free
/
freedombone
Watch 1
Star 0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
Browse Source

Reorganize matrix

Bob Mottram 8 years ago
parent
24e906dab5
commit
2778298607
3 changed files with 276 additions and 116 deletions
Split View Show Diff Stats
  1. 108
    110
      src/freedombone-app-matrix
  2. 71
    6
      src/freedombone-utils-turn
  3. 97
    0
      src/freedombone-utils-web

+ 108
- 110
src/freedombone-app-matrix View File 

@@ -36,8 +36,12 @@ IN_DEFAULT_INSTALL=0
36 36 
 SHOW_ON_ABOUT=1
37 37
38 38 
 MATRIX_DATA_DIR='/var/lib/matrix'
39 
+MATRIX_HTTP_PORT=8558
40 
+MATRIX_ID_HTTP_PORT=8557
39 41 
 MATRIX_PORT=8448
40 42 
 MATRIX_ID_PORT=8081
43 
+MATRIX_ONION_PORT=8109
44 
+MATRIX_ID_ONION_PORT=8111
41 45 
 MATRIX_REPO="https://github.com/matrix-org/synapse"
42 46 
 MATRIX_COMMIT='f5a4001bb116c468cc5e8e0ae04a1c570e2cb171'
43 47 
 SYDENT_REPO="https://github.com/matrix-org/sydent"
 
