freedombone-app-xmpp 43KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # XMPP functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2017 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. VARIANTS='full full-vim chat'
  31. IN_DEFAULT_INSTALL=0
  32. SHOW_ON_ABOUT=1
  33. # Directory where XMPP settings are stored
  34. XMPP_DIRECTORY="/var/lib/prosody"
  35. XMPP_PASSWORD=
  36. XMPP_CIPHERS='"EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"'
  37. XMPP_ECC_CURVE='"secp384r1"'
  38. prosody_latest_version='0.10'
  39. prosody_nightly=410
  40. prosody_nightly_hash='9cf3db6a09895a744d72eb90b4a635758a710afe1a16b78506c7139c4e7211eb'
  41. prosody_filename=prosody-${prosody_latest_version}-1nightly${prosody_nightly}
  42. prosody_nightly_url="https://prosody.im/nightly/${prosody_latest_version}/latest/${prosody_filename}.tar.gz"
  43. # From https://hg.prosody.im/prosody-modules
  44. prosody_modules_filename='prosody-modules-20170514.tar.gz'
  45. prosody_modules_hash='ef404c203317cc0de6da7aaec4f21765a57f630adfbf082cf2dd92b881c15f86'
  46. xmpp_variables=(ONION_ONLY
  47. INSTALLED_WITHIN_DOCKER
  48. XMPP_CIPHERS
  49. XMPP_ECC_CURVE
  50. XMPP_ECC_CURVE
  51. MY_USERNAME
  52. DEFAULT_DOMAIN_NAME
  53. XMPP_DOMAIN_CODE)
  54. function logging_on_xmpp {
  55. if [ -d /etc/prosody ]; then
  56. if [ ! -d /var/log/prosody ]; then
  57. mkdir /var/log/prosody
  58. chown root:adm /var/log/prosody
  59. fi
  60. if ! grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  61. sed -i 's|info = "/dev/null";|info = "/var/log/prosody/prosody.log";|g' /etc/prosody/prosody.cfg.lua
  62. sed -i 's|error = "/dev/null";|error = "/var/log/prosody/prosody.err";|g' /etc/prosody/prosody.cfg.lua
  63. sed -i 's|levels = { "error" }; to = "/dev/null";|levels = { "error" }; to = "syslog";|g' /etc/prosody/prosody.cfg.lua
  64. fi
  65. fi
  66. }
  67. function logging_off_xmpp {
  68. if [ -d /etc/prosody ]; then
  69. if grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  70. sed -i 's|info = "/var/log/prosody/prosody.log";|info = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  71. sed -i 's|error = "/var/log/prosody/prosody.err";|error = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  72. sed -i 's|levels = { "error" }; to = "syslog";|levels = { "error" }; to = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  73. $REMOVE_FILES_COMMAND /var/log/prosody/*
  74. rm -rf /var/log/prosody
  75. fi
  76. fi
  77. }
  78. function xmpp_add_onion_address {
  79. domain_name="$1"
  80. onion_address="$2"
  81. if [ ${#domain_name} -eq 0 ]; then
  82. return
  83. fi
  84. if [ ${#onion_address} -eq 0 ]; then
  85. return
  86. fi
  87. if ! grep "${onion_address}" /etc/prosody/prosody.cfg.lua; then
  88. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  89. sed -i "s|[\"${domain_name}\"].*|[\"${domain_name}\"] = \"${onion_address}\";|g" /etc/prosody/prosody.cfg.lua
  90. else
  91. sed -i "/onions_map = {/a [\"${domain_name}\"] = \"${onion_address}\";" /etc/prosody/prosody.cfg.lua
  92. fi
  93. systemctl restart prosody
  94. fi
  95. }
  96. function xmpp_add_onion_address_interactive {
  97. data=$(tempfile 2>/dev/null)
  98. trap "rm -f $data" 0 1 2 5 15
  99. dialog --backtitle $"Freedombone Control Panel" \
  100. --title $"Add an ICANN to Onion domain mapping" \
  101. --form $"Sepecify an ICANN domain name and its equivalent onion address\n" 9 50 2 \
  102. $"Domain:" 1 1 "" 1 18 26 25 \
  103. $"Onion address:" 2 1 "" 2 18 26 25 \
  104. 2> $data
  105. sel=$?
  106. case $sel in
  107. 1) return;;
  108. 255) return;;
  109. esac
  110. domain_name=$(cat $data | sed -n 1p)
  111. onion_address=$(cat $data | sed -n 2p)
  112. if [[ "$onion_address" != *".onion" ]]; then
  113. return
  114. fi
  115. if [[ "$domain_name" != *"."* ]]; then
  116. return
  117. fi
  118. xmpp_add_onion_address "$domain_name" "$onion_address"
  119. dialog --title $"Add an ICANN to Onion domain mapping" \
  120. --msgbox $"${domain_name} -> ${onion_address} added" 6 70
  121. }
  122. function xmpp_remove_onion_address {
  123. domain_name="$1"
  124. if [ ${#domain_name} -eq 0 ]; then
  125. return
  126. fi
  127. xmpp_changed=
  128. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  129. sed -i "/[\"${domain_name}\"]/d" /etc/prosody/prosody.cfg.lua
  130. xmpp_changed=1
  131. fi
  132. if grep -q "= \"${domain_name}\";" /etc/prosody/prosody.cfg.lua; then
  133. sed -i "/= \"${domain_name}\";/d" /etc/prosody/prosody.cfg.lua
  134. xmpp_changed=1
  135. fi
  136. if [ $xmpp_changed ]; then
  137. systemctl restart prosody
  138. fi
  139. }
  140. function xmpp_remove_onion_address_interactive {
  141. data=$(tempfile 2>/dev/null)
  142. trap "rm -f $data" 0 1 2 5 15
  143. dialog --title $"Remove ICANN to Onion domain mapping" \
  144. --backtitle $"Freedombone Control Panel" \
  145. --inputbox $'Enter the domain name or onion address to be removed' 8 60 2>$data
  146. sel=$?
