freedombone-app-xmpp 46KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # XMPP functions
  12. #
  13. # The two directories for prosody modules seem necessary.
  14. # Trying to remove /usr/lib/prosody/modules causes problems, and that's
  15. # part of the package install.
  16. #
  17. # License
  18. # =======
  19. #
  20. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  21. #
  22. # This program is free software: you can redistribute it and/or modify
  23. # it under the terms of the GNU Affero General Public License as published by
  24. # the Free Software Foundation, either version 3 of the License, or
  25. # (at your option) any later version.
  26. #
  27. # This program is distributed in the hope that it will be useful,
  28. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  29. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  30. # GNU Affero General Public License for more details.
  31. #
  32. # You should have received a copy of the GNU Affero General Public License
  33. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  34. VARIANTS='full full-vim chat'
  35. IN_DEFAULT_INSTALL=0
  36. SHOW_ON_ABOUT=1
  37. # Directory where XMPP settings are stored
  38. XMPP_DIRECTORY="/var/lib/prosody"
  39. XMPP_PASSWORD=
  40. XMPP_CIPHERS='"EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"'
  41. XMPP_ECC_CURVE='"secp384r1"'
  42. prosody_latest_version='0.10'
  43. prosody_nightly=468
  44. prosody_nightly_hash='c72aaab1182a86090188284f443d2f819889ca242d4e955258ef60f4c7c9a1ba'
  45. prosody_filename=prosody-${prosody_latest_version}-1nightly${prosody_nightly}
  46. prosody_nightly_url="https://prosody.im/nightly/${prosody_latest_version}/latest/${prosody_filename}.tar.gz"
  47. # From https://hg.prosody.im/prosody-modules
  48. prosody_modules_filename='prosody-modules-20180322.tar.gz'
  49. prosody_modules_hash='982d0dfcef98e9cb9cee4cc3801b8ce9a503a32e44c32b99df6fe94545b90072'
  50. xmpp_variables=(ONION_ONLY
  51. INSTALLED_WITHIN_DOCKER
  52. XMPP_CIPHERS
  53. XMPP_ECC_CURVE
  54. XMPP_ECC_CURVE
  55. MY_USERNAME
  56. MY_EMAIL_ADDRESS
  57. DEFAULT_DOMAIN_NAME
  58. XMPP_DOMAIN_CODE)
  59. function logging_on_xmpp {
  60. if [ -d /etc/prosody ]; then
  61. if [ ! -d /var/log/prosody ]; then
  62. mkdir /var/log/prosody
  63. chown root:adm /var/log/prosody
  64. fi
  65. if ! grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  66. sed -i 's|info = "/dev/null";|info = "/var/log/prosody/prosody.log";|g' /etc/prosody/prosody.cfg.lua
  67. sed -i 's|error = "/dev/null";|error = "/var/log/prosody/prosody.err";|g' /etc/prosody/prosody.cfg.lua
  68. sed -i 's|levels = { "error" }; to = "/dev/null";|levels = { "error" }; to = "syslog";|g' /etc/prosody/prosody.cfg.lua
  69. fi
  70. fi
  71. }
  72. function logging_off_xmpp {
  73. if [ -d /etc/prosody ]; then
  74. if grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  75. sed -i 's|info = "/var/log/prosody/prosody.log";|info = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  76. sed -i 's|error = "/var/log/prosody/prosody.err";|error = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  77. sed -i 's|levels = { "error" }; to = "syslog";|levels = { "error" }; to = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  78. $REMOVE_FILES_COMMAND /var/log/prosody/*
  79. rm -rf /var/log/prosody
  80. fi
  81. fi
  82. }
  83. function xmpp_add_onion_address {
  84. domain_name="$1"
  85. onion_address="$2"
  86. if [ ${#domain_name} -eq 0 ]; then
  87. return
  88. fi
  89. if [ ${#onion_address} -eq 0 ]; then
  90. return
  91. fi
  92. if ! grep "${onion_address}" /etc/prosody/prosody.cfg.lua; then
  93. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  94. sed -i "s|[\"${domain_name}\"].*|[\"${domain_name}\"] = \"${onion_address}\";|g" /etc/prosody/prosody.cfg.lua
  95. else
  96. sed -i "/onions_map = {/a [\"${domain_name}\"] = \"${onion_address}\";" /etc/prosody/prosody.cfg.lua
  97. fi
  98. systemctl restart prosody
  99. fi
  100. }
  101. function xmpp_add_onion_address_interactive {
  102. data=$(mktemp 2>/dev/null)
  103. dialog --backtitle $"Freedombone Control Panel" \
  104. --title $"Add an ICANN to Onion domain mapping" \
  105. --form $"Sepecify an ICANN domain name and its equivalent onion address\\n" 9 50 2 \
  106. $"Domain:" 1 1 "" 1 18 26 25 \
  107. $"Onion address:" 2 1 "" 2 18 26 25 \
  108. 2> "$data"
  109. sel=$?
