forked from nextcloud/vm
-
Notifications
You must be signed in to change notification settings - Fork 0
/
lib.sh
2270 lines (2076 loc) · 72.5 KB
/
lib.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/
# GNU General Public License v3.0
# https://github.com/nextcloud/vm/blob/master/LICENSE
# shellcheck disable=SC2034
true
# see https://github.com/koalaman/shellcheck/wiki/Directive
## VARIABLES
# Dirs
SCRIPTS=/var/scripts
HTML=/var/www
NCPATH="$HTML"/nextcloud
POOLNAME=ncdata
NCDATA=/mnt/"$POOLNAME"
SNAPDIR=/var/snap/spreedme
GPGDIR=/tmp/gpg
SHA256_DIR=/tmp/sha256
BACKUP=/mnt/NCBACKUP
NC_APPS_PATH=$NCPATH/apps
VMLOGS=/var/log/nextcloud
# Helper function for generating random passwords
gen_passwd() {
local length=$1
local charset="$2"
local password=""
while [ ${#password} -lt "$length" ]
do
password=$(echo "$password""$(head -c 100 /dev/urandom | LC_ALL=C tr -dc "$charset")" | fold -w "$length" | head -n 1)
done
echo "$password"
}
# Ubuntu OS
DISTRO=$(lsb_release -sr)
CODENAME=$(lsb_release -sc)
KEYBOARD_LAYOUT=$(localectl status | grep "Layout" | awk '{print $3}')
# Hypervisor
### TODO ### HYPERVISOR=$(dmesg --notime | grep -i hypervisor | cut -d ':' -f2 | head -1 | tr -d ' ')
SYSVENDOR=$(cat /sys/devices/virtual/dmi/id/sys_vendor)
# Network
IFACE=$(ip r | grep "default via" | awk '{print $5}')
IFACE2=$(ip -o link show | awk '{print $2,$9}' | grep 'UP' | cut -d ':' -f 1)
REPO=$(grep "^deb " /etc/apt/sources.list | grep http | awk '{print $2}' | head -1)
ADDRESS=$(hostname -I | cut -d ' ' -f 1)
WANIP4=$(curl -s -k -m 5 -4 https://api64.ipify.org)
INTERFACES="/etc/netplan/nextcloud.yaml"
GATEWAY=$(ip route | grep default | awk '{print $3}')
# Internet DNS required when a check needs to be made to a server outside the home/SME
INTERNET_DNS="9.9.9.9"
# Default Quad9 DNS servers, overwritten by the systemd global DNS defined servers, if set
DNS1="9.9.9.9"
DNS2="149.112.112.112"
NONO_PORTS=(22 25 53 80 443 1024 3012 3306 5178 5179 5432 7867 7983 8983 10000 8081 8443 9443 9000 9980 9090 9200 9600 1234)
# 9000 9980 9090 9200 9600 1234 are local docker ports, don't remember if they are needed here or not.
use_global_systemd_dns() {
if [ -f "/etc/systemd/resolved.conf" ]
then
local resolvedDns1
resolvedDns1=$(grep -m 1 -E "^DNS=.+" /etc/systemd/resolved.conf | sed s/^DNS=// | awk '{print $1}')
if [ -n "$resolvedDns1" ]
then
DNS1="$resolvedDns1"
local resolvedDns2
resolvedDns2=$(grep -m 1 -E "^DNS=.+" /etc/systemd/resolved.conf | sed s/^DNS=// | awk '{print $2}')
if [ -n "$resolvedDns2" ]
then
DNS2="$resolvedDns2"
else
DNS2=
fi
fi
fi
}
use_global_systemd_dns
# Whiptails
TITLE="Nextcloud VM - $(date +%Y)"
[ -n "$SCRIPT_NAME" ] && TITLE+=" - $SCRIPT_NAME"
CHECKLIST_GUIDE="Navigate with the [ARROW] keys and (de)select with the [SPACE] key. \
Confirm by pressing [ENTER]. Cancel by pressing [ESC]."
MENU_GUIDE="Navigate with the [ARROW] keys and confirm by pressing [ENTER]. Cancel by pressing [ESC]."
RUN_LATER_GUIDE="You can view this script later by running 'sudo bash $SCRIPTS/menu.sh'."