  147. case $sel in
  148. 0) domain_name=$(<$data)
  149. if [[ "$domain_name" != *"."* ]]; then
  150. return
  151. fi
  152. xmpp_remove_onion_address "$domain_name"
  153. dialog --title $"Remove an ICANN to Onion domain mapping" \
  154. --msgbox $"${domain_name} removed" 6 70
  155. ;;
  156. esac
  157. }
  158. function configure_interactive_xmpp {
  159. while true
  160. do
  161. data=$(tempfile 2>/dev/null)
  162. trap "rm -f $data" 0 1 2 5 15
  163. dialog --backtitle $"Freedombone Control Panel" \
  164. --title $"XMPP" \
  165. --radiolist $"Choose an operation:" 12 70 3 \
  166. 1 $"Add an ICANN to onion domain mapping" off \
  167. 2 $"Remove an ICANN to onion domain mapping" off \
  168. 3 $"Return to administrator control panel" on 2> $data
  169. sel=$?
  170. case $sel in
  171. 1) return;;
  172. 255) return;;
  173. esac
  174. case $(cat $data) in
  175. 1) xmpp_add_onion_address_interactive;;
  176. 2) xmpp_remove_onion_address_interactive;;
  177. 3) break;;
  178. esac
  179. done
  180. }
  181. function remove_user_xmpp {
  182. remove_username="$1"
  183. ${PROJECT_NAME}-pass -u $remove_username --rmapp xmpp
  184. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  185. if [[ $ONION_ONLY != "no" ]]; then
  186. ${PROJECT_NAME}-rmxmpp -e "${remove_username}@${XMPP_ONION_HOSTNAME}"
  187. else
  188. ${PROJECT_NAME}-rmxmpp -e "${remove_username}@${HOSTNAME}"
  189. fi
  190. }
  191. function add_user_xmpp_client {
  192. new_username="$1"
  193. new_user_password="$2"
  194. if [ -f /usr/local/bin/profanity ]; then
  195. XMPP_CLIENT_DIR=/home/$new_username/.local/share/profanity
  196. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  197. if [ ! -d $XMPP_CLIENT_DIR ]; then
  198. mkdir -p $XMPP_CLIENT_DIR
  199. fi
  200. if [ ! -d /home/$new_username/.config/profanity ]; then
  201. mkdir -p /home/$new_username/.config/profanity
  202. fi
  203. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$new_username" "$new_username@$HOSTNAME")
  204. echo "[${new_username}@${HOSTNAME}]" > $XMPP_CLIENT_ACCOUNTS
  205. echo 'enabled=true' >> $XMPP_CLIENT_ACCOUNTS
  206. echo "jid=${new_username}@${HOSTNAME}" >> $XMPP_CLIENT_ACCOUNTS
  207. echo "server=$XMPP_ONION_HOSTNAME" >> $XMPP_CLIENT_ACCOUNTS
  208. echo "pgp.keyid=$GPG_PUBLIC_KEY_ID" >> $XMPP_CLIENT_ACCOUNTS
  209. echo 'resource=profanity' >> $XMPP_CLIENT_ACCOUNTS
  210. echo "muc.service=conference.${HOSTNAME}" >> $XMPP_CLIENT_ACCOUNTS
  211. echo "muc.nick=${new_username}" >> $XMPP_CLIENT_ACCOUNTS
  212. echo 'presence.last=online' >> $XMPP_CLIENT_ACCOUNTS
  213. echo 'presence.login=online' >> $XMPP_CLIENT_ACCOUNTS
  214. echo 'priority.online=0' >> $XMPP_CLIENT_ACCOUNTS
  215. echo 'priority.chat=0' >> $XMPP_CLIENT_ACCOUNTS
  216. echo 'priority.away=0' >> $XMPP_CLIENT_ACCOUNTS
  217. echo 'priority.xa=0' >> $XMPP_CLIENT_ACCOUNTS
  218. echo 'priority.dnd=0' >> $XMPP_CLIENT_ACCOUNTS
  219. echo '[connection]' > /home/$new_username/.config/profanity/profrc
  220. if [[ $ONION_ONLY != "no" ]]; then
  221. echo "account=${new_username}@${XMPP_ONION_HOSTNAME}" >> /home/$new_username/.config/profanity/profrc
  222. else
  223. echo "account=${new_username}@${HOSTNAME}" >> /home/$new_username/.config/profanity/profrc
  224. fi
  225. echo '' >> /home/$new_username/.config/profanity/profrc
  226. echo '[plugins]' >> /home/$new_username/.config/profanity/profrc
  227. echo 'load=prof_omemo_plugin.py;' >> /home/$new_username/.config/profanity/profrc
  228. echo '' >> /home/$new_username/.config/profanity/profrc
  229. echo '[otr]' >> /home/$new_username/.config/profanity/profrc
  230. echo 'policy=opportunistic' >> /home/$new_username/.config/profanity/profrc
  231. echo 'log=off' >> /home/$new_username/.config/profanity/profrc
  232. echo '' >> /home/$new_username/.config/profanity/profrc
  233. echo '[pgp]' >> /home/$new_username/.config/profanity/profrc
  234. echo 'log=off' >> /home/$new_username/.config/profanity/profrc
  235. echo '' >> /home/$new_username/.config/profanity/profrc
  236. echo '[ui]' >> /home/$new_username/.config/profanity/profrc
  237. echo 'enc.warn=true' >> /home/$new_username/.config/profanity/profrc
  238. chown -R $new_username:$new_username /home/$new_username/.local
  239. chown -R $new_username:$new_username /home/$new_username/.config
  240. fi
  241. }
  242. function add_user_xmpp {
  243. new_username="$1"
  244. new_user_password="$2"
  245. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  246. ${PROJECT_NAME}-pass -u $new_username -a xmpp -p "$new_user_password"
  247. if [[ $ONION_ONLY != "no" ]]; then
  248. ${PROJECT_NAME}-addxmpp -e "$new_username@$XMPP_ONION_HOSTNAME" -p "$new_user_password"
  249. else
  250. ${PROJECT_NAME}-addxmpp -e "$new_username@$HOSTNAME" -p "$new_user_password"
  251. fi
  252. if [ ! "$?" = "0" ]; then
  253. echo '1'
  254. return
  255. fi
  256. add_user_xmpp_client "$new_username" "$new_user_password"
  257. echo '0'
  258. }
  259. function install_interactive_xmpp {
  260. echo -n ''
  261. APP_INSTALLED=1
  262. }
  263. function change_password_xmpp {
  264. curr_username="$1"
  265. new_user_password="$2"
  266. read_config_param DEFAULT_DOMAIN_NAME
  267. ${PROJECT_NAME}-pass -u $curr_username -a xmpp -p "$new_user_password"
  268. # TODO: this is currently interactive. Really there needs to be a