@@ -51,124 +55,115 @@ matrix_variables=(ONION_ONLY
51 55 
                   DEFAULT_DOMAIN_NAME)
52 56
53 57 
 function matrix_nginx {
54 
-    matrix_identityserver_proxy_str=' \
55 
-    location /_matrixid { \
56 
-        proxy_pass http://localhost:8081; \
57 
-        proxy_set_header X-Forwarded-For $remote_addr; \
58 
-    }'
59 
-    matrix_proxy_str=' \
60 
-    location /_matrix { \
61 
-        proxy_pass https://localhost:8448; \
62 
-        proxy_set_header X-Forwarded-For $remote_addr; \
63 
-    }'
64 
-    turn_proxy_str=' \
65 
-    location /_turn { \
66 
-        proxy_pass https://localhost:3478; \
67 
-        proxy_set_header X-Forwarded-For $remote_addr; \
68 
-    }'
69 
-
70 
-    if [[ $ONION_ONLY != 'no' ]]; then
71 
-        matrix_proxy_str=' \
72 
-    location /_matrix { \
73 
-        proxy_pass http://localhost:8448; \
74 
-        proxy_set_header X-Forwarded-For $remote_addr; \
75 
-    }'
76 
-        turn_proxy_str=' \
77 
-    location /_turn { \
78 
-        proxy_pass http://localhost:3478; \
79 
-        proxy_set_header X-Forwarded-For $remote_addr; \
80 
-    }'
81 
-    fi
58 
+    create_default_web_site
82 59
83 
-    if [ ! -f /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME} ]; then
84 
-        matrix_nginx_site=/etc/nginx/sites-available/$DEFAULT_DOMAIN_NAME
85 
-        if [[ $ONION_ONLY == "no" ]]; then
86 
-            function_check nginx_http_redirect
87 
-            nginx_http_redirect $DEFAULT_DOMAIN_NAME
88 
-            echo 'server {' >> $matrix_nginx_site
89 
-            echo '  listen 443 ssl;' >> $matrix_nginx_site
90 
-            echo '  listen [::]:443 ssl;' >> $matrix_nginx_site
91 
-            echo "  server_name $DEFAULT_DOMAIN_NAME;" >> $matrix_nginx_site
92 
-            echo '' >> $matrix_nginx_site
93 
-            echo '  # Security' >> $matrix_nginx_site
94 
-            function_check nginx_ssl
95 
-            nginx_ssl $DEFAULT_DOMAIN_NAME
96 
-
97 
-            function_check nginx_disable_sniffing
98 
-            nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
99 
-
100 
-            echo '  add_header Strict-Transport-Security max-age=15768000;' >> $matrix_nginx_site
101 
-            echo '' >> $matrix_nginx_site
102 
-            echo '  # Logs' >> $matrix_nginx_site
103 
-            echo '  access_log /dev/null;' >> $matrix_nginx_site
104 
-            echo '  error_log /dev/null;' >> $matrix_nginx_site
105 
-            echo '' >> $matrix_nginx_site
106 
-            echo '  # Root' >> $matrix_nginx_site
107 
-            echo "  root /var/www/$DEFAULT_DOMAIN_NAME/htdocs;" >> $matrix_nginx_site
108 
-            echo '' >> $matrix_nginx_site
109 
-            echo '  # Index' >> $matrix_nginx_site
110 
-            echo '  index index.html;' >> $matrix_nginx_site
111 
-            echo '' >> $matrix_nginx_site
112 
-            echo '  # Location' >> $matrix_nginx_site
113 
-            echo '  location / {' >> $matrix_nginx_site
114 
-            function_check nginx_limits
115 
-            nginx_limits $DEFAULT_DOMAIN_NAME '15m'
116 
-            echo '  }' >> $matrix_nginx_site
117 
-            echo '' >> $matrix_nginx_site
118 
-            echo '  # Restrict access that is unnecessary anyway' >> $matrix_nginx_site
119 
-            echo '  location ~ /\.(ht|git) {' >> $matrix_nginx_site
120 
-            echo '    deny all;' >> $matrix_nginx_site
121 
-            echo '  }' >> $matrix_nginx_site
122 
-            echo '}' >> $matrix_nginx_site
123 
-        else
124 
-            echo -n '' > $matrix_nginx_site
125 
-        fi
60 
+    # append the matrix server to the web site config
61 
+    matrix_nginx_site=/etc/nginx/sites-available/$DEFAULT_DOMAIN_NAME
62 
+    if [[ $ONION_ONLY == "no" ]]; then
63 
+        echo '# Matrix Server' >> $matrix_nginx_site
126 64 
         echo 'server {' >> $matrix_nginx_site
127 
