Update changelog for 11.2.30

Fix ynh_restore_everything

.codeclimate.yml

@@ -0,0 +1,24 @@
+---
+version: "2"
+plugins:
+  duplication:
+    enabled: true
+    config:
+      languages:
+        python:
+          python_version: 3
+  shellcheck:
+    enabled: true
+  pep8:
+    enabled: true
+  fixme:
+    enabled: true
+  sonar-python:
+    enabled: true
+    config:
+      tests_patterns:
+        - bin/*
+        - data/**
+        - doc/*
+        - src/**
+        - tests/**

.coveragerc

@@ -1,2 +1,2 @@
 [report]
-omit=src/yunohost/tests/*,src/yunohost/vendor/*,/usr/lib/moulinette/yunohost/*
+omit=src/tests/*,src/vendor/*,/usr/lib/moulinette/yunohost/*,/usr/lib/python3/dist-packages/yunohost/tests/*,/usr/lib/python3/dist-packages/yunohost/vendor/*

.github/workflows/autoblack.yml

@@ -0,0 +1,30 @@
+name: Check / auto apply Black
+
+on:
+  push:
+    branches: [ "dev" ]
+
+jobs:
+  black:
+    name: Check / auto apply black
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check files using the black formatter
+        uses: psf/black@stable
+        id: black
+        with:
+          options: "."
+        continue-on-error: true
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          title: "Format Python code with Black"
+          commit-message: ":art: Format Python code with Black"
+          body: |
+            This pull request uses the [psf/black](https://github.com/psf/black) formatter.
+          base: ${{ github.head_ref }} # Creates pull request onto pull request or commit branch
+          branch: actions/black

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "dev" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "dev" ]
+    paths-ignore:
+      - 'src/tests/**'
+  schedule:
+    - cron: '43 12 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/n_updater.yml

@@ -0,0 +1,39 @@
+# This workflow allows GitHub Actions to automagically update YunoHost NodeJS helper whenever a new release of n is detected.
+name: Check for new n releases
+on:
+  # Allow to manually trigger the workflow
+  workflow_dispatch:
+  # Run it every day at 5:00 UTC
+  schedule:
+    - cron:  '0 5 * * *'
+jobs:
+  updater:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch the source code
+        uses: actions/checkout@v4
+
+      - name: Run the updater script
+        id: run_updater
+        run: |
+          # Download n
+          wget https://raw.githubusercontent.com/tj/n/master/bin/n --output-document=helpers/vendor/n/n
+
+          echo "VERSION=$(sed -n 's/^VERSION=\"\(.*\)\"/\1/p' < helpers/vendor/n/n)" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        id: cpr
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Update n to ${{ env.VERSION }}
+          committer: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
+          author: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
+          signoff: false
+          base: dev
+          branch: ci-auto-update-n-${{ env.VERSION }}
+          delete-branch: true
+          title: 'Upgrade n to ${{ env.VERSION }}'
+          body: |
+            Upgrade `n` to ${{ env.VERSION }}
+          draft: false

.gitignore

@@ -31,7 +31,14 @@ pip-log.txt
 .mr.developer.cfg
 
 # moulinette lib
-src/yunohost/locales
+src/locales
 
 # Test
-src/yunohost/tests/apps
+src/tests/apps
+
+# Tmp/local doc stuff
+doc/bash-completion.sh
+doc/bash_completion.d
+doc/openapi.js
+doc/openapi.json
+doc/swagger

.gitlab-ci.yml

@@ -2,7 +2,7 @@
 stages:
   - build
   - install
-  - tests
+  - test
   - lint
   - doc
   - translation
@@ -13,20 +13,43 @@ default:
   # All jobs are interruptible by default
   interruptible: true
 
+code_quality:
+  tags:
+    - docker
+  rules:
+    - if: $CI_COMMIT_TAG # Only for tags
+
+
+code_quality_html:
+  extends: code_quality
+  variables:
+    REPORT_FORMAT: html
+  artifacts:
+    paths: [gl-code-quality-report.html]
+  rules:
+    - if: $CI_COMMIT_TAG # Only for tags
+
+
 # see: https://docs.gitlab.com/ee/ci/yaml/#switch-between-branch-pipelines-and-merge-request-pipelines
 workflow:
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event" # If we move to gitlab one day
     - if: $CI_PIPELINE_SOURCE == "external_pull_request_event" # For github PR
     - if: $CI_COMMIT_TAG # For tags
-    - if: $CI_COMMIT_REF_NAME == "ci-format-dev"  # Ignore black formatting branch created by the CI
+    - if: $CI_COMMIT_REF_NAME == "ci-format-$CI_DEFAULT_BRANCH"  # Ignore black formatting branch created by the CI
+      when: never
+    - if: $CI_COMMIT_REF_NAME == "actions/black"  # Ignore black formatting branch created by the CI
       when: never
     - if: $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH  && $CI_PIPELINE_SOURCE == "push" # If it's not the default branch and if it's a push, then do not trigger a build
       when: never
     - when: always
 
 variables:
-  YNH_BUILD_DIR: "ynh-build"
+  GIT_CLONE_PATH: '$CI_BUILDS_DIR/$CI_COMMIT_SHA/$CI_JOB_ID'
+  YNH_SOURCE: "https://github.com/yunohost"
+  YNH_DEBIAN: "bullseye"
+  YNH_SKIP_DIAGNOSIS_DURING_UPGRADE: "true"
 
 include:
+  - template: Code-Quality.gitlab-ci.yml
   - local: .gitlab/ci/*.gitlab-ci.yml

.gitlab/ci/build.gitlab-ci.yml

@@ -1,20 +1,22 @@
 .build-stage:
   stage: build
-  image: "before-install"
+  image: "build-and-lint"
   variables:
-    YNH_SOURCE: "https://github.com/yunohost"
+    YNH_BUILD_DIR: "$GIT_CLONE_PATH/build"
   before_script:
     - mkdir -p $YNH_BUILD_DIR
   artifacts:
     paths:
-      - $YNH_BUILD_DIR/*.deb
+      - ./*.deb
 
 .build_script: &build_script
   - cd $YNH_BUILD_DIR/$PACKAGE
   - VERSION=$(dpkg-parsechangelog -S Version 2>/dev/null)
-  - VERSION_NIGHTLY="${VERSION}+$(date +%Y%m%d%H%M)"
+  - VERSION_TIMESTAMPED="${VERSION}+$(date +%Y%m%d%H%M)"
-  - dch --package "${PACKAGE}" --force-bad-version -v "${VERSION_NIGHTLY}" -D "unstable" --force-distribution "Daily build."
+  - dch --package "${PACKAGE}" --force-bad-version -v "${VERSION_TIMESTAMPED}" -D "unstable" --force-distribution "CI build."
   - debuild --no-lintian -us -uc
+  - cp $YNH_BUILD_DIR/*.deb ${CI_PROJECT_DIR}/
+  - cd ${CI_PROJECT_DIR}
 
 ########################################
 # BUILD DEB
@@ -29,18 +31,16 @@ build-yunohost:
     - mkdir -p $YNH_BUILD_DIR/$PACKAGE
     - cat archive.tar.gz | tar -xz -C $YNH_BUILD_DIR/$PACKAGE
     - rm archive.tar.gz
-    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $(pwd)/$YNH_BUILD_DIR/$PACKAGE
+    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $YNH_BUILD_DIR/$PACKAGE
     - *build_script
 
-
 build-ssowat:
   extends: .build-stage
   variables:
     PACKAGE: "ssowat"
   script:
-    - DEBIAN_DEPENDS=$(cat debian/control | tr "," "\n" | grep -Po "ssowat \([>,=,<]+ .*\)" | grep -Po "[0-9\.]+")
+    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE -b $YNH_DEBIAN $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE --depth 1
-    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE -b $DEBIAN_DEPENDS $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE --depth 1
+    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $YNH_BUILD_DIR/$PACKAGE
-    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $(pwd)/$YNH_BUILD_DIR/$PACKAGE
     - *build_script
 
 build-moulinette:
@@ -48,7 +48,6 @@ build-moulinette:
   variables:
     PACKAGE: "moulinette"
   script:
-    - DEBIAN_DEPENDS=$(cat debian/control | tr "," "\n" | grep -Po "moulinette \([>,=,<]+ .*\)" | grep -Po "[0-9\.]+")
+    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE -b $YNH_DEBIAN $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE --depth 1
-    - git clone $YNH_SOURCE/$PACKAGE -b $CI_COMMIT_REF_NAME $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE -b $DEBIAN_DEPENDS $YNH_BUILD_DIR/$PACKAGE --depth 1 || git clone $YNH_SOURCE/$PACKAGE $YNH_BUILD_DIR/$PACKAGE --depth 1
+    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $YNH_BUILD_DIR/$PACKAGE
-    - DEBIAN_FRONTEND=noninteractive apt --assume-yes -o Dpkg::Options::="--force-confold" build-dep $(pwd)/$YNH_BUILD_DIR/$PACKAGE
     - *build_script

.gitlab/ci/doc.gitlab-ci.yml

@@ -4,24 +4,28 @@
 
 generate-helpers-doc:
   stage: doc
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   before_script:
-    - apt-get update -y && apt-get install git hub -y
     - git config --global user.email "yunohost@yunohost.org"
     - git config --global user.name "$GITHUB_USER"
   script:
     - cd doc
-    - python3 generate_helper_doc.py
+    - python3 generate_helper_doc.py 2
+    - python3 generate_helper_doc.py 2.1
+    - python3 generate_resource_doc.py > resources.md
     - hub clone https://$GITHUB_TOKEN:x-oauth-basic@github.com/YunoHost/doc.git doc_repo
-    - cp helpers.md doc_repo/pages/04.contribute/04.packaging_apps/11.helpers/packaging_apps_helpers.md
+    - cp helpers.v2.md doc_repo/pages/06.contribute/10.packaging_apps/20.scripts/10.helpers/packaging_app_scripts_helpers.md
+    - cp helpers.v2.1.md doc_repo/pages/06.contribute/10.packaging_apps/20.scripts/12.helpers21/packaging_app_scripts_helpers_v21.md
+    - cp resources.md doc_repo/pages/06.contribute/10.packaging_apps/10.manifest/10.appresources/packaging_app_manifest_resources.md
     - cd doc_repo
     # replace ${CI_COMMIT_REF_NAME} with ${CI_COMMIT_TAG} ?
     - hub checkout -b "${CI_COMMIT_REF_NAME}"
-    - hub commit -am "[CI] Helper for ${CI_COMMIT_REF_NAME}"
+    - hub commit -am "[CI] Update app helpers/resources for ${CI_COMMIT_REF_NAME}"
-    - hub pull-request -m "[CI] Helper for ${CI_COMMIT_REF_NAME}" -p # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
+    - hub pull-request -m "[CI] Update app helpers/resources for ${CI_COMMIT_REF_NAME}" -p # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
   artifacts:
     paths:
       - doc/helpers.md
+      - doc/resources.md
   only:
     - tags

.gitlab/ci/install.gitlab-ci.yml

@@ -14,16 +14,14 @@
 
 upgrade:
   extends: .install-stage
-  image: "after-install"
+  image: "core-tests"
   script:
-    - apt-get update -o Acquire::Retries=3
+    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ${CI_PROJECT_DIR}/*.deb
-    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb
 
 
 install-postinstall:
   extends: .install-stage
   image: "before-install"
   script:
-    - apt-get update -o Acquire::Retries=3
+    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ${CI_PROJECT_DIR}/*.deb
-    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb
+    - yunohost tools postinstall -d domain.tld -u syssa -F 'Syssa Mine' -p the_password --ignore-dyndns --force-diskspace
-    - yunohost tools postinstall -d domain.tld -p the_password --ignore-dyndns --force-diskspace

.gitlab/ci/lint.gitlab-ci.yml

@@ -3,47 +3,24 @@
 ########################################
 # later we must fix lint and format-check jobs and remove "allow_failure"
 
----
+lint39:
-lint37:
   stage: lint
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   allow_failure: true
   script:
-    - tox -e py37-lint
+    - tox -e py39-lint
 
-invalidcode37:
+invalidcode39:
   stage: lint
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   script:
-    - tox -e py37-invalidcode
+    - tox -e py39-invalidcode
 
 mypy:
   stage: lint
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   script:
-    - tox -e py37-mypy
+    - tox -e py39-mypy
-
-black:
-  stage: lint
-  image: "before-install"
-  needs: []
-  before_script:
-    - apt-get update -y && apt-get install git hub -y
-    - git config --global user.email "yunohost@yunohost.org"
-    - git config --global user.name "$GITHUB_USER"
-    - hub clone --branch ${CI_COMMIT_REF_NAME} "https://$GITHUB_TOKEN:x-oauth-basic@github.com/YunoHost/yunohost.git" github_repo
-    - cd github_repo
-  script:
-    # create a local branch that will overwrite distant one
-    - git checkout -b "ci-format-${CI_COMMIT_REF_NAME}" --no-track
-    - tox -e py37-black-run
-    - '[ $(git diff | wc -l) != 0 ] || exit 0'  # stop if there is nothing to commit
-    - git commit -am "[CI] Format code with Black" || true
-    - git push -f origin "ci-format-${CI_COMMIT_REF_NAME}":"ci-format-${CI_COMMIT_REF_NAME}"
-    - hub pull-request -m "[CI] Format code with Black" -b Yunohost:dev -p || true # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
-  only:
-    refs:
-      - dev

.gitlab/ci/test.gitlab-ci.yml

@@ -1,17 +1,16 @@
 .install_debs: &install_debs
-    - apt-get update -o Acquire::Retries=3
+    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ${CI_PROJECT_DIR}/*.deb
-    - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb
 
 .test-stage:
-  stage: tests
+  stage: test
-  image: "after-install"
+  image: "core-tests"
   variables:
     PYTEST_ADDOPTS: "--color=yes"
   before_script:
     - *install_debs
   cache:
     paths: 
-      - src/yunohost/tests/apps
+      - src/tests/apps
     key: "$CI_JOB_STAGE-$CI_COMMIT_REF_SLUG"
   needs:
       - job: build-yunohost
@@ -22,23 +21,21 @@
         artifacts: true
       - job: upgrade
 
-
 ########################################
 # TESTS
 ########################################
 
 full-tests:
-  stage: tests
+  stage: test
   image: "before-install"
   variables:
     PYTEST_ADDOPTS: "--color=yes"
   before_script:
     - *install_debs
-    - yunohost tools postinstall -d domain.tld -p the_password --ignore-dyndns --force-diskspace
+    - pip install mock pip pyOpenSSL pytest pytest-cov pytest-mock pytest-sugar requests-mock "packaging<22"
+    - yunohost tools postinstall -d domain.tld -u syssa -F 'Syssa Mine' -p the_password --ignore-dyndns --force-diskspace
   script:
-    - python3 -m pytest --cov=yunohost tests/ src/yunohost/tests/ data/hooks/diagnosis/ --junitxml=report.xml
+    - python3 -m pytest --cov=yunohost tests/ src/tests/ --junitxml=report.xml
-    - cd tests
-    - bash test_helpers.sh
   needs:
       - job: build-yunohost
         artifacts: true
@@ -46,163 +43,158 @@ full-tests:
         artifacts: true
       - job: build-moulinette
         artifacts: true
+  coverage: '/TOTAL.*\s+(\d+%)/'
   artifacts:
     reports:
       junit: report.xml
 
-test-i18n-keys:
-  extends: .test-stage
-  script:
-    - python3 -m pytest tests/test_i18n_keys.py
-  only:
-    changes:
-      - locales/en.json
-      - src/yunohost/*.py
-      - data/hooks/diagnosis/*.py
-
-test-translation-format-consistency:
-  extends: .test-stage
-  script:
-    - python3 -m pytest tests/test_translation_format_consistency.py
-  only:
-    changes:
-      - locales/*
-
 test-actionmap:
   extends: .test-stage
   script:
     - python3 -m pytest tests/test_actionmap.py
   only:
     changes:
-      - data/actionsmap/*.yml
+      - share/actionsmap.yml
 
-test-helpers:
+test-helpers2:
   extends: .test-stage
   script:
     - cd tests
     - bash test_helpers.sh
-  only:
+
-    changes:
+test-helpers2.1:
-      - data/helpers.d/*
+  extends: .test-stage
+  script:
+    - cd tests
+    - bash test_helpers.sh 2.1
 
 test-domains:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_domains.py
+    - python3 -m pytest src/tests/test_domains.py
   only:
     changes:
-      - src/yunohost/domain.py
+      - src/domain.py
 
 test-dns:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_dns.py
+    - python3 -m pytest src/tests/test_dns.py
   only:
     changes:
-      - src/yunohost/dns.py
+      - src/dns.py
-      - src/yunohost/utils/dns.py
+      - src/utils/dns.py
 
 test-apps:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_apps.py
+    - python3 -m pytest src/tests/test_apps.py
   only:
     changes:
-      - src/yunohost/app.py
+      - src/app.py
 
 test-appscatalog:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_app_catalog.py
+    - python3 -m pytest src/tests/test_app_catalog.py
   only:
     changes:
-      - src/yunohost/app_calalog.py
+      - src/app_calalog.py
 
 test-appurl:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_appurl.py
+    - python3 -m pytest src/tests/test_appurl.py
   only:
     changes:
-      - src/yunohost/app.py
+      - src/app.py
 
 test-questions:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_questions.py
+    - python3 -m pytest src/tests/test_questions.py
   only:
     changes:
-      - src/yunohost/utils/config.py
+      - src/utils/config.py
 
 test-app-config:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_app_config.py
+    - python3 -m pytest src/tests/test_app_config.py
   only:
     changes:
-      - src/yunohost/app.py
+      - src/app.py
-      - src/yunohost/utils/config.py
+      - src/utils/config.py
+
+test-app-resources:
+  extends: .test-stage
+  script:
+    - python3 -m pytest src/tests/test_app_resources.py
+  only:
+    changes:
+      - src/app.py
+      - src/utils/resources.py
 
 test-changeurl:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_changeurl.py
+    - python3 -m pytest src/tests/test_changeurl.py
   only:
     changes:
-      - src/yunohost/app.py
+      - src/app.py
 
 test-backuprestore:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_backuprestore.py
+    - python3 -m pytest src/tests/test_backuprestore.py
   only:
     changes:
-      - src/yunohost/backup.py
+      - src/backup.py
 
 test-permission:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_permission.py
+    - python3 -m pytest src/tests/test_permission.py
   only:
     changes:
-      - src/yunohost/permission.py
+      - src/permission.py
 
 test-settings:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_settings.py
+    - python3 -m pytest src/tests/test_settings.py
   only:
     changes:
-      - src/yunohost/settings.py
+      - src/settings.py
 
 test-user-group:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_user-group.py
+    - python3 -m pytest src/tests/test_user-group.py
   only:
     changes:
-      - src/yunohost/user.py
+      - src/user.py
 
 test-regenconf:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_regenconf.py
+    - python3 -m pytest src/tests/test_regenconf.py
   only:
     changes:
-      - src/yunohost/regenconf.py
+      - src/regenconf.py
 
 test-service:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_service.py
+    - python3 -m pytest src/tests/test_service.py
   only:
     changes:
-      - src/yunohost/service.py
+      - src/service.py
 
 test-ldapauth:
   extends: .test-stage
   script:
-    - python3 -m pytest src/yunohost/tests/test_ldapauth.py
+    - python3 -m pytest src/tests/test_ldapauth.py
   only:
     changes:
-      - src/yunohost/authenticators/*.py
+      - src/authenticators/*.py