  110. case $sel in
  111. 1) rm -f "$data"
  112. return;;
  113. 255) rm -f "$data"
  114. return;;
  115. esac
  116. domain_name=$(sed -n 1p < "$data")
  117. onion_address=$(sed -n 2p < "$data")
  118. rm -f "$data"
  119. if [[ "$onion_address" != *".onion" ]]; then
  120. return
  121. fi
  122. if [[ "$domain_name" != *"."* ]]; then
  123. return
  124. fi
  125. xmpp_add_onion_address "$domain_name" "$onion_address"
  126. dialog --title $"Add an ICANN to Onion domain mapping" \
  127. --msgbox $"${domain_name} -> ${onion_address} added" 6 70
  128. }
  129. function xmpp_remove_onion_address {
  130. domain_name="$1"
  131. if [ ${#domain_name} -eq 0 ]; then
  132. return
  133. fi
  134. xmpp_changed=
  135. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  136. sed -i "/[\"${domain_name}\"]/d" /etc/prosody/prosody.cfg.lua
  137. xmpp_changed=1
  138. fi
  139. if grep -q "= \"${domain_name}\";" /etc/prosody/prosody.cfg.lua; then
  140. sed -i "/= \"${domain_name}\";/d" /etc/prosody/prosody.cfg.lua
  141. xmpp_changed=1
  142. fi
  143. if [ $xmpp_changed ]; then
  144. systemctl restart prosody
  145. fi
  146. }
  147. function xmpp_remove_onion_address_interactive {
  148. data=$(mktemp 2>/dev/null)
  149. dialog --title $"Remove ICANN to Onion domain mapping" \
  150. --backtitle $"Freedombone Control Panel" \
  151. --inputbox $'Enter the domain name or onion address to be removed' 8 60 2>"$data"
  152. sel=$?
  153. case $sel in
  154. 0) domain_name=$(<"$data")
  155. if [[ "$domain_name" != *"."* ]]; then
  156. rm -f "$data"
  157. return
  158. fi
  159. xmpp_remove_onion_address "$domain_name"
  160. dialog --title $"Remove an ICANN to Onion domain mapping" \
  161. --msgbox $"${domain_name} removed" 6 70
  162. ;;
  163. esac
  164. rm -f "$data"
  165. }
  166. function configure_interactive_xmpp {
  167. while true
  168. do
  169. data=$(mktemp 2>/dev/null)
  170. dialog --backtitle $"Freedombone Control Panel" \
  171. --title $"XMPP" \
  172. --radiolist $"Choose an operation:" 12 70 3 \
  173. 1 $"Add an ICANN to onion domain mapping" off \
  174. 2 $"Remove an ICANN to onion domain mapping" off \
  175. 3 $"Return to administrator control panel" on 2> "$data"
  176. sel=$?
  177. case $sel in
  178. 1) rm -f "$data"
  179. return;;
  180. 255) rm -f "$data"
  181. return;;
  182. esac
  183. case $(cat "$data") in
  184. 1) xmpp_add_onion_address_interactive;;
  185. 2) xmpp_remove_onion_address_interactive;;
  186. 3) rm -f "$data"
  187. break;;
  188. esac
  189. rm -f "$data"
  190. done
  191. }
  192. function remove_user_xmpp {
  193. remove_username="$1"
  194. "${PROJECT_NAME}-pass" -u "$remove_username" --rmapp xmpp
  195. if [[ "$ONION_ONLY" != "no" ]]; then
  196. DOMAIN=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  197. else
  198. DOMAIN=${HOSTNAME}
  199. fi
  200. prosodyctl deluser "${remove_username}@${DOMAIN}"
  201. }
  202. function add_user_xmpp_client {
  203. new_username="$1"
  204. new_user_password="$2"
  205. if [ -f /usr/local/bin/profanity ]; then
  206. XMPP_CLIENT_DIR=/home/$new_username/.local/share/profanity
  207. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  208. if [ ! -d "$XMPP_CLIENT_DIR" ]; then
  209. mkdir -p "$XMPP_CLIENT_DIR"
  210. fi
  211. if [ ! -d "/home/$new_username/.config/profanity" ]; then
  212. mkdir -p "/home/$new_username/.config/profanity"
  213. fi
  214. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$new_username" "$new_username@$HOSTNAME")
  215. { echo "[${new_username}@${HOSTNAME}]";
  216. echo 'enabled=true';
  217. echo "jid=${new_username}@${HOSTNAME}";
  218. echo "server=$XMPP_ONION_HOSTNAME";
  219. echo "pgp.keyid=$MY_GPG_PUBLIC_KEY_ID";
  220. echo 'resource=profanity';
  221. echo "muc.service=conference.${HOSTNAME}";
  222. echo "muc.nick=${new_username}";
  223. echo 'presence.last=online';
  224. echo 'presence.login=online';
  225. echo 'priority.online=0';
  226. echo 'priority.chat=0';
  227. echo 'priority.away=0';
  228. echo 'priority.xa=0';
  229. echo 'priority.dnd=0'; } > "$XMPP_CLIENT_ACCOUNTS"
  230. echo '[connection]' > "/home/$new_username/.config/profanity/profrc"
  231. if [[ $ONION_ONLY != "no" ]]; then
  232. echo "account=${new_username}@${XMPP_ONION_HOSTNAME}" >> "/home/$new_username/.config/profanity/profrc"
  233. else
  234. echo "account=${new_username}@${HOSTNAME}" >> "/home/$new_username/.config/profanity/profrc"
  235. fi
  236. { echo '';