-        echo "    listen 127.0.0.1:$MATRIX_PORT default_server;" >> $matrix_nginx_site
128 
-        echo "    server_name $DEFAULT_DOMAIN_NAME;" >> $matrix_nginx_site
65 
+        echo "  listen ${MATRIX_HTTP_PORT} ssl;" >> $matrix_nginx_site
66 
+        echo '  listen [::]:${MATRIX_HTTP_PORT} ssl;' >> $matrix_nginx_site
67 
+        echo "  server_name ${DEFAULT_DOMAIN_NAME};" >> $matrix_nginx_site
129 68 
         echo '' >> $matrix_nginx_site
69 
+        echo '  # Security' >> $matrix_nginx_site
70 
+        function_check nginx_ssl
71 
+        nginx_ssl ${DEFAULT_DOMAIN_NAME}
72 
+
130 73 
         function_check nginx_disable_sniffing
131 
-        nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
74 
+        nginx_disable_sniffing ${DEFAULT_DOMAIN_NAME}
75 
+
76 
+        echo '  add_header Strict-Transport-Security max-age=15768000;' >> $matrix_nginx_site
132 77 
         echo '' >> $matrix_nginx_site
133 78 
         echo '  # Logs' >> $matrix_nginx_site
134 79 
         echo '  access_log /dev/null;' >> $matrix_nginx_site
135 80 
         echo '  error_log /dev/null;' >> $matrix_nginx_site
136 81 
         echo '' >> $matrix_nginx_site
137 
-        echo '  # Root' >> $matrix_nginx_site
138 
-        echo "  root /var/www/$DEFAULT_DOMAIN_NAME/htdocs;" >> $matrix_nginx_site
82 
+        echo '  # Index' >> $matrix_nginx_site
83 
+        echo '  index index.html;' >> $matrix_nginx_site
139 84 
         echo '' >> $matrix_nginx_site
140 85 
         echo '  # Location' >> $matrix_nginx_site
141 86 
         echo '  location / {' >> $matrix_nginx_site
142 87 
         function_check nginx_limits
143 
-        nginx_limits $DEFAULT_DOMAIN_NAME '15m'
144 
-        echo '  }' >> $matrix_nginx_site
145 
-        echo '' >> $matrix_nginx_site
146 
-        echo '  # Restrict access that is unnecessary anyway' >> $matrix_nginx_site
147 
-        echo '  location ~ /\.(ht|git) {' >> $matrix_nginx_site
148 
-        echo '    deny all;' >> $matrix_nginx_site
88 
+        nginx_limits ${DEFAULT_DOMAIN_NAME} '15m'
89 
+        echo "      proxy_pass http://localhost:${MATRIX_PORT};" >> $matrix_nginx_site
90 
+        echo '      proxy_set_header X-Forwarded-For $remote_addr;' >> $matrix_nginx_site
149 91 
         echo '  }' >> $matrix_nginx_site
150 92 
         echo '}' >> $matrix_nginx_site
93 
+        echo '' >> $matrix_nginx_site
94 
+        echo 'server {' >> $matrix_nginx_site
95 
+        echo "  listen ${MATRIX_ID_HTTP_PORT} ssl;" >> $matrix_nginx_site
96 
+        echo '  listen [::]:${MATRIX_ID_HTTP_PORT} ssl;' >> $matrix_nginx_site
97 
+        echo "  server_name ${DEFAULT_DOMAIN_NAME};" >> $matrix_nginx_site
98 
+        echo '' >> $matrix_nginx_site
99 
+        echo '  # Security' >> $matrix_nginx_site
100 
+        function_check nginx_ssl
101 
+        nginx_ssl ${DEFAULT_DOMAIN_NAME}
151 102
152 
-        if [ ! -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
153 
-            function_check create_site_certificate
154 
-            create_site_certificate $DEFAULT_DOMAIN_NAME 'yes'
155 
-        fi
156 
-
157 
-        nginx_ensite $DEFAULT_DOMAIN_NAME
158 
-    fi
103 
+        function_check nginx_disable_sniffing
104 
+        nginx_disable_sniffing ${DEFAULT_DOMAIN_NAME}
159 105
160 
-    if ! grep "localhost:${MATRIX_ID_PORT}" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}; then
161 
-        sed -i "s|:443 ssl;|:443 ssl;${matrix_identityserver_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
162 
-        sed -i "s| default_server;| default_server;${matrix_identityserver_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
163 
-    fi
164 
-    if ! grep "localhost:${MATRIX_PORT}" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}; then
165 
-        sed -i "s|:443 ssl;|:443 ssl;${matrix_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
166 
-        sed -i "s| default_server;| default_server;${matrix_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
