: -u, --usage=           - Expected usage of the service (low/medium/high).
-# low    - Personal usage, behind the sso.
-# medium - Low usage, few people or/and publicly accessible.
-# high   - High usage, frequently visited website.
-#
-# | arg: -p, --print            - Print the result (intended for debug purpose only when packaging the app)
-ynh_get_scalable_phpfpm () {
-    local legacy_args=ufp
-    # Declare an array to define the options of this helper.
-    local -A args_array=( [u]=usage= [f]=footprint= [p]=print )
-    local usage
-    local footprint
-    local print
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    # Set all characters as lowercase
-    footprint=${footprint,,}
-    usage=${usage,,}
-    print=${print:-0}
-
-    if [ "$footprint" = "low" ]
-    then
-        footprint=20
-    elif [ "$footprint" = "medium" ]
-    then
-        footprint=35
-    elif [ "$footprint" = "high" ]
-    then
-        footprint=50
-    fi
-
-    # Define the factor to determine min_spare_servers
-    # to avoid having too few children ready to start for heavy apps
-    if [ $footprint -le 20 ]
-    then
-        min_spare_servers_factor=8
-    elif [ $footprint -le 35 ]
-    then
-        min_spare_servers_factor=5
-    else
-        min_spare_servers_factor=3
-    fi
-
-    # Define the way the process manager handle child processes.
-    if [ "$usage" = "low" ]
-    then
-        php_pm=ondemand
-    elif [ "$usage" = "medium" ]
-    then
-        php_pm=dynamic
-    elif [ "$usage" = "high" ]
-    then
-        php_pm=static
-    else
-        ynh_die --message="Does not recognize '$usage' as an usage value."
-    fi
-
-    # Get the total of RAM available, except swap.
-    local max_ram=$(ynh_get_ram --total --ignore_swap)
-
-    at_least_one() {
-        # Do not allow value below 1
-        if [ $1 -le 0 ]
-        then
-            echo 1
-        else
-            echo $1
-        fi
-    }
-
-    # Define pm.max_children
-    # The value of pm.max_children is the total amount of ram divide by 2 and divide again by the footprint of a pool for this app.
-    # So if php-fpm start the maximum of children, it won't exceed half of the ram.
-    php_max_children=$(( $max_ram / 2 / $footprint ))
-    # If process manager is set as static, use half less children.
-    # Used as static, there's always as many children as the value of pm.max_children
-    if [ "$php_pm" = "static" ]
-    then
-        php_max_children=$(( $php_max_children / 2 ))
-    fi
-    php_max_children=$(at_least_one $php_max_children)
-
-    # To not overload the proc, limit the number of children to 4 times the number of cores.
-    local core_number=$(nproc)
-    local max_proc=$(( $core_number * 4 ))
-    if [ $php_max_children -gt $max_proc ]
-    then
-        php_max_children=$max_proc
-    fi
-
-    # Get a potential forced value for php_max_children
-    local php_forced_max_children=$(ynh_app_setting_get --app=$app --key=php_forced_max_children)
-    if [ -n "$php_forced_max_children" ]; then
-        php_max_children=$php_forced_max_children
-    fi
-
-    if [ "$php_pm" = "dynamic" ]
-    then
-        # Define pm.start_servers, pm.min_spare_servers and pm.max_spare_servers for a dynamic process manager
-        php_min_spare_servers=$(( $php_max_children / $min_spare_servers_factor ))
-        php_min_spare_servers=$(at_least_one $php_min_spare_servers)
-
-        php_max_spare_servers=$(( $php_max_children / 2 ))
-        php_max_spare_servers=$(at_least_one $php_max_spare_servers)
-
-        php_start_servers=$(( $php_min_spare_servers + ( $php_max_spare_servers - $php_min_spare_servers ) /2 ))
-        php_start_servers=$(at_least_one $php_start_servers)
-    else
-        php_min_spare_servers=0
-        php_max_spare_servers=0
-        php_start_servers=0
-    fi
-
-    if [ $print -eq 1 ]
-    then
-        ynh_debug --message="Footprint=${footprint}Mb by pool."