.gitlab/ci/translation.gitlab-ci.yml

@@ -1,27 +1,34 @@
 ########################################
 # TRANSLATION
 ########################################
+test-i18n-keys:
+  stage: translation
+  script:
+    - python3 maintenance/missing_i18n_keys.py --check
+  only:
+    changes:
+      - locales/en.json
+      - src/*.py
+      - src/diagnosers/*.py
 
 autofix-translated-strings:
   stage: translation
-  image: "before-install"
+  image: "build-and-lint"
   needs: []
   before_script:
-    - apt-get update -y && apt-get install git hub -y
     - git config --global user.email "yunohost@yunohost.org"
     - git config --global user.name "$GITHUB_USER"
-    - git remote set-url origin https://$GITHUB_TOKEN:x-oauth-basic@github.com/YunoHost/yunohost.git
+    - hub clone --branch ${CI_COMMIT_REF_NAME} "https://$GITHUB_TOKEN:x-oauth-basic@github.com/YunoHost/yunohost.git" github_repo
+    - cd github_repo
   script:
-    - cd tests # Maybe move this script location to another folder?
     # create a local branch that will overwrite distant one
     - git checkout -b "ci-autofix-translated-strings-${CI_COMMIT_REF_NAME}" --no-track
-    - python3 remove_stale_translated_strings.py
+    - python3 maintenance/missing_i18n_keys.py --fix
-    - python3 autofix_locale_format.py
+    - python3 maintenance/autofix_locale_format.py
-    - python3 reformat_locales.py
+    - '[ $(git diff --ignore-blank-lines --ignore-all-space --ignore-space-at-eol --ignore-cr-at-eol | wc -l) != 0 ] || exit 0'  # stop if there is nothing to commit
-    - '[ $(git diff -w | wc -l) != 0 ] || exit 0'  # stop if there is nothing to commit
     - git commit -am "[CI] Reformat / remove stale translated strings" || true
-    - git push -f origin "HEAD":"ci-remove-stale-translated-strings-${CI_COMMIT_REF_NAME}"
+    - git push -f origin "ci-autofix-translated-strings-${CI_COMMIT_REF_NAME}":"ci-remove-stale-translated-strings-${CI_COMMIT_REF_NAME}"
-    - hub pull-request -m "[CI] Reformat / remove stale translated strings" -b Yunohost:dev -p || true # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
+    - hub pull-request -m "[CI] Reformat / remove stale translated strings" -b Yunohost:$CI_COMMIT_REF_NAME -p || true # GITHUB_USER and GITHUB_TOKEN registered here https://gitlab.com/yunohost/yunohost/-/settings/ci_cd
   only:
     variables:
       - $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH

CONTRIBUTORS.md

@@ -1,101 +0,0 @@
-YunoHost core contributors
-==========================
-
-YunoHost is built and maintained by the YunoHost project community.
-Everyone is encouraged to submit issues and changes, and to contribute in other ways -- see https://yunohost.org/contribute to find out how.
-
---
-
-Initial YunoHost core was built by Kload & beudbeud, for YunoHost v2.
-
-Most of code was written by Kload and jerome, with help of numerous contributors.
-
-Translation is made by a bunch of lovely people all over the world.
-
-We would like to thank anyone who ever helped the YunoHost project <3
-
-
-YunoHost core Contributors
---------------------------
-
-- Jérôme Lebleu
-- Kload
-- Laurent 'Bram' Peuch
-- Julien 'ju' Malik
-- opi
-- Aleks
-- Adrien 'beudbeud' Beudin
-- M5oul
-- Valentin 'zamentur' / 'ljf' Grimaud
-- Jocelyn Delalande
-- infertux
-- Taziden
-- ZeHiro
-- Josue-T
-- nahoj
-- a1ex
-- JimboJoe
-- vetetix
-- jellium
-- Sebastien 'sebian' Badia
-- lmangani
-- Julien Vaubourg
-- thardev
-- zimo2001
-
-
-YunoHost core Translators
--------------------------
-
-If you want to help translation, please visit https://translate.yunohost.org/projects/yunohost/yunohost/
-
-
-### Dutch
-
-- DUBWiSE
-- Jeroen Keerl
-- marut
-
-### English
-
-- Bugsbane
-- rokaz
-
-### French
-
-- aoz roon
-- Genma
-- Jean-Baptiste Holcroft
-- Jean P.
-- Jérôme Lebleu
-- Lapineige
-- paddy
-
-
-### German
-
-- david.bartke
-- Fabian Gruber
-- Felix Bartels
-- Jeroen Keerl
-- martin kistner
-- Philip Gatzka
-
-### Hindi
-
-- Anmol
-
-### Italian
-
-- bricabrac
-- Thomas Bille
-
-### Portuguese
-
-- Deleted User
-- Trollken
-
-### Spanish
-
-- Juanu
-

README.md

@@ -7,9 +7,10 @@
 <div align="center">
     
 ![Version](https://img.shields.io/github/v/tag/yunohost/yunohost?label=version&sort=semver)
-[![Build status](https://shields.io/gitlab/pipeline/yunohost/yunohost/dev)](https://gitlab.com/yunohost/yunohost/-/pipelines)
+[![Pipeline status](https://gitlab.com/yunohost/yunohost/badges/dev/pipeline.svg)](https://gitlab.com/yunohost/yunohost/-/pipelines)
-![Test coverage](https://img.shields.io/gitlab/coverage/yunohost/yunohost/dev)
+![Test coverage](https://gitlab.com/yunohost/yunohost/badges/dev/coverage.svg)
-[![GitHub license](https://img.shields.io/github/license/YunoHost/yunohost)](https://github.com/YunoHost/yunohost/blob/dev/LICENSE)
+[![Project license](https://img.shields.io/gitlab/license/yunohost/yunohost)](https://github.com/YunoHost/yunohost/blob/dev/LICENSE)
+[![CodeQL](https://github.com/yunohost/yunohost/workflows/CodeQL/badge.svg)](https://github.com/YunoHost/yunohost/security/code-scanning)
 [![Mastodon Follow](https://img.shields.io/mastodon/follow/28084)](https://mastodon.social/@yunohost)
 
 </div>
@@ -18,28 +19,49 @@ YunoHost is an operating system aiming to simplify as much as possible the admin
 
 This repository corresponds to the core code of YunoHost, mainly written in Python and Bash.
 
-- [Project features](https://yunohost.org/#/whatsyunohost)
+- [Project features](https://yunohost.org/whatsyunohost)
 - [Project website](https://yunohost.org)
 - [Install documentation](https://yunohost.org/install)
 - [Issue tracker](https://github.com/YunoHost/issues)
 
-# Screenshots
+## Screenshots
 
 Webadmin ([Yunohost-Admin](https://github.com/YunoHost/yunohost-admin)) | Single sign-on user portal ([SSOwat](https://github.com/YunoHost/ssowat))
---- |  ---
+--- | ---
-![](https://raw.githubusercontent.com/YunoHost/doc/master/images/webadmin.png) | ![](https://raw.githubusercontent.com/YunoHost/doc/master/images/user_panel.png)
+![Web admin insterface screenshot](https://raw.githubusercontent.com/YunoHost/doc/master/images/webadmin.png) | ![User portal screenshot](https://raw.githubusercontent.com/YunoHost/doc/master/images/user_panel.png)
 
 
 ## Contributing
 
 - You can learn how to get started with developing on YunoHost by reading [this piece of documentation](https://yunohost.org/dev).
-- Come chat with us on the [dev chatroom](https://yunohost.org/#/chat_rooms) !
+- Come chat with us on the [dev chatroom](https://yunohost.org/chat_rooms)!
-- You can help translate YunoHost on our [translation platform](https://translate.yunohost.org/engage/yunohost/?utm_source=widget)
+- You can help translate YunoHost on our [translation platform](https://translate.yunohost.org/engage/yunohost/?utm_source=widget).
 
 <p align="center">
-<img src="https://translate.yunohost.org/widgets/yunohost/-/core/horizontal-auto.svg" alt="Translation status" />
+<img alt="View of the translation rate for the different languages available in YunoHost" src="https://translate.yunohost.org/widgets/yunohost/-/core/horizontal-auto.svg" alt="Translation status" />
 </p>
 
 ## License
 
-As [other components of YunoHost](https://yunohost.org/#/faq_en), this repository is licensed under GNU AGPL v3.
+As [other components of YunoHost](https://yunohost.org/faq), this repository is licensed under GNU AGPL v3.
+
+## They support us <3
+
+We are thankful for our sponsors providing us with infrastructure and grants!
+
+<div align="center">
+<p style="margin-left:auto;margin-right:auto;">
+<a style="padding: 5px;" href="https://nlnet.nl"><img alt="NLnet Foundation" src="https://user-images.githubusercontent.com/36127788/198088570-823c40bd-7ac3-44e3-a8ee-e7a9f14b47ac.png" width="150px"/></a>
+<a style="padding: 5px;" href="https://www.ngi.eu"><img alt="Next Generation Internet" src="https://user-images.githubusercontent.com/36127788/198088663-daf587b9-fd09-4c00-aaf2-37c803939c94.png" width="130px"/></a>
+<a style="padding: 5px;" href="https://www.codelutin.com"><img alt="Code Lutin" src="https://user-images.githubusercontent.com/36127788/198088737-d37b6674-379c-4be4-9d74-b93b6ad318d1.png" width="100px"/></a>
+</p>
+<p style="margin-left:auto;margin-right:auto;">
+<a style="padding: 5px;" href="https://www.globenet.org"><img alt="Globenet" src="https://user-images.githubusercontent.com/36127788/198088794-751129ab-737d-4d99-9f35-5e01845dcdfe.png" width="150px"/></a>
+<a style="padding: 5px;" href="https://www.gitoyen.net"><img alt="Gitoyen" src="https://user-images.githubusercontent.com/36127788/198088931-f16f4af4-57ae-42e9-8d42-fb3e2d8d7ee3.png" width="150px"/></a>
+<a style="padding: 5px;" href="https://tetaneutral.net"><img alt="tetaneutral.net" src="https://user-images.githubusercontent.com/36127788/198088995-3ad9c34d-9807-4ead-934b-44df97d3c552.png" width="90px"/></a>
+<a style="padding: 5px;" href="https://ldn-fai.net"><img alt="LDN (Lorraine Data Network)" src="https://user-images.githubusercontent.com/36127788/198089086-a4089d51-9173-4081-bd2e-fa1ac3378e49.png" width="120px"/></a>
+<a style="padding: 5px;" href="https://www.nbs-system.com"><img alt="NBS System" src="https://user-images.githubusercontent.com/36127788/198089161-4cc0b7b7-bf56-4798-892e-a76112497921.png" width="130px"/></a>
+</p>
+</div>
+
+This project was funded through the [NGI0 PET](https://nlnet.nl/PET) Fund, a fund established by NLnet with financial support from the European Commission's [Next Generation Internet](https://ngi.eu/) programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310. If you're interested, [check out how to apply in this video](https://media.ccc.de/v/36c3-10795-ngi_zero_a_treasure_trove_of_it_innovation)! 

bin/yunohost

@@ -1,67 +1,78 @@
 #! /usr/bin/python3
-# -*- coding: utf-8 -*-
 
 import os
 import sys
 import argparse
-
-sys.path.insert(0, "/usr/lib/moulinette/")
 import yunohost
 
 
 def _parse_cli_args():
     """Parse additional arguments for the cli"""
     parser = argparse.ArgumentParser(add_help=False)
-    parser.add_argument('--output-as',
+    parser.add_argument(
-        choices=['json', 'plain', 'none'], default=None,
+        "--output-as",
-        help="Output result in another format"
+        choices=["json", "plain", "none"],
+        default=None,
+        help="Output result in another format",
     )
-    parser.add_argument('--debug',
+    parser.add_argument(
-        action='store_true', default=False,
+        "--debug",
-        help="Log and print debug messages"
+        action="store_true",
+        default=False,
+        help="Log and print debug messages",
     )
-    parser.add_argument('--quiet',
+    parser.add_argument(
-        action='store_true', default=False,
+        "--quiet", action="store_true", default=False, help="Don't produce any output"
-        help="Don't produce any output"
     )
-    parser.add_argument('--timeout',
+    parser.add_argument(
-        type=int, default=None,
+        "--version", action="store_true", default=False, help="Display YunoHost packages versions (alias to 'yunohost tools versions')"
-        help="Number of seconds before this command will timeout because it can't acquire the lock (meaning that another command is currently running), by default there is no timeout and the command will wait until it can get the lock"
+    )
+    parser.add_argument(
+        "--timeout",
+        type=int,
+        default=None,
+        help="Number of seconds before this command will timeout because it can't acquire the lock (meaning that another command is currently running), by default there is no timeout and the command will wait until it can get the lock",
     )
     # deprecated arguments
-    parser.add_argument('--plain',
+    parser.add_argument(
-        action='store_true', default=False, help=argparse.SUPPRESS
+        "--plain", action="store_true", default=False, help=argparse.SUPPRESS
     )
-    parser.add_argument('--json',
+    parser.add_argument(
-        action='store_true', default=False, help=argparse.SUPPRESS
+        "--json", action="store_true", default=False, help=argparse.SUPPRESS
     )
 
     opts, args = parser.parse_known_args()
 
     # output compatibility
     if opts.plain:
-        opts.output_as = 'plain'
+        opts.output_as = "plain"
     elif opts.json:
-        opts.output_as = 'json'
+        opts.output_as = "json"
 
     return (parser, opts, args)
 
 
 # Stupid PATH management because sometimes (e.g. some cron job) PATH is only /usr/bin:/bin ...
+
 default_path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 if os.environ["PATH"] != default_path:
     os.environ["PATH"] = default_path + ":" + os.environ["PATH"]
 
 # Main action ----------------------------------------------------------
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     if os.geteuid() != 0:
-        sys.stderr.write("\033[1;31mError:\033[0m yunohost command must be "
+        sys.stderr.write(
-                         "run as root or with sudo.\n")
+            "\033[1;31mError:\033[0m yunohost command must be "
+            "run as root or with sudo.\n"
+        )
         sys.exit(1)
 
     parser, opts, args = _parse_cli_args()
 
+    if opts.version:
+        args = ["tools", "versions"]
+
     # Execute the action
     yunohost.cli(
         debug=opts.debug,
@@ -69,5 +80,5 @@ if __name__ == '__main__':
         output_as=opts.output_as,
         timeout=opts.timeout,
         args=args,
-        parser=parser
+        parser=parser,
     )

bin/yunohost-api

@@ -1,44 +1,52 @@
 #! /usr/bin/python3
-# -*- coding: utf-8 -*-
 
-import sys
 import argparse
-
-sys.path.insert(0, "/usr/lib/moulinette/")
 import yunohost
 
 # Default server configuration
-DEFAULT_HOST = 'localhost'
+DEFAULT_HOST = "localhost"
 DEFAULT_PORT = 6787
 
 
 def _parse_api_args():
     """Parse main arguments for the api"""
-    parser = argparse.ArgumentParser(add_help=False,
+    parser = argparse.ArgumentParser(
+        add_help=False,
         description="Run the YunoHost API to manage your server.",
     )
-    srv_group = parser.add_argument_group('server configuration')
+    srv_group = parser.add_argument_group("server configuration")
-    srv_group.add_argument('-h', '--host',
+    srv_group.add_argument(
-        action='store', default=DEFAULT_HOST,
+        "-h",
+        "--host",
+        action="store",
+        default=DEFAULT_HOST,
         help="Host to listen on (default: %s)" % DEFAULT_HOST,
     )
-    srv_group.add_argument('-p', '--port',
+    srv_group.add_argument(
-        action='store', default=DEFAULT_PORT, type=int,
+        "-p",
+        "--port",
+        action="store",
+        default=DEFAULT_PORT,
+        type=int,
         help="Port to listen on (default: %d)" % DEFAULT_PORT,
     )
-    glob_group = parser.add_argument_group('global arguments')
+    glob_group = parser.add_argument_group("global arguments")
-    glob_group.add_argument('--debug',
+    glob_group.add_argument(
-        action='store_true', default=False,
+        "--debug",
+        action="store_true",
+        default=False,
         help="Set log level to DEBUG",
     )
-    glob_group.add_argument('--help',
+    glob_group.add_argument(
-        action='help', help="Show this help message and exit",
+        "--help",
+        action="help",
+        help="Show this help message and exit",
     )
 
     return parser.parse_args()
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     opts = _parse_api_args()
     # Run the server
     yunohost.api(debug=opts.debug, host=opts.host, port=opts.port)

bin/yunomdns

@@ -21,8 +21,20 @@ def get_network_local_interfaces() -> Dict[str, Dict[str, List[str]]]:
 
     interfaces = {
         adapter.name: {
-            "ipv4": [ip.ip for ip in adapter.ips if ip.is_IPv4 and ip_address(ip.ip).is_private],
+            "ipv4": [
-            "ipv6": [ip.ip[0] for ip in adapter.ips if ip.is_IPv6 and ip_address(ip.ip[0]).is_private and not ip_address(ip.ip[0]).is_link_local],
+                ip.ip
+                for ip in adapter.ips
+                if ip.is_IPv4
+                and ip_address(ip.ip).is_private
+                and not ip_address(ip.ip).is_link_local
+            ],
+            "ipv6": [
+                ip.ip[0]
+                for ip in adapter.ips
+                if ip.is_IPv6
+                and ip_address(ip.ip[0]).is_private
+                and not ip_address(ip.ip[0]).is_link_local
+            ],
         }
         for adapter in ifaddr.get_adapters()
         if adapter.name != "lo"
@@ -33,7 +45,6 @@ def get_network_local_interfaces() -> Dict[str, Dict[str, List[str]]]:
 # Listener class, to detect duplicates on the network
 # Stores the list of servers in its list property
 class Listener:
-
     def __init__(self):
         self.list = []
 