  237. echo '[plugins]';
  238. echo 'load=prof_omemo_plugin.py;';
  239. echo '';
  240. echo '[otr]';
  241. echo 'policy=opportunistic';
  242. echo 'log=off';
  243. echo '';
  244. echo '[pgp]';
  245. echo 'log=off';
  246. echo '';
  247. echo '[ui]';
  248. echo 'enc.warn=true'; } >> "/home/$new_username/.config/profanity/profrc"
  249. chown -R "$new_username":"$new_username" "/home/$new_username/.local"
  250. chown -R "$new_username":"$new_username" "/home/$new_username/.config"
  251. fi
  252. }
  253. function add_user_xmpp {
  254. new_username="$1"
  255. new_user_password="$2"
  256. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  257. "${PROJECT_NAME}-pass" -u "$new_username" -a xmpp -p "$new_user_password"
  258. if [[ "$ONION_ONLY" != "no" ]]; then
  259. DOMAIN_NAME=$XMPP_ONION_HOSTNAME
  260. else
  261. DOMAIN_NAME=$HOSTNAME
  262. fi
  263. EMAIL_ADDRESS="$new_username@$DOMAIN_NAME"
  264. if [ ${#new_user_password} -eq 0 ]; then
  265. prosodyctl adduser "$EMAIL_ADDRESS"
  266. else
  267. if ! prosodyctl register "$new_username" "$DOMAIN_NAME" "$new_user_password"; then
  268. exit 653456375
  269. fi
  270. fi
  271. # add the xmpp address to email headers
  272. if [ -f "/home/$new_username/.muttrc" ]; then
  273. if ! grep -q "Jabber-ID" "/home/$new_username/.muttrc"; then
  274. echo "my_hdr Jabber-ID: $EMAIL_ADDRESS" >> "/home/$new_username/.muttrc"
  275. else
  276. sed -i "s|my_hdr Jabber-ID.*|my_hdr Jabber-ID: $EMAIL_ADDRESS|g" "/home/$new_username/.muttrc"
  277. fi
  278. fi
  279. add_user_xmpp_client "$new_username" "$new_user_password"
  280. echo '0'
  281. }
  282. function install_interactive_xmpp {
  283. echo -n ''
  284. APP_INSTALLED=1
  285. }
  286. function change_password_xmpp {
  287. curr_username="$1"
  288. new_user_password="$2"
  289. read_config_param DEFAULT_DOMAIN_NAME
  290. "${PROJECT_NAME}-pass" -u "$curr_username" -a xmpp -p "$new_user_password"
  291. # TODO: this is currently interactive. Really there needs to be a
  292. # non-interactive password change option for prosodyctl
  293. clear
  294. echo ''
  295. echo $'Currently Prosody requires password changes to be done interactively'
  296. prosodyctl passwd "${curr_username}@${DEFAULT_DOMAIN_NAME}"
  297. if [ -f /usr/local/bin/profanity ]; then
  298. XMPP_CLIENT_DIR=/home/$curr_username/.local/share/profanity
  299. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  300. if [ -f "$XMPP_CLIENT_ACCOUNTS" ]; then
  301. sed -i "s|password=.*|password=$new_user_password|g" "$XMPP_CLIENT_ACCOUNTS"
  302. fi
  303. fi
  304. }
  305. function reconfigure_xmpp {
  306. echo -n ''
  307. }
  308. function update_prosody_modules {
  309. if [ ! "$1" ]; then
  310. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  311. return
  312. fi
  313. fi
  314. if [ ! -d /usr/lib/prosody ]; then
  315. return
  316. fi
  317. if [ ! -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  318. # Obtain the modules
  319. if [ -f ~/freedombone/image_build/$prosody_modules_filename ]; then
  320. cp ~/freedombone/image_build/$prosody_modules_filename "$INSTALL_DIR"
  321. else
  322. if [ -f "/home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename" ]; then
  323. cp "/home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename" "$INSTALL_DIR"
  324. fi
  325. fi
  326. if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  327. cd "$INSTALL_DIR" || exit 246824684
  328. # Check the hash
  329. curr_hash=$(sha256sum "$INSTALL_DIR/$prosody_modules_filename" | awk -F ' ' '{print $1}')
  330. if [[ "$curr_hash" != "$prosody_modules_hash" ]]; then
  331. echo $'Prosody modules hash does not match'
  332. exit 83562
  333. else
  334. # Extract the modules
  335. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  336. rm -rf "$INSTALL_DIR/prosody-modules"
  337. fi
  338. tar -xzvf $prosody_modules_filename
  339. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  340. systemctl stop prosody
  341. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  342. mkdir -p /var/lib/prosody/prosody-modules
  343. fi
  344. cp -r "$INSTALL_DIR/prosody-modules/"* /var/lib/prosody/prosody-modules/
  345. cp -r "$INSTALL_DIR/prosody-modules/"* /usr/lib/prosody/modules/
  346. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  347. chown -R prosody:prosody /usr/lib/prosody/modules
  348. systemctl start prosody
  349. else
  350. echo $'Prosody modules not extracted'
  351. exit 72524
