Browse Source

Move to unprivileged user

Bob Mottram 8 years ago
parent
commit
3213eb004c
2 changed files with 59 additions and 56 deletions
  1. 58
    55
      src/freedombone-app-turtl
  2. 1
    1
      src/freedombone-utils-validation

+ 58
- 55
src/freedombone-app-turtl View File

47
 TURTL_COMMIT='61923ffb47d95d172f80d14c76aa032a4d5f5d6d'
47
 TURTL_COMMIT='61923ffb47d95d172f80d14c76aa032a4d5f5d6d'
48
 TURTL_ADMIN_PASSWORD=
48
 TURTL_ADMIN_PASSWORD=
49
 TURTL_STORAGE_LIMIT_MB=100
49
 TURTL_STORAGE_LIMIT_MB=100
50
+TURTL_BASE_DIR=/etc/turtl
50
 
51
 
51
 LIBUV_VERSION='1.9.1'
52
 LIBUV_VERSION='1.9.1'
52
 LIBUV_HASH='e83953782c916d7822ef0b94e8115ce5756fab5300cca173f0de5f5b0e0ae928'
53
 LIBUV_HASH='e83953782c916d7822ef0b94e8115ce5756fab5300cca173f0de5f5b0e0ae928'
252
 }
253
 }
253
 
254
 
254
 function remove_turtl {
255
 function remove_turtl {
255
-    if [ ! -d /opt/api ]; then
256
+    if [ ! -d $TURTL_BASE_DIR ]; then
256
         return
257
         return
257
     fi
258
     fi
258
     systemctl stop turtl
259
     systemctl stop turtl
262
     remove_app turtl
263
     remove_app turtl
263
     remove_completion_param install_turtl
264
     remove_completion_param install_turtl
264
     sed -i '/turtl/d' $COMPLETION_FILE
265
     sed -i '/turtl/d' $COMPLETION_FILE
265
-    rm $INSTALL_DIR/quicklisp.lisp
266
-    rm $INSTALL_DIR/asdf.lisp
266
+    deluser turtl
267
     rm -rf /etc/rethinkdb
267
     rm -rf /etc/rethinkdb
268
     rm -rf /var/lib/rethinkdb
268
     rm -rf /var/lib/rethinkdb
269
-    rm -rf /root/quicklisp
270
-    rm -rf /opt/ccl
271
-    rm -rf /opt/api
269
+    rm -rf $TURTL_BASE_DIR
272
 }
270
 }
273
 
271
 
274
 function install_libuv {
272
 function install_libuv {
484
 
482
 
485
     check_architecture=$(uname -a)
483
     check_architecture=$(uname -a)
486
     if [[ "$check_architecture" == *"64"* && "$check_architecture" != *"arm"* ]]; then
484
     if [[ "$check_architecture" == *"64"* && "$check_architecture" != *"arm"* ]]; then
487
-        su -c '/usr/bin/ccl64 --load install.lisp --eval "(quit)"' - turtl
485
+        su -c '/usr/bin/ccl64 --load install.lisp --eval "(ccl::quit)"' - turtl
488
     else
486
     else
489
-        su -c '/usr/bin/ccl --load install.lisp --eval "(quit)"' - turtl
487
+        su -c '/usr/bin/ccl --load install.lisp --eval "(ccl::quit)"' - turtl
490
     fi
488
     fi
491
 
489
 
492
     echo "(pushnew \"./\" asdf:*central-registry* :test #'equal)" > /var/www/$TURTL_DOMAIN_NAME/htdocs/api/launch.lisp
490
     echo "(pushnew \"./\" asdf:*central-registry* :test #'equal)" > /var/www/$TURTL_DOMAIN_NAME/htdocs/api/launch.lisp
712
     DEFAULT_STORAGE_LIMIT=${DEFAULT_STORAGE_LIMIT:-100}
710
     DEFAULT_STORAGE_LIMIT=${DEFAULT_STORAGE_LIMIT:-100}
713
     STORAGE_INVITE_CREDIT=${STORAGE_INVITE_CREDIT:-25}
711
     STORAGE_INVITE_CREDIT=${STORAGE_INVITE_CREDIT:-25}
714
     LOCAL_UPLOAD_URL=${LOCAL_UPLOAD_URL:-http://turtl.local}
712
     LOCAL_UPLOAD_URL=${LOCAL_UPLOAD_URL:-http://turtl.local}
715
-    LOCAL_UPLOAD_PATH=${LOCAL_UPLOAD_PATH:-"/opt/api/uploads"}
713
+    LOCAL_UPLOAD_PATH=${LOCAL_UPLOAD_PATH:-"$TURTL_BASE_DIR/api/uploads"}
716
     AWS_S3_TOKEN=${AWS_S3_TOKEN:-(:token ''
714
     AWS_S3_TOKEN=${AWS_S3_TOKEN:-(:token ''
717
                                   :secret ''
715
                                   :secret ''
718
                                   :bucket ''
716
                                   :bucket ''
719
                                   :endpoint 'https://s3.amazonaws.com')}
717
                                   :endpoint 'https://s3.amazonaws.com')}
720
 