  269. # non-interactive password change option for prosodyctl
  270. clear
  271. echo ''
  272. echo $'Currently Prosody requires password changes to be done interactively'
  273. prosodyctl passwd ${curr_username}@${DEFAULT_DOMAIN_NAME}
  274. if [ -f /usr/local/bin/profanity ]; then
  275. XMPP_CLIENT_DIR=/home/$curr_username/.local/share/profanity
  276. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  277. if [ -f $XMPP_CLIENT_ACCOUNTS ]; then
  278. sed -i "s|password=.*|password=$new_user_password|g" $XMPP_CLIENT_ACCOUNTS
  279. fi
  280. fi
  281. }
  282. function reconfigure_xmpp {
  283. echo -n ''
  284. }
  285. function update_prosody_modules {
  286. if [ ! $1 ]; then
  287. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  288. return
  289. fi
  290. fi
  291. if [ ! -d /usr/lib/prosody ]; then
  292. return
  293. fi
  294. if [ ! -f $INSTALL_DIR/$prosody_modules_filename ]; then
  295. # Obtain the modules
  296. if [ -f ~/freedombone/image_build/$prosody_modules_filename ]; then
  297. cp ~/freedombone/image_build/$prosody_modules_filename $INSTALL_DIR
  298. else
  299. if [ -f /home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename ]; then
  300. cp /home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename $INSTALL_DIR
  301. fi
  302. fi
  303. if [ -f $INSTALL_DIR/$prosody_modules_filename ]; then
  304. cd $INSTALL_DIR
  305. # Check the hash
  306. curr_hash=$(sha256sum $INSTALL_DIR/$prosody_modules_filename | awk -F ' ' '{print $1}')
  307. if [[ "$curr_hash" != "$prosody_modules_hash" ]]; then
  308. echo $'Prosody modules hash does not match'
  309. exit 83562
  310. else
  311. # Extract the modules
  312. if [ -d $INSTALL_DIR/prosody-modules ]; then
  313. rm -rf $INSTALL_DIR/prosody-modules
  314. fi
  315. tar -xzvf $prosody_modules_filename
  316. if [ -d $INSTALL_DIR/prosody-modules ]; then
  317. systemctl stop prosody
  318. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  319. mkdir -p /var/lib/prosody/prosody-modules
  320. fi
  321. cp -r $INSTALL_DIR/prosody-modules/* /var/lib/prosody/prosody-modules/
  322. cp -r $INSTALL_DIR/prosody-modules/* /usr/lib/prosody/modules/
  323. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  324. chown -R prosody:prosody /usr/lib/prosody/modules
  325. systemctl start prosody
  326. else
  327. echo $'Prosody modules not extracted'
  328. exit 72524
  329. fi
  330. fi
  331. fi
  332. fi
  333. if ! grep -q '"vcard"' /etc/prosody/prosody.cfg.lua; then
  334. systemctl stop prosody
  335. sed -i '/"pep"/a "vcard";' /etc/prosody/prosody.cfg.lua
  336. systemctl start prosody
  337. fi
  338. }
  339. function upgrade_xmpp {
  340. if [ -d /etc/letsencrypt ]; then
  341. prosody_groups=$(groups prosody)
  342. if [[ "$prosody_groups" != *'ssl-cert'* ]]; then
  343. usermod -a -G ssl-cert prosody
  344. fi
  345. fi
  346. function_check update_prosody_modules
  347. update_prosody_modules
  348. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  349. curr_prosody_filename=$(cat $COMPLETION_FILE | grep "prosody_filename" | awk -F ':' '{print $2}')
  350. if [[ "$curr_prosody_filename" != "$prosody_filename" ]]; then
  351. if [ -d ${INSTALL_DIR}/${prosody_filename} ]; then
  352. # ensure that the binaries have not been overwritten
  353. # by an operating system upgrade
  354. cd ${INSTALL_DIR}/${prosody_filename}
  355. make prefix=/usr install
  356. else
  357. cd $INSTALL_DIR
  358. # Try to get the source from the project repo
  359. if [ -f /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  360. cp /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  361. else
  362. if [ -f /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  363. cp /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  364. else
  365. wget $prosody_nightly_url
  366. fi
  367. fi
  368. if [ ! -f ${INSTALL_DIR}/${prosody_filename}.tar.gz ]; then
  369. echo $"Failed to download prosody nightly $prosody_nightly_url"
  370. return
  371. fi
  372. hash_value=$(sha256sum ${INSTALL_DIR}/${prosody_filename}.tar.gz | awk -F ' ' '{print $1}')
  373. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  374. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  375. echo $'Unexpected hash value for prosody nightly download'
  376. return
  377. fi
  378. tar -xzvf ${INSTALL_DIR}/${prosody_filename}.tar.gz
  379. cd ${INSTALL_DIR}/${prosody_filename}
  380. ./configure --ostype=debian --prefix=/usr
  381. make prefix=/usr
  382. make prefix=/usr install
  383. if [ -f /usr/local/bin/prosody ]; then
  384. echo $'Failed to build prosody nightly to /usr/bin'
  385. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  386. rm -rf ${INSTALL_DIR}/${prosody_filename}
  387. return
  388. fi
  389. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  390. fi
  391. # add onion addresses for known servers
  392. if ! grep -q "onions_map =" /etc/prosody/prosody.cfg.lua; then
  393. echo '' >> /etc/prosody/prosody.cfg.lua
  394. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  395. fi
  396. set_completion_param "prosody_filename" "${prosody_filename}"
  397. fi
  398. cp -r $INSTALL_DIR/prosody-modules/* /var/lib/prosody/prosody-modules/
  399. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  400. systemctl restart prosody
  401. }