@@ -66,14 +77,18 @@ def main() -> bool:
         return False
 
     if "interfaces" not in config:
-        config["interfaces"] = [interface
+        config["interfaces"] = [
-                                for interface, local_ips in interfaces.items()
+            interface
-                                if local_ips["ipv4"]]
+            for interface, local_ips in interfaces.items()
+            if local_ips["ipv4"]
+        ]
 
     if "ban_interfaces" in config:
-        config["interfaces"] = [interface
+        config["interfaces"] = [
-                                for interface in config["interfaces"]
+            interface
-                                if interface not in config["ban_interfaces"]]
+            for interface in config["interfaces"]
+            if interface not in config["ban_interfaces"]
+        ]
 
     # Let's discover currently published .local domains accross the network
     zc = Zeroconf()
@@ -103,14 +118,18 @@ def main() -> bool:
 
         return domain_i
 
-    config['domains'] = [find_domain_not_already_published(domain) for domain in config['domains']]
+    config["domains"] = [
+        find_domain_not_already_published(domain) for domain in config["domains"]
+    ]
 
     zcs: Dict[Zeroconf, List[ServiceInfo]] = {}
 
     for interface in config["interfaces"]:
 
         if interface not in interfaces:
-            print(f"Interface {interface} listed in config file is not present on system.")
+            print(
+                f"Interface {interface} listed in config file is not present on system."
+            )
             continue
 
         # Only broadcast IPv4 because IPv6 is buggy ... because we ain't using python3-ifaddr >= 0.1.7
@@ -149,7 +168,9 @@ def main() -> bool:
     print("Registering...")
     for zc, infos in zcs.items():
         for info in infos:
-            zc.register_service(info, allow_name_change=True, cooperating_responders=True)
+            zc.register_service(
+                info, allow_name_change=True, cooperating_responders=True
+            )
 
     try:
         print("Registered. Press Ctrl+C or stop service to stop.")

bin/yunopaste

@@ -1,77 +1,34 @@
-#!/bin/bash
+#!/usr/bin/env python3
 
-set -e
+import sys
-set -u
+import requests
+import json
 
-PASTE_URL="https://paste.yunohost.org"
+SERVER_URL = "https://paste.yunohost.org"
+TIMEOUT = 3
 
-_die() {
+def create_snippet(data):
-  printf "Error: %s\n" "$*"
+    try:
-  exit 1
+        url = SERVER_URL + "/documents"
-}
+        response = requests.post(url, data=data.encode('utf-8'), timeout=TIMEOUT)
+        response.raise_for_status()
+        dockey = json.loads(response.text)['key']
+        return SERVER_URL + "/raw/" + dockey
+    except requests.exceptions.RequestException as e:
+        print("\033[31mError: {}\033[0m".format(e))
+        sys.exit(1)
 
-check_dependencies() {
-  curl -V > /dev/null 2>&1 || _die "This script requires curl."
-}
 
-paste_data() {
+def main():
-  json=$(curl -X POST -s -d "$1" "${PASTE_URL}/documents")
+    output = sys.stdin.read()
-  [[ -z "$json" ]] && _die "Unable to post the data to the server."
 
-  key=$(echo "$json" \
+    if not output:
-    | python -c 'import json,sys;o=json.load(sys.stdin);print o["key"]' \
+        print("\033[31mError: No input received from stdin.\033[0m")
-        2>/dev/null)
+        sys.exit(1)
-  [[ -z "$key" ]] && _die "Unable to parse the server response."
 
-  echo "${PASTE_URL}/${key}"
+    url = create_snippet(output)
-}
 
-usage() {
+    print("\033[32mURL: {}\033[0m".format(url))
-  printf "Usage: ${0} [OPTION]...
 
-Read from input stream and paste the data to the YunoHost
+if __name__ == "__main__":
-Haste server.
+    main()
-
-For example, to paste the output of the YunoHost diagnosis, you
-can simply execute the following:
-  yunohost diagnosis show | ${0}
-
-It will return the URL where you can access the pasted data.
-
-Options:
-  -h, --help   show this help message and exit
-"
-}
-
-main() {
-  # parse options
-  while (( ${#} )); do
-    case "${1}" in
-      --help|-h)
-        usage
-        exit 0
-        ;;
-      *)
-        echo "Unknown parameter detected: ${1}" >&2
-        echo >&2
-        usage >&2
-        exit 1
-        ;;
-    esac
-
-    shift 1
-  done
-
-  # check input stream
-  read -t 0 || {
-    echo -e "Invalid usage: No input is provided.\n" >&2
-    usage
-    exit 1
-  }
-
-  paste_data "$(cat)"
-}
-
-check_dependencies
-
-main "${@}"

bin/yunoprompt

@@ -56,7 +56,7 @@ EOF
 
 echo "$LOGO_AND_FINGERPRINTS" > /etc/issue
 
-if [[ ! -f /etc/yunohost/installed ]]
+if ! groups | grep -q all_users && [[ ! -f /etc/yunohost/installed ]]
 then
     chvt 2
 
@@ -69,7 +69,7 @@ then
 You should now proceed with YunoHost post-installation. This is where you will
 be asked for:
   - the main domain of your server;
-  - the administration password.
+  - the username and password for the first admin
 
 You can perform this step:
   - from your web browser, by accessing: https://yunohost.local/ or ${local_ip}

conf/dovecot/dovecot.conf

@@ -10,7 +10,7 @@ mail_uid = 500
 
 protocols = imap sieve {% if pop3_enabled == "True" %}pop3{% endif %}
 
-mail_plugins = $mail_plugins quota
+mail_plugins = $mail_plugins quota notify push_notification
 
 ###############################################################################
 
@@ -21,9 +21,14 @@ ssl = required
 
 ssl_cert = </etc/yunohost/certs/{{ main_domain }}/crt.pem
 ssl_key = </etc/yunohost/certs/{{ main_domain }}/key.pem
+{% for domain in domain_list.split() %}{% if domain != main_domain %}
+local_name {{ domain }} {
+  ssl_cert = </etc/yunohost/certs/{{ domain }}/crt.pem
+  ssl_key = </etc/yunohost/certs/{{ domain }}/key.pem
+}{% endif %}{% endfor %}
 
 # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
-ssl_dh = </usr/share/yunohost/other/ffdhe2048.pem
+ssl_dh = </usr/share/yunohost/ffdhe2048.pem
 
 # intermediate configuration
 ssl_min_protocol = TLSv1.2
@@ -33,14 +38,26 @@ ssl_prefer_server_ciphers = no
 ###############################################################################
 
 
+# Regular Yunohost accounts
 passdb {
   args = /etc/dovecot/dovecot-ldap.conf
   driver = ldap
 }
 
+# Internally, allow authentication from apps system user who have "enable_email = true"
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/app-senders-passwd
+}
+
 userdb {
-  args = /etc/dovecot/dovecot-ldap.conf
   driver = ldap
+  args = /etc/dovecot/dovecot-ldap.conf
+}
+
+userdb {
+  driver = passwd-file
+  args = username_format=%n /etc/dovecot/app-senders-passwd
 }
 
 protocol imap {
@@ -48,13 +65,40 @@ protocol imap {
   mail_plugins = $mail_plugins imap_quota antispam
 }
 
-
 protocol lda {
   auth_socket_path = /var/run/dovecot/auth-master
   mail_plugins = quota sieve
   postmaster_address = postmaster@{{ main_domain }}
 }
 
+namespace inbox {
+  inbox = yes
+
+  mailbox Drafts {
+    special_use = \Drafts
+    auto = subscribe
+  }
+  mailbox Junk {
+    special_use = \Junk
+    auto = subscribe
+  }
+  mailbox Trash {
+    special_use = \Trash
+    auto = subscribe
+  }
+  mailbox Sent {
+    special_use = \Sent
+    auto = subscribe
+  }
+  mailbox "Sent Messages" {
+    special_use = \Sent
+  }
+  mailbox "Archive" {
+    special_use = \Archive
+    auto = subscribe
+  }
+}
+
 protocol sieve {
 }
 
@@ -102,8 +146,8 @@ plugin {
   antispam_debug_target = syslog
   antispam_verbose_debug = 0
   antispam_backend = pipe
-  antispam_spam = Junk;SPAM
+  antispam_spam_pattern_ignorecase = junk;spam
-  antispam_trash = Trash
+  antispam_trash_pattern_ignorecase = trash;papierkorb;deleted messages
   antispam_pipe_program = /usr/bin/rspamc
   antispam_pipe_program_args = -h;localhost:11334;-P;q1
   antispam_pipe_program_spam_arg = learn_spam

conf/dovecot/dovecot.sieve

@@ -1,4 +1,4 @@
 require "fileinto"; 
-    if header :contains "X-Spam-Flag" "YES" { 
+    if header :contains "X-Spam-Flag" "Yes" { 
         fileinto "Junk"; 
     }

conf/fail2ban/postfix-sasl.conf

@@ -0,0 +1,6 @@
+# Fail2Ban filter for postfix authentication failures
+[INCLUDES]
+before = common.conf
+[Definition]
+_daemon = postfix/smtpd
+failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$

conf/fail2ban/yunohost-jails.conf

@@ -8,6 +8,13 @@ enabled = true
 [postfix]
 enabled = true
 
+[sasl]
+enabled  = true
+port     = smtp
+filter   = postfix-sasl
+logpath  = /var/log/mail.log
+maxretry = 5
+
 [dovecot]
 enabled = true
 

conf/mdns/yunomdns.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=YunoHost mDNS service
-After=network.target
+Wants=network-online.target
+After=network-online.target
 
 [Service]
 User=mdns
@@ -8,7 +9,7 @@ Group=mdns
 Type=simple
 Environment=PYTHONUNBUFFERED=1
 ExecStart=/usr/bin/yunomdns
-StandardOutput=syslog
+StandardOutput=journal
 
 [Install]
 WantedBy=default.target

conf/metronome/domain.tpl.cfg.lua

@@ -0,0 +1,75 @@
+VirtualHost "{{ domain }}"
+    enable = true
+    ssl = {
+                key = "/etc/yunohost/certs/{{ domain }}/key.pem";
+                certificate = "/etc/yunohost/certs/{{ domain }}/crt.pem";
+    }
+    authentication = "ldap2"
+    ldap = {
+         hostname      = "localhost",
+         user = {
+             basedn        = "ou=users,dc=yunohost,dc=org",
+             filter        = "(&(objectClass=posixAccount)(mail=*@{{ domain }})(permission=cn=xmpp.main,ou=permission,dc=yunohost,dc=org))",
+             usernamefield = "mail",
+             namefield     = "cn",
+             },
+    }
+
+    -- Discovery items
+    disco_items = {
+        { "muc.{{ domain }}" },
+        { "pubsub.{{ domain }}" },
+        { "jabber.{{ domain }}" },
+        { "vjud.{{ domain }}" },
+        { "xmpp-upload.{{ domain }}" },
+    };
+
+--  contact_info = {
+--    abuse = { "mailto:abuse@{{ domain }}", "xmpp:admin@{{ domain }}" };
+--    admin = { "mailto:root@{{ domain }}", "xmpp:admin@{{ domain }}" };
+--  };
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+
+---Set up a MUC (multi-user chat) room server
+Component "muc.{{ domain }}" "muc"
+    name = "{{ domain }} Chatrooms"
+
+    modules_enabled = {
+        "muc_limits";
+        "muc_log";
+        "muc_log_mam";
+        "muc_log_http";
+        "muc_vcard";
+    }
+
+    muc_event_rate = 0.5
+    muc_burst_factor = 10
+    room_default_config = {
+        logging = true,
+        persistent = true
+    };
+
+---Set up a PubSub server
+Component "pubsub.{{ domain }}" "pubsub"
+    name = "{{ domain }} Publish/Subscribe"
+
+    unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server)
+
+---Set up a HTTP Upload service
+Component "xmpp-upload.{{ domain }}" "http_upload"
+    name = "{{ domain }} Sharing Service"
+
+    http_file_path = "/var/xmpp-upload/{{ domain }}/upload"
+    http_external_url = "https://xmpp-upload.{{ domain }}:443"
+    http_file_base_path = "/upload"
+    http_file_size_limit = 6*1024*1024
+    http_file_quota = 60*1024*1024
+    http_upload_file_size_limit = 100 * 1024 * 1024 -- bytes
+    http_upload_quota = 10 * 1024 * 1024 * 1024 -- bytes
+
+---Set up a VJUD service
+Component "vjud.{{ domain }}" "vjud"
+    vjud_disco_name = "{{ domain }} User Directory"

conf/metronome/metronome.cfg.lua

@@ -0,0 +1,123 @@
+-- ** Metronome's config file example **
+--
+-- The format is exactly equal to Prosody's:
+--
+-- Lists are written { "like", "this", "one" }
+-- Lists can also be of { 1, 2, 3 } numbers, etc.
+-- Either commas, or semi-colons; may be used as seperators.
+--
+-- A table is a list of values, except each value has a name. An
+-- example would be:
+--
+-- ssl = { key = "keyfile.key", certificate = "certificate.cert" }
+--
+-- Tip: You can check that the syntax of this file is correct when you have finished
+-- by running: luac -p metronome.cfg.lua
+-- If there are any errors, it will let you know what and where they are, otherwise it
+-- will keep quiet.
+
+-- Global settings go in this section
+
+-- This is the list of modules Metronome will load on startup.
+-- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
+
+modules_enabled = {
+    -- Generally required
+        "roster"; -- Allow users to have a roster. Recommended.
+        "saslauth"; -- Authentication for clients. Recommended if you want to log in.
+        "tls"; -- Add support for secure TLS on c2s/s2s connections
+        "disco"; -- Service discovery
+
+    -- Not essential, but recommended
+        "private"; -- Private XML storage (for room bookmarks, etc.)
+        "vcard"; -- Allow users to set vCards
+        "pep"; -- Allows setting of mood, tune, etc.
+        "pubsub";  -- Publish-subscribe XEP-0060
+        "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
+        "bidi"; -- Enables Bidirectional Server-to-Server Streams.
+
+    -- Nice to have
+        "version"; -- Replies to server version requests
+        "uptime"; -- Report how long server has been running
+        "time"; -- Let others know the time here on this server
+        "ping"; -- Replies to XMPP pings with pongs
+        "register"; -- Allow users to register on this server using a client and change passwords
+        "stream_management"; -- Allows clients and servers to use Stream Management
+        "stanza_optimizations"; -- Allows clients to use Client State Indication and SIFT
+        "message_carbons"; -- Allows clients to enable carbon copies of messages
+        "mam"; -- Enable server-side message archives using Message Archive Management
+        "push"; -- Enable Push Notifications via PubSub using XEP-0357
+        "lastactivity"; -- Enables clients to know the last presence status of an user
+        "adhoc_cm"; -- Allow to set client certificates to login through SASL External via adhoc
+        "admin_adhoc"; -- administration adhoc commands
+        "bookmarks"; -- XEP-0048 Bookmarks synchronization between PEP and Private Storage
+        "sec_labels"; -- Allows to use a simplified version XEP-0258 Security Labels and related ACDFs.
+        "privacy"; -- Add privacy lists and simple blocking command support
+
+        -- Other specific functionality
+        --"admin_telnet"; -- administration console, telnet to port 5582
+        --"admin_web"; -- administration web interface
+        "bosh"; -- Enable support for BOSH clients, aka "XMPP over Bidirectional Streams over Synchronous HTTP"
+        --"compression"; -- Allow clients to enable Stream Compression
+        --"spim_block"; -- Require authorization via OOB form for messages from non-contacts and block unsollicited messages
+        --"gate_guard"; -- Enable config-based blacklisting and hit-based auto-banning features
+        --"incidents_handling"; -- Enable Incidents Handling support (can be administered via adhoc commands)
+        --"server_presence"; -- Enables Server Buddies extension support
+        --"service_directory"; -- Enables Service Directories extension support
+        --"public_service"; -- Enables Server vCard support for public services in directories and advertises in features
+        --"register_api"; -- Provides secure API for both Out-Of-Band and In-Band registration for E-Mail verification
+        "websocket"; -- Enable support for WebSocket clients, aka "XMPP over WebSockets"
+};
+
+-- Server PID
+pidfile = "/var/run/metronome/metronome.pid"
+
+-- HTTP server
+http_ports = { 5290 }
+http_interfaces = { "127.0.0.1", "::1" }
+
+--https_ports = { 5291 }
+--https_interfaces = { "127.0.0.1", "::1" }
+
+-- Enable IPv6
+use_ipv6 = true
+
+-- BOSH configuration (mod_bosh)
+consider_bosh_secure = true
+cross_domain_bosh = true
+
+-- WebSocket configuration (mod_websocket)
+consider_websocket_secure = true
+cross_domain_websocket = true
+
+-- Disable account creation by default, for security
+allow_registration = false
+
+-- Use LDAP storage backend for all stores
+storage = "ldap"
+
+-- stanza optimization
+csi_config_queue_all_muc_messages_but_mentions = false;
+
+
+-- Logging configuration
+log = {
+    info = "/var/log/metronome/metronome.log"; -- Change 'info' to 'debug' for verbose logging
+    error = "/var/log/metronome/metronome.err";
+    -- "*syslog"; -- Uncomment this for logging to syslog
+    -- "*console"; -- Log to the console, useful for debugging with daemonize=false
+}
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+
+---Set up a local BOSH service
+Component "localhost" "http"
+    modules_enabled = { "bosh" }
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Metronome to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+Include "conf.d/*.cfg.lua"