718
 
721
     # generates the config-file
719
     # generates the config-file
722
-    cat  << __ENDCONFIG__ > /opt/api/config/config.lisp
720
+    cat  << __ENDCONFIG__ > $TURTL_BASE_DIR/api/config/config.lisp
723
 (in-package :turtl)
721
 (in-package :turtl)
724
 (defparameter *root* (asdf:system-relative-pathname :turtl #P""))
722
 (defparameter *root* (asdf:system-relative-pathname :turtl #P""))
725
 (defparameter *pid-file* "${PIDFILE}")
723
 (defparameter *pid-file* "${PIDFILE}")
745
 (defvar *amazon-s3* "${AWS_S3_TOKEN}")
743
 (defvar *amazon-s3* "${AWS_S3_TOKEN}")
746
 __ENDCONFIG__
744
 __ENDCONFIG__
747
 
745
 
748
-    cat /opt/api/config/config.footer >> /opt/api/config/config.lisp
746
+    cat $TURTL_BASE_DIR/api/config/config.footer >> $TURTL_BASE_DIR/api/config/config.lisp
749
 
747
 
750
     # start the turtl server
748
     # start the turtl server
751
     systemctl restart rethinkdb
749
     systemctl restart rethinkdb
760
     echo '' >> /etc/systemd/system/turtl.service
758
     echo '' >> /etc/systemd/system/turtl.service
761
     echo '[Service]' >> /etc/systemd/system/turtl.service
759
     echo '[Service]' >> /etc/systemd/system/turtl.service
762
     echo 'Type=simple' >> /etc/systemd/system/turtl.service
760
     echo 'Type=simple' >> /etc/systemd/system/turtl.service
763
-    echo 'User=root' >> /etc/systemd/system/turtl.service
764
-    echo 'WorkingDirectory=/opt/api/' >> /etc/systemd/system/turtl.service
761
+    echo 'User=turtl' >> /etc/systemd/system/turtl.service
762
+    echo "WorkingDirectory=$TURTL_BASE_DIR/api/" >> /etc/systemd/system/turtl.service
765
 
763
 
766
     if [[ "$check_architecture" == *"64"* && "$check_architecture" != *"arm"* ]]; then
764
     if [[ "$check_architecture" == *"64"* && "$check_architecture" != *"arm"* ]]; then
767
-        echo "ExecStart=/opt/ccl/lx86cl64 -l /root/quicklisp/setup.lisp -l launch.lisp" >> /etc/systemd/system/turtl.service
765
+        echo "ExecStart=$TURTL_BASE_DIR/ccl/lx86cl64 -l $TURTL_BASE_DIR/quicklisp/setup.lisp -l launch.lisp" >> /etc/systemd/system/turtl.service
768
     else
766
     else
769
         if [[ "$check_architecture" != *"arm"* ]]; then
767
         if [[ "$check_architecture" != *"arm"* ]]; then
770
-            echo "ExecStart=/opt/ccl/lx86cl -l /root/quicklisp/setup.lisp -l launch.lisp" >> /etc/systemd/system/turtl.service
768
+            echo "ExecStart=$TURTL_BASE_DIR/ccl/lx86cl -l $TURTL_BASE_DIR/quicklisp/setup.lisp -l launch.lisp" >> /etc/systemd/system/turtl.service
771
         else
769
         else
772
-            echo "ExecStart=/opt/ccl/larmcl -l /root/quicklisp/setup.lisp -l launch.lisp" >> /etc/systemd/system/turtl.service
770
+            echo "ExecStart=$TURTL_BASE_DIR/ccl/larmcl -l $TURTL_BASE_DIR/quicklisp/setup.lisp -l launch.lisp" >> /etc/systemd/system/turtl.service
773
         fi
771
         fi
774
     fi
772
     fi
775
     echo '' >> /etc/systemd/system/turtl.service
773
     echo '' >> /etc/systemd/system/turtl.service
777
     echo 'WantedBy=multi-user.target' >> /etc/systemd/system/turtl.service
775
     echo 'WantedBy=multi-user.target' >> /etc/systemd/system/turtl.service
778
     chmod +x /etc/systemd/system/turtl.service
776
     chmod +x /etc/systemd/system/turtl.service
779
 