  402. function backup_local_xmpp {
  403. source_directory=/var/lib/prosody
  404. if [ -d $source_directory ]; then
  405. dest_directory=xmpp
  406. function_check backup_directory_to_usb
  407. backup_directory_to_usb $source_directory $dest_directory
  408. fi
  409. }
  410. function restore_local_xmpp {
  411. if [ -d /var/lib/prosody ]; then
  412. echo $"Restoring xmpp settings"
  413. temp_restore_dir=/root/tempxmpp
  414. function_check restore_directory_from_usb
  415. restore_directory_from_usb $temp_restore_dir xmpp
  416. if [ -d $temp_restore_dir/var/lib/prosody ]; then
  417. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  418. else
  419. cp -r $temp_restore_dir/* /var/lib/prosody/
  420. fi
  421. if [ ! "$?" = "0" ]; then
  422. function_check set_user_permissions
  423. set_user_permissions
  424. function_check backup_unmount_drive
  425. backup_unmount_drive
  426. exit 725
  427. fi
  428. rm -rf $temp_restore_dir
  429. systemctl restart prosody
  430. chown -R prosody:prosody /var/lib/prosody/*
  431. echo $"Restore of xmpp settings complete"
  432. fi
  433. }
  434. function backup_remote_xmpp {
  435. if [ -d /var/lib/prosody ]; then
  436. echo $"Backing up the xmpp settings"
  437. backup_directory_to_friend /var/lib/prosody xmpp
  438. echo $"Backup of xmpp settings complete"
  439. fi
  440. }
  441. function restore_remote_xmpp {
  442. if [ -d /var/lib/prosody ]; then
  443. echo $"Restoring xmpp settings"
  444. temp_restore_dir=/root/tempxmpp
  445. function_check restore_directory_from_friend
  446. restore_directory_from_friend $temp_restore_dir xmpp
  447. if [ -d $temp_restore_dir/var/lib/prosody ]; then
  448. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  449. else
  450. cp -r $temp_restore_dir/* /var/lib/prosody/
  451. fi
  452. if [ ! "$?" = "0" ]; then
  453. exit 725
  454. fi
  455. rm -rf $temp_restore_dir
  456. systemctl restart prosody
  457. chown -R prosody:prosody /var/lib/prosody/*
  458. echo $"Restore of xmpp settings complete"
  459. fi
  460. }
  461. function configure_firewall_for_xmpp {
  462. if [ ! -d /etc/prosody ]; then
  463. return
  464. fi
  465. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  466. return
  467. fi
  468. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  469. # docker does its own firewalling
  470. return
  471. fi
  472. if [[ $ONION_ONLY != "no" ]]; then
  473. return
  474. fi
  475. firewall_add XMPP 5222 tcp
  476. firewall_add XMPP 5223 tcp
  477. firewall_add XMPP 5269 tcp
  478. firewall_add XMPP 5280 tcp
  479. firewall_add XMPP 5281 tcp
  480. mark_completed $FUNCNAME
  481. }
  482. function remove_xmpp {
  483. remove_profanity
  484. remove_movim
  485. firewall_remove 5222 tcp
  486. firewall_remove 5223 tcp
  487. firewall_remove 5269 tcp
  488. firewall_remove 5280 tcp
  489. firewall_remove 5281 tcp
  490. function_check remove_onion_service
  491. remove_onion_service xmpp 5222 5223 5269
  492. apt-get -yq remove --purge prosody
  493. if [ -f $INSTALL_DIR/$prosody_modules_filename ]; then
  494. rm $INSTALL_DIR/$prosody_modules_filename
  495. fi
  496. if [ -d $INSTALL_DIR/prosody-modules ]; then
  497. rm -rf $INSTALL_DIR/prosody-modules
  498. fi
  499. if [ -d /etc/prosody ]; then
  500. rm -rf /etc/prosody
  501. fi
  502. if [ -d /var/lib/prosody ]; then
  503. rm -rf /var/lib/prosody
  504. fi
  505. if [ -d /usr/lib/prosody ]; then
  506. rm -rf /usr/lib/prosody
  507. fi
  508. if [ -f /usr/local/bin/prosody ]; then
  509. rm /usr/local/bin/prosody
  510. fi
  511. if [ -f /usr/local/bin/prosodyctl ]; then
  512. rm /usr/local/bin/prosodyctl
  513. fi
  514. groupdel prosody
  515. remove_completion_param install_xmpp
  516. sed -i '/xmpp/d' $COMPLETION_FILE
  517. sed -i '/prosody/d' $COMPLETION_FILE
  518. }
  519. function xmpp_email_headers {
  520. for d in /home/*/ ; do
  521. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  522. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  523. if [ -f /home/$USERNAME/.muttrc ]; then
  524. if ! grep -q "Jabber-ID" /home/$USERNAME/.muttrc; then
  525. echo "my_hdr Jabber-ID: ${USERNAME}@${HOSTNAME}" >> /home/$USERNAME/.muttrc
  526. fi
  527. fi
  528. fi
  529. done
  530. }
  531. function xmpp_modules {
  532. filename=$1
  533. echo 'modules_enabled = {' >> $filename
  534. echo ' "pubsub";' >> $filename
  535. echo ' "pubsub_hub";' >> $filename
  536. echo ' "dialback"; -- s2s dialback support' >> $filename
  537. echo ' "disco"; -- Service discovery' >> $filename
  538. echo ' "private"; -- Private XML storage (for room bookmarks, etc.)' >> $filename
  539. echo ' "version"; -- Replies to server version requests' >> $filename
  540. echo ' "uptime"; -- Report how long server has been running' >> $filename
  541. echo ' "time"; -- Let others know the time here on this server' >> $filename
  542. echo ' "ping"; -- Replies to XMPP pings with pongs' >> $filename
  543. echo ' "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands' >> $filename
  544. echo ' "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.' >> $filename
  545. echo ' "bosh"; -- Enable mod_bosh' >> $filename
  546. echo ' "tls"; -- Enable mod_tls' >> $filename
  547. echo ' "saslauth"; -- Enable mod_saslauth' >> $filename
  548. echo ' "onions"; -- Enable chat via onion service' >> $filename