conf/metronome/modules/mod_auth_ldap2.lua

@@ -0,0 +1,90 @@
+-- vim:sts=4 sw=4
+
+-- Metronome IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+-- Copyright (C) 2012 Rob Hoelz
+-- Copyright (C) 2015 YUNOHOST.ORG
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+--
+-- https://github.com/YunoHost/yunohost-config-metronome/blob/unstable/lib/modules/mod_auth_ldap2.lua
+-- adapted to use common LDAP store on Metronome
+
+local ldap     = module:require 'ldap';
+local new_sasl = require 'util.sasl'.new;
+local jsplit   = require 'util.jid'.split;
+
+local log = module._log
+
+if not ldap then
+    return;
+end
+
+function new_default_provider(host)
+    local provider = { name = "ldap2" };
+    log("debug", "initializing ldap2 authentication provider for host '%s'", host);
+
+    function provider.test_password(username, password)
+        return ldap.bind(username, password);
+    end
+
+    function provider.user_exists(username)
+        local params = ldap.getparams()
+
+        local filter = ldap.filter.combine_and(params.user.filter, params.user.usernamefield .. '=' .. username);
+        if params.user.usernamefield == 'mail' then
+            filter = ldap.filter.combine_and(params.user.filter, 'mail=' .. username .. '@*');
+        end
+
+        return ldap.singlematch {
+            base   = params.user.basedn,
+            filter = filter,
+        };
+    end
+
+    function provider.get_password(username)
+        return nil, "Passwords unavailable for LDAP.";
+    end
+
+    function provider.set_password(username, password)
+        return nil, "Passwords unavailable for LDAP.";
+    end
+
+    function provider.create_user(username, password)
+        return nil, "Account creation/modification not available with LDAP.";
+    end
+
+    function provider.get_sasl_handler(session)
+        local testpass_authentication_profile = {
+            session = session,
+            plain_test = function(sasl, username, password, realm)
+                return provider.test_password(username, password), true;
+            end,
+            order = { "plain_test" },
+        };
+        return new_sasl(module.host, testpass_authentication_profile);
+    end
+
+    function provider.is_admin(jid)
+        local admin_config = ldap.getparams().admin;
+
+        if not admin_config then
+            return;
+        end
+
+        local ld       = ldap:getconnection();
+        local username = jsplit(jid);
+        local filter   = ldap.filter.combine_and(admin_config.filter, admin_config.namefield .. '=' .. username);
+
+        return ldap.singlematch {
+            base   = admin_config.basedn,
+            filter = filter,
+        };
+    end
+
+    return provider;
+end
+
+module:add_item("auth-provider", new_default_provider(module.host));

conf/metronome/modules/mod_legacyauth.lua

@@ -0,0 +1,86 @@
+-- Prosody IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+--
+
+
+
+local st = require "util.stanza";
+local t_concat = table.concat;
+
+local secure_auth_only = module:get_option("c2s_require_encryption")
+    or module:get_option("require_encryption")
+    or not(module:get_option("allow_unencrypted_plain_auth"));
+
+local sessionmanager = require "core.sessionmanager";
+local usermanager = require "core.usermanager";
+local nodeprep = require "util.encodings".stringprep.nodeprep;
+local resourceprep = require "util.encodings".stringprep.resourceprep;
+
+module:add_feature("jabber:iq:auth");
+module:hook("stream-features", function(event)
+    local origin, features = event.origin, event.features;
+    if secure_auth_only and not origin.secure then
+        -- Sorry, not offering to insecure streams!
+        return;
+    elseif not origin.username then
+        features:tag("auth", {xmlns='http://jabber.org/features/iq-auth'}):up();
+    end
+end);
+
+module:hook("stanza/iq/jabber:iq:auth:query", function(event)
+    local session, stanza = event.origin, event.stanza;
+
+    if session.type ~= "c2s_unauthed" then
+        (session.sends2s or session.send)(st.error_reply(stanza, "cancel", "service-unavailable", "Legacy authentication is only allowed for unauthenticated client connections."));
+        return true;
+    end
+
+    if secure_auth_only and not session.secure then
+        session.send(st.error_reply(stanza, "modify", "not-acceptable", "Encryption (SSL or TLS) is required to connect to this server"));
+        return true;
+    end
+
+    local username = stanza.tags[1]:child_with_name("username");
+    local password = stanza.tags[1]:child_with_name("password");
+    local resource = stanza.tags[1]:child_with_name("resource");
+    if not (username and password and resource) then
+        local reply = st.reply(stanza);
+        session.send(reply:query("jabber:iq:auth")
+            :tag("username"):up()
+            :tag("password"):up()
+            :tag("resource"):up());
+    else
+        username, password, resource = t_concat(username), t_concat(password), t_concat(resource);
+        username = nodeprep(username);
+        resource = resourceprep(resource)
+        if not (username and resource) then
+            session.send(st.error_reply(stanza, "modify", "bad-request"));
+            return true;
+        end
+        if usermanager.test_password(username, session.host, password) then
+            -- Authentication successful!
+            local success, err = sessionmanager.make_authenticated(session, username);
+            if success then
+                local err_type, err_msg;
+                success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource);
+                if not success then
+                    session.send(st.error_reply(stanza, err_type, err, err_msg));
+                    session.username, session.type = nil, "c2s_unauthed"; -- FIXME should this be placed in sessionmanager?
+                    return true;
+                elseif resource ~= session.resource then -- server changed resource, not supported by legacy auth
+                    session.send(st.error_reply(stanza, "cancel", "conflict", "The requested resource could not be assigned to this session."));
+                    session:close(); -- FIXME undo resource bind and auth instead of closing the session?
+                    return true;
+                end
+            end
+            session.send(st.reply(stanza));
+        else
+            session.send(st.error_reply(stanza, "auth", "not-authorized"));
+        end
+    end
+    return true;
+end);

conf/metronome/modules/mod_storage_ldap.lua

@@ -0,0 +1,243 @@
+-- vim:sts=4 sw=4
+
+-- Metronome IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+-- Copyright (C) 2012 Rob Hoelz
+-- Copyright (C) 2015 YUNOHOST.ORG
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+
+----------------------------------------
+-- Constants and such --
+----------------------------------------
+
+local setmetatable = setmetatable;
+
+local get_config = require "core.configmanager".get;
+local ldap       = module:require 'ldap';
+local vcardlib   = module:require 'vcard';
+local st         = require 'util.stanza';
+local gettime    = require 'socket'.gettime;
+
+local log = module._log
+
+if not ldap then
+    return;
+end
+
+local CACHE_EXPIRY = 300;
+
+----------------------------------------
+-- Utility Functions --
+----------------------------------------
+
+local function ldap_record_to_vcard(record, format)
+    return vcardlib.create {
+        record = record,
+        format = format,
+    }
+end
+
+local get_alias_for_user;
+
+do
+    local user_cache;
+    local last_fetch_time;
+
+    local function populate_user_cache()
+        local user_c = get_config(module.host, 'ldap').user;
+        if not user_c then return; end
+
+        local ld = ldap.getconnection();
+
+        local usernamefield = user_c.usernamefield;
+        local namefield     = user_c.namefield;
+
+        user_cache = {};
+
+        for _, attrs in ld:search { base = user_c.basedn, scope = 'onelevel', filter = user_c.filter } do
+            user_cache[attrs[usernamefield]] = attrs[namefield];
+        end
+        last_fetch_time = gettime();
+    end
+
+    function get_alias_for_user(user)
+        if last_fetch_time and last_fetch_time + CACHE_EXPIRY < gettime() then
+            user_cache = nil;
+        end
+        if not user_cache then
+            populate_user_cache();
+        end
+        return user_cache[user];
+    end
+end
+
+----------------------------------------
+-- Base LDAP store class --
+----------------------------------------
+
+local function ldap_store(config)
+    local self = {};
+    local config = config;
+
+    function self:get(username)
+        return nil, "Data getting is not available for this storage backend";
+    end
+
+    function self:set(username, data)
+        return nil, "Data setting is not available for this storage backend";
+    end
+
+    return self;
+end
+
+local adapters = {};
+
+----------------------------------------
+-- Roster Storage Implementation --
+----------------------------------------
+
+adapters.roster = function (config)
+    -- Validate configuration requirements
+    if not config.groups then return nil; end
+
+    local self = ldap_store(config)
+
+    function self:get(username)
+        local ld = ldap.getconnection();
+        local contacts = {};
+
+        local memberfield = config.groups.memberfield;
+        local namefield   = config.groups.namefield;
+        local filter      = memberfield .. '=' .. tostring(username);
+
+        local groups = {};
+        for _, config in ipairs(config.groups) do
+            groups[ config[namefield] ] = config.name;
+        end
+
+        log("debug", "Found %d group(s) for user %s", select('#', groups), username)
+
+        -- XXX this kind of relies on the way we do groups at INOC
+        for _, attrs in ld:search { base = config.groups.basedn, scope = 'onelevel', filter = filter } do
+            if groups[ attrs[namefield] ] then
+                local members = attrs[memberfield];
+
+                for _, user in ipairs(members) do
+                    if user ~= username then
+                        local jid    = user .. '@' .. module.host;
+                        local record = contacts[jid];
+
+                        if not record then
+                            record = {
+                                subscription = 'both',
+                                groups       = {},
+                                name         = get_alias_for_user(user),
+                            };
+                            contacts[jid] = record;
+                        end
+
+                        record.groups[ groups[ attrs[namefield] ] ] = true;
+                    end
+                end
+            end
+        end
+
+        return contacts;
+    end
+
+    function self:set(username, data)
+        log("warn", "Setting data in Roster LDAP storage is not supported yet")
+        return nil, "not supported";
+    end
+
+    return self;
+end
+
+----------------------------------------
+-- vCard Storage Implementation --
+----------------------------------------
+
+adapters.vcard = function (config)
+    -- Validate configuration requirements
+    if not config.vcard_format or not config.user then return nil; end
+
+    local self = ldap_store(config)
+
+    function self:get(username)
+        local ld     = ldap.getconnection();
+        local filter = config.user.usernamefield .. '=' .. tostring(username);
+
+        log("debug", "Retrieving vCard for user '%s'", username);
+
+        local match = ldap.singlematch {
+            base   = config.user.basedn,
+            filter = filter,
+        };
+        if match then
+            match.jid = username .. '@' .. module.host
+            return st.preserialize(ldap_record_to_vcard(match, config.vcard_format));
+        else
+            return nil, "username not found";
+        end
+    end
+
+    function self:set(username, data)
+        log("warn", "Setting data in vCard LDAP storage is not supported yet")
+        return nil, "not supported";
+    end
+
+    return self;
+end
+
+----------------------------------------
+-- Driver Definition --
+----------------------------------------
+
+cache = {};
+
+local driver = { name = "ldap" };
+
+function driver:open(store)
+    log("debug", "Opening ldap storage backend for host '%s' and store '%s'", module.host, store);
+
+    if not cache[module.host] then
+        log("debug", "Caching adapters for the host '%s'", module.host);
+
+        local ad_config = get_config(module.host, "ldap");
+        local ad_cache  = {};
+        for k, v in pairs(adapters) do
+            ad_cache[k] = v(ad_config);
+        end
+
+        cache[module.host] = ad_cache;
+    end
+
+    local adapter = cache[module.host][store];
+
+    if not adapter then
+        log("info", "Unavailable adapter for store '%s'", store);
+        return nil, "unsupported-store";
+    end
+    return adapter;
+end
+
+function driver:stores(username, type, pattern)
+    return nil, "not implemented";
+end
+
+function driver:store_exists(username, type)
+    return nil, "not implemented";
+end
+
+function driver:purge(username)
+    return nil, "not implemented";
+end
+
+function driver:nodes(type)
+    return nil, "not implemented";
+end
+
+module:add_item("data-driver", driver);

conf/metronome/modules/vcard.lib.lua

@@ -135,28 +135,28 @@ function builder_methods:build()
 end
 
 local function new_builder(params)
-  local vcard_tag = st.stanza('vCard', { xmlns = VCARD_NS });
+    local vcard_tag = st.stanza('vCard', { xmlns = VCARD_NS });
 
-  local object = {
+    local object = {
-      vcard   = vcard_tag,
+        vcard   = vcard_tag,
-      __index = builder_methods,
+        __index = builder_methods,
-  };
+    };
 
-  for k, v in pairs(params) do
+    for k, v in pairs(params) do
-      object[k] = v;
+        object[k] = v;
-  end
+    end
 
-  setmetatable(object, object);
+    setmetatable(object, object);
 
-  return object;
+    return object;
 end
 
 local _M = {};
 
 function _M.create(params)
-  local builder = new_builder(params);
+    local builder = new_builder(params);
 
-  return builder:build();
+    return builder:build();
 end
 
 return _M;

conf/nginx/plain/acme-challenge.conf.inc

@@ -1,6 +1,6 @@
 location ^~ '/.well-known/acme-challenge/'
 {
         default_type "text/plain";
-        alias /tmp/acme-challenge-public/;
+        alias /var/www/.well-known/acme-challenge-public/;
         gzip off;
 }

conf/nginx/plain/yunohost_http_errors.conf.inc

@@ -0,0 +1,7 @@
+error_page 502 /502.html;
+
+location = /502.html {
+
+        root /usr/share/yunohost/html/;
+
+}

conf/nginx/redirect_to_admin.conf

@@ -0,0 +1,3 @@
+location / {
+    return 302 https://$host/yunohost/admin;
+}

conf/nginx/security.conf.inc

@@ -18,7 +18,7 @@ ssl_prefer_server_ciphers off;
 # Pre-defined FFDHE group (RFC 7919)
 # From https://ssl-config.mozilla.org/ffdhe2048.txt
 # https://security.stackexchange.com/a/149818
-ssl_dhparam /usr/share/yunohost/other/ffdhe2048.pem;
+ssl_dhparam /usr/share/yunohost/ffdhe2048.pem;
 {% endif %}
 
 
@@ -26,10 +26,9 @@ ssl_dhparam /usr/share/yunohost/other/ffdhe2048.pem;
 # https://wiki.mozilla.org/Security/Guidelines/Web_Security
 # https://observatory.mozilla.org/
 {% if experimental == "True" %}
-more_set_headers "Content-Security-Policy : upgrade-insecure-requests; default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'";
+more_set_headers "Content-Security-Policy : upgrade-insecure-requests; default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'; worker-src 'self' blob:;";
 {% else %}
 more_set_headers "Content-Security-Policy : upgrade-insecure-requests";
-more_set_headers "Content-Security-Policy-Report-Only : default-src https: data: blob: ; object-src https: data: 'unsafe-inline'; style-src https: data: 'unsafe-inline' ; script-src https: data: 'unsafe-inline' 'unsafe-eval'";
 {% endif %}
 more_set_headers "X-Content-Type-Options : nosniff";
 more_set_headers "X-XSS-Protection : 1; mode=block";

conf/nginx/server.tpl.conf

@@ -6,30 +6,34 @@ map $http_upgrade $connection_upgrade {
 server {
     listen 80;
     listen [::]:80;
-    server_name {{ domain }} xmpp-upload.{{ domain }};
+    server_name {{ domain }}{% if xmpp_enabled == "True" %} xmpp-upload.{{ domain }} muc.{{ domain }}{% endif %};
 
     access_by_lua_file /usr/share/ssowat/access.lua;
 
     include /etc/nginx/conf.d/acme-challenge.conf.inc;
 
     location ^~ '/.well-known/ynh-diagnosis/' {
-        alias /tmp/.well-known/ynh-diagnosis/;
+        alias /var/www/.well-known/ynh-diagnosis/;
     }
 
+    {% if mail_enabled == "True" %}
     location ^~ '/.well-known/autoconfig/mail/' {
         alias /var/www/.well-known/{{ domain }}/autoconfig/mail/;
     }
+    {% endif %}
 
     {# Note that this != "False" is meant to be failure-safe, in the case the redrect_to_https would happen to contain empty string or whatever value. We absolutely don't want to disable the HTTPS redirect *except* when it's explicitly being asked to be disabled. #}
     {% if redirect_to_https != "False" %}
     location / {
-        return 301 https://$http_host$request_uri;
+        return 301 https://$host$request_uri;
     }
     {# The app config snippets are not included in the HTTP conf unless HTTPS redirect is disabled, because app's location may blocks will conflict or bypass/ignore the HTTPS redirection. #}
     {% else %}
     include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
     {% endif %}
 
+    include /etc/nginx/conf.d/yunohost_http_errors.conf.inc;
+
     access_log /var/log/nginx/{{ domain }}-access.log;
     error_log /var/log/nginx/{{ domain }}-error.log;
 }
@@ -44,21 +48,23 @@ server {
     ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
     ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem;
 
-    {% if domain_cert_ca != "Self-signed" %}
+    {% if domain_cert_ca != "selfsigned" %}
     more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
     {% endif %}
-    {% if domain_cert_ca == "Let's Encrypt" %}
+    {% if domain_cert_ca == "letsencrypt" %}
     # OCSP settings
     ssl_stapling on;
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
-    resolver 127.0.0.1 127.0.1.1 valid=300s;
+    resolver 1.1.1.1 9.9.9.9 valid=300s;
     resolver_timeout 5s;
     {% endif %}
 
+    {% if mail_enabled == "True" %}
     location ^~ '/.well-known/autoconfig/mail/' {
         alias /var/www/.well-known/{{ domain }}/autoconfig/mail/;
     }
+    {% endif %}
 
     access_by_lua_file /usr/share/ssowat/access.lua;
 
@@ -67,11 +73,13 @@ server {
     include /etc/nginx/conf.d/yunohost_sso.conf.inc;
     include /etc/nginx/conf.d/yunohost_admin.conf.inc;
     include /etc/nginx/conf.d/yunohost_api.conf.inc;
+    include /etc/nginx/conf.d/yunohost_http_errors.conf.inc;
 
     access_log /var/log/nginx/{{ domain }}-access.log;
     error_log /var/log/nginx/{{ domain }}-error.log;
 }
 
+{% if xmpp_enabled == "True" %}
 # vhost dedicated to XMPP http_upload
 server {
     listen 443 ssl http2;
@@ -99,18 +107,19 @@ server {
     ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
     ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem;
 
-    {% if domain_cert_ca != "Self-signed" %}
+    {% if domain_cert_ca != "selfsigned" %}
     more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
     {% endif %}
-    {% if domain_cert_ca == "Let's Encrypt" %}
+    {% if domain_cert_ca == "letsencrypt" %}
     # OCSP settings
     ssl_stapling on;
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
-    resolver 127.0.0.1 127.0.1.1 valid=300s;
+    resolver 1.1.1.1 9.9.9.9 valid=300s;
     resolver_timeout 5s;
     {% endif %}
 
     access_log /var/log/nginx/xmpp-upload.{{ domain }}-access.log;
     error_log /var/log/nginx/xmpp-upload.{{ domain }}-error.log;
 }
+{% endif %}

conf/nginx/yunohost_admin.conf.inc

@@ -7,9 +7,11 @@ location /yunohost/admin/ {
     index index.html;
 