  352. fi
  353. fi
  354. fi
  355. fi
  356. if ! grep -q '"vcard"' /etc/prosody/prosody.cfg.lua; then
  357. systemctl stop prosody
  358. sed -i '/"pep"/a "vcard";' /etc/prosody/prosody.cfg.lua
  359. systemctl start prosody
  360. fi
  361. if ! grep -q "omemo_all_access" /etc/prosody/prosody.cfg.lua; then
  362. sed -i '/"pep";/a "omemo_all_access"; -- Fix for PEP with OMEMO' /etc/prosody/prosody.cfg.lua
  363. sed -i 's|"omemo_all_access";| "omemo_all_access";|g' /etc/prosody/prosody.cfg.lua
  364. fi
  365. if ! grep -q "omemo_all_access" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  366. sed -i '/"pep";/a "omemo_all_access"; -- Fix for PEP with OMEMO' /etc/prosody/conf.avail/xmpp.cfg.lua
  367. sed -i 's|"omemo_all_access";| "omemo_all_access";|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  368. fi
  369. }
  370. function prosody_daemon_restart_script {
  371. # On rare occasions the daemon appears to get stuck
  372. # i.e. still active, but not accepting connections
  373. # This ensures that it will unstick itself at least once per day
  374. if [ -f /etc/cron.daily/prosody ]; then
  375. rm /etc/cron.daily/prosody
  376. fi
  377. if [ ! -f /etc/cron.hourly/prosody ]; then
  378. { echo '#!/bin/bash';
  379. echo "is_active=\$(systemctl is-active prosody)";
  380. echo "if [[ \"\$is_active\" != 'active' ]]; then";
  381. echo ' systemctl restart prosody'
  382. echo 'fi'; } > /etc/cron.hourly/prosody
  383. chmod +x /etc/cron.hourly/prosody
  384. fi
  385. }
  386. function upgrade_xmpp {
  387. if [ -d /etc/letsencrypt ]; then
  388. prosody_groups=$(groups prosody)
  389. if [[ "$prosody_groups" != *'ssl-cert'* ]]; then
  390. usermod -a -G ssl-cert prosody
  391. fi
  392. fi
  393. prosody_daemon_restart_script
  394. function_check update_prosody_modules
  395. update_prosody_modules
  396. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  397. xmpp_contact_info /etc/prosody/prosody.cfg.lua
  398. if grep -q "/etc/ssl/certs/xmpp.dhparam" /etc/prosody/prosody.cfg.lua; then
  399. cp /etc/ssl/certs/xmpp.dhparam /etc/prosody/xmpp.dhparam
  400. chown prosody:prosody /etc/prosody/xmpp.dhparam
  401. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/prosody.cfg.lua
  402. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  403. fi
  404. if grep -q "/etc/ssl/private/xmpp.key" /etc/prosody/prosody.cfg.lua; then
  405. if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem" ]; then
  406. sed -i "s|/etc/ssl/private/xmpp.key|/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/prosody/prosody.cfg.lua
  407. fi
  408. fi
  409. if grep -q "/etc/ssl/certs/xmpp.crt" /etc/prosody/prosody.cfg.lua; then
  410. if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem" ]; then
  411. sed -i "s|/etc/ssl/certs/xmpp.crt|/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/prosody/prosody.cfg.lua
  412. fi
  413. fi
  414. curr_prosody_filename=$(grep "prosody_filename" "$COMPLETION_FILE" | awk -F ':' '{print $2}')
  415. if [[ "$curr_prosody_filename" != "$prosody_filename" ]]; then
  416. if [ -d "${INSTALL_DIR}/${prosody_filename}" ]; then
  417. # ensure that the binaries have not been overwritten
  418. # by an operating system upgrade
  419. cd "${INSTALL_DIR}/${prosody_filename}" || exit 462846284
  420. make prefix=/usr install
  421. else
  422. cd "$INSTALL_DIR" || exit 23681468
  423. # Try to get the source from the project repo
  424. if [ -f "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  425. cp "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  426. else
  427. if [ -f "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  428. cp "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  429. else
  430. wget $prosody_nightly_url
  431. fi
  432. fi
  433. if [ ! -f "${INSTALL_DIR}/${prosody_filename}.tar.gz" ]; then
  434. echo $"Failed to download prosody nightly $prosody_nightly_url"
  435. return
  436. fi
  437. hash_value=$(sha256sum "${INSTALL_DIR}/${prosody_filename}.tar.gz" | awk -F ' ' '{print $1}')
  438. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  439. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  440. echo $'Unexpected hash value for prosody nightly download'
  441. return
  442. fi
  443. tar -xzvf "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  444. cd "${INSTALL_DIR}/${prosody_filename}" || exit 246872468246
  445. ./configure --ostype=debian --prefix=/usr
  446. make prefix=/usr
  447. make prefix=/usr install