  549. echo ' "mam"; -- Message archive management' >> $filename
  550. echo ' "csi"; -- Client state indication' >> $filename
  551. echo ' "carbons"; -- Message carbons' >> $filename
  552. echo ' "carbons_adhoc"; -- Message carbons' >> $filename
  553. echo ' "carbons_copies"; -- Message carbons' >> $filename
  554. echo ' "smacks"; -- Stream management' >> $filename
  555. echo ' "smacks_offline"; -- Stream management' >> $filename
  556. echo ' "pep"; -- Personal Eventing Protocol (to support OMEMO)' >> $filename
  557. echo ' "vcard"; -- Personal Eventing Protocol (to support OMEMO)' >> $filename
  558. echo ' "e2e_policy"; -- To support OMEMO' >> $filename
  559. echo ' "pep_vcard_avatar"; -- Personal Eventing Protocol (to support OMEMO)' >> $filename
  560. echo ' "blocklist"; -- Privacy lists' >> $filename
  561. echo ' "privacy_lists"; -- Privacy lists' >> $filename
  562. echo ' "blocking"; -- Blocking command' >> $filename
  563. echo ' "roster"; -- Roster versioning' >> $filename
  564. echo ' "offline_email"; -- If offline send to email' >> $filename
  565. echo ' "offline"; -- Store offline messages' >> $filename
  566. echo ' "http";' >> $filename
  567. echo ' "http_upload";' >> $filename
  568. echo ' "websocket";' >> $filename
  569. echo ' "throttle_presence"; -- Reduce battery and bandwidth usage' >> $filename
  570. echo ' "filter_chatstates"; -- Reduce battery and bandwidth usage' >> $filename
  571. echo '};' >> $filename
  572. }
  573. function xmpp_onion_addresses {
  574. filename=$1
  575. echo 'onions_map = {' >> $filename
  576. echo ' ["anonymitaet-im-inter.net"] = "rwf5skuv5vqzcdit.onion";' >> $filename
  577. echo ' ["autistici.org"] = "wi7qkxyrdpu5cmvr.onion";' >> $filename
  578. echo ' ["jabber.calyxinstitute.org"] = "ijeeynrc6x2uy5ob.onion";' >> $filename
  579. echo ' ["jabber.ccc.de"] = "okj7xc6j2szr2y75.onion";' >> $filename
  580. echo ' ["cloak.dk"] = "m2dsl4banuimpm6c.onion";' >> $filename
  581. echo ' ["jabber.cryptoparty.is"] = "cryjabkbdljzohnp.onion";' >> $filename
  582. echo ' ["daemons.cf"] = "daemon4jidu2oig6.onion";' >> $filename
  583. echo ' ["dukgo.com"] = "wlcpmruglhxp6quz.onion";' >> $filename
  584. echo ' ["evil.im"] = "evilxro6nvjuvxqo.onion";' >> $filename
  585. echo ' ["xmpp.evil.im"] = "evilxro6nvjuvxqo.onion";' >> $filename
  586. echo ' ["inventati.org"] = "wi7qkxyrdpu5cmvr.onion";' >> $filename
  587. echo ' ["jabber.ipredator.se"] = "3iffdebkzzkpgipa.onion";' >> $filename
  588. echo ' ["jabber-germany.de"] = "dbbrphko5tqcpar3.onion";' >> $filename
  589. echo ' ["kode.im"] = "ihkw7qy3tok45dun.onion";' >> $filename
  590. echo ' ["im.koderoot.net"] = "ihkw7qy3tok45dun.onion";' >> $filename
  591. echo ' ["adb-centralen.se"] = "qai7jjjnhbrdiexf.onion";' >> $filename
  592. echo ' ["joelpurra.se"] = "37x6i3wgr2jyublb.onion";' >> $filename
  593. echo ' ["nordberg.se"] = "qai7jjjnhbrdiexf.onion";' >> $filename
  594. echo ' ["jabber.lqdn.fr"] = "jabber63t4r2qi57.onion";' >> $filename
  595. echo ' ["jabber.otr.im"] = "5rgdtlawqkcplz75.onion";' >> $filename
  596. echo ' ["otromundo.cf"] = "arauemwe2utqqzye.onion";' >> $filename
  597. echo ' ["patchcord.be"] = "xsydhi3dnbjuatpz.onion";' >> $filename
  598. echo ' ["riseup.net"] = "4cjw6cwpeaeppfqz.onion";' >> $filename
  599. echo ' ["xmpp.riseup.net"] = "4cjw6cwpeaeppfqz.onion";' >> $filename
  600. echo ' ["rows.io"] = "yz6yiv2hxyagvwy6.onion";' >> $filename
  601. echo ' ["xmpp.rows.io"] = "yz6yiv2hxyagvwy6.onion";' >> $filename
  602. echo ' ["securejabber.me"] = "giyvshdnojeivkom.onion";' >> $filename
  603. echo ' ["so36.net"] = "s4fgy24e2b5weqdb.onion";' >> $filename
  604. echo ' ["jabber.so36.net"] = "s4fgy24e2b5weqdb.onion";' >> $filename
  605. echo ' ["jabber.systemli.org"] = "x5tno6mwkncu5m3h.onion";' >> $filename
  606. echo ' ["taolo.ga"] = "l3ybpw4vs6ie5rv2.onion";' >> $filename
  607. echo ' ["tchncs.de"] = "duvfmyqmdlyvc3mi.onion";' >> $filename
  608. echo ' ["wtfismyip.com"] = "ofkztxcohimx34la.onion";' >> $filename
  609. echo ' ["prosody.xmpp.is"] = "y2qmqomqpszzryei.onion";' >> $filename
  610. echo ' ["xndr.de"] = "trcubpttd6zkc3tf.onion";' >> $filename
  611. echo ' ["trashserver.net"] = "m4c722bvc2r7brnn.onion";' >> $filename
  612. echo '};' >> $filename
  613. }
  614. function xmpp_create_config {
  615. echo "admins = { \"$MY_USERNAME@$DEFAULT_DOMAIN_NAME\" }" > /etc/prosody/prosody.cfg.lua
  616. echo 'plugin_paths = { "/var/lib/prosody/prosody-modules" }' >> /etc/prosody/prosody.cfg.lua
  617. echo '' >> /etc/prosody/prosody.cfg.lua
  618. xmpp_modules /etc/prosody/prosody.cfg.lua
  619. echo '' >> /etc/prosody/prosody.cfg.lua
  620. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  621. echo '' >> /etc/prosody/prosody.cfg.lua
  622. echo 'allow_registration = false;' >> /etc/prosody/prosody.cfg.lua
  623. echo '' >> /etc/prosody/prosody.cfg.lua
  624. echo 'daemonize = true;' >> /etc/prosody/prosody.cfg.lua
  625. echo '' >> /etc/prosody/prosody.cfg.lua
  626. echo 'pidfile = "/var/run/prosody/prosody.pid";' >> /etc/prosody/prosody.cfg.lua
  627. echo '' >> /etc/prosody/prosody.cfg.lua
  628. echo 'https_ports = { 5281 }' >> /etc/prosody/prosody.cfg.lua
  629. echo 'https_interfaces = { "*" }' >> /etc/prosody/prosody.cfg.lua
  630. echo 'https_ssl = {' >> /etc/prosody/prosody.cfg.lua