-        ynh_debug --message="Process manager=$php_pm"
-        ynh_debug --message="Max RAM=${max_ram}Mb"
-        if [ "$php_pm" != "static" ]
-        then
-            ynh_debug --message="\nMax estimated footprint=$(( $php_max_children * $footprint ))"
-            ynh_debug --message="Min estimated footprint=$(( $php_min_spare_servers * $footprint ))"
-        fi
-        if [ "$php_pm" = "dynamic" ]
-        then
-            ynh_debug --message="Estimated average footprint=$(( $php_max_spare_servers * $footprint ))"
-        elif [ "$php_pm" = "static" ]
-        then
-            ynh_debug --message="Estimated footprint=$(( $php_max_children * $footprint ))"
-        fi
-        ynh_debug --message="\nRaw php-fpm values:"
-        ynh_debug --message="pm.max_children = $php_max_children"
-        if [ "$php_pm" = "dynamic" ]
-        then
-            ynh_debug --message="pm.start_servers = $php_start_servers"
-            ynh_debug --message="pm.min_spare_servers = $php_min_spare_servers"
-            ynh_debug --message="pm.max_spare_servers = $php_max_spare_servers"
-        fi
-    fi
-}

data/helpers.d/setting

@@ -1,323 +0,0 @@
-#!/bin/bash
-
-# Get an application setting
-#
-# usage: ynh_app_setting_get --app=app --key=key
-# | arg: -a, --app=     - the application id
-# | arg: -k, --key=     - the setting to get
-#
-# Requires YunoHost version 2.2.4 or higher.
-ynh_app_setting_get() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=ak
-    local -A args_array=( [a]=app= [k]=key= )
-    local app
-    local key
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    ynh_app_setting "get" "$app" "$key"
-}
-
-# Set an application setting
-#
-# usage: ynh_app_setting_set --app=app --key=key --value=value
-# | arg: -a, --app=     - the application id
-# | arg: -k, --key=     - the setting name to set
-# | arg: -v, --value=   - the setting value to set
-#
-# Requires YunoHost version 2.2.4 or higher.
-ynh_app_setting_set() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=akv
-    local -A args_array=( [a]=app= [k]=key= [v]=value= )
-    local app
-    local key
-    local value
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    ynh_app_setting "set" "$app" "$key" "$value"
-}
-
-# Delete an application setting
-#
-# usage: ynh_app_setting_delete --app=app --key=key
-# | arg: -a, --app=     - the application id
-# | arg: -k, --key=     - the setting to delete
-#
-# Requires YunoHost version 2.2.4 or higher.
-ynh_app_setting_delete() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=ak
-    local -A args_array=( [a]=app= [k]=key= )
-    local app
-    local key
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    ynh_app_setting "delete" "$app" "$key"
-}
-
-# Small "hard-coded" interface to avoid calling "yunohost app" directly each
-# time dealing with a setting is needed (which may be so slow on ARM boards)
-#
-# [internal]
-#
-ynh_app_setting()
-{
-    if [[ "$1" == "delete" ]] && [[ "$3" =~ ^(unprotected|skipped)_ ]] 
-    then
-        current_value=$(ynh_app_setting_get --app=$app --key=$3)
-    fi
-
-    ACTION="$1" APP="$2" KEY="$3" VALUE="${4:-}" python2.7 - <<EOF
-import os, yaml, sys
-app, action = os.environ['APP'], os.environ['ACTION'].lower()
-key, value = os.environ['KEY'], os.environ.get('VALUE', None)
-setting_file = "/etc/yunohost/apps/%s/settings.yml" % app
-assert os.path.exists(setting_file), "Setting file %s does not exists ?" % setting_file
-with open(setting_file) as f:
-    settings = yaml.load(f)
-if action == "get":
-    if key in settings:
-        print(settings[key])
-else:
-    if action == "delete":
-        if key in settings:
-            del settings[key]
-    elif action == "set":
-        if key in ['redirected_urls', 'redirected_regex']:
-            value = yaml.load(value)
-        if any(key.startswith(word+"_") for word in ["unprotected", "protected", "skipped"]):
-            sys.stderr.write("/!\\ Packagers! This app is still using the skipped/protected/unprotected_uris/regex settings which are now obsolete and deprecated... Instead, you should use the new helpers 'ynh_permission_{create,urls,update,delete}' and the 'visitors' group to initialize the public/private access. Check out the documentation at the bottom of yunohost.org/groups_and_permissions to learn how to use the new permission mechanism.\n")
-        settings[key] = value
-    else:
-        raise ValueError("action should either be get, set or delete")
-    with open(setting_file, "w") as f:
-        yaml.safe_dump(settings, f, default_flow_style=False)
-EOF
-
-    # Fucking legacy permission management.