# Repo
GITHUB_REPO="https://raw.githubusercontent.com/klausagnoletti/vm/master/" #Changing this is enough for our fork of nextcloud-startup.sh to be downloaded later on
STATIC="$GITHUB_REPO/static"
LETS_ENC="$GITHUB_REPO/lets-encrypt"
APP="$GITHUB_REPO/apps"
OLD="$GITHUB_REPO/old"
ADDONS="$GITHUB_REPO/addons"
DESEC="$GITHUB_REPO/addons/deSEC"
MENU="$GITHUB_REPO/menu"
DISK="$GITHUB_REPO/disk"
NETWORK="$GITHUB_REPO/network"
VAGRANT_DIR="$GITHUB_REPO/vagrant"
NOT_SUPPORTED_FOLDER="$GITHUB_REPO/not-supported"
GEOBLOCKDAT="$GITHUB_REPO/geoblockdat"
NCREPO="https://download.nextcloud.com/server/releases"
ISSUES="https://github.com/klausagnoletti/vm/issues"
# User information
GUIUSER=ncadmin
GUIPASS=nextcloud
UNIXUSER=$SUDO_USER
UNIXUSER_PROFILE="/home/$UNIXUSER/.bash_profile"
ROOT_PROFILE="/root/.bash_profile"
# User for Bitwarden
BITWARDEN_USER=bitwarden
BITWARDEN_HOME=/home/"$BITWARDEN_USER"
# Database
SHUF=$(shuf -i 25-29 -n 1)
PGDB_USER=nextcloud_db_user
PGDB_PASS=$(gen_passwd "$SHUF" "a-zA-Z0-9@#*")
NEWPGPASS=$(gen_passwd "$SHUF" "a-zA-Z0-9@#*")
ncdb() {
NCDB=$(grep "dbname" $NCPATH/config/config.php | awk '{print $3}' | sed "s/[',]//g")
NCDBPASS=$(grep "dbpassword" $NCPATH/config/config.php | awk '{print $3}' | sed "s/[',]//g")
NCDBUSER=$(grep "dbuser" $NCPATH/config/config.php | awk '{print $3}' | sed "s/[',]//g")
NCDBTYPE=$(grep "dbtype" /var/www/nextcloud/config/config.php | awk '{print $3}' | sed "s/[',]//g")
NCDBHOST=$(grep "dbhost" /var/www/nextcloud/config/config.php | awk '{print $3}' | sed "s/[',]//g")
}
# Path to specific files
SECURE="$SCRIPTS/setup_secure_permissions_nextcloud.sh"
# Nextcloud version
nc_update() {
CURRENTVERSION=$(sudo -u www-data php $NCPATH/occ status | grep "versionstring" | awk '{print $3}')
NCVERSION=$(curl -s -m 900 $NCREPO/ | sed --silent 's/.*href="nextcloud-\([^"]\+\).zip.asc".*/\1/p' | sort --version-sort | tail -1)
STABLEVERSION="nextcloud-$NCVERSION"
NCMAJOR="${NCVERSION%%.*}"
CURRENTMAJOR="${CURRENTVERSION%%.*}"
NCBAD=$((NCMAJOR-2))
NCNEXT="$((${CURRENTVERSION%%.*}+1))"
}
# Set the hour for automatic updates. This would be 18:00 as only the hour is configurable.
AUT_UPDATES_TIME="18"
# Keys
OpenPGP_fingerprint='28806A878AE423A28372792ED75899B9A724937A'
# Letsencrypt
SITES_AVAILABLE="/etc/apache2/sites-available"
LETSENCRYPTPATH="/etc/letsencrypt"
CERTFILES="$LETSENCRYPTPATH/live"
DHPARAMS_TLS="$CERTFILES/$TLSDOMAIN/dhparam.pem"
DHPARAMS_SUB="$CERTFILES/$SUBDOMAIN/dhparam.pem"
TLS_CONF="nextcloud_tls_domain_self_signed.conf"
HTTP_CONF="nextcloud_http_domain_self_signed.conf"
# Collabora App
HTTPS_CONF="$SITES_AVAILABLE/$SUBDOMAIN.conf"
HTTP2_CONF="/etc/apache2/mods-available/http2.conf"
# PHP-FPM
PHPVER=8.1
PHP_FPM_DIR=/etc/php/$PHPVER/fpm
PHP_INI=$PHP_FPM_DIR/php.ini
PHP_POOL_DIR=$PHP_FPM_DIR/pool.d
PHP_MODS_DIR=/etc/php/"$PHPVER"/mods-available
opcache_interned_strings_buffer_value=24
# Notify push
NOTIFY_PUSH_SERVICE_PATH="/etc/systemd/system/notify_push.service"
# Adminer
ADMINERDIR=/usr/share/adminer
ADMINER_CONF="$SITES_AVAILABLE/adminer.conf"
# Redis
REDIS_CONF=/etc/redis/redis.conf
REDIS_SOCK=/var/run/redis/redis-server.sock
REDIS_PASS=$(gen_passwd "$SHUF" "a-zA-Z0-9@#*")
# Extra security
SPAMHAUS=/etc/spamhaus.wl
ENVASIVE=/etc/apache2/mods-available/mod-evasive.load
APACHE2=/etc/apache2/apache2.conf
# Full text Search
fulltextsearch_install() {
FULLTEXTSEARCH_DIR="$SCRIPTS"/fulltextsearch
NEXTCLOUD_INDEX=$(gen_passwd "$SHUF" '[:lower:]')
ELASTIC_USER_PASSWORD=$(gen_passwd "$SHUF" '[:lower:]')