  631. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  632. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  633. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  634. else
  635. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  636. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  637. fi
  638. echo " curve = $XMPP_ECC_CURVE;" >> /etc/prosody/prosody.cfg.lua
  639. echo " ciphers = $XMPP_CIPHERS;" >> /etc/prosody/prosody.cfg.lua
  640. echo ' options = {"no_sslv2", "no_sslv3" };' >> /etc/prosody/prosody.cfg.lua
  641. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  642. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  643. else
  644. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  645. fi
  646. echo "}" >> /etc/prosody/prosody.cfg.lua
  647. echo '' >> /etc/prosody/prosody.cfg.lua
  648. echo 'ssl = {' >> /etc/prosody/prosody.cfg.lua
  649. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  650. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  651. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  652. else
  653. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  654. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  655. fi
  656. echo " curve = $XMPP_ECC_CURVE;" >> /etc/prosody/prosody.cfg.lua
  657. echo ' depth = "2";' >> /etc/prosody/prosody.cfg.lua
  658. echo " ciphers = $XMPP_CIPHERS;" >> /etc/prosody/prosody.cfg.lua
  659. echo ' options = {"no_sslv2", "no_sslv3" };' >> /etc/prosody/prosody.cfg.lua
  660. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  661. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  662. else
  663. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  664. fi
  665. echo '}' >> /etc/prosody/prosody.cfg.lua
  666. echo '' >> /etc/prosody/prosody.cfg.lua
  667. echo 'c2s_require_encryption = true' >> /etc/prosody/prosody.cfg.lua
  668. echo 's2s_require_encryption = true' >> /etc/prosody/prosody.cfg.lua
  669. echo '' >> /etc/prosody/prosody.cfg.lua
  670. echo 's2s_secure_auth = false' >> /etc/prosody/prosody.cfg.lua
  671. echo '' >> /etc/prosody/prosody.cfg.lua
  672. echo 'authentication = "internal_hashed"' >> /etc/prosody/prosody.cfg.lua
  673. echo '' >> /etc/prosody/prosody.cfg.lua
  674. echo 'storage = "sql"' >> /etc/prosody/prosody.cfg.lua
  675. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }' >> /etc/prosody/prosody.cfg.lua
  676. echo '' >> /etc/prosody/prosody.cfg.lua
  677. echo 'log = {' >> /etc/prosody/prosody.cfg.lua
  678. echo ' info = "/dev/null";' >> /etc/prosody/prosody.cfg.lua
  679. echo ' error = "/dev/null";' >> /etc/prosody/prosody.cfg.lua
  680. echo ' { levels = { "error" }; to = "/dev/null"; };' >> /etc/prosody/prosody.cfg.lua
  681. echo '}' >> /etc/prosody/prosody.cfg.lua
  682. echo '' >> /etc/prosody/prosody.cfg.lua
  683. if [[ $ONION_ONLY != 'no' ]]; then
  684. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"" >> /etc/prosody/prosody.cfg.lua
  685. else
  686. echo "VirtualHost \"${DEFAULT_DOMAIN_NAME}\"" >> /etc/prosody/prosody.cfg.lua
  687. fi
  688. echo ' ssl = {' >> /etc/prosody/prosody.cfg.lua
  689. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  690. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  691. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  692. else
  693. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  694. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  695. fi
  696. echo " curve = $XMPP_ECC_CURVE;" >> /etc/prosody/prosody.cfg.lua
  697. echo ' depth = "2";' >> /etc/prosody/prosody.cfg.lua
  698. echo " ciphers = $XMPP_CIPHERS;" >> /etc/prosody/prosody.cfg.lua
  699. echo ' options = {"no_sslv2", "no_sslv3" };' >> /etc/prosody/prosody.cfg.lua
  700. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  701. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  702. else
  703. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  704. fi
  705. echo ' }' >> /etc/prosody/prosody.cfg.lua
  706. echo '' >> /etc/prosody/prosody.cfg.lua
  707. echo 'Include "conf.d/*.cfg.lua"' >> /etc/prosody/prosody.cfg.lua
  708. echo 'http_upload_path = "/var/lib/prosody/http_uploads"' >> /etc/prosody/prosody.cfg.lua
  709. echo 'http_upload_file_size_limit = 307200' >> /etc/prosody/prosody.cfg.lua
  710. echo '' >> /etc/prosody/prosody.cfg.lua
  711. echo "Component \"chat.${DEFAULT_DOMAIN_NAME}\" \"muc\"" >> /etc/prosody/prosody.cfg.lua
  712. echo ' name = "Chatrooms"' >> /etc/prosody/prosody.cfg.lua
  713. echo ' modules_enabled = {' >> /etc/prosody/prosody.cfg.lua
  714. echo ' "muc_limits";' >> /etc/prosody/prosody.cfg.lua
  715. echo ' "muc_log";' >> /etc/prosody/prosody.cfg.lua
  716. echo ' "mam_muc";' >> /etc/prosody/prosody.cfg.lua
  717. echo ' "muc_log_http";' >> /etc/prosody/prosody.cfg.lua
  718. echo ' }' >> /etc/prosody/prosody.cfg.lua
  719. echo 'storage = { muc_log = "sql"; }' >> /etc/prosody/prosody.cfg.lua
  720. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }' >> /etc/prosody/prosody.cfg.lua
  721. echo 'muc_event_rate = 0.5;' >> /etc/prosody/prosody.cfg.lua
  722. echo 'muc_burst_factor = 10;' >> /etc/prosody/prosody.cfg.lua
  723. echo 'muc_log_by_default = false;' >> /etc/prosody/prosody.cfg.lua
  724. echo 'muc_log_all_rooms = false;' >> /etc/prosody/prosody.cfg.lua
  725. echo 'max_archive_query_results = 10;' >> /etc/prosody/prosody.cfg.lua