777
 
778
+    chown -R turtl:turtl $TURTL_BASE_DIR
780
     systemctl enable turtl
779
     systemctl enable turtl
781
     systemctl daemon-reload
780
     systemctl daemon-reload
782
     systemctl start turtl
781
     systemctl start turtl
786
     # https://github.com/ArthurGarnier/turtl-docker
785
     # https://github.com/ArthurGarnier/turtl-docker
787
     apt-get -yq install wget libterm-readline-perl-perl gcc libuv1-dev
786
     apt-get -yq install wget libterm-readline-perl-perl gcc libuv1-dev
788
 
787
 
789
-    if [ ! -d $INSTALL_DIR ]; then
790
-        mkdir -p $INSTALL_DIR
788
+    if [ ! -d $TURTL_BASE_DIR ]; then
789
+        mkdir -p $TURTL_BASE_DIR
791
     fi
790
     fi
792
-    cd $INSTALL_DIR
791
+    cd $TURTL_BASE_DIR
793
     check_architecture=$(uname -a)
792
     check_architecture=$(uname -a)
794
 
793
 
795
     # Install ccl
794
     # Install ccl
796
     if [[ "$check_architecture" != *"arm"* ]]; then
795
     if [[ "$check_architecture" != *"arm"* ]]; then
797
-        wget -P /opt/ ftp://ftp.clozure.com/pub/release/1.11/ccl-1.11-linuxx86.tar.gz
798
-        mkdir -p /opt/ccl
799
-        tar xvzf /opt/ccl-1.11-linuxx86.tar.gz -C /opt/ccl --strip-components=1
796
+        wget -P $TURTL_BASE_DIR/ ftp://ftp.clozure.com/pub/release/1.11/ccl-1.11-linuxx86.tar.gz
797
+        mkdir -p $TURTL_BASE_DIR/ccl
798
+        tar xvzf $TURTL_BASE_DIR/ccl-1.11-linuxx86.tar.gz -C $TURTL_BASE_DIR/ccl --strip-components=1
800
     else
799
     else
801
-        wget -P /opt/ ftp://ftp.clozure.com/pub/release/1.11/ccl-1.11-linuxarm.tar.gz
802
-        mkdir -p /opt/ccl
803
-        tar xvzf /opt/ccl-1.11-linuxarm.tar.gz -C /opt/ccl --strip-components=1
800
+        wget -P $TURTL_BASE_DIR/ ftp://ftp.clozure.com/pub/release/1.11/ccl-1.11-linuxarm.tar.gz
801
+        mkdir -p $TURTL_BASE_DIR/ccl
802
+        tar xvzf $TURTL_BASE_DIR/ccl-1.11-linuxarm.tar.gz -C $TURTL_BASE_DIR/ccl --strip-components=1
804
     fi
803
     fi
805
 