     {% if webadmin_allowlist_enabled == "True" %}
-    {% for ip in webadmin_allowlist.split(',') %}
+    {% if webadmin_allowlist.strip() -%}
-    allow {{ ip }};
+    {% for ip in webadmin_allowlist.strip().split(',') -%}
-    {% endfor %}
+    allow {{ ip.strip() }};
+    {% endfor -%}
+    {% endif -%}
     deny all;
     {% endif %}
 
@@ -19,6 +21,10 @@ location /yunohost/admin/ {
         more_set_headers "Cache-Control: no-store, no-cache, must-revalidate";
     }
 
+    location /yunohost/admin/applogos/ {
+        alias /usr/share/yunohost/applogos/;
+    }
+
     more_set_headers "Content-Security-Policy: upgrade-insecure-requests; default-src 'self'; connect-src 'self' https://paste.yunohost.org wss://$host; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; object-src 'none'; img-src 'self' data:;";
     more_set_headers "Content-Security-Policy-Report-Only:";
 }

conf/nginx/yunohost_api.conf.inc

@@ -4,7 +4,7 @@ location /yunohost/api/ {
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";
-    proxy_set_header Host $http_host;
+    proxy_set_header Host $host;
 
     {% if webadmin_allowlist_enabled == "True" %}
     {% for ip in webadmin_allowlist.split(',') %}

conf/postfix/main.cf

@@ -23,8 +23,11 @@ smtpd_use_tls = yes
 
 smtpd_tls_security_level = may
 smtpd_tls_auth_only = yes
-smtpd_tls_cert_file = /etc/yunohost/certs/{{ main_domain }}/crt.pem
+smtpd_tls_chain_files =
-smtpd_tls_key_file = /etc/yunohost/certs/{{ main_domain }}/key.pem
+    /etc/yunohost/certs/{{ main_domain }}/key.pem,
+    /etc/yunohost/certs/{{ main_domain }}/crt.pem
+
+tls_server_sni_maps = hash:/etc/postfix/sni
 
 {% if compatibility == "intermediate" %}
 # generated 2020-08-18, Mozilla Guideline v5.6, Postfix 3.4.14, OpenSSL 1.1.1d, intermediate configuration
@@ -36,7 +39,7 @@ smtpd_tls_mandatory_ciphers = medium
 
 # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
 # not actually 1024 bits, this applies to all DHE >= 1024 bits
-smtpd_tls_dh1024_param_file = /usr/share/yunohost/other/ffdhe2048.pem
+smtpd_tls_dh1024_param_file = /usr/share/yunohost/ffdhe2048.pem
 
 tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
 {% else %}
@@ -78,7 +81,7 @@ alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
 mydomain = {{ main_domain }}
 mydestination = localhost
-{% if relay_host == "" %}
+{% if relay_enabled != "True" %}
 relayhost =
 {% else %}
 relayhost = [{{ relay_host }}]:{{ relay_port }}
@@ -97,14 +100,18 @@ message_size_limit = 35914708
 
 # Virtual Domains Control
 virtual_mailbox_domains = ldap:/etc/postfix/ldap-domains.cf
-virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf
+virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf,hash:/etc/postfix/app_senders_login_maps
 virtual_mailbox_base =
-virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf
+virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf,ldap:/etc/postfix/ldap-groups.cf
 virtual_alias_domains =
 virtual_minimum_uid = 100
 virtual_uid_maps = static:vmail
 virtual_gid_maps = static:mail
-smtpd_sender_login_maps= ldap:/etc/postfix/ldap-accounts.cf
+smtpd_sender_login_maps = unionmap:{
+   # Regular Yunohost accounts
+   ldap:/etc/postfix/ldap-accounts.cf,
+   # Extra maps for app system users who need to send emails
+   hash:/etc/postfix/app_senders_login_maps }
 
 # Dovecot LDA
 virtual_transport = dovecot
@@ -195,7 +202,7 @@ smtpd_client_recipient_rate_limit=150
 # and after to send spam
 disable_vrfy_command = yes
 
-{% if relay_user != "" %}
+{% if relay_enabled == "True" %}
 # Relay email through an other smtp account
 # enable SASL authentication
 smtp_sasl_auth_enable = yes
@@ -204,3 +211,11 @@ smtp_sasl_security_options = noanonymous
 # where to find sasl_passwd
 smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
 {% endif %}
+
+{% if backup_mx_domains != "" %}
+# Backup MX (secondary MX)
+relay_domains = $mydestination {{backup_mx_domains}}
+relay_recipient_maps = hash:/etc/postfix/relay_recipients
+maximal_queue_lifetime = 20d
+{% endif %}
+

conf/postfix/plain/ldap-groups.cf

@@ -0,0 +1,7 @@
+server_host = localhost
+server_port = 389
+search_base = dc=yunohost,dc=org
+query_filter = (&(objectClass=groupOfNamesYnh)(mail=%s))
+scope = sub
+result_attribute = memberUid, mail
+terminal_result_attribute = memberUid

conf/postfix/sni

@@ -0,0 +1,4 @@
+# This maps domain to certificates to properly handle multi-domain context
+# (also we need a comment in this file such that it's never empty to prevent regenconf issues)
+{% for domain in domain_list.split() %}{{ domain }} /etc/yunohost/certs/{{ domain }}/key.pem /etc/yunohost/certs/{{ domain }}/crt.pem
+{% endfor %}

conf/rspamd/redis.conf

@@ -0,0 +1,2 @@
+# set redis server
+servers = "127.0.0.1";

conf/rspamd/rspamd.sieve

@@ -1,4 +1,4 @@
 require ["fileinto"];
-if header :is "X-Spam" "yes" {
+if header :is "X-Spam" "Yes" {
     fileinto "Junk";
 }

conf/slapd/config.ldif

@@ -10,7 +10,7 @@
 # Config database customization:
 # 1. Edit this file as you want.
 # 2. Apply your modifications. For this just run this following command in a shell:
-#    $ /usr/share/yunohost/hooks/conf_regen/06-slapd apply_config
+#    $ /usr/share/yunohost/hooks/conf_regen/06-slapd post true
 #
 # Note that if you customize this file, YunoHost's regen-conf will NOT
 # overwrite this file. But that also means that you should be careful about
@@ -130,7 +130,6 @@ olcSuffix: dc=yunohost,dc=org
 # admin entry below
 # These access lines apply to database #1 only
 olcAccess: {0}to attrs=userPassword,shadowLastChange
-    by dn.base="cn=admin,dc=yunohost,dc=org" write
     by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
     by anonymous auth
     by self write
@@ -140,7 +139,6 @@ olcAccess: {0}to attrs=userPassword,shadowLastChange
 # owning it if they are authenticated.
 # Others should be able to see it.
 olcAccess: {1}to attrs=cn,gecos,givenName,mail,maildrop,displayName,sn
-    by dn.base="cn=admin,dc=yunohost,dc=org" write
     by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
     by self write
     by * read
@@ -160,9 +158,8 @@ olcAccess: {2}to dn.base=""
 # The admin dn has full write access, everyone else
 # can read everything.
 olcAccess: {3}to *
-    by dn.base="cn=admin,dc=yunohost,dc=org" write
     by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
-    by group/groupOfNames/member.exact="cn=admin,ou=groups,dc=yunohost,dc=org" write
+    by group/groupOfNamesYnh/member.exact="cn=admins,ou=groups,dc=yunohost,dc=org" write
     by * read
 #
 olcAddContentAcl: FALSE

conf/slapd/db_init.ldif

@@ -5,15 +5,6 @@ objectClass: organization
 o: yunohost.org
 dc: yunohost
 
-dn: cn=admin,ou=sudo,dc=yunohost,dc=org
-cn: admin
-objectClass: sudoRole
-objectClass: top
-sudoCommand: ALL
-sudoUser: admin
-sudoOption: !authenticate
-sudoHost: ALL
-
 dn: ou=users,dc=yunohost,dc=org
 objectClass: organizationalUnit
 objectClass: top
@@ -39,27 +30,23 @@ objectClass: organizationalUnit
 objectClass: top
 ou: groups
 
+dn: cn=admins,ou=sudo,dc=yunohost,dc=org
+cn: admins
+objectClass: sudoRole
+objectClass: top
+sudoCommand: ALL
+sudoUser: %admins
+sudoHost: ALL
+
 dn: ou=sudo,dc=yunohost,dc=org
 objectClass: organizationalUnit
 objectClass: top
 ou: sudo
 
-dn: cn=admin,dc=yunohost,dc=org
-objectClass: organizationalRole
-objectClass: posixAccount
-objectClass: simpleSecurityObject
-cn: admin
-uid: admin
-uidNumber: 1007
-gidNumber: 1007
-homeDirectory: /home/admin
-loginShell: /bin/bash
-userPassword: yunohost
-
 dn: cn=admins,ou=groups,dc=yunohost,dc=org
 objectClass: posixGroup
 objectClass: top
-memberUid: admin
+objectClass: groupOfNamesYnh
 gidNumber: 4001
 cn: admins
 

conf/slapd/mailserver.ldif

@@ -89,4 +89,7 @@ olcObjectClasses: ( 1.3.6.1.4.1.40328.1.1.2.3
         NAME 'mailGroup' SUP top AUXILIARY
         DESC 'Mail Group'
         MUST ( mail )
+        MAY (
+            mailalias $ maildrop 
+            )
         )

conf/slapd/slapd.default

@@ -21,7 +21,7 @@ SLAPD_PIDFILE=
 # sockets.
 # Example usage:
 # SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
-SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
+SLAPD_SERVICES="ldap://localhost:389/ ldaps:/// ldapi:///"
 
 # If SLAPD_NO_START is set, the init script will not start or restart
 # slapd (but stop will still work).  Uncomment this if you are

conf/ssh/sshd_config

@@ -2,6 +2,8 @@
 # by YunoHost
 
 Protocol 2
+# PLEASE: if you wish to change the ssh port properly in YunoHost, use this command:
+# yunohost settings set security.ssh.ssh_port -v <port>
 Port {{ port }}
 
 {% if ipv6_enabled == "true" %}ListenAddress ::{% endif %}
@@ -53,12 +55,16 @@ PermitEmptyPasswords no
 ChallengeResponseAuthentication no
 UsePAM yes
 
-# Change to no to disable tunnelled clear text passwords
+# PLEASE: if you wish to force everybody to authenticate using ssh keys, run this command:
-# (i.e. everybody will need to authenticate using ssh keys)
+# yunohost settings set security.ssh.ssh_password_authentication -v no
+{% if password_authentication == "False" %}
+PasswordAuthentication no
+{% else %}
 #PasswordAuthentication yes
+{% endif %}
 
 # Post-login stuff
-Banner /etc/issue.net
+# Banner none
 PrintMotd no
 PrintLastLog yes
 ClientAliveInterval 60
@@ -78,7 +84,7 @@ Subsystem sftp internal-sftp
 
 # Apply following instructions to user with sftp perm only
 Match Group sftp.main,!ssh.main
-    ForceCommand internal-sftp
+    ForceCommand internal-sftp -u 0002
     # We can't restrict to /home/%u because the chroot base must be owned by root
     # So we chroot only on /home
     # See https://serverfault.com/questions/584986/bad-ownership-or-modes-for-chroot-directory-component
@@ -91,7 +97,7 @@ Match Group sftp.main,!ssh.main
     PermitUserRC no
 
 Match Group sftp.app,!ssh.app
-    ForceCommand internal-sftp
+    ForceCommand internal-sftp -u 0002
     ChrootDirectory %h
     AllowTcpForwarding no
     AllowStreamLocalForwarding no

conf/ssl/openssl.cnf

@@ -5,7 +5,7 @@
 
 # This definition stops the following lines choking if HOME isn't
 # defined.
-HOME			= /usr/share/yunohost/yunohost-config/ssl
+HOME			= /usr/share/yunohost/ssl
 RANDFILE		= $ENV::HOME/.rnd
 
 # Extra OBJECT IDENTIFIER info:
@@ -34,7 +34,7 @@ default_ca	= Yunohost		# The default ca section
 ####################################################################
 [ Yunohost ]
 
-dir		= /usr/share/yunohost/yunohost-config/ssl/yunoCA		# Where everything is kept
+dir		= /usr/share/yunohost/ssl		# Where everything is kept
 certs		= $dir/certs		# Where the issued certs are kept
 crl_dir		= $dir/crl		# Where the issued crl are kept
 database	= $dir/index.txt	# database index file.

conf/yunohost/services.yml

@@ -12,24 +12,31 @@ metronome:
   log: [/var/log/metronome/metronome.log,/var/log/metronome/metronome.err]
   needs_exposed_ports: [5222, 5269]
   category: xmpp
+  ignore_if_package_is_not_installed: metronome
 mysql:
   log: [/var/log/mysql.log,/var/log/mysql.err,/var/log/mysql/error.log]
   actual_systemd_service: mariadb
   category: database
+  ignore_if_package_is_not_installed: mariadb-server
 nginx:
   log: /var/log/nginx
   test_conf: nginx -t
   needs_exposed_ports: [80, 443]
   category: web
-php7.3-fpm:
+# Yunohost will dynamically add installed php-fpm services (7.3, 7.4, 8.0, ...) in services.py
-  log: /var/log/php7.3-fpm.log
+#php7.4-fpm:
-  test_conf: php-fpm7.3 --test
+#  log: /var/log/php7.4-fpm.log
-  category: web
+#  test_conf: php-fpm7.4 --test
+#  category: web
 postfix:
   log: [/var/log/mail.log,/var/log/mail.err]
   actual_systemd_service: postfix@-
   needs_exposed_ports: [25, 587]
   category: email
+postgresql:
+  actual_systemd_service: 'postgresql@13-main'
+  category: database
+  ignore_if_package_is_not_installed: postgresql-13
 redis-server:
   log: /var/log/redis/redis-server.log
   category: database
@@ -68,5 +75,6 @@ spamassassin: null
 rmilter: null
 php5-fpm: null
 php7.0-fpm: null
+php7.3-fpm: null
 nslcd: null
 avahi-daemon: null

conf/yunohost/yunohost-api.service

@@ -4,9 +4,7 @@ After=network.target
 
 [Service]
 Type=simple
-Environment=DAEMON_OPTS=
+ExecStart=/usr/bin/yunohost-api
-EnvironmentFile=-/etc/default/yunohost-api
-ExecStart=/usr/bin/yunohost-api $DAEMON_OPTS
 Restart=always
 RestartSec=5
 TimeoutStopSec=30

data/helpers

@@ -1,8 +0,0 @@
-# -*- shell-script -*-
-
-readonly XTRACE_ENABLE=$(set +o | grep xtrace) # This is a trick to later only restore set -x if it was set when calling this script
-set +x
-for helper in $(run-parts --list /usr/share/yunohost/helpers.d 2>/dev/null) ; do
-    [ -r $helper ] && . $helper || true
-done
-eval "$XTRACE_ENABLE"

data/helpers.d/logrotate

@@ -1,109 +0,0 @@
-#!/bin/bash
-
-# Use logrotate to manage the logfile
-#
-# usage: ynh_use_logrotate [--logfile=/log/file] [--nonappend] [--specific_user=user/group]
-# | arg: -l, --logfile=         - absolute path of logfile
-# | arg: -n, --nonappend        - (optional) Replace the config file instead of appending this new config.
-# | arg: -u, --specific_user=   - run logrotate as the specified user and group. If not specified logrotate is runned as root.
-#
-# If no `--logfile` is provided, `/var/log/$app` will be used as default.
-# `logfile` can point to a directory or a file.
-#
-# It's possible to use this helper multiple times, each config will be added to
-# the same logrotate config file. Unless you use the option `--non-append`
-#
-# Requires YunoHost version 2.6.4 or higher.
-# Requires YunoHost version 3.2.0 or higher for the argument `--specific_user`
-ynh_use_logrotate() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=lnuya
-    local -A args_array=([l]=logfile= [n]=nonappend [u]=specific_user= [y]=non [a]=append)
-    # [y]=non [a]=append are only for legacy purpose, to not fail on the old option '--non-append'
-    local logfile
-    local nonappend
-    local specific_user
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    logfile="${logfile:-}"
-    nonappend="${nonappend:-0}"
-    specific_user="${specific_user:-}"
-
-    # LEGACY CODE - PRE GETOPTS
-    if [ $# -gt 0 ] && [ "$1" == "--non-append" ]; then
-        nonappend=1
-        # Destroy this argument for the next command.
-        shift
-    elif [ $# -gt 1 ] && [ "$2" == "--non-append" ]; then
-        nonappend=1
-    fi
-
-    if [ $# -gt 0 ] && [ "$(echo ${1:0:1})" != "-" ]; then
-        # If the given logfile parameter already exists as a file, or if it ends up with ".log",
-        # we just want to manage a single file
-        if [ -f "$1" ] || [ "$(echo ${1##*.})" == "log" ]; then
-            local logfile=$1
-        # Otherwise we assume we want to manage a directory and all its .log file inside
-        else
-            local logfile=$1/*.log
-        fi
-    fi
-    # LEGACY CODE
-
-    local customtee="tee --append"
-    if [ "$nonappend" -eq 1 ]; then
-        customtee="tee"
-    fi
-    if [ -n "$logfile" ]; then
-        if [ ! -f "$1" ] && [ "$(echo ${logfile##*.})" != "log" ]; then # Keep only the extension to check if it's a logfile
-            local logfile="$logfile/*.log"                              # Else, uses the directory and all logfile into it.
-        fi
-    else
-        logfile="/var/log/${app}/*.log" # Without argument, use a defaut directory in /var/log
-    fi
-    local su_directive=""
-    if [[ -n $specific_user ]]; then
-        su_directive="	# Run logorotate as specific user - group
-    su ${specific_user%/*} ${specific_user#*/}"
-    fi
-
-    cat >./${app}-logrotate <<EOF # Build a config file for logrotate
-$logfile {
-        # Rotate if the logfile exceeds 100Mo
-    size 100M
-        # Keep 12 old log maximum
-    rotate 12
-        # Compress the logs with gzip
-    compress
-        # Compress the log at the next cycle. So keep always 2 non compressed logs
-    delaycompress
-        # Copy and truncate the log to allow to continue write on it. Instead of move the log.
-    copytruncate
-        # Do not do an error if the log is missing
-    missingok
-        # Not rotate if the log is empty
-    notifempty
-        # Keep old logs in the same dir
-    noolddir
-    $su_directive
-}
-EOF
-    mkdir --parents $(dirname "$logfile")                              # Create the log directory, if not exist
-    cat ${app}-logrotate | $customtee /etc/logrotate.d/$app >/dev/null # Append this config to the existing config file, or replace the whole config file (depending on $customtee)
-
-    if ynh_user_exists --username="$app"; then
-        chown $app:$app "$logfile"
-        chmod o-rwx "$logfile"
-    fi
-}
-
-# Remove the app's logrotate config.
-#
-# usage: ynh_remove_logrotate
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_remove_logrotate() {
-    if [ -e "/etc/logrotate.d/$app" ]; then
-        rm "/etc/logrotate.d/$app"
-    fi
-}