  726. echo 'max_history_messages = 10;' >> /etc/prosody/prosody.cfg.lua
  727. }
  728. function install_xmpp_nightly {
  729. if [ ! -d $INSTALL_DIR ]; then
  730. mkdir -p $INSTALL_DIR
  731. fi
  732. cd $INSTALL_DIR
  733. # Try to get the source from the project repo
  734. if [ -f /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  735. cp /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  736. else
  737. if [ -f /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  738. cp /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  739. else
  740. wget $prosody_nightly_url
  741. fi
  742. fi
  743. if [ ! -f ${INSTALL_DIR}/${prosody_filename}.tar.gz ]; then
  744. echo $"Failed to download prosody nightly $prosody_nightly_url"
  745. exit 78352
  746. fi
  747. hash_value=$(sha256sum ${INSTALL_DIR}/${prosody_filename}.tar.gz | awk -F ' ' '{print $1}')
  748. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  749. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  750. echo $'Unexpected hash value for prosody nightly download'
  751. exit 68224283
  752. fi
  753. tar -xzvf ${INSTALL_DIR}/${prosody_filename}.tar.gz
  754. cd ${INSTALL_DIR}/${prosody_filename}
  755. ./configure --ostype=debian --prefix=/usr
  756. make prefix=/usr
  757. make prefix=/usr install
  758. if [ -f /usr/local/bin/prosody ]; then
  759. echo $'Failed to build prosody nightly to /usr/bin'
  760. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  761. rm -rf ${INSTALL_DIR}/${prosody_filename}
  762. exit 628732
  763. fi
  764. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  765. set_completion_param "prosody_filename" "${prosody_filename}"
  766. }
  767. function install_xmpp {
  768. if [ ! -d $INSTALL_DIR ]; then
  769. mkdir -p $INSTALL_DIR
  770. fi
  771. # remove any existing install attempt
  772. if [ -f $INSTALL_DIR/$prosody_modules_filename ]; then
  773. rm $INSTALL_DIR/$prosody_modules_filename
  774. fi
  775. if [ -d $INSTALL_DIR/prosody-modules ]; then
  776. rm -rf $INSTALL_DIR/prosody-modules
  777. fi
  778. update_prosody_modules
  779. # obtain a cert for the default domain
  780. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME} pem)" == "0" ]]; then
  781. create_site_certificate ${DEFAULT_DOMAIN_NAME} 'yes'
  782. if [[ $ONION_ONLY == 'no' ]]; then
  783. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME} pem)" == "0" ]]; then
  784. echo $'LetsEncrypt cert could not be obtained for xmpp'
  785. exit 72342
  786. fi
  787. fi
  788. fi
  789. apt-get -yq install lua-sec lua-bitop lua5.1 liblua5.1-dev
  790. apt-get -yq install libidn11-dev libssl-dev lua-dbi-sqlite3
  791. apt-get -yq install mercurial
  792. apt-get -yq install prosody
  793. if [ ! -f /usr/bin/hg ]; then
  794. echo $"Couldn't install mercurial"
  795. exit 52825
  796. fi
  797. if [ ! -d /etc/prosody ]; then
  798. echo $"ERROR: prosody does not appear to have installed. $CHECK_MESSAGE"
  799. exit 52367
  800. fi
  801. groupadd prosody
  802. if [ ! -d /var/lib/prosody/http_uploads ]; then
  803. mkdir -p /var/lib/prosody/http_uploads
  804. fi
  805. if [ ! -d /etc/prosody/conf.d ]; then
  806. mkdir -p /etc/prosody/conf.d
  807. fi
  808. chmod -R 700 /etc/prosody/conf.d
  809. chown -R prosody /var/lib/prosody
  810. chown -R prosody /etc/prosody/conf.d
  811. # install modules
  812. update_prosody_modules initial
  813. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  814. echo $'No prosody modules available'
  815. exit 82634
  816. fi
  817. # create a certificate
  818. if [ ! -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  819. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  820. ${PROJECT_NAME}-addcert -h xmpp --dhkey ${DH_KEYLENGTH}
  821. check_certificates xmpp
  822. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  823. echo $'Failed to create xmpp certificate'
  824. exit 72352
  825. fi
  826. if [ ! -f /etc/ssl/private/xmpp.key ]; then
  827. echo $'Failed to create xmpp private certificate'
  828. exit 36829
  829. fi
  830. chmod g=rX /etc/ssl/private/xmpp.key
  831. chmod g=rX /etc/ssl/certs/xmpp.*
  832. fi
  833. fi
  834. groupadd default
  835. chmod 600 /etc/shadow
  836. chmod 600 /etc/gshadow
  837. usermod -g default prosody
  838. chmod 0000 /etc/shadow
  839. chmod 0000 /etc/gshadow
  840. chown root:default /etc/ssl/private/xmpp.*
  841. chown root:default /etc/ssl/certs/xmpp.*
  842. chown root:default /etc/ssl/private/${DEFAULT_DOMAIN_NAME}.*
  843. chown root:default /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.*
  844. cp -a /etc/prosody/conf.avail/example.com.cfg.lua /etc/prosody/conf.avail/xmpp.cfg.lua
  845. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME} pem)" == "1" ]]; then
  846. sed -i "s|key =.*|key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  847. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  848. else
  849. sed -i "s|key =.*|key = \"/etc/ssl/private/xmpp.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  850. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/xmpp.crt\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  851. fi
  852. if ! grep -q "xmpp.dhparam" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  853. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME})" == "1" ]]; then