FULLTEXTSEARCH_IMAGE_NAME=fulltextsearch_es01
FULLTEXTSEARCH_SERVICE=nextcloud-fulltext-elasticsearch-worker.service
# Supports 0-9.0-99.0-9. Max supprted version with this function is 9.99.9. When ES 10.0.0 is out we have a problem.
# Maybe "10\\.[[:digit:]][[:digit:]]\\.[[:digit:]]" will work?
FULLTEXTSEARCH_IMAGE_NAME_LATEST_TAG="$(curl -s -m 900 https://www.docker.elastic.co/r/elasticsearch | grep -Eo "[[:digit:]]\\.[[:digit:]][[:digit:]]\\.[[:digit:]]" | sort --version-sort | tail -1)"
# Legacy, changed 2023-09-21
DOCKER_IMAGE_NAME=es01
# Legacy, not used at all
RORDIR=/opt/es/
OPNSDIR=/opt/opensearch
nc_fts="ark74/nc_fts"
opens_fts="opensearchproject/opensearch"
fts_node="fts_os-node"
}
# Name in trusted_config
ncdomain() {
NCDOMAIN=$(nextcloud_occ_no_check config:system:get overwrite.cli.url | sed 's|https://||;s|/||')
}
# Talk
turn_install() {
TURN_CONF="/etc/turnserver.conf"
TURN_PORT=3478
TURN_DOMAIN=$(sudo -u www-data /var/www/nextcloud/occ config:system:get overwrite.cli.url | sed 's|https://||;s|/||')
SHUF=$(shuf -i 25-29 -n 1)
TURN_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9")
JANUS_API_KEY=$(gen_passwd "$SHUF" "a-zA-Z0-9")
SIGNALING_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9")
SIGNALING_SERVER_CONF=/etc/signaling/server.conf
TURN_INTERNAL_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9")
TURN_RECORDING_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9")
TURN_RECORDING_HOST=127.0.0.1
TURN_RECORDING_HOST_PORT=1234
}
## FUNCTIONS
# If script is running as root?
#
# Example:
# if is_root
# then
# # do stuff
# else
# print_text_in_color "$IRed" "You are not root..."
# exit 1
# fi
#
is_root() {
if [[ "$EUID" -ne 0 ]]
then
return 1
else
return 0
fi
}
# Check if root
root_check() {
if ! is_root
then
msg_box "Sorry, you are not root. You now have two options:
1. Use SUDO directly:
a) :~$ sudo bash $SCRIPTS/name-of-script.sh
2. Become ROOT and then type your command:
a) :~$ sudo -i
b) :~# bash $SCRIPTS/name-of-script.sh
In both cases above you can leave out $SCRIPTS/ if the script
is directly in your PATH.
More information can be found here: https://unix.stackexchange.com/a/3064"
exit 1
fi
}
debug_mode() {
if [ "$DEBUG" -eq 1 ]
then
set -ex
fi
}
msg_box() {
[ -n "$2" ] && local SUBTITLE=" - $2"
whiptail --title "$TITLE$SUBTITLE" --msgbox "$1" "$WT_HEIGHT" "$WT_WIDTH" 3>&1 1>&2 2>&3
}
yesno_box_yes() {
[ -n "$2" ] && local SUBTITLE=" - $2"
if (whiptail --title "$TITLE$SUBTITLE" --yesno "$1" "$WT_HEIGHT" "$WT_WIDTH" 3>&1 1>&2 2>&3)
then
return 0
else
return 1
fi
}
yesno_box_no() {
[ -n "$2" ] && local SUBTITLE=" - $2"
if (whiptail --title "$TITLE$SUBTITLE" --defaultno --yesno "$1" "$WT_HEIGHT" "$WT_WIDTH" 3>&1 1>&2 2>&3)
then
return 0
else
return 1
fi
}
input_box() {
[ -n "$2" ] && local SUBTITLE=" - $2"
local RESULT && RESULT=$(whiptail --title "$TITLE$SUBTITLE" --nocancel --inputbox "$1" "$WT_HEIGHT" "$WT_WIDTH" 3>&1 1>&2 2>&3)
echo "$RESULT"
}
input_box_flow() {
local RESULT
while :
do
RESULT=$(input_box "$1" "$2")
if [ -z "$RESULT" ]
then
msg_box "Input is empty, please try again." "$2"
elif ! yesno_box_yes "Is this correct? $RESULT" "$2"
then
msg_box "OK, please try again." "$2"
else
break
fi
done
echo "$RESULT"
}
install_popup() {
msg_box "$SCRIPT_EXPLAINER"
if yesno_box_yes "Do you want to install $1?"
then
print_text_in_color "$ICyan" "Installing $1..."
else
if [ -z "$2" ] || [ "$2" = "exit" ]
then
exit 1
elif [ "$2" = "sleep" ]
then
sleep 1
elif [ "$2" = "return" ]
then
return 1
else
exit 1
fi
fi
}
reinstall_remove_menu() {
REINSTALL_REMOVE=$(whiptail --title "$TITLE" --menu \
"It seems like $1 is already installed.\nChoose what you want to do.