data/helpers.d/utils

@@ -1,970 +0,0 @@
-#!/bin/bash
-
-YNH_APP_BASEDIR=${YNH_APP_BASEDIR:-$(realpath ..)}
-
-# Handle script crashes / failures
-#
-# [internal]
-#
-# usage:
-# ynh_exit_properly is used only by the helper ynh_abort_if_errors.
-# You should not use it directly.
-# Instead, add to your script:
-# ynh_clean_setup () {
-#        instructions...
-# }
-#
-# This function provide a way to clean some residual of installation that not managed by remove script.
-#
-# It prints a warning to inform that the script was failed, and execute the ynh_clean_setup function if used in the app script
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_exit_properly() {
-    local exit_code=$?
-
-    rm -rf "/var/cache/yunohost/download/"
-
-    if [ "$exit_code" -eq 0 ]; then
-        exit 0 # Exit without error if the script ended correctly
-    fi
-
-    trap '' EXIT # Ignore new exit signals
-    # Do not exit anymore if a command fail or if a variable is empty
-    set +o errexit # set +e
-    set +o nounset # set +u
-
-    # Small tempo to avoid the next message being mixed up with other DEBUG messages
-    sleep 0.5
-
-    if type -t ynh_clean_setup >/dev/null; then # Check if the function exist in the app script.
-        ynh_clean_setup                         # Call the function to do specific cleaning for the app.
-    fi
-
-    # Exit with error status
-    # We don't call ynh_die basically to avoid unecessary 10-ish
-    # debug lines about parsing args and stuff just to exit 1..
-    exit 1
-}
-
-# Exits if an error occurs during the execution of the script.
-#
-# usage: ynh_abort_if_errors
-#
-# This configure the rest of the script execution such that, if an error occurs
-# or if an empty variable is used, the execution of the script stops immediately
-# and a call to `ynh_clean_setup` is triggered if it has been defined by your script.
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_abort_if_errors() {
-    set -o errexit              # set -e; Exit if a command fail
-    set -o nounset              # set -u; And if a variable is used unset
-    trap ynh_exit_properly EXIT # Capturing exit signals on shell script
-}
-
-# Download, check integrity, uncompress and patch the source from app.src
-#
-# usage: ynh_setup_source --dest_dir=dest_dir [--source_id=source_id] [--keep="file1 file2"]
-# | arg: -d, --dest_dir=    - Directory where to setup sources
-# | arg: -s, --source_id=   - Name of the source, defaults to `app`
-# | arg: -k, --keep=        - Space-separated list of files/folders that will be backup/restored in $dest_dir, such as a config file you don't want to overwrite. For example 'conf.json secrets.json logs/'
-#
-# This helper will read `conf/${source_id}.src`, download and install the sources.
-#
-# The src file need to contains:
-# ```
-# SOURCE_URL=Address to download the app archive
-# SOURCE_SUM=Control sum
-# # (Optional) Program to check the integrity (sha256sum, md5sum...). Default: sha256
-# SOURCE_SUM_PRG=sha256
-# # (Optional) Archive format. Default: tar.gz
-# SOURCE_FORMAT=tar.gz
-# # (Optional) Put false if sources are directly in the archive root. Default: true
-# # Instead of true, SOURCE_IN_SUBDIR could be the number of sub directories to remove.
-# SOURCE_IN_SUBDIR=false
-# # (Optionnal) Name of the local archive (offline setup support). Default: ${src_id}.${src_format}
-# SOURCE_FILENAME=example.tar.gz
-# # (Optional) If it set as false don't extract the source. Default: true
-# # (Useful to get a debian package or a python wheel.)
-# SOURCE_EXTRACT=(true|false)
-# ```
-#
-# The helper will:
-# - Check if there is a local source archive in `/opt/yunohost-apps-src/$APP_ID/$SOURCE_FILENAME`
-# - Download `$SOURCE_URL` if there is no local archive
-# - Check the integrity with `$SOURCE_SUM_PRG -c --status`
-# - Uncompress the archive to `$dest_dir`.
-#   - If `$SOURCE_IN_SUBDIR` is true, the first level directory of the archive will be removed.
-#   - If `$SOURCE_IN_SUBDIR` is a numeric value, the N first level directories will be removed.
-# - Patches named `sources/patches/${src_id}-*.patch` will be applied to `$dest_dir`
-# - Extra files in `sources/extra_files/$src_id` will be copied to dest_dir
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_setup_source() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=dsk
-    local -A args_array=([d]=dest_dir= [s]=source_id= [k]=keep=)
-    local dest_dir
-    local source_id
-    local keep
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    source_id="${source_id:-app}"
-    keep="${keep:-}"
-
-    local src_file_path="$YNH_APP_BASEDIR/conf/${source_id}.src"
-
-    # Load value from configuration file (see above for a small doc about this file
-    # format)
-    local src_url=$(grep 'SOURCE_URL=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-    local src_sum=$(grep 'SOURCE_SUM=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-    local src_sumprg=$(grep 'SOURCE_SUM_PRG=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-    local src_format=$(grep 'SOURCE_FORMAT=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-    local src_extract=$(grep 'SOURCE_EXTRACT=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-    local src_in_subdir=$(grep 'SOURCE_IN_SUBDIR=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-    local src_filename=$(grep 'SOURCE_FILENAME=' "$src_file_path" | cut --delimiter='=' --fields=2-)
-
-    # Default value
-    src_sumprg=${src_sumprg:-sha256sum}
-    src_in_subdir=${src_in_subdir:-true}
-    src_format=${src_format:-tar.gz}
-    src_format=$(echo "$src_format" | tr '[:upper:]' '[:lower:]')
-    src_extract=${src_extract:-true}
-    if [ "$src_filename" = "" ]; then
-        src_filename="${source_id}.${src_format}"
-    fi
-
-    # (Unused?) mecanism where one can have the file in a special local cache to not have to download it...
-    local local_src="/opt/yunohost-apps-src/${YNH_APP_ID}/${src_filename}"
-
-    mkdir -p /var/cache/yunohost/download/${YNH_APP_ID}/
-    src_filename="/var/cache/yunohost/download/${YNH_APP_ID}/${src_filename}"
-
-    if test -e "$local_src"; then
-        cp $local_src $src_filename
-    else
-        [ -n "$src_url" ] || ynh_die "Couldn't parse SOURCE_URL from $src_file_path ?"
-
-        # NB. we have to declare the var as local first,
-        # otherwise 'local foo=$(false) || echo 'pwet'" does'nt work
-        # because local always return 0 ...
-        local out
-        # Timeout option is here to enforce the timeout on dns query and tcp connect (c.f. man wget)
-        out=$(wget --tries 3 --no-dns-cache --timeout 900 --no-verbose --output-document=$src_filename $src_url 2>&1) \
-            || ynh_die --message="$out"
-    fi
-
-    # Check the control sum
-    echo "${src_sum} ${src_filename}" | ${src_sumprg} --check --status \
-        || ynh_die --message="Corrupt source"
-
-    # Keep files to be backup/restored at the end of the helper
-    # Assuming $dest_dir already exists
-    rm -rf /var/cache/yunohost/files_to_keep_during_setup_source/
-    if [ -n "$keep" ] && [ -e "$dest_dir" ]; then
-        local keep_dir=/var/cache/yunohost/files_to_keep_during_setup_source/${YNH_APP_ID}
-        mkdir -p $keep_dir
-        local stuff_to_keep
-        for stuff_to_keep in $keep; do
-            if [ -e "$dest_dir/$stuff_to_keep" ]; then
-                mkdir --parents "$(dirname "$keep_dir/$stuff_to_keep")"
-                cp --archive "$dest_dir/$stuff_to_keep" "$keep_dir/$stuff_to_keep"
-            fi
-        done
-    fi
-
-    # Extract source into the app dir
-    mkdir --parents "$dest_dir"
-
-    if [ -n "${final_path:-}" ] && [ "$dest_dir" == "$final_path" ]; then
-        _ynh_apply_default_permissions $dest_dir
-    fi
-
-    if ! "$src_extract"; then
-        mv $src_filename $dest_dir
-    elif [ "$src_format" = "zip" ]; then
-        # Zip format
-        # Using of a temp directory, because unzip doesn't manage --strip-components
-        if $src_in_subdir; then
-            local tmp_dir=$(mktemp --directory)
-            unzip -quo $src_filename -d "$tmp_dir"
-            cp --archive $tmp_dir/*/. "$dest_dir"
-            ynh_secure_remove --file="$tmp_dir"
-        else
-            unzip -quo $src_filename -d "$dest_dir"
-        fi
-        ynh_secure_remove --file="$src_filename"
-    else
-        local strip=""
-        if [ "$src_in_subdir" != "false" ]; then
-            if [ "$src_in_subdir" == "true" ]; then
-                local sub_dirs=1
-            else
-                local sub_dirs="$src_in_subdir"
-            fi
-            strip="--strip-components $sub_dirs"
-        fi
-        if [[ "$src_format" =~ ^tar.gz|tar.bz2|tar.xz$ ]]; then
-            tar --extract --file=$src_filename --directory="$dest_dir" $strip
-        else
-            ynh_die --message="Archive format unrecognized."
-        fi
-        ynh_secure_remove --file="$src_filename"
-    fi
-
-    # Apply patches
-    if [ -d "$YNH_APP_BASEDIR/sources/patches/" ]; then
-        local patches_folder=$(realpath $YNH_APP_BASEDIR/sources/patches/)
-        if (($(find $patches_folder -type f -name "${source_id}-*.patch" 2>/dev/null | wc --lines) > "0")); then
-            (
-                cd "$dest_dir"
-                for p in $patches_folder/${source_id}-*.patch; do
-                    echo $p
-                    patch --strip=1 <$p
-                done
-            ) || ynh_die --message="Unable to apply patches"
-        fi
-    fi
-
-    # Add supplementary files
-    if test -e "$YNH_APP_BASEDIR/sources/extra_files/${source_id}"; then
-        cp --archive $YNH_APP_BASEDIR/sources/extra_files/$source_id/. "$dest_dir"
-    fi
-
-    # Keep files to be backup/restored at the end of the helper
-    # Assuming $dest_dir already exists
-    if [ -n "$keep" ]; then
-        local keep_dir=/var/cache/yunohost/files_to_keep_during_setup_source/${YNH_APP_ID}
-        local stuff_to_keep
-        for stuff_to_keep in $keep; do
-            if [ -e "$keep_dir/$stuff_to_keep" ]; then
-                mkdir --parents "$(dirname "$dest_dir/$stuff_to_keep")"
-                cp --archive "$keep_dir/$stuff_to_keep" "$dest_dir/$stuff_to_keep"
-            fi
-        done
-    fi
-    rm -rf /var/cache/yunohost/files_to_keep_during_setup_source/
-}
-
-# Curl abstraction to help with POST requests to local pages (such as installation forms)
-#
-# usage: ynh_local_curl "page_uri" "key1=value1" "key2=value2" ...
-# | arg: page_uri    - Path (relative to `$path_url`) of the page where POST data will be sent
-# | arg: key1=value1 - (Optionnal) POST key and corresponding value
-# | arg: key2=value2 - (Optionnal) Another POST key and corresponding value
-# | arg: ...         - (Optionnal) More POST keys and values
-#
-# example: ynh_local_curl "/install.php?installButton" "foo=$var1" "bar=$var2"
-#
-# For multiple calls, cookies are persisted between each call for the same app
-#
-# `$domain` and `$path_url` should be defined externally (and correspond to the domain.tld and the /path (of the app?))
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_local_curl() {
-    # Define url of page to curl
-    local local_page=$(ynh_normalize_url_path $1)
-    local full_path=$path_url$local_page
-
-    if [ "${path_url}" == "/" ]; then
-        full_path=$local_page
-    fi
-
-    local full_page_url=https://localhost$full_path
-
-    # Concatenate all other arguments with '&' to prepare POST data
-    local POST_data=""
-    local arg=""
-    for arg in "${@:2}"; do
-        POST_data="${POST_data}${arg}&"
-    done
-    if [ -n "$POST_data" ]; then
-        # Add --data arg and remove the last character, which is an unecessary '&'
-        POST_data="--data ${POST_data::-1}"
-    fi
-
-    # Wait untils nginx has fully reloaded (avoid curl fail with http2)
-    sleep 2
-
-    local cookiefile=/tmp/ynh-$app-cookie.txt
-    touch $cookiefile
-    chown root $cookiefile
-    chmod 700 $cookiefile
-
-    # Temporarily enable visitors if needed...
-    local visitors_enabled=$(ynh_permission_has_user "main" "visitors" && echo yes || echo no)
-    if [[ $visitors_enabled == "no" ]]; then
-        ynh_permission_update --permission "main" --add "visitors"
-    fi
-
-    # Curl the URL
-    curl --silent --show-error --insecure --location --header "Host: $domain" --resolve $domain:443:127.0.0.1 $POST_data "$full_page_url" --cookie-jar $cookiefile --cookie $cookiefile
-
-    if [[ $visitors_enabled == "no" ]]; then
-        ynh_permission_update --permission "main" --remove "visitors"
-    fi
-}
-
-# Create a dedicated config file from a template
-#
-# usage: ynh_add_config --template="template" --destination="destination"
-# | arg: -t, --template=     - Template config file to use
-# | arg: -d, --destination=    - Destination of the config file
-#
-# examples:
-#    ynh_add_config --template=".env" --destination="$final_path/.env"
-#    ynh_add_config --template="../conf/.env" --destination="$final_path/.env"
-#    ynh_add_config --template="/etc/nginx/sites-available/default" --destination="etc/nginx/sites-available/mydomain.conf"
-#
-# The template can be by default the name of a file in the conf directory
-# of a YunoHost Package, a relative path or an absolute path.
-#
-# The helper will use the template `template` to generate a config file
-# `destination` by replacing the following keywords with global variables
-# that should be defined before calling this helper :
-# ```
-#   __PATH__                by $path_url
-#   __NAME__                by $app
-#   __NAMETOCHANGE__        by $app
-#   __USER__                by $app
-#   __FINALPATH__           by $final_path
-#   __PHPVERSION__          by $YNH_PHP_VERSION
-#   __YNH_NODE_LOAD_PATH__  by $ynh_node_load_PATH
-# ```
-# And any dynamic variables that should be defined before calling this helper like:
-# ```
-#   __DOMAIN__   by $domain
-#   __APP__      by $app
-#   __VAR_1__    by $var_1
-#   __VAR_2__    by $var_2
-# ```
-#
-# The helper will verify the checksum and backup the destination file
-# if it's different before applying the new template.
-#
-# And it will calculate and store the destination file checksum
-# into the app settings when configuration is done.
-#
-# Requires YunoHost version 4.1.0 or higher.
-ynh_add_config() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=tdv
-    local -A args_array=([t]=template= [d]=destination=)
-    local template
-    local destination
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    local template_path
-
-    if [ -f "$YNH_APP_BASEDIR/conf/$template" ]; then
-        template_path="$YNH_APP_BASEDIR/conf/$template"
-    elif [ -f "$template" ]; then
-        template_path=$template
-    else
-        ynh_die --message="The provided template $template doesn't exist"
-    fi
-
-    ynh_backup_if_checksum_is_different --file="$destination"
-
-    # Make sure to set the permissions before we copy the file
-    # This is to cover a case where an attacker could have
-    # created a file beforehand to have control over it
-    # (cp won't overwrite ownership / modes by default...)
-    touch $destination
-    chown root:root $destination
-    chmod 640 $destination
-
-    cp -f "$template_path" "$destination"
-
-    _ynh_apply_default_permissions $destination
-
-    ynh_replace_vars --file="$destination"
-
-    ynh_store_file_checksum --file="$destination"
-}
-
-# Replace variables in a file
-#
-# [internal]
-#
-# usage: ynh_replace_vars --file="file"
-# | arg: -f, --file=     - File where to replace variables
-#
-# The helper will replace the following keywords with global variables
-# that should be defined before calling this helper :
-#   __PATH__                by $path_url
-#   __NAME__                by $app
-#   __NAMETOCHANGE__        by $app
-#   __USER__                by $app
-#   __FINALPATH__           by $final_path
-#   __PHPVERSION__          by $YNH_PHP_VERSION
-#   __YNH_NODE_LOAD_PATH__  by $ynh_node_load_PATH
-#
-# And any dynamic variables that should be defined before calling this helper like:
-#   __DOMAIN__   by $domain
-#   __APP__      by $app
-#   __VAR_1__    by $var_1
-#   __VAR_2__    by $var_2
-#
-# Requires YunoHost version 4.1.0 or higher.
-ynh_replace_vars() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=f
-    local -A args_array=([f]=file=)
-    local file
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    # Replace specific YunoHost variables
-    if test -n "${path_url:-}"; then
-        # path_url_slash_less is path_url, or a blank value if path_url is only '/'
-        local path_url_slash_less=${path_url%/}
-        ynh_replace_string --match_string="__PATH__/" --replace_string="$path_url_slash_less/" --target_file="$file"
-        ynh_replace_string --match_string="__PATH__" --replace_string="$path_url" --target_file="$file"
-    fi
-    if test -n "${app:-}"; then
-        ynh_replace_string --match_string="__NAME__" --replace_string="$app" --target_file="$file"
-        ynh_replace_string --match_string="__NAMETOCHANGE__" --replace_string="$app" --target_file="$file"
-        ynh_replace_string --match_string="__USER__" --replace_string="$app" --target_file="$file"
-    fi
-    if test -n "${final_path:-}"; then
-        ynh_replace_string --match_string="__FINALPATH__" --replace_string="$final_path" --target_file="$file"
-    fi
-    if test -n "${YNH_PHP_VERSION:-}"; then
-        ynh_replace_string --match_string="__PHPVERSION__" --replace_string="$YNH_PHP_VERSION" --target_file="$file"
-    fi
-    if test -n "${ynh_node_load_PATH:-}"; then
-        ynh_replace_string --match_string="__YNH_NODE_LOAD_PATH__" --replace_string="$ynh_node_load_PATH" --target_file="$file"
-    fi
-
-    # Replace others variables
-
-    # List other unique (__ __) variables in $file
-    local uniques_vars=($(grep -oP '__[A-Z0-9]+?[A-Z0-9_]*?[A-Z0-9]*?__' $file | sort --unique | sed "s@__\([^.]*\)__@\L\1@g"))
-
-    # Do the replacement
-    local delimit=@
-    for one_var in "${uniques_vars[@]}"; do
-        # Validate that one_var is indeed defined
-        # -v checks if the variable is defined, for example:
-        #     -v FOO  tests if $FOO is defined
-        #     -v $FOO tests if ${!FOO} is defined