167 
-    fi
168 
-    if ! grep "localhost:${TURN_PORT}" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}; then
169 
-        sed -i "s|:443 ssl;|:443 ssl;${turn_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
170 
-        sed -i "s| default_server;| default_server;${turn_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
106 
+        echo '  add_header Strict-Transport-Security max-age=15768000;' >> $matrix_nginx_site
107 
+        echo '' >> $matrix_nginx_site
108 
+        echo '  # Logs' >> $matrix_nginx_site
109 
+        echo '  access_log /dev/null;' >> $matrix_nginx_site
110 
+        echo '  error_log /dev/null;' >> $matrix_nginx_site
111 
+        echo '' >> $matrix_nginx_site
112 
+        echo '  # Index' >> $matrix_nginx_site
113 
+        echo '  index index.html;' >> $matrix_nginx_site
114 
+        echo '' >> $matrix_nginx_site
115 
+        echo '  # Location' >> $matrix_nginx_site
116 
+        echo '  location / {' >> $matrix_nginx_site
117 
+        function_check nginx_limits
118 
+        nginx_limits ${DEFAULT_DOMAIN_NAME} '15m'
119 
+        echo "      proxy_pass http://localhost:${MATRIX_ID_PORT};" >> $matrix_nginx_site
120 
+        echo '      proxy_set_header X-Forwarded-For $remote_addr;' >> $matrix_nginx_site
121 
+        echo '  }' >> $matrix_nginx_site
122 
+        echo '}' >> $matrix_nginx_site
123 
+        echo '' >> $matrix_nginx_site
124 
+    else
125 
+        echo '# Matrix Server' >> $matrix_nginx_site
171 126 
     fi
127 
+    echo 'server {' >> $matrix_nginx_site
128 
+    echo "    listen 127.0.0.1:$MATRIX_ONION_PORT default_server;" >> $matrix_nginx_site
129 
+    echo "    server_name $DEFAULT_DOMAIN_NAME;" >> $matrix_nginx_site
130 
+    echo '' >> $matrix_nginx_site
131 
+    function_check nginx_disable_sniffing
132 
+    nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
133 
+    echo '' >> $matrix_nginx_site
134 
+    echo '  # Logs' >> $matrix_nginx_site
135 
+    echo '  access_log /dev/null;' >> $matrix_nginx_site
136 
+    echo '  error_log /dev/null;' >> $matrix_nginx_site
137 
+    echo '' >> $matrix_nginx_site
138 
+    echo '  # Location' >> $matrix_nginx_site
139 
+    echo '  location / {' >> $matrix_nginx_site
140 
+    function_check nginx_limits
141 
+    nginx_limits $DEFAULT_DOMAIN_NAME '15m'
142 
+    echo "      proxy_pass http://localhost:${MATRIX_PORT};" >> $matrix_nginx_site
143 
+    echo '      proxy_set_header X-Forwarded-For $remote_addr;' >> $matrix_nginx_site
144 
+    echo '  }' >> $matrix_nginx_site
145 
+    echo '}' >> $matrix_nginx_site
146 
+    echo '' >> $matrix_nginx_site
147 
+    echo 'server {' >> $matrix_nginx_site
148 
+    echo "    listen 127.0.0.1:$MATRIX_ID_ONION_PORT default_server;" >> $matrix_nginx_site
149 
+    echo "    server_name $DEFAULT_DOMAIN_NAME;" >> $matrix_nginx_site
150 
+    echo '' >> $matrix_nginx_site
151 
+    function_check nginx_disable_sniffing
152 
+    nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
153 
+    echo '' >> $matrix_nginx_site
154 
+    echo '  # Logs' >> $matrix_nginx_site
155 
+    echo '  access_log /dev/null;' >> $matrix_nginx_site
156 
+    echo '  error_log /dev/null;' >> $matrix_nginx_site
157 
+    echo '' >> $matrix_nginx_site
158 
+    echo '  # Location' >> $matrix_nginx_site
159 
+    echo '  location / {' >> $matrix_nginx_site
160 
+    function_check nginx_limits
161 
+    nginx_limits $DEFAULT_DOMAIN_NAME '15m'
162 
+    echo "      proxy_pass http://localhost:${MATRIX_ID_PORT};" >> $matrix_nginx_site
163 
+    echo '      proxy_set_header X-Forwarded-For $remote_addr;' >> $matrix_nginx_site
164 
+    echo '  }' >> $matrix_nginx_site
165 
+    echo '}' >> $matrix_nginx_site
166 
+    echo '# End of Matrix Server' >> $matrix_nginx_site
172 167
173 168 
     systemctl restart nginx
174 169 
     systemctl restart turn
 