$MENU_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
"Reinstall" " $1" \
"Uninstall" " $1" 3>&1 1>&2 2>&3)
if [ "$REINSTALL_REMOVE" = "Reinstall" ]
then
print_text_in_color "$ICyan" "Reinstalling $1..."
elif [ "$REINSTALL_REMOVE" = "Uninstall" ]
then
print_text_in_color "$ICyan" "Uninstalling $1..."
elif [ -z "$REINSTALL_REMOVE" ]
then
if [ -z "$2" ] || [ "$2" = "exit" ]
then
exit 1
elif [ "$2" = "sleep" ]
then
sleep 1
elif [ "$2" = "return" ]
then
return 1
else
exit 1
fi
fi
}
removal_popup() {
if [ "$REINSTALL_REMOVE" = "Uninstall" ]
then
msg_box "$1 was successfully uninstalled."
if [ -z "$2" ] || [ "$2" = "exit" ]
then
exit 1
elif [ "$2" = "sleep" ]
then
sleep 1
elif [ "$2" = "return" ]
then
return 1
else
exit 1
fi
elif [ "$REINSTALL_REMOVE" = "Reinstall" ]
then
print_text_in_color "$ICyan" "Reinstalling $1..."
else
msg_box "It seems like neither Uninstall nor Reinstall was selected, \
something is wrong here. Please report this to $ISSUES"
exit 1
fi
}
# Used in geoblock.sh
get_newest_dat_files() {
# IPv4
IPV4_NAME=$(curl -s https://github.com/nextcloud/vm/tree/master/geoblockdat \
| grep -oP '202[0-9]-[01][0-9]-Maxmind-Country-IPv4\.dat' | sort -r | head -1) #deliberately not pointing to fork on github.com
if [ -z "$IPV4_NAME" ]
then
print_text_in_color "$IRed" "Could not get the latest IPv4 name. Not updating the .dat file"
sleep 1
else
if ! [ -f "$SCRIPTS/$IPV4_NAME" ]
then
print_text_in_color "$ICyan" "Downloading new IPv4 dat file..."
sleep 1
curl_to_dir "$GEOBLOCKDAT" "$IPV4_NAME" "$SCRIPTS"
mkdir -p /usr/share/GeoIP
rm -f /usr/share/GeoIP/GeoIP.dat
check_command cp "$SCRIPTS/$IPV4_NAME" /usr/share/GeoIP
check_command mv "/usr/share/GeoIP/$IPV4_NAME" /usr/share/GeoIP/GeoIP.dat
chown root:root /usr/share/GeoIP/GeoIP.dat
chmod 644 /usr/share/GeoIP/GeoIP.dat
find /var/scripts -type f -regex \
"$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv4\.dat" -not -name "$IPV4_NAME" -delete
else
print_text_in_color "$ICyan" "The latest IPv4 dat file is already downloaded."
sleep 1
fi
fi
# IPv6
IPV6_NAME=$(curl -s https://github.com/nextcloud/vm/tree/master/geoblockdat \
| grep -oP '202[0-9]-[01][0-9]-Maxmind-Country-IPv6\.dat' | sort -r | head -1) #deliberately not pointing to fork on github.com
if [ -z "$IPV6_NAME" ]
then
print_text_in_color "$IRed" "Could not get the latest IPv6 name. Not updating the .dat file"
sleep 1
else
if ! [ -f "$SCRIPTS/$IPV6_NAME" ]
then
print_text_in_color "$ICyan" "Downloading new IPv6 dat file..."
sleep 1
curl_to_dir "$GEOBLOCKDAT" "$IPV6_NAME" "$SCRIPTS"
mkdir -p /usr/share/GeoIP
rm -f /usr/share/GeoIP/GeoIPv6.dat
check_command cp "$SCRIPTS/$IPV6_NAME" /usr/share/GeoIP
check_command mv "/usr/share/GeoIP/$IPV6_NAME" /usr/share/GeoIP/GeoIPv6.dat
chown root:root /usr/share/GeoIP/GeoIPv6.dat
chmod 644 /usr/share/GeoIP/GeoIPv6.dat
find /var/scripts -type f -regex \
"$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv6\.dat" -not -name "$IPV6_NAME" -delete
else
print_text_in_color "$ICyan" "The latest IPv6 dat file is already downloaded."
sleep 1
fi
fi
}
# Check if process is runnnig: is_process_running dpkg
is_process_running() {
PROCESS="$1"
while :
do
RESULT=$(pgrep "${PROCESS}")
if [ "${RESULT:-null}" = null ]; then
break
else
print_text_in_color "$ICyan" "${PROCESS} is running, waiting for it to stop. Please be patient..."
sleep 30
fi
done
}
# Fix issues like https://github.com/nextcloud/spreed/issues/5518
check_running_cronjobs() {
while [ -n "$(pgrep -f nextcloud/cron.php)" ]
do
# Check if virus scan is running, could take ages for it to finish...
if ! pgrep -f clamd
then
# If not running, then keep waiting
countdown "Waiting for the Nextcloud cronjob to finish..." "30"
else
# If virus scan is running, then wait a bit longer, and kill it to release cron.php
countdown "Waiting for the Nextcloud cronjob and virusscan to finish..." "120"
pkill -f clamd
fi
done
}
# Checks if site is reachable with a HTTP 200 status
site_200() {
print_text_in_color "$ICyan" "Checking connection..."