-        # More info: https://stackoverflow.com/questions/3601515/how-to-check-if-a-variable-is-set-in-bash/17538964#comment96392525_17538964
-        [[ -v "${one_var:-}" ]] || ynh_die --message="Variable \$$one_var wasn't initialized when trying to replace __${one_var^^}__ in $file"
-
-        # Escape delimiter in match/replace string
-        match_string="__${one_var^^}__"
-        match_string=${match_string//${delimit}/"\\${delimit}"}
-        replace_string="${!one_var}"
-        replace_string=${replace_string//\\/\\\\}
-        replace_string=${replace_string//${delimit}/"\\${delimit}"}
-
-        # Actually replace (sed is used instead of ynh_replace_string to avoid triggering an epic amount of debug logs)
-        sed --in-place "s${delimit}${match_string}${delimit}${replace_string}${delimit}g" "$file"
-    done
-}
-
-# Get a value from heterogeneous file (yaml, json, php, python...)
-#
-# usage: ynh_read_var_in_file --file=PATH --key=KEY
-# | arg: -f, --file=     - the path to the file
-# | arg: -k, --key=     - the key to get
-#
-# This helpers match several var affectation use case in several languages
-# We don't use jq or equivalent to keep comments and blank space in files
-# This helpers work line by line, it is not able to work correctly
-# if you have several identical keys in your files
-#
-# Example of line this helpers can managed correctly
-# .yml
-#     title: YunoHost documentation
-#     email: 'yunohost@yunohost.org'
-# .json
-#     "theme": "colib'ris",
-#     "port": 8102
-#     "some_boolean":     false,
-#     "user": null
-# .ini
-#     some_boolean = On
-#     action = "Clear"
-#     port = 20
-# .php
-#     $user=
-#     user => 20
-# .py
-#     USER = 8102
-#     user = 'https://donate.local'
-#     CUSTOM['user'] = 'YunoHost'
-#
-# Requires YunoHost version 4.3 or higher.
-ynh_read_var_in_file() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=fka
-    local -A args_array=([f]=file= [k]=key= [a]=after=)
-    local file
-    local key
-    local after
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    after="${after:-}"
-
-    [[ -f $file ]] || ynh_die --message="File $file does not exists"
-
-    set +o xtrace # set +x
-
-    # Get the line number after which we search for the variable
-    local line_number=1
-    if [[ -n "$after" ]]; then
-        line_number=$(grep -n $after $file | cut -d: -f1)
-        if [[ -z "$line_number" ]]; then
-            set -o xtrace # set -x
-            return 1
-        fi
-    fi
-
-    local filename="$(basename -- "$file")"
-    local ext="${filename##*.}"
-    local endline=',;'
-    local assign="=>|:|="
-    local comments="#"
-    local string="\"'"
-    if [[ "$ext" =~ ^ini|env|toml|yml|yaml$ ]]; then
-        endline='#'
-    fi
-    if [[ "$ext" =~ ^ini|env$ ]]; then
-        comments="[;#]"
-    fi
-    if [[ "php" == "$ext" ]] || [[ "$ext" == "js" ]]; then
-        comments="//"
-    fi
-    local list='\[\s*['$string']?\w+['$string']?\]'
-    local var_part='^\s*((const|var|let)\s+)?\$?(\w+('$list')*(->|\.|\[))*\s*'
-    var_part+="[$string]?${key}[$string]?"
-    var_part+='\s*\]?\s*'
-    var_part+="($assign)"
-    var_part+='\s*'
-
-    # Extract the part after assignation sign
-    local expression_with_comment="$(tail +$line_number ${file} | grep -i -o -P $var_part'\K.*$' || echo YNH_NULL | head -n1)"
-    if [[ "$expression_with_comment" == "YNH_NULL" ]]; then
-        set -o xtrace # set -x
-        echo YNH_NULL
-        return 0
-    fi
-
-    # Remove comments if needed
-    local expression="$(echo "$expression_with_comment" | sed "s@${comments}[^$string]*\$@@g" | sed "s@\s*[$endline]*\s*]*\$@@")"
-
-    local first_char="${expression:0:1}"
-    if [[ "$first_char" == '"' ]]; then
-        echo "$expression" | grep -m1 -o -P '"\K([^"](\\")?)*[^\\](?=")' | head -n1 | sed 's/\\"/"/g'
-    elif [[ "$first_char" == "'" ]]; then
-        echo "$expression" | grep -m1 -o -P "'\K([^'](\\\\')?)*[^\\\\](?=')" | head -n1 | sed "s/\\\\'/'/g"
-    else
-        echo "$expression"
-    fi
-    set -o xtrace # set -x
-}
-
-# Set a value into heterogeneous file (yaml, json, php, python...)
-#
-# usage: ynh_write_var_in_file --file=PATH --key=KEY --value=VALUE
-# | arg: -f, --file=     - the path to the file
-# | arg: -k, --key=     - the key to set
-# | arg: -v, --value=     - the value to set
-#
-# Requires YunoHost version 4.3 or higher.
-ynh_write_var_in_file() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=fkva
-    local -A args_array=([f]=file= [k]=key= [v]=value= [a]=after=)
-    local file
-    local key
-    local value
-    local after
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    after="${after:-}"
-
-    [[ -f $file ]] || ynh_die --message="File $file does not exists"
-
-    set +o xtrace # set +x
-
-    # Get the line number after which we search for the variable
-    local line_number=1
-    if [[ -n "$after" ]]; then
-        line_number=$(grep -n $after $file | cut -d: -f1)
-        if [[ -z "$line_number" ]]; then
-            set -o xtrace # set -x
-            return 1
-        fi
-    fi
-    local range="${line_number},\$ "
-
-    local filename="$(basename -- "$file")"
-    local ext="${filename##*.}"
-    local endline=',;'
-    local assign="=>|:|="
-    local comments="#"
-    local string="\"'"
-    if [[ "$ext" =~ ^ini|env|toml|yml|yaml$ ]]; then
-        endline='#'
-    fi
-    if [[ "$ext" =~ ^ini|env$ ]]; then
-        comments="[;#]"
-    fi
-    if [[ "php" == "$ext" ]] || [[ "$ext" == "js" ]]; then
-        comments="//"
-    fi
-    local list='\[\s*['$string']?\w+['$string']?\]'
-    local var_part='^\s*((const|var|let)\s+)?\$?(\w+('$list')*(->|\.|\[))*\s*'
-    var_part+="[$string]?${key}[$string]?"
-    var_part+='\s*\]?\s*'
-    var_part+="($assign)"
-    var_part+='\s*'
-
-    # Extract the part after assignation sign
-    local expression_with_comment="$(tail +$line_number ${file} | grep -i -o -P $var_part'\K.*$' || echo YNH_NULL | head -n1)"
-    if [[ "$expression_with_comment" == "YNH_NULL" ]]; then
-        set -o xtrace # set -x
-        return 1
-    fi
-
-    # Remove comments if needed
-    local expression="$(echo "$expression_with_comment" | sed "s@${comments}[^$string]*\$@@g" | sed "s@\s*[$endline]*\s*]*\$@@")"
-    endline=${expression_with_comment#"$expression"}
-    endline="$(echo "$endline" | sed 's/\\/\\\\/g')"
-    value="$(echo "$value" | sed 's/\\/\\\\/g')"
-    local first_char="${expression:0:1}"
-    delimiter=$'\001'
-    if [[ "$first_char" == '"' ]]; then
-        # \ and sed is quite complex you need 2 \\ to get one in a sed
-        # So we need \\\\ to go through 2 sed
-        value="$(echo "$value" | sed 's/"/\\\\"/g')"
-        sed -ri "${range}s$delimiter"'(^'"${var_part}"'")([^"]|\\")*("[\s;,]*)(\s*'$comments'.*)?$'$delimiter'\1'"${value}"'"'"${endline}${delimiter}i" ${file}
-    elif [[ "$first_char" == "'" ]]; then
-        # \ and sed is quite complex you need 2 \\ to get one in a sed
-        # However double quotes implies to double \\ to
-        # So we need \\\\\\\\ to go through 2 sed and 1 double quotes str
-        value="$(echo "$value" | sed "s/'/\\\\\\\\'/g")"
-        sed -ri "${range}s$delimiter(^${var_part}')([^']|\\')*('"'[\s,;]*)(\s*'$comments'.*)?$'$delimiter'\1'"${value}'${endline}${delimiter}i" ${file}
-    else
-        if [[ "$value" == *"'"* ]] || [[ "$value" == *'"'* ]] || [[ "$ext" =~ ^php|py|json|js$ ]]; then
-            value='\"'"$(echo "$value" | sed 's/"/\\\\"/g')"'\"'
-        fi
-        if [[ "$ext" =~ ^yaml|yml$ ]]; then
-            value=" $value"
-        fi
-        sed -ri "${range}s$delimiter(^${var_part}).*\$$delimiter\1${value}${endline}${delimiter}i" ${file}
-    fi
-    set -o xtrace # set -x
-}
-
-# Render templates with Jinja2
-#
-# [internal]
-#
-# Attention : Variables should be exported before calling this helper to be
-# accessible inside templates.
-#
-# usage: ynh_render_template some_template output_path
-# | arg: some_template - Template file to be rendered
-# | arg: output_path   - The path where the output will be redirected to
-ynh_render_template() {
-    local template_path=$1
-    local output_path=$2
-    mkdir -p "$(dirname $output_path)"
-    # Taken from https://stackoverflow.com/a/35009576
-    python3 -c 'import os, sys, jinja2; sys.stdout.write(
-                    jinja2.Template(sys.stdin.read()
-                    ).render(os.environ));' <$template_path >$output_path
-}
-
-# Fetch the Debian release codename
-#
-# usage: ynh_get_debian_release
-# | ret: The Debian release codename (i.e. jessie, stretch, ...)
-#
-# Requires YunoHost version 2.7.12 or higher.
-ynh_get_debian_release() {
-    echo $(lsb_release --codename --short)
-}
-
-# Create a directory under /tmp
-#
-# [internal]
-#
-# Deprecated helper
-#
-# usage: ynh_mkdir_tmp
-# | ret: the created directory path
-ynh_mkdir_tmp() {
-    ynh_print_warn --message="The helper ynh_mkdir_tmp is deprecated."
-    ynh_print_warn --message="You should use 'mktemp -d' instead and manage permissions \
-properly with chmod/chown."
-    local TMP_DIR=$(mktemp --directory)
-
-    # Give rights to other users could be a security risk.
-    # But for retrocompatibility we need it. (This helpers is deprecated)
-    chmod 755 $TMP_DIR
-    echo $TMP_DIR
-}
-
-_acceptable_path_to_delete() {
-    local file=$1
-
-    local forbidden_paths=$(ls -d / /* /{var,home,usr}/* /etc/{default,sudoers.d,yunohost,cron*})
-
-    # Legacy : A couple apps still have data in /home/$app ...
-    if [[ -n "$app" ]]
-    then
-        forbidden_paths=$(echo "$forbidden_paths" | grep -v "/home/$app")
-    fi
-
-    # Use realpath to normalize the path ..
-    # i.e convert ///foo//bar//..///baz//// to /foo/baz
-    file=$(realpath --no-symlinks "$file")
-    if [ -z "$file" ] || grep -q -x -F "$file" <<< "$forbidden_paths"; then
-        return 1
-    else
-        return 0
-    fi
-}
-
-
-# Remove a file or a directory securely
-#
-# usage: ynh_secure_remove --file=path_to_remove
-# | arg: -f, --file=    - File or directory to remove
-#
-# Requires YunoHost version 2.6.4 or higher.
-ynh_secure_remove() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=f
-    local -A args_array=([f]=file=)
-    local file
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    set +o xtrace # set +x
-
-    if [ $# -ge 2 ]; then
-        ynh_print_warn --message="/!\ Packager ! You provided more than one argument to ynh_secure_remove but it will be ignored... Use this helper with one argument at time."
-    fi
-
-    if [[ -z "$file" ]]; then
-        ynh_print_warn --message="ynh_secure_remove called with empty argument, ignoring."
-    elif [[ ! -e $file ]]; then
-        ynh_print_info --message="'$file' wasn't deleted because it doesn't exist."
-    elif ! _acceptable_path_to_delete "$file"; then
-        ynh_print_warn --message="Not deleting '$file' because it is not an acceptable path to delete."
-    else
-        rm --recursive "$file"
-    fi
-
-    set -o xtrace # set -x
-}
-
-# Extract a key from a plain command output
-#
-# [internal]
-#
-# (Deprecated, use --output-as json and jq instead)
-ynh_get_plain_key() {
-    local prefix="#"
-    local found=0
-    # We call this key_ so that it's not caught as
-    # an info to be redacted by the core
-    local key_=$1
-    shift
-    while read line; do
-        if [[ "$found" == "1" ]]; then
-            [[ "$line" =~ ^${prefix}[^#] ]] && return
-            echo $line
-        elif [[ "$line" =~ ^${prefix}${key_}$ ]]; then
-            if [[ -n "${1:-}" ]]; then
-                prefix+="#"
-                key_=$1
-                shift
-            else
-                found=1
-            fi
-        fi
-    done
-}
-
-# Read the value of a key in a ynh manifest file
-#
-# usage: ynh_read_manifest --manifest="manifest.json" --key="key"
-# | arg: -m, --manifest=    - Path of the manifest to read
-# | arg: -k, --key=         - Name of the key to find
-# | ret: the value associate to that key
-#
-# Requires YunoHost version 3.5.0 or higher.
-ynh_read_manifest() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=mk
-    local -A args_array=([m]=manifest= [k]=manifest_key=)
-    local manifest
-    local manifest_key
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    if [ ! -e "$manifest" ]; then
-        # If the manifest isn't found, try the common place for backup and restore script.
-        manifest="$YNH_APP_BASEDIR/manifest.json"
-    fi
-
-    jq ".$manifest_key" "$manifest" --raw-output
-}
-
-# Read the upstream version from the manifest or `$YNH_APP_MANIFEST_VERSION`
-#
-# usage: ynh_app_upstream_version [--manifest="manifest.json"]
-# | arg: -m, --manifest=    - Path of the manifest to read
-# | ret: the version number of the upstream app
-#
-# If the `manifest` is not specified, the envvar `$YNH_APP_MANIFEST_VERSION` will be used.
-#
-# The version number in the manifest is defined by `<upstreamversion>~ynh<packageversion>`.
-#
-# For example, if the manifest contains `4.3-2~ynh3` the function will return `4.3-2`
-#
-# Requires YunoHost version 3.5.0 or higher.
-ynh_app_upstream_version() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=m
-    local -A args_array=([m]=manifest=)
-    local manifest
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-    manifest="${manifest:-}"
-
-    if [[ "$manifest" != "" ]] && [[ -e "$manifest" ]]; then
-        version_key_=$(ynh_read_manifest --manifest="$manifest" --manifest_key="version")
-    else
-        version_key_=$YNH_APP_MANIFEST_VERSION
-    fi
-
-    echo "${version_key_/~ynh*/}"
-}
-
-# Read package version from the manifest
-#
-# usage: ynh_app_package_version [--manifest="manifest.json"]
-# | arg: -m, --manifest=    - Path of the manifest to read
-# | ret: the version number of the package
-#
-# The version number in the manifest is defined by `<upstreamversion>~ynh<packageversion>`.
-#
-# For example, if the manifest contains `4.3-2~ynh3` the function will return `3`
-#
-# Requires YunoHost version 3.5.0 or higher.
-ynh_app_package_version() {
-    # Declare an array to define the options of this helper.
-    local legacy_args=m
-    local -A args_array=([m]=manifest=)
-    local manifest
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    version_key_=$YNH_APP_MANIFEST_VERSION
-    echo "${version_key_/*~ynh/}"
-}
-
-# Checks the app version to upgrade with the existing app version and returns:
-#
-# usage: ynh_check_app_version_changed
-# | ret: `UPGRADE_APP` if the upstream version changed, `UPGRADE_PACKAGE` otherwise.
-#
-# This helper should be used to avoid an upgrade of an app, or the upstream part
-# of it, when it's not needed
-#
-# You can force an upgrade, even if the package is up to date, with the `--force` (or `-F`) argument :
-# ```
-# sudo yunohost app upgrade <appname> --force
-# ```
-# Requires YunoHost version 3.5.0 or higher.
-ynh_check_app_version_changed() {
-    local return_value=${YNH_APP_UPGRADE_TYPE}
-
-    if [ "$return_value" == "UPGRADE_FULL" ] || [ "$return_value" == "UPGRADE_FORCED" ] || [ "$return_value" == "DOWNGRADE_FORCED" ]; then
-        return_value="UPGRADE_APP"
-    fi
-
-    echo $return_value
-}
-
-# Compare the current package version against another version given as an argument.
-#
-# usage: ynh_compare_current_package_version --comparison (lt|le|eq|ne|ge|gt) --version <X~ynhY>
-# | arg: --comparison - Comparison type. Could be : `lt` (lower than), `le` (lower or equal), `eq` (equal), `ne` (not equal), `ge` (greater or equal), `gt` (greater than)
-# | arg: --version - The version to compare. Need to be a version in the yunohost package version type (like `2.3.1~ynh4`)
-# | ret: 0 if the evaluation is true, 1 if false.
-#
-# example: ynh_compare_current_package_version --comparison lt --version 2.3.2~ynh1
-#
-# This helper is usually used when we need to do some actions only for some old package versions.
-#
-# Generally you might probably use it as follow in the upgrade script :
-# ```
-# if ynh_compare_current_package_version --comparison lt --version 2.3.2~ynh1
-# then
-#     # Do something that is needed for the package version older than 2.3.2~ynh1
-# fi
-# ```
-#
-# Requires YunoHost version 3.8.0 or higher.
-ynh_compare_current_package_version() {
-    local legacy_args=cv
-    declare -Ar args_array=([c]=comparison= [v]=version=)
-    local version
-    local comparison
-    # Manage arguments with getopts
-    ynh_handle_getopts_args "$@"
-
-    local current_version=$YNH_APP_CURRENT_VERSION
-
-    # Check the syntax of the versions
-    if [[ ! $version =~ '~ynh' ]] || [[ ! $current_version =~ '~ynh' ]]; then
-        ynh_die --message="Invalid argument for version."
-    fi
-
-    # Check validity of the comparator
-    if [[ ! $comparison =~ (lt|le|eq|ne|ge|gt) ]]; then
-        ynh_die --message="Invalid comparator must be : lt, le, eq, ne, ge, gt"
-    fi
-
-    # Return the return value of dpkg --compare-versions
-    dpkg --compare-versions $current_version $comparison $version
-}
-
-# Check if we should enforce sane default permissions (= disable rwx for 'others')
-# on file/folders handled with ynh_setup_source and ynh_add_config
-#
-# [internal]
-#
-# Having a file others-readable or a folder others-executable(=enterable)
-# is a security risk comparable to "chmod 777"
-#
-# Configuration files may contain secrets. Or even just being able to enter a
-# folder may allow an attacker to do nasty stuff (maybe a file or subfolder has
-# some write permission enabled for 'other' and the attacker may edit the
-# content or create files as leverage for priviledge escalation ...)
-#
-# The sane default should be to set ownership to $app:$app.
-# In specific case, you may want to set the ownership to $app:www-data
-# for example if nginx needs access to static files.
-#
-_ynh_apply_default_permissions() {
-    local target=$1
-
-    local ynh_requirement=$(jq -r '.requirements.yunohost' $YNH_APP_BASEDIR/manifest.json | tr -d '>= ')
-
-    if [ -z "$ynh_requirement" ] || [ "$ynh_requirement" == "null" ] || dpkg --compare-versions $ynh_requirement ge 4.2; then
-        chmod o-rwx $target
-        chmod g-w $target
-        chown -R root:root $target
-        if ynh_system_user_exists $app; then
-            chown $app:$app $target
-        fi
-    fi
-}