-    # We need this because app temporarily set the app as unprotected to configure it with curl...
-    if [[ "$3" =~ ^(unprotected|skipped)_ ]]
-    then
-        if [[ "$1" == "set" ]] && [[ "${4:-}" == "/" ]]
-        then
-            ynh_permission_update --permission "main" --add "visitors"
-        elif [[ "$1" == "delete" ]] && [[ "${current_value:-}" == "/" ]] && [[ -n "$(ynh_app_setting_get --app=$2 --key='is_public' )" ]]
-        then
-            ynh_permission_update --permission "main" --remove "visitors"
-        fi
-    fi
-}
-
-# Check availability of a web path
-#
-# example: ynh_webpath_available --domain=some.domain.tld --path_url=/coffee
-#
-# usage: ynh_webpath_available --domain=domain --path_url=path
-# | arg: -d, --domain=      - the domain/host of the url
-# | arg: -p, --path_url=    - the web path to check the availability of
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_webpath_available () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=dp
-    local -A args_array=( [d]=domain= [p]=path_url= )
-    local domain
-    local path_url
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    yunohost domain url-available $domain $path_url
-}
-
-# Register/book a web path for an app
-#
-# example: ynh_webpath_register --app=wordpress --domain=some.domain.tld --path_url=/coffee
-#
-# usage: ynh_webpath_register --app=app --domain=domain --path_url=path
-# | arg: -a, --app=         - the app for which the domain should be registered
-# | arg: -d, --domain=      - the domain/host of the web path
-# | arg: -p, --path_url=    - the web path to be registered
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_webpath_register () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=adp
-    local -A args_array=( [a]=app= [d]=domain= [p]=path_url= )
-    local app
-    local domain
-    local path_url
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    yunohost app register-url $app $domain $path_url
-}
-
-# Create a new permission for the app
-#
-# example: ynh_permission_create --permission=admin --url=/admin --allowed="alice bob"
-#
-# usage: ynh_permission_create --permission "permission" [--url=url] [--allowed="group1 group2"]
-# | arg: -p, --permission=  - the name for the permission (by default a permission named "main" already exist)
-# | arg: -u, --url=         - (optional) URL for which access will be allowed/forbidden
-# | arg: -a, --allowed=     - (optional) A list of group/user to allow for the permission
-#
-# If provided, 'url' is assumed to be relative to the app domain/path if they
-# start with '/'.  For example:
-#    /                             -> domain.tld/app
-#    /admin                        -> domain.tld/app/admin
-#    domain.tld/app/api            -> domain.tld/app/api
-#
-# 'url' can be later treated as a regex if it starts with "re:".
-# For example:
-#    re:/api/[A-Z]*$               -> domain.tld/app/api/[A-Z]*$
-#    re:domain.tld/app/api/[A-Z]*$ -> domain.tld/app/api/[A-Z]*$
-#
-# Requires YunoHost version 3.7.0 or higher.
-ynh_permission_create() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=pua
-    local -A args_array=( [p]=permission= [u]=url= [a]=allowed= )
-    local permission
-    local url
-    local allowed
-    ynh_handle_getopts_args "$@"
-    url=${url:-}
-    allowed=${allowed:-}
-
-    if [[ -n $url ]]
-    then
-        url="'$url'"
-    else
-        url="None"
-    fi
-
-    if [[ -n $allowed ]]; then
-        allowed=",allowed=['${allowed//';'/"','"}']"
-    fi
-    
-    yunohost tools shell -c "from yunohost.permission import permission_create; permission_create('$app.$permission', url=$url $allowed , sync_perm=False)"
-}
-
-# Remove a permission for the app (note that when the app is removed all permission is automatically removed)
-#
-# example: ynh_permission_delete --permission=editors
-#
-# usage: ynh_permission_delete --permission="permission"
-# | arg: -p, --permission=      - the name for the permission (by default a permission named "main" is removed automatically when the app is removed)
-#
-# Requires YunoHost version 3.7.0 or higher.