@@ -207,7 +202,7 @@ function matrix_configure_homeserver_yaml {
207 202
208 203 
     local ymltemp="$(mktemp)"
209 204
210 
-    awk -v TURNURIES="turn_uris: [\"turn:${DEFAULT_DOMAIN_NAME}/_turn?transport=udp\", \"turn:${DEFAULT_DOMAIN_NAME}/_turn?transport=tcp\"]" \
205 
+    awk -v TURNURIES="turn_uris: [\"turn:${DEFAULT_DOMAIN_NAME}:${TURN_HTTP_PORT}?transport=udp\", \"turn:${DEFAULT_DOMAIN_NAME}:${TURN_HTTP_PORT}?transport=tcp\"]" \
211 206 
         -v TURNSHAREDSECRET="turn_shared_secret: \"${turnkey}\"" \
212 207 
         -v PIDFILE="pid_file: ${MATRIX_DATA_DIR}/homeserver.pid" \
213 208 
         -v DATABASE="database: \"${MATRIX_DATA_DIR}/homeserver.db\"" \
 
@@ -225,15 +220,14 @@ function matrix_configure_homeserver_yaml {
225 220
226 221 
     mv ${ymltemp} "${filepath}"
227 222
228 
-    if [[ $ONION_ONLY != 'no' ]]; then
229 
-        sed -i 's|no_tls: .*|no_tls: True|g' "${filepath}"
230 
-    fi
223 
+    sed -i 's|no_tls: .*|no_tls: true|g' "${filepath}"
224 
+    sed -i 's| tls: .*| tls: false|g' "${filepath}"
231 225 
     sed -i 's|enable_registration_captcha.*|enable_registration_captcha: False|g' "${filepath}"
232 226 
     sed -i "s|database: \".*|database: \"${MATRIX_DATA_DIR}/homeserver.db\"|g" "${filepath}"
233 227 
     sed -i "s|media_store_path:.*|media_store_path: \"${MATRIX_DATA_DIR}/media_store\"|g" "${filepath}"
234 228 
     sed -i "s|pid_file:.*|pid_file: \"${MATRIX_DATA_DIR}/homeserver.pid\"|g" "${filepath}"
235 229 
     sed -i "s|log_file:.*|log_file: \"/dev/null\"|g" "${filepath}"
236 
-    sed -i '0,/bind_address:.*/s//bind_address: 127.0.0.1/' "${filepath}"
230 
+    sed -i 's|bind_address:.*|bind_address: 127.0.0.1|g' "${filepath}"
237 231 
     sed -i '0,/x_forwarded:.*/s//x_forwarded: true/' "${filepath}"
238 232 
     sed -i "s|server_name:.*|server_name: \"${DEFAULT_DOMAIN_NAME}\"|g" "${filepath}"
239 233 
     sed -i "/trusted_third_party_id_servers:/a     - ${DEFAULT_DOMAIN_NAME}" "${filepath}"
 