CURL_STATUS="$(curl -LI "${1}" -o /dev/null -w '%{http_code}\n' -s)"
if [[ "$CURL_STATUS" = "200" ]]
then
return 0
else
print_text_in_color "$IRed" "curl didn't produce a 200 status, is ${1} reachable?"
return 1
fi
}
# Do a DNS lookup and compare the WAN address with the A record
domain_check_200() {
print_text_in_color "$ICyan" "Doing a DNS lookup for ${1}..."
install_if_not dnsutils
# Try to resolve the domain with nslookup using $DNS as resolver
if nslookup "${1}" "$INTERNET_DNS"
then
print_text_in_color "$IGreen" "DNS seems correct when checking with nslookup!"
else
msg_box "DNS lookup failed with nslookup. \
Please check your DNS settings! Maybe the domain isn't propagated?
You can use this site to check if the IP seems correct: https://www.whatsmydns.net/#A/${1}"
if ! yesno_box_no "Are you 100% sure the domain is correct?"
then
exit
fi
fi
# Is the DNS record same as the external IP address of the server?
DIG="$(dig +short "${1}" @resolver1.opendns.com)"
if [ "$DIG" = "$WANIP4" ]
then
print_text_in_color "$IGreen" "DNS seems correct when checking with dig!"
else
msg_box "DNS lookup failed with dig. The external IP ($WANIP4) \
address of this server is not the same as the A-record ($DIG).
Please check your DNS settings! Maybe the domain hasn't propagated?
Please check https://www.whatsmydns.net/#A/${1} if the IP seems correct."
msg_box "As you noticed your WAN IP and DNS record doesn't match. \
This can happen when using DDNS for example, or in other edge cases.
If you feel brave, or are sure that everything is set up correctly, \
then you can choose to skip this test in the next step.
If needed, you can always contact us for further support: \
https://shop.hanssonit.se/product/premium-support-per-30-minutes/"
if ! yesno_box_no "Do you feel brave and want to continue?"
then
exit
fi
fi
}
# A function to set the systemd-resolved default DNS servers based on the
# current Internet facing interface. This is needed for docker interfaces
# that might not use the same DNS servers otherwise.
set_systemd_resolved_dns() {
local iface="$1"
local pattern="$iface(?:.|\n)*?DNS Servers: ((?:[0-9a-f.: ]|\n)*?)\s*(?=\n\S|\n.+: |$)"
local dnss
dnss=$( systemd-resolve --status | perl -0777 -ne "if ((\$v) = (/$pattern/)) {\$v=~s/(?:\s|\n)+/ /g;print \"\$v\n\";}" )
if [ -n "$dnss" ]
then
sed -i "s/^#\?DNS=.*$/DNS=${dnss}/" /etc/systemd/resolved.conf
systemctl restart systemd-resolved &>/dev/null
sleep 1
fi
}
# A function to fetch a file with curl to a directory
# 1 = https://example.com
# 2 = name of file
# 3 = directory that the file should end up in
curl_to_dir() {
if [ ! -d "$3" ]
then
mkdir -p "$3"
fi
rm -f "$3"/"$2"
if [ -n "$download_script_function_in_use" ]
then
curl -sfL "$1"/"$2" -o "$3"/"$2"
else
local retries=0
while :
do
if [ "$retries" -ge 10 ]
then
if yesno_box_yes "Tried 10 times but didn't succeed. We will now exit the script because it might break things. You can choose 'No' to continue on your own risk."
then
exit 1
else
return 1
fi
fi
if ! curl -sfL "$1"/"$2" -o "$3"/"$2"
then
msg_box "We just tried to fetch '$1/$2', but it seems like the server for the download isn't reachable, or that a temporary error occurred. We will now try again.
Please report this issue to $ISSUES"
retries=$((retries+1))
print_text_in_color "$ICyan" "$retries of 10 retries."
countdown "Trying again in 30 seconds..." "30"
else
break
fi
done
fi
}
start_if_stopped() {
if ! pgrep "$1"
then
print_text_in_color "$ICyan" "Starting $1..."
systemctl start "$1".service
fi
}
# Warn user that HTTP/2 will be disabled if installing app that use Apache2 PHP instead of PHP-FPM
# E.g: http2_warn Modsecurity
http2_warn() {
msg_box "This VM has HTTP/2 enabled by default.
If you continue with installing $1, HTTP/2 will be disabled since it's not compatible with the mpm module used by $1.
This is what Apache will say in the error.log if you enable $1 anyway:
'The mpm module (prefork.c) is not supported by mod_http2.
The mpm determines how things are processed in your server.
HTTP/2 has more demands in this regard and the currently selected mpm will just not do.