  854. sed -i "/certificate =/a\ dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" /etc/prosody/conf.avail/xmpp.cfg.lua
  855. else
  856. sed -i '/certificate =/a\ dhparam = "/etc/ssl/certs/xmpp.dhparam";' /etc/prosody/conf.avail/xmpp.cfg.lua
  857. fi
  858. fi
  859. if ! grep -q 'options = {"no_sslv2", "no_sslv3" }' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  860. sed -i '/certificate =/a\ options = {"no_sslv2", "no_sslv3" };' /etc/prosody/conf.avail/xmpp.cfg.lua
  861. fi
  862. if ! grep -q 'ciphers =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  863. sed -i "/certificate =/a\ ciphers = $XMPP_CIPHERS;" /etc/prosody/conf.avail/xmpp.cfg.lua
  864. fi
  865. if ! grep -q 'depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  866. sed -i '/certificate =/a\ depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua
  867. fi
  868. if ! grep -q 'curve =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  869. sed -i "/certificate =/a\ curve = $XMPP_ECC_CURVE;" /etc/prosody/conf.avail/xmpp.cfg.lua
  870. fi
  871. sed -i "s/example.com/$DEFAULT_DOMAIN_NAME/g" /etc/prosody/conf.avail/xmpp.cfg.lua
  872. sed -i 's/enabled = false -- Remove this line to enable this host//g' /etc/prosody/conf.avail/xmpp.cfg.lua
  873. if ! grep -q "modules_enabled" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  874. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  875. xmpp_modules /etc/prosody/conf.avail/xmpp.cfg.lua
  876. fi
  877. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  878. if ! grep -q "c2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  879. echo 'c2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  880. else
  881. sed -i 's|c2s_require_encryption.*|c2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  882. fi
  883. if ! grep -q "s2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  884. echo 's2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  885. else
  886. sed -i 's|s2s_require_encryption.*|s2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  887. fi
  888. if ! grep -q "allow_unencrypted_plain_auth" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  889. echo 'allow_unencrypted_plain_auth = false' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  890. else
  891. sed -i 's|allow_unencrypted_plain_auth.*|allow_unencrypted_plain_auth = false|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  892. fi
  893. ln -sf /etc/prosody/conf.avail/xmpp.cfg.lua /etc/prosody/conf.d/xmpp.cfg.lua
  894. if [ ! -d /var/lib/tor ]; then
  895. echo $'No Tor installation found. xmpp onion site cannot be configured.'
  896. exit 877367
  897. fi
  898. if ! grep -q "hidden_service_xmpp" /etc/tor/torrc; then
  899. echo 'HiddenServiceDir /var/lib/tor/hidden_service_xmpp/' >> /etc/tor/torrc
  900. echo "HiddenServicePort 5222 127.0.0.1:5222" >> /etc/tor/torrc
  901. echo "HiddenServicePort 5269 127.0.0.1:5269" >> /etc/tor/torrc
  902. echo $'Added onion site for xmpp chat'
  903. fi
  904. onion_update
  905. wait_for_onion_service 'xmpp'
  906. if [ ! -f /var/lib/tor/hidden_service_xmpp/hostname ]; then
  907. echo $'xmpp onion site hostname not found'
  908. exit 65349
  909. fi
  910. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  911. if ! grep -q "${XMPP_ONION_HOSTNAME}" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  912. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  913. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"" >> /etc/prosody/conf.avail/xmpp.cfg.lua
  914. echo ' modules_enabled = { "onions" };' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  915. fi
  916. set_completion_param "xmpp onion domain" "${XMPP_ONION_HOSTNAME}"
  917. if [ -f $IMAGE_PASSWORD_FILE ]; then
  918. XMPP_PASSWORD="$(printf `cat $IMAGE_PASSWORD_FILE`)"
  919. else
  920. if [ ${#XMPP_PASSWORD} -lt 8 ]; then
  921. XMPP_PASSWORD="$(create_password ${MINIMUM_PASSWORD_LENGTH})"
  922. fi
  923. fi
  924. function_check configure_firewall_for_xmpp
  925. configure_firewall_for_xmpp
  926. xmpp_email_headers
  927. update_default_domain
  928. xmpp_create_config
  929. # TODO comment this out after debian supports prosody 0.10 or later
  930. install_xmpp_nightly
  931. chown -R prosody /etc/prosody
  932. chown -R prosody /var/lib/prosody
  933. chown -R prosody /usr/lib/prosody
  934. chmod -R 700 /etc/prosody/conf.d
  935. usermod -a -G www-data prosody
  936. if [ -d /etc/letsencrypt ]; then
  937. usermod -a -G ssl-cert prosody
  938. fi
  939. apt-mark -q hold prosody
  940. systemctl restart prosody
  941. if [[ $ONION_ONLY != 'no' ]]; then
  942. prosodyctl register $MY_USERNAME $XMPP_ONION_HOSTNAME "$XMPP_PASSWORD"
  943. else
  944. prosodyctl register $MY_USERNAME $DEFAULT_DOMAIN_NAME "$XMPP_PASSWORD"
  945. fi
  946. if [ ! "$?" = "0" ]; then
  947. echo ''
  948. echo ''
  949. systemctl status prosody -l
  950. echo ''
  951. echo ''
  952. which prosody
  953. which prosodyctl
  954. echo ''
  955. echo ''
  956. cat /etc/prosody/prosody.cfg.lua
  957. echo ''
  958. echo ''
  959. cat /etc/prosody/conf.avail/xmpp.cfg.lua
  960. echo ''
  961. echo ''
  962. #remove_xmpp
  963. echo $'Unable to register prosody user'
  964. exit 347682
  965. fi
  966. ${PROJECT_NAME}-pass -u $MY_USERNAME -a xmpp -p "$XMPP_PASSWORD"
  967. APP_INSTALLED=1
  968. }
  969. # NOTE: deliberately no exit 0