804
 
806
     # install quicklisp
805
     # install quicklisp
807
-    cat  << __ENDCONFIG__ > $INSTALL_DIR/quicklisp_install
806
+    cat  << __ENDCONFIG__ > $TURTL_BASE_DIR/quicklisp_install
808
 (load (compile-file "asdf.lisp"))
807
 (load (compile-file "asdf.lisp"))
809
 (load (compile-file "quicklisp.lisp"))
808
 (load (compile-file "quicklisp.lisp"))
810
 (quicklisp-quickstart:install)
809
 (quicklisp-quickstart:install)
875
     if [ ! -f quicklisp.lisp ]; then
874
     if [ ! -f quicklisp.lisp ]; then
876
         wget https://beta.quicklisp.org/quicklisp.lisp
875
         wget https://beta.quicklisp.org/quicklisp.lisp
877
     fi
876
     fi
877
+
878
+    adduser --disabled-login --home=$TURTL_BASE_DIR --gecos 'turtl' turtl
879
+    chown -R turtl:turtl $TURTL_BASE_DIR
880
+
878
     if [[ "$check_architecture" != *"arm"* ]]; then
881
     if [[ "$check_architecture" != *"arm"* ]]; then
879
         if [[ "$check_architecture" == *"64"* ]]; then
882
         if [[ "$check_architecture" == *"64"* ]]; then
880
-            cat $INSTALL_DIR/quicklisp_install | /opt/ccl/lx86cl64
883
+            su -c "cat $TURTL_BASE_DIR/quicklisp_install | $TURTL_BASE_DIR/ccl/lx86cl64" - turtl
881
         else
884
         else
882
-            cat $INSTALL_DIR/quicklisp_install | /opt/ccl/lx86cl
885
+            su -c "cat $TURTL_BASE_DIR/quicklisp_install | $TURTL_BASE_DIR/ccl/lx86cl" - turtl
883
         fi
886
         fi
884
     else
887
     else
885
-        cat $INSTALL_DIR/quicklisp_install | /opt/ccl/larmcl
888
+        su -c "cat $TURTL_BASE_DIR/quicklisp_install | $TURTL_BASE_DIR/ccl/larmcl" - turtl
886
     fi
889
     fi
887
-    rm $INSTALL_DIR/quicklisp_install
890
+    rm $TURTL_BASE_DIR/quicklisp_install
888
 
891
 
889
     install_rethinkdb
892
     install_rethinkdb
890
 
893
 
891
     # install turtl API
894
     # install turtl API
892
-    cd /opt/
893
-    git clone $TURTL_API_REPO /opt/api
894
-    cd /opt/api
895
+    cd $TURTL_BASE_DIR/
896
+    git clone $TURTL_API_REPO $TURTL_BASE_DIR/api
897
+    cd $TURTL_BASE_DIR/api
895
     git checkout $TURTL_API_COMMIT -b $TURTL_API_COMMIT
898
     git checkout $TURTL_API_COMMIT -b $TURTL_API_COMMIT
896
     cd /root/quicklisp/local-projects
899
     cd /root/quicklisp/local-projects
897
     git clone git://github.com/orthecreedence/cl-hash-util
900
     git clone git://github.com/orthecreedence/cl-hash-util
898
     if [[ "$check_architecture" != *"arm"* ]]; then
901
     if [[ "$check_architecture" != *"arm"* ]]; then
899
         if [[ "$check_architecture" == *"64"* ]]; then
902
         if [[ "$check_architecture" == *"64"* ]]; then
900
-            /opt/ccl/lx86cl64 -l /root/quicklisp/setup.lisp
903
+            su -c "cat '(ccl:quit)' | $TURTL_BASE_DIR/ccl/lx86cl64 -l /root/quicklisp/setup.lisp" - turtl
901
         else
904
         else
902
-            /opt/ccl/lx86cl -l /root/quicklisp/setup.lisp
905
+            su -c "cat '(ccl:quit)' | $TURTL_BASE_DIR/ccl/lx86cl -l /root/quicklisp/setup.lisp" - turtl
903
         fi
906
         fi
904
     else
907
     else
905
-        /opt/ccl/larmcl -l /root/quicklisp/setup.lisp
908
+        su -c "cat '(ccl:quit)' | $TURTL_BASE_DIR/ccl/larmcl -l /root/quicklisp/setup.lisp" - turtl
906
     fi
909
     fi
907
 
