mirror of
https://github.com/YunoHost/yunohost.git
synced 2024-09-03 20:06:10 +02:00
272 lines
10 KiB
Bash
Executable file
272 lines
10 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
do_init_regen() {
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "You must be root to run this script" 1>&2
|
|
exit 1
|
|
fi
|
|
|
|
cd /usr/share/yunohost/conf/yunohost
|
|
|
|
[[ -d /etc/yunohost ]] || mkdir -p /etc/yunohost
|
|
|
|
# set default current_host
|
|
[[ -f /etc/yunohost/current_host ]] \
|
|
|| echo "yunohost.org" >/etc/yunohost/current_host
|
|
|
|
# copy default services and firewall
|
|
[[ -f /etc/yunohost/firewall.yml ]] \
|
|
|| cp firewall.yml /etc/yunohost/firewall.yml
|
|
|
|
# allow users to access /media directory
|
|
[[ -d /etc/skel/media ]] \
|
|
|| (mkdir -p /media && ln -s /media /etc/skel/media)
|
|
|
|
# Cert folders
|
|
mkdir -p /etc/yunohost/certs
|
|
chown -R root:ssl-cert /etc/yunohost/certs
|
|
chmod 750 /etc/yunohost/certs
|
|
|
|
# App folders
|
|
mkdir -p /etc/yunohost/apps
|
|
chmod 700 /etc/yunohost/apps
|
|
mkdir -p /home/yunohost.app
|
|
chmod 755 /home/yunohost.app
|
|
|
|
# Domain settings
|
|
mkdir -p /etc/yunohost/domains
|
|
chmod 700 /etc/yunohost/domains
|
|
|
|
# Backup folders
|
|
mkdir -p /home/yunohost.backup/archives
|
|
chmod 750 /home/yunohost.backup/archives
|
|
chown root:root /home/yunohost.backup/archives # This is later changed to root:admins once the admins group exists
|
|
|
|
# Empty ssowat json persistent conf
|
|
echo "{}" >'/etc/ssowat/conf.json.persistent'
|
|
chmod 644 /etc/ssowat/conf.json.persistent
|
|
chown root:root /etc/ssowat/conf.json.persistent
|
|
|
|
# Empty service conf
|
|
touch /etc/yunohost/services.yml
|
|
|
|
mkdir -p /var/cache/yunohost/repo
|
|
chown root:root /var/cache/yunohost
|
|
chmod 700 /var/cache/yunohost
|
|
|
|
cp yunohost-api.service /etc/systemd/system/yunohost-api.service
|
|
cp yunohost-firewall.service /etc/systemd/system/yunohost-firewall.service
|
|
cp yunoprompt.service /etc/systemd/system/yunoprompt.service
|
|
|
|
systemctl daemon-reload
|
|
|
|
systemctl enable yunohost-api.service --quiet
|
|
systemctl start yunohost-api.service
|
|
# Yunohost-firewall is enabled only during postinstall, not init, not 100% sure why
|
|
|
|
cp dpkg-origins /etc/dpkg/origins/yunohost
|
|
|
|
# Change dpkg vendor
|
|
# see https://wiki.debian.org/Derivatives/Guidelines#Vendor
|
|
if readlink -f /etc/dpkg/origins/default | grep -q debian;
|
|
then
|
|
rm -f /etc/dpkg/origins/default
|
|
ln -s /etc/dpkg/origins/yunohost /etc/dpkg/origins/default
|
|
fi
|
|
}
|
|
|
|
do_pre_regen() {
|
|
pending_dir=$1
|
|
|
|
cd /usr/share/yunohost/conf/yunohost
|
|
|
|
mkdir -p $pending_dir/etc/systemd/system
|
|
mkdir -p $pending_dir/etc/cron.d/
|
|
mkdir -p $pending_dir/etc/cron.daily/
|
|
|
|
# add cron job for diagnosis to be ran at 7h and 19h + a random delay between
|
|
# 0 and 20min, meant to avoid every instances running their diagnosis at
|
|
# exactly the same time, which may overload the diagnosis server.
|
|
cat >$pending_dir/etc/cron.d/yunohost-diagnosis <<EOF
|
|
SHELL=/bin/bash
|
|
0 7,19 * * * root : YunoHost Automatic Diagnosis; sleep \$((RANDOM\\%1200)); yunohost diagnosis run --email > /dev/null 2>/dev/null || echo "Running the automatic diagnosis failed miserably"