This is an advisory warning. Your server will continue to work, but the HTTP/2 protocol will be inactive.'"
if ! yesno_box_yes "Do you really want to enable $1 anyway?"
then
exit 1
fi
}
calculate_php_fpm() {
# Get current PHP version
check_php
# Minimum amount of max children (lower than this won't work with 2 GB RAM)
min_max_children=8
# If start servers are lower than this then it's likely that there are room for max_spare_servers
min_start_servers=20
# Maximum amount of children is only set if the min_start_servers value are met
min_max_spare_servers=35
# Calculate the sum of the current values
CURRENT_START="$(grep pm.start_servers "$PHP_POOL_DIR"/nextcloud.conf | awk '{ print $3}')"
CURRENT_MAX="$(grep pm.max_spare_servers "$PHP_POOL_DIR"/nextcloud.conf | awk '{ print $3}')"
CURRENT_MIN="$(grep pm.min_spare_servers "$PHP_POOL_DIR"/nextcloud.conf | awk '{ print $3}')"
CURRENT_SUM="$((CURRENT_START + CURRENT_MAX + CURRENT_MIN))"
# Calculate max_children depending on RAM
# Tends to be between 30-50MB per children
average_php_memory_requirement=50
available_memory=$(awk '/MemAvailable/ {printf "%d", $2/1024}' /proc/meminfo)
PHP_FPM_MAX_CHILDREN=$((available_memory/average_php_memory_requirement))
# Lowest possible value is 8
print_text_in_color "$ICyan" "Automatically configures pm.max_children for php-fpm..."
if [ $PHP_FPM_MAX_CHILDREN -lt $min_max_children ]
then
msg_box "The current max_children value available to set is \
$PHP_FPM_MAX_CHILDREN, and PHP-FPM won't function properly with that value.
The minimum value is 8, and the value is calculated depening on how much available RAM you have left.
The absolute minimum amount of RAM required to run the VM is 2 GB, but we recommend 4 GB.
You now have two choices:
1. Import this VM again, raise the amount of RAM with at least 1 GB, and run this script
in the same way as you just have.
2. Import this VM again without raising the RAM, but don't install any of the following apps:
1) Collabora
2) OnlyOffice
3) Full Text Search
This script will now exit.
The installation was not successful, sorry for the inconvenience.
If you think this is a bug, please report it to $ISSUES"
exit 1
else
check_command sed -i "s|pm.max_children.*|pm.max_children = $PHP_FPM_MAX_CHILDREN|g" "$PHP_POOL_DIR"/nextcloud.conf
print_text_in_color "$IGreen" "pm.max_children was set to $PHP_FPM_MAX_CHILDREN"
# Check if the sum of all the current values are more than $PHP_FPM_MAX_CHILDREN and only continue it is
if [ $PHP_FPM_MAX_CHILDREN -gt $CURRENT_SUM ]
then
# Set pm.max_spare_servers
if [ $PHP_FPM_MAX_CHILDREN -ge $min_max_spare_servers ]
then
if [ "$(grep pm.start_servers "$PHP_POOL_DIR"/nextcloud.conf | awk '{ print $3}')" -lt $min_start_servers ]
then
check_command sed -i "s|pm.max_spare_servers.*|pm.max_spare_servers = $((PHP_FPM_MAX_CHILDREN - 30))|g" "$PHP_POOL_DIR"/nextcloud.conf
print_text_in_color "$IGreen" "pm.max_spare_servers was set to $((PHP_FPM_MAX_CHILDREN - 30))"
fi
fi
fi
fi
# If $PHP_FPM_MAX_CHILDREN is lower than the current sum of all values, revert to default settings
if [ $PHP_FPM_MAX_CHILDREN -lt $CURRENT_SUM ]
then
check_command sed -i "s|pm.max_children.*|pm.max_children = $PHP_FPM_MAX_CHILDREN|g" "$PHP_POOL_DIR"/nextcloud.conf
check_command sed -i "s|pm.start_servers.*|pm.start_servers = 3|g" "$PHP_POOL_DIR"/nextcloud.conf
check_command sed -i "s|pm.min_spare_servers.*|pm.min_spare_servers = 2|g" "$PHP_POOL_DIR"/nextcloud.conf
check_command sed -i "s|pm.max_spare_servers.*|pm.max_spare_servers = 3|g" "$PHP_POOL_DIR"/nextcloud.conf
print_text_in_color "$ICyan" "All PHP-INI values were set back to default values as the value for pm.max_children ($PHP_FPM_MAX_CHILDREN) was lower than the sum of all the current values ($CURRENT_SUM)"
print_text_in_color "$ICyan" "Please run this again to set optimal values"
fi
restart_webserver
}
# Compatibility with older VMs
calculate_max_children() {
calculate_php_fpm
}
test_connection() {
version(){
local h t v
[[ $2 = "$1" || $2 = "$3" ]] && return 0
v=$(printf '%s\n' "$@" | sort -V)
h=$(head -n1 <<<"$v")
t=$(tail -n1 <<<"$v")
[[ $2 != "$h" && $2 != "$t" ]]
}
if ! version 20.04 "$DISTRO" 22.04.10
then
print_text_in_color "$IRed" "Your current Ubuntu version is $DISTRO but must be between \
20.04 - 22.04.10 to run this script."