910
 
908
     # config
911
     # config
909
-    echo '(defvar *enabled-cors-resources* "resource://turtl-at-lyonbros-dot-com"' > /opt/api/config/config.footer
910
-    echo '  "When set, will enable CORS for resource:// origins if they match the given' >> /opt/api/config/config.footer
911
-    echo '   string. Entries should be comma separated (this string is passed verbatim in' >> /opt/api/config/config.footer
912
-    echo '   the Access-Control-Allow-Origin header).")' >> /opt/api/config/config.footer
913
-    echo '(defparameter *public-actions*' >> /opt/api/config/config.footer
914
-    echo "  \`((:post . ,(concatenate 'string *api-path* \"/users\"))" >> /opt/api/config/config.footer
915
-    echo "    (:post . ,(concatenate 'string *api-path* \"/log/error\"))" >> /opt/api/config/config.footer
916
-    echo '    (:post . "/cla/sign")' >> /opt/api/config/config.footer
917
-    echo '    (:get  . "/ping")' >> /opt/api/config/config.footer
918
-    echo '    (:get  . "/admin")' >> /opt/api/config/config.footer
919
-    echo "    (:get . ,(cl-ppcre:create-scanner (concatenate 'string *api-path* \"/invites/codes/([0-9a-f-]+)\"))))" >> /opt/api/config/config.footer
920
-    echo "  \"A list of public resources/actions that do not require authentication.\")" >> /opt/api/config/config.footer
921
-    echo "(defvar *analytics* '(:enabled t" >> /opt/api/config/config.footer
922
-    echo '                      :db "analytics"))' >> /opt/api/config/config.footer
923
-
924
-    cp $INSTALL_DIR/asdf.lisp /opt/api
925
-    echo '(load (compile-file "asdf.lisp"))' > /opt/api/launch.lisp
926
-    echo "(pushnew \"./\" asdf:*central-registry* :test #'equal)" >> /opt/api/launch.lisp
927
-    echo '(load "start")' >> /opt/api/launch.lisp
912
+    echo '(defvar *enabled-cors-resources* "resource://turtl-at-lyonbros-dot-com"' > $TURTL_BASE_DIR/api/config/config.footer
913
+    echo '  "When set, will enable CORS for resource:// origins if they match the given' >> $TURTL_BASE_DIR/api/config/config.footer
914
+    echo '   string. Entries should be comma separated (this string is passed verbatim in' >> $TURTL_BASE_DIR/api/config/config.footer
915
+    echo '   the Access-Control-Allow-Origin header).")' >> $TURTL_BASE_DIR/api/config/config.footer
916
+    echo '(defparameter *public-actions*' >> $TURTL_BASE_DIR/api/config/config.footer
917
+    echo "  \`((:post . ,(concatenate 'string *api-path* \"/users\"))" >> $TURTL_BASE_DIR/api/config/config.footer
918
+    echo "    (:post . ,(concatenate 'string *api-path* \"/log/error\"))" >> $TURTL_BASE_DIR/api/config/config.footer
919
+    echo '    (:post . "/cla/sign")' >> $TURTL_BASE_DIR/api/config/config.footer
920
+    echo '    (:get  . "/ping")' >> $TURTL_BASE_DIR/api/config/config.footer
921
+    echo '    (:get  . "/admin")' >> $TURTL_BASE_DIR/api/config/config.footer
922
+    echo "    (:get . ,(cl-ppcre:create-scanner (concatenate 'string *api-path* \"/invites/codes/([0-9a-f-]+)\"))))" >> $TURTL_BASE_DIR/api/config/config.footer
923
+    echo "  \"A list of public resources/actions that do not require authentication.\")" >> $TURTL_BASE_DIR/api/config/config.footer
924
+    echo "(defvar *analytics* '(:enabled t" >> $TURTL_BASE_DIR/api/config/config.footer
925
+    echo '                      :db "analytics"))' >> $TURTL_BASE_DIR/api/config/config.footer
926
+
927
+    cp $TURTL_BASE_DIR/asdf.lisp $TURTL_BASE_DIR/api
928
+    echo '(load (compile-file "asdf.lisp"))' > $TURTL_BASE_DIR/api/launch.lisp
929
+    echo "(pushnew \"./\" asdf:*central-registry* :test #'equal)" >> $TURTL_BASE_DIR/api/launch.lisp
930
+    echo '(load "start")' >> $TURTL_BASE_DIR/api/launch.lisp
928
 
931
 
929
     turtl_setup
932
     turtl_setup
930
 }
933
 }

+ 1
- 1
src/freedombone-utils-validation View File

62
 
62
 
63
 function is_valid_user {
63
 function is_valid_user {
64
     USRNAME="$1"
64
     USRNAME="$1"
65
-    if [[ "$USRNAME" != "znc" && "$USRNAME" != "pihole" && "$USRNAME" != "fbone" && "$USRNAME" != "go" && "$USRNAME" != "gogs" && "$USRNAME" != "git" && "$USRNAME" != "mirrors" && "$USRNAME" != "sync" && "$USERNAME" != "tahoelafs" ]]; then
65
+    if [[ "$USRNAME" != "turtl" && "$USRNAME" != "znc" && "$USRNAME" != "pihole" && "$USRNAME" != "fbone" && "$USRNAME" != "go" && "$USRNAME" != "gogs" && "$USRNAME" != "git" && "$USRNAME" != "mirrors" && "$USRNAME" != "sync" && "$USERNAME" != "tahoelafs" ]]; then
66
         echo "1"
66
         echo "1"
67
     else
67
     else
68
         echo "0"
68
         echo "0"