|
|
EOF
|
|
|
|
# Cron job that upgrade the app list everyday
|
|
cat >$pending_dir/etc/cron.daily/yunohost-fetch-apps-catalog <<EOF
|
|
#!/bin/bash
|
|
sleep \$((RANDOM%3600)); yunohost tools update apps > /dev/null
|
|
EOF
|
|
|
|
# Cron job that renew lets encrypt certificates if there's any that needs renewal
|
|
cat >$pending_dir/etc/cron.daily/yunohost-certificate-renew <<EOF
|
|
#!/bin/bash
|
|
yunohost domain cert renew --email
|
|
EOF
|
|
|
|
# If we subscribed to a dyndns domain, add the corresponding cron
|
|
# - delay between 0 and 60 secs to spread the check over a 1 min window
|
|
# - do not run the command if some process already has the lock, to avoid queuing hundreds of commands...
|
|
if ls -l /etc/yunohost/dyndns/K*.key 2>/dev/null; then
|
|
cat >$pending_dir/etc/cron.d/yunohost-dyndns <<EOF
|
|
SHELL=/bin/bash
|
|
# Every 10 minutes,
|
|
# - (sleep random 60 is here to spread requests over a 1-min window)
|
|
# - if ip.yunohost.org answers ping (basic check to validate that we're connected to the internet and yunohost infra aint down)
|
|
# - and if lock ain't already taken by another command
|
|
# - trigger yunohost dyndns update
|
|
*/10 * * * * root : YunoHost DynDNS update; sleep \$((RANDOM\\%60)); ! ping -q -W5 -c1 ip.yunohost.org >/dev/null 2>&1 || test -e /var/run/moulinette_yunohost.lock || yunohost dyndns update >> /dev/null
|
|
EOF
|
|
else
|
|
# (Delete cron if no dyndns domain found)
|
|
touch $pending_dir/etc/cron.d/yunohost-dyndns
|
|
fi
|
|
|
|
# Skip ntp if inside a container (inspired from the conf of systemd-timesyncd)
|
|
if systemctl | grep -q 'ntp.service'
|
|
then
|
|
mkdir -p ${pending_dir}/etc/systemd/system/ntp.service.d/
|
|
cat >${pending_dir}/etc/systemd/system/ntp.service.d/ynh-override.conf <<EOF
|
|
[Unit]
|
|
ConditionCapability=CAP_SYS_TIME
|
|
ConditionVirtualization=!container
|
|
EOF
|
|
fi
|
|
|
|
# Make nftable conflict with yunohost-firewall
|
|
mkdir -p ${pending_dir}/etc/systemd/system/nftables.service.d/
|
|
cat >${pending_dir}/etc/systemd/system/nftables.service.d/ynh-override.conf <<EOF
|
|
[Unit]
|
|
# yunohost-firewall and nftables conflict with each other
|
|
Conflicts=yunohost-firewall.service
|
|
ConditionFileIsExecutable=!/etc/init.d/yunohost-firewall
|
|
ConditionPathExists=!/etc/systemd/system/multi-user.target.wants/yunohost-firewall.service
|
|
EOF
|
|
|
|
# Don't suspend computer on LidSwitch
|
|
mkdir -p ${pending_dir}/etc/systemd/logind.conf.d/
|
|
cat >${pending_dir}/etc/systemd/logind.conf.d/ynh-override.conf <<EOF
|
|
[Login]
|
|
HandleLidSwitch=ignore
|
|
HandleLidSwitchDocked=ignore
|
|
HandleLidSwitchExternalPower=ignore
|
|
EOF
|
|
|
|
cp yunohost-api.service ${pending_dir}/etc/systemd/system/yunohost-api.service
|
|
cp yunohost-firewall.service ${pending_dir}/etc/systemd/system/yunohost-firewall.service
|
|
cp yunoprompt.service ${pending_dir}/etc/systemd/system/yunoprompt.service
|
|
cp proc-hidepid.service ${pending_dir}/etc/systemd/system/proc-hidepid.service
|
|
|
|
mkdir -p ${pending_dir}/etc/dpkg/origins/
|
|
cp dpkg-origins ${pending_dir}/etc/dpkg/origins/yunohost
|
|
|
|
}
|
|
|
|
do_post_regen() {
|
|
regen_conf_files=$1
|
|
|
|
######################
|
|
# Enfore permissions #
|
|
######################
|
|
|
|
chmod 770 /home/yunohost.backup
|
|
chmod 770 /home/yunohost.backup/archives
|
|
chmod 700 /var/cache/yunohost
|
|
chown root:admins /home/yunohost.backup
|
|
chown root:admins /home/yunohost.backup/archives
|
|
chown root:root /var/cache/yunohost
|
|
|
|
[ ! -e /var/www/.well-known/ynh-diagnosis/ ] || chmod 775 /var/www/.well-known/ynh-diagnosis/
|
|
|
|
# NB: x permission for 'others' is important for ssl-cert (and maybe mdns), otherwise slapd will fail to start because can't access the certs