  448. if [ -f /usr/local/bin/prosody ]; then
  449. echo $'Failed to build prosody nightly to /usr/bin'
  450. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  451. rm -rf "${INSTALL_DIR:?}/${prosody_filename}"
  452. return
  453. fi
  454. rm "${INSTALL_DIR:?}/${prosody_filename}.tar.gz"
  455. fi
  456. # add onion addresses for known servers
  457. if ! grep -q "onions_map =" /etc/prosody/prosody.cfg.lua; then
  458. echo '' >> /etc/prosody/prosody.cfg.lua
  459. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  460. fi
  461. set_completion_param "prosody_filename" "${prosody_filename}"
  462. fi
  463. cp -r "$INSTALL_DIR/prosody-modules/"* /var/lib/prosody/prosody-modules/
  464. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  465. systemctl restart prosody
  466. }
  467. function backup_local_xmpp {
  468. source_directory=/var/lib/prosody
  469. if [ -d $source_directory ]; then
  470. dest_directory=xmpp
  471. function_check backup_directory_to_usb
  472. backup_directory_to_usb $source_directory $dest_directory
  473. fi
  474. }
  475. function restore_local_xmpp {
  476. if [ -d /var/lib/prosody ]; then
  477. echo $"Restoring xmpp settings"
  478. temp_restore_dir=/root/tempxmpp
  479. function_check restore_directory_from_usb
  480. restore_directory_from_usb $temp_restore_dir xmpp
  481. if [ -d $temp_restore_dir/var/lib/prosody ]; then
  482. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  483. else
  484. cp -r $temp_restore_dir/* /var/lib/prosody/
  485. fi
  486. # shellcheck disable=SC2181
  487. if [ ! "$?" = "0" ]; then
  488. function_check set_user_permissions
  489. set_user_permissions
  490. function_check backup_unmount_drive
  491. backup_unmount_drive
  492. exit 725
  493. fi
  494. rm -rf $temp_restore_dir
  495. systemctl restart prosody
  496. chown -R prosody:prosody /var/lib/prosody/*
  497. echo $"Restore of xmpp settings complete"
  498. fi
  499. }
  500. function backup_remote_xmpp {
  501. if [ -d /var/lib/prosody ]; then
  502. echo $"Backing up the xmpp settings"
  503. backup_directory_to_friend /var/lib/prosody xmpp
  504. echo $"Backup of xmpp settings complete"
  505. fi
  506. }
  507. function restore_remote_xmpp {
  508. if [ -d /var/lib/prosody ]; then
  509. echo $"Restoring xmpp settings"
  510. temp_restore_dir=/root/tempxmpp
  511. function_check restore_directory_from_friend
  512. restore_directory_from_friend $temp_restore_dir xmpp
  513. if [ -d $temp_restore_dir/var/lib/prosody ]; then
  514. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  515. else
  516. cp -r $temp_restore_dir/* /var/lib/prosody/
  517. fi
  518. # shellcheck disable=SC2181
  519. if [ ! "$?" = "0" ]; then
  520. exit 725
  521. fi
  522. rm -rf $temp_restore_dir
  523. systemctl restart prosody
  524. chown -R prosody:prosody /var/lib/prosody/*
  525. echo $"Restore of xmpp settings complete"
  526. fi
  527. }
  528. function configure_firewall_for_xmpp {
  529. if [ ! -d /etc/prosody ]; then
  530. return
  531. fi
  532. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  533. return
  534. fi
  535. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  536. # docker does its own firewalling
  537. return
  538. fi
  539. if [[ $ONION_ONLY != "no" ]]; then
  540. return
  541. fi
  542. firewall_add XMPP 5222 tcp
  543. firewall_add XMPP 5223 tcp
  544. firewall_add XMPP 5269 tcp
  545. firewall_add XMPP 5280 tcp
  546. firewall_add XMPP 5281 tcp
  547. mark_completed "${FUNCNAME[0]}"
  548. }
  549. function remove_xmpp {
  550. remove_profanity
  551. remove_movim
  552. firewall_remove 5222 tcp
  553. firewall_remove 5223 tcp
  554. firewall_remove 5269 tcp
  555. firewall_remove 5280 tcp
  556. firewall_remove 5281 tcp
  557. function_check remove_onion_service
  558. remove_onion_service xmpp 5222 5223 5269
  559. sed -i '/HiddenServiceVersion 2/d' /etc/tor/torrc
  560. apt-get -yq remove --purge prosody
  561. rm /etc/cron.daily/prosody
  562. if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  563. rm "$INSTALL_DIR/$prosody_modules_filename"
  564. fi
  565. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  566. rm -rf "$INSTALL_DIR/prosody-modules"
  567. fi
  568. if [ -d /etc/prosody ]; then
  569. rm -rf /etc/prosody
  570. fi
  571. if [ -d /var/lib/prosody ]; then
  572. rm -rf /var/lib/prosody
  573. fi
  574. if [ -d /usr/lib/prosody ]; then
  575. rm -rf /usr/lib/prosody
  576. fi