-ynh_permission_delete() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=p
-    local -A args_array=( [p]=permission= )
-    local permission
-    ynh_handle_getopts_args "$@"
-
-    yunohost tools shell -c "from yunohost.permission import permission_delete; permission_delete('$app.$permission', sync_perm=False)"
-}
-
-# Check if a permission exists
-#
-# usage: ynh_permission_exists --permission=permission
-# | arg: -p, --permission=      - the permission to check
-# | exit: Return 1 if the permission doesn't exist, 0 otherwise
-#
-# Requires YunoHost version 3.7.0 or higher.
-ynh_permission_exists() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=p
-    local -A args_array=( [p]=permission= )
-    local permission
-    ynh_handle_getopts_args "$@"
-
-    yunohost user permission list --short | grep --word-regexp --quiet "$app.$permission"
-}
-
-# Redefine the url associated to a permission
-#
-# usage: ynh_permission_url --permission="permission" [--url="url"]
-# | arg: -p, --permission=  - the name for the permission (by default a permission named "main" is removed automatically when the app is removed)
-# | arg: -u, --url=         - (optional) URL for which access will be allowed/forbidden
-#
-# Requires YunoHost version 3.7.0 or higher.
-ynh_permission_url() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=pu
-    local -A args_array=([p]=permission= [u]=url=)
-    local permission
-    local url
-    ynh_handle_getopts_args "$@"
-    url=${url:-}
-
-    if [[ -n $url ]]
-    then
-        url="'$url'"
-    else
-        url="None"
-    fi
-
-    yunohost tools shell -c "from yunohost.permission import permission_url; permission_url('$app.$permission', url=$url)"
-}
-
-
-# Update a permission for the app
-#
-# example: ynh_permission_update --permission admin --add=samdoe --remove=all_users
-#
-# usage: ynh_permission_update --permission="permission" [--add="group1 group2"] [--remove="group1 group2"]
-# | arg: -p, --permission=  - the name for the permission (by default a permission named "main" already exist)
-# | arg: -a, --add=         - the list of group or users to enable add to the permission
-# | arg: -r, --remove=      - the list of group or users to remove from the permission
-#
-# Requires YunoHost version 3.7.0 or higher.
-ynh_permission_update() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=par
-    local -A args_array=( [p]=permission= [a]=add= [r]=remove= )
-    local permission
-    local add
-    local remove
-    ynh_handle_getopts_args "$@"
-    add=${add:-}
-    remove=${remove:-}
-
-    if [[ -n $add ]]; then
-        add="--add ${add//';'/" "}"
-    fi
-    if [[ -n $remove ]]; then
-        remove="--remove ${remove//';'/" "} "
-    fi
-
-    yunohost user permission update "$app.$permission" $add $remove
-}
-
-# Check if a permission has an user
-#
-# example: ynh_permission_has_user --permission=main --user=visitors
-#
-# usage: ynh_permission_has_user --permission=permission --user=user
-# | arg: -p, --permission=  - the permission to check
-# | arg: -u, --user=        - the user seek in the permission
-# | exit: Return 1 if the permission doesn't have that user or doesn't exist, 0 otherwise
-#
-# Requires YunoHost version 3.7.1 or higher.
-ynh_permission_has_user() {
-    local legacy_args=pu
-    # Declare an array to define the options of this helper.
-    local -A args_array=( [p]=permission= [u]=user= )
-    local permission
-    local user
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    if ! ynh_permission_exists --permission=$permission
-    then
-        return 1
-    fi
-
-    yunohost user permission info "$app.$permission" | grep --word-regexp --quiet "$user"
-}

data/helpers.d/user

@@ -1,165 +0,0 @@
-#!/bin/bash
-
-# Check if a YunoHost user exists
-#
-# example: ynh_user_exists 'toto' || exit 1
-#
-# usage: ynh_user_exists --username=username
-# | arg: -u, --username=    - the username to check
-# | exit: Return 1 if the user doesn't exist, 0 otherwise
-#
-# Requires YunoHost version 2.2.4 or higher.