|
|
chmod 755 /etc/yunohost
|
|
|
|
find /etc/systemd/system/*.service -type f | xargs -r chown root:root
|
|
find /etc/systemd/system/*.service -type f | xargs -r chmod 0644
|
|
|
|
if ls -l /etc/php/*/fpm/pool.d/*.conf
|
|
then
|
|
chown root:root /etc/php/*/fpm/pool.d/*.conf
|
|
chmod 644 /etc/php/*/fpm/pool.d/*.conf
|
|
fi
|
|
|
|
# Certs
|
|
# We do this with find because there could be a lot of them...
|
|
chown -R root:ssl-cert /etc/yunohost/certs
|
|
chmod 750 /etc/yunohost/certs
|
|
find /etc/yunohost/certs/ -type f -exec chmod 640 {} \;
|
|
find /etc/yunohost/certs/ -type d -exec chmod 750 {} \;
|
|
|
|
find /etc/cron.*/yunohost-* -type f -exec chmod 755 {} \;
|
|
find /etc/cron.d/yunohost-* -type f -exec chmod 644 {} \;
|
|
find /etc/cron.*/yunohost-* -type f -exec chown root:root {} \;
|
|
|
|
setfacl -m g:all_users:--- /var/www
|
|
setfacl -m g:all_users:--- /var/log/nginx
|
|
setfacl -m g:all_users:--- /etc/yunohost
|
|
setfacl -m g:all_users:--- /etc/ssowat
|
|
|
|
for USER in $(yunohost user list --quiet --output-as json | jq -r '.users | .[] | .username'); do
|
|
[ ! -e "/home/$USER" ] || setfacl -m g:all_users:--- /home/$USER
|
|
done
|
|
|
|
# Domain settings
|
|
mkdir -p /etc/yunohost/domains
|
|
|
|
# Misc configuration / state files
|
|
chown root:root $(ls /etc/yunohost/{*.yml,*.yaml,*.json,mysql,psql} 2>/dev/null | grep -vw mdns.yml)
|
|
chmod 600 $(ls /etc/yunohost/{*.yml,*.yaml,*.json,mysql,psql} 2>/dev/null)
|
|
|
|
# Apps folder, custom hooks folder
|
|
[[ ! -e /etc/yunohost/hooks.d ]] || (chown root /etc/yunohost/hooks.d && chmod 700 /etc/yunohost/hooks.d)
|
|
[[ ! -e /etc/yunohost/apps ]] || (chown root /etc/yunohost/apps && chmod 700 /etc/yunohost/apps)
|
|
[[ ! -e /etc/yunohost/domains ]] || (chown root /etc/yunohost/domains && chmod 700 /etc/yunohost/domains)
|
|
|
|
# Create ssh.app and sftp.app groups if they don't exist yet
|
|
grep -q '^ssh.app:' /etc/group || groupadd ssh.app
|
|
grep -q '^sftp.app:' /etc/group || groupadd sftp.app
|
|
|
|
# Propagates changes in systemd service config overrides
|
|
if systemctl | grep -q 'ntp.service'
|
|
then
|
|
[[ ! "$regen_conf_files" =~ "ntp.service.d/ynh-override.conf" ]] || {
|
|
systemctl daemon-reload
|
|
systemctl restart ntp
|
|
}
|
|
fi
|
|
[[ ! "$regen_conf_files" =~ "nftables.service.d/ynh-override.conf" ]] || systemctl daemon-reload
|
|
[[ ! "$regen_conf_files" =~ "login.conf.d/ynh-override.conf" ]] || {
|
|
systemctl daemon-reload
|
|
systemctl restart systemd-logind
|
|
}
|
|
[[ ! "$regen_conf_files" =~ "yunohost-firewall.service" ]] || systemctl daemon-reload
|
|
[[ ! "$regen_conf_files" =~ "yunohost-api.service" ]] || systemctl daemon-reload
|
|
|
|
if [[ "$regen_conf_files" =~ "yunoprompt.service" ]]; then
|
|
systemctl daemon-reload
|
|
action=$([[ -e /etc/systemd/system/yunoprompt.service ]] && echo 'enable' || echo 'disable')
|
|
systemctl $action yunoprompt --quiet --now
|
|
fi
|
|
if [[ "$regen_conf_files" =~ "proc-hidepid.service" ]]; then
|
|
systemctl daemon-reload
|
|
action=$([[ -e /etc/systemd/system/proc-hidepid.service ]] && echo 'enable' || echo 'disable')
|
|
systemctl $action proc-hidepid --quiet --now
|
|
fi
|
|
|
|
# Change dpkg vendor
|
|
# see https://wiki.debian.org/Derivatives/Guidelines#Vendor
|
|
if readlink -f /etc/dpkg/origins/default | grep -q debian;
|
|
then
|
|
rm -f /etc/dpkg/origins/default
|
|
ln -s /etc/dpkg/origins/yunohost /etc/dpkg/origins/default
|
|
fi
|
|
|
|
if test -e /etc/yunohost/installed && test -e /etc/profile.d/check_yunohost_is_installed.sh
|
|
then
|
|
rm /etc/profile.d/check_yunohost_is_installed.sh
|
|
fi
|
|
}
|
|
|
|
do_$1_regen ${@:2}
|