@@ -473,6 +467,8 @@ function restore_remote_matrix {
473 467 
 }
474 468
475 469 
 function remove_matrix {
470 
+    firewall_remove ${MATRIX_HTTP_PORT}
471 
+
476 472 
     systemctl stop matrix
477 473 
     systemctl stop sydent
478 474 
 
@@ -497,11 +493,10 @@ function remove_matrix {
497 493 
     rm -rf /etc/sydent
498 494 
     deluser matrix
499 495 
     delgroup matrix
500 
-    remove_onion_service matrix ${MATRIX_PORT}
496 
+    remove_onion_service matrix ${MATRIX_ONION_PORT}
497 
+    remove_onion_service matrix ${MATRIX_ID_ONION_PORT}
501 498
502 
-    sed -i "/location \/_matrix {/,/}/d" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
503 
-    sed -i "/location \/_matrixid {/,/}/d" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
504 
-    sed -i "/location \/_turn {/,/}/d" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
499 
+    sed -i "/# Matrix Server{/,/# End of Matrix Server/d" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
505 500 
     systemctl restart nginx
506 501
507 502 
     remove_completion_param install_matrix
 
@@ -644,7 +639,8 @@ function install_home_server {
644 639 
     fi
645 640 
     chmod -R 700 $MATRIX_DATA_DIR/homeserver.db
646 641
647 
-    MATRIX_ONION_HOSTNAME=$(add_onion_service matrix ${MATRIX_PORT} ${MATRIX_PORT})
642 
+    MATRIX_ONION_HOSTNAME=$(add_onion_service matrix ${MATRIX_PORT} ${MATRIX_ONION_PORT})
643 
+    MATRIX_ID_ONION_HOSTNAME=$(add_onion_service matrixid ${MATRIX_ID_PORT} ${MATRIX_ID_ONION_PORT})
648 644 
     if [ ! ${MATRIX_PASSWORD} ]; then
649 645 
         if [ -f ${IMAGE_PASSWORD_FILE} ]; then
650 646 
             MATRIX_PASSWORD="$(printf `cat $IMAGE_PASSWORD_FILE`)"
 
@@ -653,6 +649,8 @@ function install_home_server {
653 649 
         fi
654 650 
     fi
655 651
652 
+    firewall_add matrix ${MATRIX_HTTP_PORT}
653 
+
656 654 
     rm -rf ${MATRIX_DATA_DIR}/Maildir
657 655 
     rm -rf ${MATRIX_DATA_DIR}/.mutt
658 656 
     rm -f ${MATRIX_DATA_DIR}/.muttrc