data/hooks/conf_regen/03-ssh

@@ -1,51 +0,0 @@
-#!/bin/bash
-
-set -e
-
-. /usr/share/yunohost/helpers
-
-do_pre_regen() {
-    pending_dir=$1
-
-    # If the (legacy) 'from_script' flag is here,
-    # we won't touch anything in the ssh config.
-    [[ ! -f /etc/yunohost/from_script ]] || return 0
-
-    cd /usr/share/yunohost/templates/ssh
-
-    # do not listen to IPv6 if unavailable
-    [[ -f /proc/net/if_inet6 ]] && ipv6_enabled=true || ipv6_enabled=false
-
-    ssh_keys=$(ls /etc/ssh/ssh_host_{ed25519,rsa,ecdsa}_key 2>/dev/null || true)
-
-    # Support legacy setting (this setting might be disabled by a user during a migration)
-    if [[ "$(yunohost settings get 'service.ssh.allow_deprecated_dsa_hostkey')" == "True" ]]; then
-        ssh_keys="$ssh_keys $(ls /etc/ssh/ssh_host_dsa_key 2>/dev/null || true)"
-    fi
-
-    # Support different strategy for security configurations
-    export compatibility="$(yunohost settings get 'security.ssh.compatibility')"
-    export port="$(yunohost settings get 'security.ssh.port')"
-    export ssh_keys
-    export ipv6_enabled
-    ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config"
-}
-
-do_post_regen() {
-    regen_conf_files=$1
-
-    # If the (legacy) 'from_script' flag is here,
-    # we won't touch anything in the ssh config.
-    [[ ! -f /etc/yunohost/from_script ]] || return 0
-
-    # If no file changed, there's nothing to do
-    [[ -n "$regen_conf_files" ]] || return 0
-
-    # Enforce permissions for /etc/ssh/sshd_config
-    chown root:root "/etc/ssh/sshd_config"
-    chmod 644 "/etc/ssh/sshd_config"
-
-    systemctl restart ssh
-}
-
-do_$1_regen ${@:2}

data/hooks/conf_regen/10-apt

@@ -1,56 +0,0 @@
-#!/bin/bash
-
-set -e
-
-do_pre_regen() {
-    pending_dir=$1
-
-    mkdir --parents "${pending_dir}/etc/apt/preferences.d"
-
-    packages_to_refuse_from_sury="php php-fpm php-mysql php-xml php-zip php-mbstring php-ldap php-gd php-curl php-bz2 php-json php-sqlite3 php-intl openssl libssl1.1 libssl-dev"
-    for package in $packages_to_refuse_from_sury; do
-        echo "
-Package: $package
-Pin: origin \"packages.sury.org\" 
-Pin-Priority: -1" >>"${pending_dir}/etc/apt/preferences.d/extra_php_version"
-    done
-
-    echo "
-
-# PLEASE READ THIS WARNING AND DON'T EDIT THIS FILE
-
-# You are probably reading this file because you tried to install apache2 or 
-# bind9. These 2 packages conflict with YunoHost.
-
-# Installing apache2 will break nginx and break the entire YunoHost ecosystem
-# on your server, therefore don't remove those lines! 
-
-# You have been warned.
-
-Package: apache2
-Pin: release *
-Pin-Priority: -1
-
-Package: apache2-bin
-Pin: release *
-Pin-Priority: -1
-
-# Also bind9 will conflict with dnsmasq.
-# Same story as for apache2.
-# Don't install it, don't remove those lines.
-
-Package: bind9
-Pin: release *
-Pin-Priority: -1
-" >>"${pending_dir}/etc/apt/preferences.d/ban_packages"
-
-}
-
-do_post_regen() {
-    regen_conf_files=$1
-
-    # Make sure php7.3 is the default version when using php in cli
-    update-alternatives --set php /usr/bin/php7.3
-}
-
-do_$1_regen ${@:2}

data/hooks/conf_regen/19-postfix

@@ -1,81 +0,0 @@
-#!/bin/bash
-
-set -e
-
-. /usr/share/yunohost/helpers
-
-do_pre_regen() {
-    pending_dir=$1
-
-    cd /usr/share/yunohost/templates/postfix
-
-    postfix_dir="${pending_dir}/etc/postfix"
-    mkdir -p "$postfix_dir"
-
-    default_dir="${pending_dir}/etc/default/"
-    mkdir -p "$default_dir"
-
-    # install plain conf files
-    cp plain/* "$postfix_dir"
-
-    # prepare main.cf conf file
-    main_domain=$(cat /etc/yunohost/current_host)
-
-    # Support different strategy for security configurations
-    export compatibility="$(yunohost settings get 'security.postfix.compatibility')"
-
-    # Add possibility to specify a relay
-    # Could be useful with some isp with no 25 port open or more complex setup
-    export relay_port=""
-    export relay_user=""
-    export relay_host="$(yunohost settings get 'smtp.relay.host')"
-    if [ -n "${relay_host}" ]; then
-        relay_port="$(yunohost settings get 'smtp.relay.port')"
-        relay_user="$(yunohost settings get 'smtp.relay.user')"
-        relay_password="$(yunohost settings get 'smtp.relay.password')"
-
-        # Avoid to display "Relay account paswword" to other users
-        touch ${postfix_dir}/sasl_passwd
-        chmod 750 ${postfix_dir}/sasl_passwd
-        # Avoid "postmap: warning: removing zero-length database file"
-        chown postfix ${pending_dir}/etc/postfix
-        chown postfix ${pending_dir}/etc/postfix/sasl_passwd
-
-        cat <<<"[${relay_host}]:${relay_port} ${relay_user}:${relay_password}" >${postfix_dir}/sasl_passwd
-        postmap ${postfix_dir}/sasl_passwd
-    fi
-    export main_domain
-    export domain_list="$YNH_DOMAINS"
-    ynh_render_template "main.cf" "${postfix_dir}/main.cf"
-
-    cat postsrsd \
-        | sed "s/{{ main_domain }}/${main_domain}/g" \
-        | sed "s/{{ domain_list }}/${YNH_DOMAINS}/g" \
-            >"${default_dir}/postsrsd"
-
-    # adapt it for IPv4-only hosts
-    ipv6="$(yunohost settings get 'smtp.allow_ipv6')"
-    if [ "$ipv6" == "False" ] || [ ! -f /proc/net/if_inet6 ]; then
-        sed -i \
-            's/ \[::ffff:127.0.0.0\]\/104 \[::1\]\/128//g' \
-            "${postfix_dir}/main.cf"
-        sed -i \
-            's/inet_interfaces = all/&\ninet_protocols = ipv4/' \
-            "${postfix_dir}/main.cf"
-    fi
-}
-
-do_post_regen() {
-    regen_conf_files=$1
-
-    if [ -e /etc/postfix/sasl_passwd ]; then
-        chmod 750 /etc/postfix/sasl_passwd*
-        chown postfix:root /etc/postfix/sasl_passwd*
-    fi
-
-    [[ -z "$regen_conf_files" ]] \
-        || { systemctl restart postfix && systemctl restart postsrsd; }
-
-}
-
-do_$1_regen ${@:2}

data/hooks/restore/18-data_multimedia

@@ -1,9 +0,0 @@
-#!/bin/bash
-
-# Exit hook on subcommand error or unset variable
-set -eu
-
-# Source YNH helpers
-source /usr/share/yunohost/helpers
-
-ynh_restore_file --origin_path="/home/yunohost.multimedia" --not_mandatory

data/other/config_domain.toml

@@ -1,55 +0,0 @@
-version = "1.0"
-i18n = "domain_config"
-
-#
-# Other things we may want to implement in the future:
-#
-# - maindomain handling
-# - default app
-# - autoredirect www in nginx conf
-# - ?
-#
-
-[feature]
-    
-    [feature.mail]
-    #services = ['postfix', 'dovecot']
-
-        [feature.mail.features_disclaimer]
-        type = "alert"
-        style = "warning"
-        icon = "warning"
-
-        [feature.mail.mail_out]
-        type = "boolean"
-        default = 1
-        
-        [feature.mail.mail_in]
-        type = "boolean"
-        default = 1
-        
-        #[feature.mail.backup_mx]
-        #type = "tags"
-        #default = []
-        #pattern.regexp = '^([^\W_A-Z]+([-]*[^\W_A-Z]+)*\.)+((xn--)?[^\W_]{2,})$'
-        #pattern.error = "pattern_error"
-    
-    [feature.xmpp]
-
-        [feature.xmpp.xmpp]
-        type = "boolean"
-        default = 0
-
-[dns]
-    
-    [dns.registrar]
-    optional = true
-
-        # This part is automatically generated in DomainConfigPanel
-
-#   [dns.advanced]
-#
-#        [dns.advanced.ttl]
-#        type = "number"
-#        min = 0
-#        default = 3600

data/templates/metronome/domain.tpl.cfg.lua

@@ -1,75 +0,0 @@
-VirtualHost "{{ domain }}"
-  enable = true
-  ssl = {
-        key = "/etc/yunohost/certs/{{ domain }}/key.pem";
-        certificate = "/etc/yunohost/certs/{{ domain }}/crt.pem";
-  }
-  authentication = "ldap2"
-  ldap = {
-     hostname      = "localhost",
-     user = {
-       basedn        = "ou=users,dc=yunohost,dc=org",
-       filter        = "(&(objectClass=posixAccount)(mail=*@{{ domain }})(permission=cn=xmpp.main,ou=permission,dc=yunohost,dc=org))",
-       usernamefield = "mail",
-       namefield     = "cn",
-       },
-  }
-
-  -- Discovery items
-  disco_items = {
-    { "muc.{{ domain }}" },
-    { "pubsub.{{ domain }}" },
-    { "jabber.{{ domain }}" },
-    { "vjud.{{ domain }}" },
-    { "xmpp-upload.{{ domain }}" },
-  };
-
---  contact_info = {
---    abuse = { "mailto:abuse@{{ domain }}", "xmpp:admin@{{ domain }}" };
---    admin = { "mailto:root@{{ domain }}", "xmpp:admin@{{ domain }}" };
---  };
-
------- Components ------
--- You can specify components to add hosts that provide special services,
--- like multi-user conferences, and transports.
-
----Set up a MUC (multi-user chat) room server
-Component "muc.{{ domain }}" "muc"
-  name = "{{ domain }} Chatrooms"
-
-  modules_enabled = {
-    "muc_limits";
-    "muc_log";
-    "muc_log_mam";
-    "muc_log_http";
-    "muc_vcard";
-  }
-
-  muc_event_rate = 0.5
-  muc_burst_factor = 10
-  room_default_config = {
-    logging = true,
-    persistent = true
-  };
-
----Set up a PubSub server
-Component "pubsub.{{ domain }}" "pubsub"
-  name = "{{ domain }} Publish/Subscribe"
-
-  unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server)
-
----Set up a HTTP Upload service
-Component "xmpp-upload.{{ domain }}" "http_upload"
-  name = "{{ domain }} Sharing Service"
-
-  http_file_path = "/var/xmpp-upload/{{ domain }}/upload"
-  http_external_url = "https://xmpp-upload.{{ domain }}:443"
-  http_file_base_path = "/upload"
-  http_file_size_limit = 6*1024*1024
-  http_file_quota = 60*1024*1024
-  http_upload_file_size_limit = 100 * 1024 * 1024 -- bytes
-  http_upload_quota = 10 * 1024 * 1024 * 1024 -- bytes
-
----Set up a VJUD service
-Component "vjud.{{ domain }}" "vjud"
-  vjud_disco_name = "{{ domain }} User Directory"

data/templates/metronome/metronome.cfg.lua

@@ -1,123 +0,0 @@
--- ** Metronome's config file example **
--- 
--- The format is exactly equal to Prosody's:
---
--- Lists are written { "like", "this", "one" } 
--- Lists can also be of { 1, 2, 3 } numbers, etc. 
--- Either commas, or semi-colons; may be used as seperators.
---
--- A table is a list of values, except each value has a name. An 
--- example would be:
---
--- ssl = { key = "keyfile.key", certificate = "certificate.cert" }
---
--- Tip: You can check that the syntax of this file is correct when you have finished
--- by running: luac -p metronome.cfg.lua
--- If there are any errors, it will let you know what and where they are, otherwise it 
--- will keep quiet.
-
--- Global settings go in this section
- 
--- This is the list of modules Metronome will load on startup.
--- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
-
-modules_enabled = {
-	-- Generally required
-		"roster"; -- Allow users to have a roster. Recommended.
-		"saslauth"; -- Authentication for clients. Recommended if you want to log in.
-		"tls"; -- Add support for secure TLS on c2s/s2s connections
-		"disco"; -- Service discovery
- 
-	-- Not essential, but recommended
-		"private"; -- Private XML storage (for room bookmarks, etc.)
-		"vcard"; -- Allow users to set vCards
-		"pep"; -- Allows setting of mood, tune, etc.
-		"pubsub";  -- Publish-subscribe XEP-0060
-		"posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
-		"bidi"; -- Enables Bidirectional Server-to-Server Streams.
- 
-	-- Nice to have
-		"version"; -- Replies to server version requests
-		"uptime"; -- Report how long server has been running
-		"time"; -- Let others know the time here on this server
-		"ping"; -- Replies to XMPP pings with pongs
-		"register"; -- Allow users to register on this server using a client and change passwords
-		"stream_management"; -- Allows clients and servers to use Stream Management
-		"stanza_optimizations"; -- Allows clients to use Client State Indication and SIFT
-		"message_carbons"; -- Allows clients to enable carbon copies of messages
-		"mam"; -- Enable server-side message archives using Message Archive Management
-		"push"; -- Enable Push Notifications via PubSub using XEP-0357
-		"lastactivity"; -- Enables clients to know the last presence status of an user
-		"adhoc_cm"; -- Allow to set client certificates to login through SASL External via adhoc
-		"admin_adhoc"; -- administration adhoc commands
-		"bookmarks"; -- XEP-0048 Bookmarks synchronization between PEP and Private Storage
-		"sec_labels"; -- Allows to use a simplified version XEP-0258 Security Labels and related ACDFs.
-		"privacy"; -- Add privacy lists and simple blocking command support
-
-		-- Other specific functionality
-		--"admin_telnet"; -- administration console, telnet to port 5582
-		--"admin_web"; -- administration web interface
-		"bosh"; -- Enable support for BOSH clients, aka "XMPP over Bidirectional Streams over Synchronous HTTP"
-		--"compression"; -- Allow clients to enable Stream Compression
-		--"spim_block"; -- Require authorization via OOB form for messages from non-contacts and block unsollicited messages
-		--"gate_guard"; -- Enable config-based blacklisting and hit-based auto-banning features
-		--"incidents_handling"; -- Enable Incidents Handling support (can be administered via adhoc commands)
-		--"server_presence"; -- Enables Server Buddies extension support
-		--"service_directory"; -- Enables Service Directories extension support
-		--"public_service"; -- Enables Server vCard support for public services in directories and advertises in features
-		--"register_api"; -- Provides secure API for both Out-Of-Band and In-Band registration for E-Mail verification
-		"websocket"; -- Enable support for WebSocket clients, aka "XMPP over WebSockets"
-};
-
--- Server PID
-pidfile = "/var/run/metronome/metronome.pid"
-
--- HTTP server
-http_ports = { 5290 }
-http_interfaces = { "127.0.0.1", "::1" }
-
---https_ports = { 5291 }
---https_interfaces = { "127.0.0.1", "::1" }
-
--- Enable IPv6
-use_ipv6 = true
-
--- BOSH configuration (mod_bosh)
-consider_bosh_secure = true
-cross_domain_bosh = true
-
--- WebSocket configuration (mod_websocket)
-consider_websocket_secure = true
-cross_domain_websocket = true
-
--- Disable account creation by default, for security
-allow_registration = false
-
--- Use LDAP storage backend for all stores
-storage = "ldap"
-
--- stanza optimization
-csi_config_queue_all_muc_messages_but_mentions = false;
-
-
--- Logging configuration
-log = {
-	info = "/var/log/metronome/metronome.log"; -- Change 'info' to 'debug' for verbose logging
-	error = "/var/log/metronome/metronome.err";
-	-- "*syslog"; -- Uncomment this for logging to syslog
-	-- "*console"; -- Log to the console, useful for debugging with daemonize=false
-}
-
------- Components ------
--- You can specify components to add hosts that provide special services,
--- like multi-user conferences, and transports.
-
----Set up a local BOSH service
-Component "localhost" "http"
-	modules_enabled = { "bosh" }
-
------------ Virtual hosts -----------
--- You need to add a VirtualHost entry for each domain you wish Metronome to serve.
--- Settings under each VirtualHost entry apply *only* to that host.
-
-Include "conf.d/*.cfg.lua"