  577. if [ -f /usr/local/bin/prosody ]; then
  578. rm /usr/local/bin/prosody
  579. fi
  580. if [ -f /usr/local/bin/prosodyctl ]; then
  581. rm /usr/local/bin/prosodyctl
  582. fi
  583. groupdel prosody
  584. remove_completion_param install_xmpp
  585. sed -i '/xmpp/d' "$COMPLETION_FILE"
  586. sed -i '/prosody/d' "$COMPLETION_FILE"
  587. rm /etc/avahi/services/xmpp.service
  588. rm /etc/avahi/services/xmpp-server.service
  589. systemctl restart avahi-daemon
  590. }
  591. function xmpp_email_headers {
  592. for d in /home/*/ ; do
  593. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  594. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  595. if [ -f "/home/$USERNAME/.muttrc" ]; then
  596. if ! grep -q "Jabber-ID" "/home/$USERNAME/.muttrc"; then
  597. echo "my_hdr Jabber-ID: ${USERNAME}@${HOSTNAME}" >> "/home/$USERNAME/.muttrc"
  598. fi
  599. fi
  600. fi
  601. done
  602. }
  603. function xmpp_contact_info {
  604. filename="$1"
  605. if grep -q "contact_info =" "$filename"; then
  606. return
  607. fi
  608. { echo 'contact_info = {';
  609. echo "abuse = { \"mailto:${MY_EMAIL_ADDRESS}\", \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  610. echo "admin = { \"mailto:${MY_EMAIL_ADDRESS}\", \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  611. echo "feedback = { \"mailto:${MY_EMAIL_ADDRESS}\", \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  612. echo "security = { \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  613. echo "support = { \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  614. echo '};'; } >> "$filename"
  615. }
  616. function xmpp_modules {
  617. filename="$1"
  618. { echo 'modules_enabled = {';
  619. echo ' "server_contact_info";';
  620. echo ' "pubsub";';
  621. echo ' "pubsub_hub";';
  622. echo ' "dialback"; -- s2s dialback support';
  623. echo ' "disco"; -- Service discovery';
  624. echo ' "private"; -- Private XML storage (for room bookmarks, etc.)';
  625. echo ' "version"; -- Replies to server version requests';
  626. echo ' "uptime"; -- Report how long server has been running';
  627. echo ' "time"; -- Let others know the time here on this server';
  628. echo ' "ping"; -- Replies to XMPP pings with pongs';
  629. echo ' "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands';
  630. echo ' "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.';
  631. echo ' "bosh"; -- Enable mod_bosh';
  632. echo ' "tls"; -- Enable mod_tls';
  633. echo ' "saslauth"; -- Enable mod_saslauth';
  634. echo ' "onions"; -- Enable chat via onion service';
  635. echo ' "mam"; -- Message archive management';
  636. echo ' "csi"; -- Client state indication';
  637. echo ' "carbons"; -- Message carbons';
  638. echo ' "carbons_adhoc"; -- Message carbons';
  639. echo ' "carbons_copies"; -- Message carbons';
  640. echo ' "smacks"; -- Stream management';
  641. echo ' "smacks_offline"; -- Stream management';
  642. echo ' "pep"; -- Personal Eventing Protocol (to support OMEMO)';
  643. echo ' "omemo_all_access"; -- Fix for PEP with OMEMO';
  644. echo ' "vcard"; -- Personal Eventing Protocol (to support OMEMO)';
  645. echo ' "e2e_policy"; -- To support OMEMO';
  646. echo ' "pep_vcard_avatar"; -- Personal Eventing Protocol (to support OMEMO)';
  647. echo ' "blocklist"; -- Privacy lists';
  648. echo ' "privacy_lists"; -- Privacy lists';
  649. echo ' "blocking"; -- Blocking command';
  650. echo ' "roster"; -- Roster versioning';
  651. echo ' "offline_email"; -- If offline send to email';
  652. echo ' "offline"; -- Store offline messages';
  653. echo ' "http";';
  654. echo ' "http_upload";';
  655. echo ' "websocket";';
  656. echo ' "throttle_presence"; -- Reduce battery and bandwidth usage';
  657. echo ' "filter_chatstates"; -- Reduce battery and bandwidth usage';
  658. echo '};'; } >> "$filename"
  659. }
  660. function xmpp_onion_addresses {
  661. filename="$1"
  662. sed -i '/onions_map = {/,/};/d' "$filename"
  663. { echo 'onions_map = {';
  664. echo ' ["anonymitaet-im-inter.net"] = "rwf5skuv5vqzcdit.onion";';
  665. echo ' ["autistici.org"] = "wi7qkxyrdpu5cmvr.onion";';
  666. echo ' ["jabber.calyxinstitute.org"] = "ijeeynrc6x2uy5ob.onion";';
  667. echo ' ["jabber.ccc.de"] = "okj7xc6j2szr2y75.onion";';
  668. echo ' ["cloak.dk"] = "m2dsl4banuimpm6c.onion";';
  669. echo ' ["jabber.cryptoparty.is"] = "cryjabkbdljzohnp.onion";';
  670. echo ' ["daemons.cf"] = "daemon4jidu2oig6.onion";';
  671. echo ' ["dukgo.com"] = "wlcpmruglhxp6quz.onion";';