+ 71
- 6
src/freedombone-utils-turn View File 

@@ -29,6 +29,8 @@
29 29 
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
30 30
31 31 
 TURN_PORT=3478
32 
+TURN_HTTP_PORT=3407
33 
+TURN_ONION_PORT=8110
32 34
33 35 
 function generate_turn_key {
34 36 
     local turnkey="${1}"
 
@@ -45,11 +47,7 @@ function generate_turn_key {
45 47 
 }
46 48
47 49 
 function remove_turn {
48 
-    firewall_remove ${TURN_PORT}
49 
-}
50 
-
51 
-function remove_turn {
52 
-    firewall_remove ${TURN_PORT}
50 
+    firewall_remove ${TURN_HTTP_PORT}
53 51 
     systemctl stop turn
54 52 
     systemctl disable turn
55 53 
     if [ -f /etc/systemd/system/turn.service ]; then
 
@@ -57,9 +55,72 @@ function remove_turn {
57 55 
     fi
58 56 
     apt-get -y remove coturn
59 57 
     rm -rf /var/lib/turn
58 
+    sed -i "/# TURN Server{/,/# End of TURN Server/d" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
59 
+    remove_onion_service turn ${TURN_ONION_PORT}
60 
+    systemctl restart nginx
60 61 
 }
61 62
62 63 
 function install_turn {
64 
+    create_default_web_site
65 
+
66 
+    # append the matrix server to the web site config
67 
+    turn_nginx_site=/etc/nginx/sites-available/$DEFAULT_DOMAIN_NAME
68 
+    if [[ $ONION_ONLY == "no" ]]; then
69 
+        echo '# TURN Server' >> $turn_nginx_site
70 
+        echo 'server {' >> $turn_nginx_site
71 
+        echo "  listen ${TURN_HTTP_PORT} ssl;" >> $turn_nginx_site
72 
+        echo '  listen [::]:${TURN_HTTP_PORT} ssl;' >> $turn_nginx_site
73 
+        echo "  server_name ${DEFAULT_DOMAIN_NAME};" >> $turn_nginx_site
74 
+        echo '' >> $turn_nginx_site
75 
+        echo '  # Security' >> $turn_nginx_site
76 
+        function_check nginx_ssl
77 
+        nginx_ssl ${DEFAULT_DOMAIN_NAME}
78 
+
79 
+        function_check nginx_disable_sniffing
80 
+        nginx_disable_sniffing ${DEFAULT_DOMAIN_NAME}
81 
+
82 
+        echo '  add_header Strict-Transport-Security max-age=15768000;' >> $turn_nginx_site
83 
+        echo '' >> $turn_nginx_site
84 
+        echo '  # Logs' >> $turn_nginx_site
85 
+        echo '  access_log /dev/null;' >> $turn_nginx_site
86 
+        echo '  error_log /dev/null;' >> $turn_nginx_site
87 
+        echo '' >> $turn_nginx_site
88 
+        echo '  # Index' >> $turn_nginx_site
89 
+        echo '  index index.html;' >> $turn_nginx_site
90 
+        echo '' >> $turn_nginx_site
91 
+        echo '  # Location' >> $turn_nginx_site
92 
+        echo '  location / {' >> $turn_nginx_site
93 
+        function_check nginx_limits
94 
+        nginx_limits ${DEFAULT_DOMAIN_NAME} '15m'
95 
+        echo "      proxy_pass http://localhost:${TURN_PORT};" >> $turn_nginx_site
96 
+        echo '      proxy_set_header X-Forwarded-For $remote_addr;' >> $turn_nginx_site
97 
+        echo '  }' >> $turn_nginx_site
98 
+        echo '}' >> $turn_nginx_site
99 
+        echo '' >> $turn_nginx_site
100 
+    else
101 
+        echo '# TURN Server' >> $turn_nginx_site
102 
+    fi
103 
+    echo 'server {' >> $turn_nginx_site
104 
+    echo "    listen 127.0.0.1:$TURN_ONION_PORT default_server;" >> $turn_nginx_site
105 
+    echo "    server_name $DEFAULT_DOMAIN_NAME;" >> $turn_nginx_site
106 
+    echo '' >> $turn_nginx_site
107 
+    function_check nginx_disable_sniffing
108 
+    nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
109 
+    echo '' >> $turn_nginx_site
110 
+    echo '  # Logs' >> $turn_nginx_site
111 
+    echo '  access_log /dev/null;' >> $turn_nginx_site
112 
+    echo '  error_log /dev/null;' >> $turn_nginx_site
113 
+    echo '' >> $turn_nginx_site
114 
+    echo '  # Location' >> $turn_nginx_site
115 
+    echo '  location / {' >> $turn_nginx_site
116 
+    function_check nginx_limits
117 
+    nginx_limits $DEFAULT_DOMAIN_NAME '15m'
118 
+    echo "      proxy_pass http://localhost:${TURN_PORT};" >> $turn_nginx_site
119 
+    echo '      proxy_set_header X-Forwarded-For $remote_addr;' >> $turn_nginx_site
120 
+    echo '  }' >> $turn_nginx_site
121 
+    echo '}' >> $turn_nginx_site
122 
+    echo '# End of TURN Server' >> $turn_nginx_site
123 
+
63 124 
     export DEBIAN_FRONTEND=noninteractive
64 125 
     apt-get -yq install coreutils coturn \
65 126 
             curl file gcc git libevent-2.0-5 \
 