print_text_in_color "$ICyan" "Please contact us for support upgrading your server:"
print_text_in_color "$ICyan" "https://www.hanssonit.se/#contact"
print_text_in_color "$ICyan" "https://shop.hanssonit.se/"
sleep 300
fi
# Install dnsutils if not existing
if ! dpkg-query -W -f='${Status}' "dnsutils" | grep -q "ok installed"
then
apt-get update -q4 & spinner_loading && apt-get install dnsutils -y
fi
# Install net-tools if not existing
if ! dpkg-query -W -f='${Status}' "net-tools" | grep -q "ok installed"
then
apt-get update -q4 & spinner_loading && apt-get install net-tools -y
fi
# After applying Netplan settings, try a DNS lookup.
# Restart systemd-networkd if this fails and try again.
# If this second check also fails, consider this a problem.
print_text_in_color "$ICyan" "Checking connection..."
netplan apply
sleep 2
if ! nslookup github.com
then
print_text_in_color "$ICyan" "Trying to restart netplan service..."
check_command systemctl restart systemd-networkd && sleep 2
if ! nslookup github.com
then
msg_box "Network is NOT OK. You must have a working network connection to run this script.
If you think that this is a bug, please report it to https://github.com/nextcloud/vm/issues." #deliberately not pointing to fork on github.com
return 1
fi
fi
print_text_in_color "$IGreen" "Online!"
return 0
}
# Check that the script can see the external IP (apache fails otherwise), used e.g. in the adminer app script.
check_external_ip() {
if [ -z "$WANIP4" ]
then
print_text_in_color "$IRed" "WANIP4 is an empty value, Apache will fail on reboot due to this. \
Please check your network and try again."
sleep 3
exit 1
fi
}
# Check if Nextcloud is installed with TLS
check_nextcloud_https() {
if ! nextcloud_occ_no_check config:system:get overwrite.cli.url | grep -q "https"
then
# Check if it's used by any of the Documentserver apps and adopt the message to that
if [ "$1" == 'Collabora (Docker)' ] || [ "$1" == 'OnlyOffice (Docker)' ]
then
ncdomain
if ! curl -s https://"$NCDOMAIN"/status.php | grep -q 'installed":true'
then
msg_box "Sorry, but Nextcloud needs to be run on HTTPS.
You can easily activate TLS (HTTPS) by running the Let's Encrypt script.
More info here: http://shortio.hanssonit.se/1EAgBmPyFc
To run this script again, just exectue 'sudo bash $SCRIPTS/menu.sh' and choose:
Additional Apps --> Documentserver --> $1."
exit
fi
else
# Adopt the error message to anything else but the Documentserver apps
ncdomain
if ! curl -s https://"$NCDOMAIN"/status.php | grep -q 'installed":true'
then
msg_box "Sorry, but Nextcloud needs to be run on HTTPS.
You can easily activate TLS (HTTPS) by running the Let's Encrypt script.
More info here: http://shortio.hanssonit.se/1EAgBmPyFc
To run this script again, just exectue 'sudo bash $SCRIPTS/menu.sh' and choose:
Additional Apps --> $1."
exit
fi
fi
fi
}
restart_webserver() {
# https://github.com/nextcloud/vm/issues/2358
sleep 2
print_text_in_color "$ICyan" "Restarting Apache2 and PHP-FPM..."
check_command systemctl restart apache2.service
check_php
if is_this_installed php"$PHPVER"-fpm
then
check_command systemctl restart php"$PHPVER"-fpm.service
fi
}
# Install certbot (Let's Encrypt)
install_certbot() {
if certbot --version >/dev/null 2>&1
then
# Reinstall certbot (use snap instead of package)
# https://askubuntu.com/a/1271565
if dpkg -l | grep certbot >/dev/null 2>&1
then
# certbot will be removed, but still listed, so we need to check if the snap is installed as well so that this doesn't run every time
if ! snap list certbot >/dev/null 2>&1
then
print_text_in_color "$ICyan" "Reinstalling certbot (Let's Encrypt) as a snap instead..."
apt-get remove certbot -y
apt-get autoremove -y
install_if_not snapd
snap install core
snap install certbot --classic
# Update $PATH in current session (login and logout is required otherwise)
check_command hash -r
fi
fi
else
print_text_in_color "$ICyan" "Installing certbot (Let's Encrypt)..."
install_if_not snapd
snap install certbot --classic
# Update $PATH in current session (login and logout is required otherwise)
check_command hash -r
fi
}
# Generate certs and configure it automatically
# https://certbot.eff.org/docs/using.html#certbot-command-line-options
generate_cert() {
uir_hsts=""
if [ -z "$SUBDOMAIN" ]
then
uir_hsts="--uir --hsts"
fi
a2dissite 000-default.conf
systemctl reload apache2.service
default_le="--cert-name $1 --key-type ecdsa --renew-by-default --no-eff-email --agree-tos $uir_hsts --server https://acme-v02.api.letsencrypt.org/directory -d $1"
#http-01
local standalone="certbot certonly --standalone --pre-hook \"systemctl stop apache2.service\" --post-hook \"systemctl start apache2.service\" $default_le"
#tls-alpn-01
local tls_alpn_01="certbot certonly --preferred-challenges tls-alpn-01 $default_le"
#dns
local dns="certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns $default_le"
local methods=(standalone dns)
for f in "${methods[@]}"
do
print_text_in_color "${ICyan}" "Trying to generate certs and validate them with $f method."