  672. echo ' ["evil.im"] = "evilxro6nvjuvxqo.onion";';
  673. echo ' ["xmpp.evil.im"] = "evilxro6nvjuvxqo.onion";';
  674. echo ' ["inventati.org"] = "wi7qkxyrdpu5cmvr.onion";';
  675. echo ' ["jabber.ipredator.se"] = "3iffdebkzzkpgipa.onion";';
  676. echo ' ["jabber-germany.de"] = "dbbrphko5tqcpar3.onion";';
  677. echo ' ["kode.im"] = "ihkw7qy3tok45dun.onion";';
  678. echo ' ["im.koderoot.net"] = "ihkw7qy3tok45dun.onion";';
  679. echo ' ["adb-centralen.se"] = "qai7jjjnhbrdiexf.onion";';
  680. echo ' ["joelpurra.se"] = "37x6i3wgr2jyublb.onion";';
  681. echo ' ["nordberg.se"] = "qai7jjjnhbrdiexf.onion";';
  682. echo ' ["jabber.lqdn.fr"] = "jabber63t4r2qi57.onion";';
  683. echo ' ["jabber.otr.im"] = "5rgdtlawqkcplz75.onion";';
  684. echo ' ["otromundo.cf"] = "arauemwe2utqqzye.onion";';
  685. echo ' ["patchcord.be"] = "xsydhi3dnbjuatpz.onion";';
  686. echo ' ["riseup.net"] = "4cjw6cwpeaeppfqz.onion";';
  687. echo ' ["xmpp.riseup.net"] = "4cjw6cwpeaeppfqz.onion";';
  688. echo ' ["rows.io"] = "yz6yiv2hxyagvwy6.onion";';
  689. echo ' ["xmpp.rows.io"] = "yz6yiv2hxyagvwy6.onion";';
  690. echo ' ["securejabber.me"] = "giyvshdnojeivkom.onion";';
  691. echo ' ["so36.net"] = "s4fgy24e2b5weqdb.onion";';
  692. echo ' ["jabber.so36.net"] = "s4fgy24e2b5weqdb.onion";';
  693. echo ' ["jabber.systemli.org"] = "x5tno6mwkncu5m3h.onion";';
  694. echo ' ["taolo.ga"] = "l3ybpw4vs6ie5rv2.onion";';
  695. echo ' ["tchncs.de"] = "duvfmyqmdlyvc3mi.onion";';
  696. echo ' ["wtfismyip.com"] = "ofkztxcohimx34la.onion";';
  697. echo ' ["prosody.xmpp.is"] = "y2qmqomqpszzryei.onion";';
  698. echo ' ["xndr.de"] = "trcubpttd6zkc3tf.onion";';
  699. echo ' ["jabber.cat"] = "sybzodlxacch7st7.onion";';
  700. echo ' ["trashserver.net"] = "m4c722bvc2r7brnn.onion";';
  701. echo '};'; } >> "$filename"
  702. }
  703. function xmpp_create_config {
  704. echo "admins = { \"$MY_USERNAME@$DEFAULT_DOMAIN_NAME\" }" > /etc/prosody/prosody.cfg.lua
  705. echo 'plugin_paths = { "/var/lib/prosody/prosody-modules" }' >> /etc/prosody/prosody.cfg.lua
  706. echo '' >> /etc/prosody/prosody.cfg.lua
  707. xmpp_modules /etc/prosody/prosody.cfg.lua
  708. echo '' >> /etc/prosody/prosody.cfg.lua
  709. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  710. xmpp_contact_info /etc/prosody/prosody.cfg.lua
  711. { echo '';
  712. echo 'allow_registration = false;';
  713. echo '';
  714. echo 'daemonize = true;';
  715. echo '';
  716. echo 'pidfile = "/var/run/prosody/prosody.pid";';
  717. echo '';
  718. echo 'https_ports = { 5281 }';
  719. echo 'https_interfaces = { "*" }';
  720. echo 'https_ssl = {'; } >> /etc/prosody/prosody.cfg.lua
  721. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  722. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  723. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  724. else
  725. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  726. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  727. fi
  728. { echo " curve = $XMPP_ECC_CURVE;";
  729. echo " ciphers = $XMPP_CIPHERS;";
  730. echo ' options = {"no_sslv2", "no_sslv3" };'; } >> /etc/prosody/prosody.cfg.lua
  731. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  732. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  733. else
  734. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  735. fi
  736. { echo "}";
  737. echo '';
  738. echo 'ssl = {'; } >> /etc/prosody/prosody.cfg.lua
  739. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  740. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  741. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  742. else
  743. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  744. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  745. fi
  746. { echo " curve = $XMPP_ECC_CURVE;";
  747. echo ' depth = "2";';
  748. echo " ciphers = $XMPP_CIPHERS;";
  749. echo ' options = {"no_sslv2", "no_sslv3" };'; } >> /etc/prosody/prosody.cfg.lua
  750. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  751. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  752. else
  753. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  754. fi
  755. { echo '}';
  756. echo '';
  757. echo 'c2s_require_encryption = true';
  758. echo 's2s_require_encryption = true';
  759. echo '';
  760. echo 's2s_secure_auth = false';
  761. echo '';
  762. echo 'authentication = "internal_hashed"';
  763. echo '';
  764. echo 'storage = "sql"';