@@ -108,7 +169,11 @@ function install_turn {
108 169 
     systemctl daemon-reload
109 170 
     systemctl start turn
110 171
111 
-    firewall_add turn ${TURN_PORT}
172 
+    firewall_add turn ${TURN_HTTP_PORT}
173 
+
174 
+    TURN_ONION_HOSTNAME=$(add_onion_service turn ${TURN_PORT} ${TURN_ONION_PORT})
175 
+
176 
+    systemctl restart nginx
112 177 
 }
113 178
114 179 
 # NOTE: deliberately no exit 0

+ 97
- 0
src/freedombone-utils-web View File 

@@ -31,6 +31,9 @@
31 31 
 # default search engine for command line browser
32 32 
 DEFAULT_SEARCH='https://searx.laquadrature.net'
33 33
34 
+# onion port for the default domain
35 
+DEFAULT_DOMAIN_ONION_PORT=8099
36 
+
34 37 
 # Whether Let's Encrypt is enabled for all sites
35 38 
 LETSENCRYPT_ENABLED="no"
36 39 
 LETSENCRYPT_SERVER='https://acme-v01.api.letsencrypt.org/directory'
 
@@ -802,4 +805,98 @@ function update_default_domain {
802 805 
     fi
803 806 
 }
804 807
808 
+function create_default_web_site {
809 
+    if [ ! -f /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME} ]; then
810 
+        # create a web site for the default domain
811 
+        if [ ! -d /var/www/${DEFAULT_DOMAIN_NAME}/htdocs ]; then
812 
+            mkdir -p /var/www/${DEFAULT_DOMAIN_NAME}/htdocs
813 
+            if [ -d /root/${PROJECT_NAME} ]; then
814 
+                cd /root/${PROJECT_NAME}/website
815 
+                ./deploy.sh EN /var/www/${DEFAULT_DOMAIN_NAME}/htdocs
816 
+            else
817 
+                if [ -d /home/${MY_USERNAME}/${PROJECT_NAME} ]; then
818 
+                    cd /home/${MY_USERNAME}/${PROJECT_NAME}
819 
+                    ./deploy.sh EN /var/www/${DEFAULT_DOMAIN_NAME}/htdocs
820 
+                fi
821 
+            fi
822 
+        fi
823 
+
824 
+        # add a config for the default domain
825 
+        nginx_site=/etc/nginx/sites-available/$DEFAULT_DOMAIN_NAME
826 
+        if [[ $ONION_ONLY == "no" ]]; then
827 
+            function_check nginx_http_redirect
828 
+            nginx_http_redirect $DEFAULT_DOMAIN_NAME
829 
+            echo 'server {' >> $nginx_site
830 
+            echo '  listen 443 ssl;' >> $nginx_site
831 
+            echo '  listen [::]:443 ssl;' >> $nginx_site
832 
+            echo "  server_name $DEFAULT_DOMAIN_NAME;" >> $nginx_site
833 
+            echo '' >> $nginx_site
834 
+            echo '  # Security' >> $nginx_site
835 
+            function_check nginx_ssl
836 
+            nginx_ssl $DEFAULT_DOMAIN_NAME
837 
+
838 
+            function_check nginx_disable_sniffing
839 
+            nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
840 
+
841 
+            echo '  add_header Strict-Transport-Security max-age=15768000;' >> $nginx_site
842 
+            echo '' >> $nginx_site
843 
+            echo '  # Logs' >> $nginx_site
844 
+            echo '  access_log /dev/null;' >> $nginx_site
845 
+            echo '  error_log /dev/null;' >> $nginx_site
846 
+            echo '' >> $nginx_site
847 
+            echo '  # Root' >> $nginx_site
848 
+            echo "  root /var/www/$DEFAULT_DOMAIN_NAME/htdocs;" >> $nginx_site
849 
+            echo '' >> $nginx_site
850 
+            echo '  # Index' >> $nginx_site
851 
+            echo '  index index.html;' >> $nginx_site
852 
+            echo '' >> $nginx_site
853 
+            echo '  # Location' >> $nginx_site
854 
+            echo '  location / {' >> $nginx_site
855 
+            function_check nginx_limits
856 
+            nginx_limits $DEFAULT_DOMAIN_NAME '15m'
857 
+            echo '  }' >> $nginx_site
858 
+            echo '' >> $nginx_site
859 
+            echo '  # Restrict access that is unnecessary anyway' >> $nginx_site
860 
+            echo '  location ~ /\.(ht|git) {' >> $nginx_site
861 
+            echo '    deny all;' >> $nginx_site
862 
+            echo '  }' >> $nginx_site
863 
+            echo '}' >> $nginx_site
864 
+        else
865 
+            echo -n '' > $nginx_site
866 
+        fi
867 
+        echo 'server {' >> $nginx_site
868 
+        echo "    listen 127.0.0.1:$DEFAULT_DOMAIN_ONION_PORT default_server;" >> $nginx_site
869 
+        echo "    server_name $DEFAULT_DOMAIN_NAME;" >> $nginx_site
870 
+        echo '' >> $nginx_site
871 
+        function_check nginx_disable_sniffing
872 
+        nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
873 
+        echo '' >> $nginx_site
874 
+        echo '  # Logs' >> $nginx_site
875 
+        echo '  access_log /dev/null;' >> $nginx_site
876 
+        echo '  error_log /dev/null;' >> $nginx_site
877 
+        echo '' >> $nginx_site
878 
+        echo '  # Root' >> $nginx_site
879 
+        echo "  root /var/www/$DEFAULT_DOMAIN_NAME/htdocs;" >> $nginx_site
880 
+        echo '' >> $nginx_site
881 
+        echo '  # Location' >> $nginx_site
882 
+        echo '  location / {' >> $nginx_site
883 
+        function_check nginx_limits
884 
+        nginx_limits $DEFAULT_DOMAIN_NAME '15m'
885 
+        echo '  }' >> $nginx_site
886 
+        echo '' >> $nginx_site
887 
+        echo '  # Restrict access that is unnecessary anyway' >> $nginx_site
888 
+        echo '  location ~ /\.(ht|git) {' >> $nginx_site
889 
+        echo '    deny all;' >> $nginx_site
890 
+        echo '  }' >> $nginx_site
891 
+        echo '}' >> $nginx_site
892 
+
893 
+        if [ ! -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
894 
+            function_check create_site_certificate
895 
+            create_site_certificate $DEFAULT_DOMAIN_NAME 'yes'
896 
+        fi
897 
+
898 
+        nginx_ensite $DEFAULT_DOMAIN_NAME
899 
+    fi
900 
+}
901 
+
805 902 
 # NOTE: deliberately no exit 0