current_method=""
eval current_method="\$$f"
if eval "$current_method"
then
return 0
elif [ "$f" != "${methods[$((${#methods[*]} - 1))]}" ]
then
msg_box "It seems like no certs were generated when trying \
to validate them with the $f method. We will retry."
else
msg_box "It seems like no certs were generated when trying \
to validate them with the $f method. We have exhausted all the methods. Please check your DNS and try again."
return 1;
fi
done
}
is_desec_installed() {
# Check if deSEC is installed and add the needed variables if yes
if [ -f "$SCRIPTS"/deSEC/.dedynauth ]
then
if [ -f /etc/ddclient.conf ]
then
DEDYN_TOKEN=$(grep DEDYN_TOKEN "$SCRIPTS"/deSEC/.dedynauth | cut -d '=' -f2)
DEDYN_NAME=$(grep DEDYN_NAME "$SCRIPTS"/deSEC/.dedynauth | cut -d '=' -f2)
return 0
fi
else
msg_box "It seems like deSEC isn't configured on this server.
Please run 'sudo bash $SCRIPTS/menu.sh --> Server Configuration --> deSEC' to configure it."
return 1
fi
}
generate_desec_cert() {
# Check if the hook is in place
if [ ! -f "$SCRIPTS"/deSEC/hook.sh ]
then
msg_box "Sorry, but it seems like the needed hook for this to work is missing.
No TLS will be generated. Please report this to $ISSUES."
exit 1
fi
print_text_in_color "$ICyan" "Generating new TLS cert with DNS and deSEC, please don't abort the hook, it may take a while..."
# Renew with DNS by default
if certbot certonly --manual --text --key-type ecdsa --renew-by-default --server https://acme-v02.api.letsencrypt.org/directory --no-eff-email --agree-tos --preferred-challenges dns --manual-auth-hook "$SCRIPTS"/deSEC/hook.sh --manual-cleanup-hook "$SCRIPTS"/deSEC/hook.sh -d "$1"
then
# Generate DHparams cipher
if [ ! -f "$DHPARAMS_TLS" ]
then
openssl dhparam -out "$DHPARAMS_TLS" 2048
fi
# Choose which port for public access
msg_box "You will now be able to choose which port you want to put your Nextcloud on for public access.\n
The default port is 443 for HTTPS and if you don't change port, that's the port we will use.\n
Please keep in mind NOT to use the following ports as they are likely in use already:
${NONO_PORTS[*]}"
if yesno_box_no "Do you want to change the default HTTPS port (443) to something else?"
then
# Ask for port
while :
do
DEDYNPORT=$(input_box_flow "Please choose which port you want between 1024 - 49151.\n\nPlease remember to open this port in your firewall.")
if (("$DEDYNPORT" >= 1024 && "$DEDYNPORT" <= 49151))
then
if check_nono_ports "$DEDYNPORT"
then
print_text_in_color "$ICyan" "Changing to port $DEDYNPORT for public access..."
# Main port
if ! grep -q "Listen $DEDYNPORT" /etc/apache2/ports.conf
then
echo "Listen $DEDYNPORT" >> /etc/apache2/ports.conf
restart_webserver
fi
break
fi
else
msg_box "The port number needs to be between 1024 - 49151, please try again."
fi
done
fi
fi
}
# Last message depending on with script that is being run when using the generate_cert() function
last_fail_tls() {
msg_box "All methods failed. :/
You can run the script again by executing: sudo bash $SCRIPTS/menu.sh
Please try to run it again some other time with other settings.
There are different configs you can try in Let's Encrypt's user guide:
https://letsencrypt.readthedocs.org/en/latest/index.html
Please check the guide for further information on how to enable TLS.
This script is developed on GitHub, feel free to contribute:
https://github.com/nextcloud/vm"
if [ -n "$2" ]
then
msg_box "The script will now do some cleanup and revert the settings."
# Cleanup
snap remove certbot
rm -f "$SCRIPTS"/test-new-config.sh
fi
# Restart webserver services
restart_webserver
}
# Use like this: open_port 443 TCP
# or e.g. open_port 3478 UDP
open_port() {
install_if_not miniupnpc
print_text_in_color "$ICyan" "Trying to open port $1 automatically..."
if ! upnpc -a "$ADDRESS" "$1" "$1" "$2" &>/dev/null
then
msg_box "Failed to open port $1 $2 automatically. You have to do this manually."
FAIL=1
fi
}
cleanup_open_port() {
if [ -n "$FAIL" ]
then
apt-get purge miniupnpc -y
apt-get autoremove -y
fi
}
# Check if port is open # check_open_port 443 domain.example.com
check_open_port() {
print_text_in_color "$ICyan" "Checking if port ${1} is open..."
install_if_not curl
# WAN Address
if check_command curl -s -H 'Cache-Control: no-cache' -H 'Referer: https://www.networkappers.com/tools/open-port-checker' "https://networkappers.com/api/port.php?ip=${WANIP4}&port=${1}" | grep -q "open"