-ynh_user_exists() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=u
-    local -A args_array=( [u]=username= )
-    local username
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    yunohost user list --output-as json | grep --quiet "\"username\": \"${username}\""
-}
-
-# Retrieve a YunoHost user information
-#
-# example: mail=$(ynh_user_get_info 'toto' 'mail')
-#
-# usage: ynh_user_get_info --username=username --key=key
-# | arg: -u, --username=    - the username to retrieve info from
-# | arg: -k, --key=         - the key to retrieve
-# | ret: string - the key's value
-#
-# Requires YunoHost version 2.2.4 or higher.
-ynh_user_get_info() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=uk
-    local -A args_array=( [u]=username= [k]=key= )
-    local username
-    local key
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    yunohost user info "$username" --output-as plain | ynh_get_plain_key "$key"
-}
-
-# Get the list of YunoHost users
-#
-# example: for u in $(ynh_user_list); do ...
-#
-# usage: ynh_user_list
-# | ret: string - one username per line
-#
-# Requires YunoHost version 2.4.0 or higher.
-ynh_user_list() {
-    yunohost user list --output-as plain --quiet \
-        | awk '/^##username$/{getline; print}'
-}
-
-# Check if a user exists on the system
-#
-# usage: ynh_system_user_exists --username=username
-# | arg: -u, --username=    - the username to check
-# | exit: Return 1 if the user doesn't exist, 0 otherwise
-#
-# Requires YunoHost version 2.2.4 or higher.
-ynh_system_user_exists() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=u
-    local -A args_array=( [u]=username= )
-    local username
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    getent passwd "$username" &>/dev/null
-}
-
-# Check if a group exists on the system
-#
-# usage: ynh_system_group_exists --group=group
-# | arg: -g, --group=   - the group to check
-# | exit: Return 1 if the group doesn't exist, 0 otherwise
-#
-# Requires YunoHost version 3.5.0.2 or higher.
-ynh_system_group_exists() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=g
-    local -A args_array=( [g]=group= )
-    local group
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    getent group "$group" &>/dev/null
-}
-
-# Create a system user
-#
-# examples:
-#   # Create a nextcloud user with no home directory and /usr/sbin/nologin login shell (hence no login capability)
-#   ynh_system_user_create --username=nextcloud
-#   # Create a discourse user using /var/www/discourse as home directory and the default login shell
-#   ynh_system_user_create --username=discourse --home_dir=/var/www/discourse --use_shell 
-#
-# usage: ynh_system_user_create --username=user_name [--home_dir=home_dir] [--use_shell]
-# | arg: -u, --username=    - Name of the system user that will be create
-# | arg: -h, --home_dir=    - Path of the home dir for the user. Usually the final path of the app. If this argument is omitted, the user will be created without home
-# | arg: -s, --use_shell    - Create a user using the default login shell if present. If this argument is omitted, the user will be created with /usr/sbin/nologin shell
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_system_user_create () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=uhs
-    local -A args_array=( [u]=username= [h]=home_dir= [s]=use_shell )
-    local username
-    local home_dir
-    local use_shell
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    use_shell="${use_shell:-0}"
-    home_dir="${home_dir:-}"
-
-    if ! ynh_system_user_exists "$username"	# Check if the user exists on the system
-    then	# If the user doesn't exist
-        if [ -n "$home_dir" ]
-        then	# If a home dir is mentioned
-            local user_home_dir="--home-dir $home_dir"
-        else
-            local user_home_dir="--no-create-home"
-        fi
-        if [ $use_shell -eq 1 ]
-        then	# If we want a shell for the user
-            local shell="" # Use default shell
-        else
-            local shell="--shell /usr/sbin/nologin"
-        fi
-        useradd $user_home_dir --system --user-group $username $shell || ynh_die --message="Unable to create $username system account"
-    fi
-}
-
-# Delete a system user
-#
-# usage: ynh_system_user_delete --username=user_name
-# | arg: -u, --username=    - Name of the system user that will be create
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_system_user_delete () {
-    # Declare an array to define the options of this helper.
-    local legacy_args=u
-    local -A args_array=( [u]=username= )
-    local username
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    # Check if the user exists on the system
-    if ynh_system_user_exists "$username"
-    then
-        deluser $username
-    else
-        ynh_print_warn --message="The user $username was not found"
-    fi
-
-    # Check if the group exists on the system
-    if ynh_system_group_exists "$username"
-    then
-        delgroup $username
-    fi
-}