  765. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }';
  766. echo '';
  767. echo 'log = {';
  768. echo ' info = "/dev/null";';
  769. echo ' error = "/dev/null";';
  770. echo ' { levels = { "error" }; to = "/dev/null"; };';
  771. echo '}';
  772. echo ''; } >> /etc/prosody/prosody.cfg.lua
  773. if [[ "$ONION_ONLY" != 'no' ]]; then
  774. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"" >> /etc/prosody/prosody.cfg.lua
  775. else
  776. echo "VirtualHost \"${DEFAULT_DOMAIN_NAME}\"" >> /etc/prosody/prosody.cfg.lua
  777. fi
  778. echo ' ssl = {' >> /etc/prosody/prosody.cfg.lua
  779. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  780. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  781. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  782. else
  783. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  784. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  785. fi
  786. { echo " curve = $XMPP_ECC_CURVE;";
  787. echo ' depth = "2";';
  788. echo " ciphers = $XMPP_CIPHERS;";
  789. echo ' options = {"no_sslv2", "no_sslv3" };'; } >> /etc/prosody/prosody.cfg.lua
  790. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  791. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  792. else
  793. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  794. fi
  795. { echo ' }';
  796. echo '';
  797. echo 'Include "conf.d/*.cfg.lua"';
  798. echo 'http_upload_path = "/var/lib/prosody/http_uploads"';
  799. echo 'http_upload_file_size_limit = 307200';
  800. echo '';
  801. echo "Component \"chat.${DEFAULT_DOMAIN_NAME}\" \"muc\"";
  802. echo ' restrict_room_creation = true';
  803. echo ' name = "Chatrooms"';
  804. echo ' modules_enabled = {';
  805. echo ' "muc_limits";';
  806. echo ' "muc_log";';
  807. echo ' "mam_muc";';
  808. echo ' "muc_log_http";';
  809. echo ' }';
  810. echo 'storage = { muc_log = "sql"; }';
  811. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }';
  812. echo 'muc_event_rate = 0.5;';
  813. echo 'muc_burst_factor = 10;';
  814. echo 'muc_log_by_default = false;';
  815. echo 'muc_log_all_rooms = false;';
  816. echo 'max_archive_query_results = 10;';
  817. echo 'max_history_messages = 10;'; } >> /etc/prosody/prosody.cfg.lua
  818. }
  819. function install_xmpp_nightly {
  820. if [ ! -d "$INSTALL_DIR" ]; then
  821. mkdir -p "$INSTALL_DIR"
  822. fi
  823. cd "$INSTALL_DIR" || exit 2468274
  824. # Try to get the source from the project repo
  825. if [ -f "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  826. cp "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  827. else
  828. if [ -f "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  829. cp "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  830. else
  831. wget "$prosody_nightly_url"
  832. fi
  833. fi
  834. if [ ! -f "${INSTALL_DIR}/${prosody_filename}.tar.gz" ]; then
  835. echo $"Failed to download prosody nightly $prosody_nightly_url"
  836. exit 78352
  837. fi
  838. hash_value=$(sha256sum "${INSTALL_DIR}/${prosody_filename}.tar.gz" | awk -F ' ' '{print $1}')
  839. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  840. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  841. echo $'Unexpected hash value for prosody nightly download'
  842. exit 68224283
  843. fi
  844. tar -xzvf "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  845. cd "${INSTALL_DIR}/${prosody_filename}" || exit 7246284245
  846. ./configure --ostype=debian --prefix=/usr
  847. make prefix=/usr
  848. make prefix=/usr install
  849. if [ -f /usr/local/bin/prosody ]; then
  850. echo $'Failed to build prosody nightly to /usr/bin'
  851. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  852. rm -rf "${INSTALL_DIR:?}/${prosody_filename}"
  853. exit 628732
  854. fi
  855. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  856. set_completion_param "prosody_filename" "${prosody_filename}"
  857. }
  858. function install_xmpp {
  859. if [ ! -d "$INSTALL_DIR" ]; then
  860. mkdir -p "$INSTALL_DIR"
  861. fi
  862. # remove any existing install attempt
  863. if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  864. rm "$INSTALL_DIR/$prosody_modules_filename"
  865. fi
  866. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  867. rm -rf "$INSTALL_DIR/prosody-modules"
  868. fi
  869. update_prosody_modules
  870. # obtain a cert for the default domain
  871. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}" pem)" == "0" ]]; then
  872. create_site_certificate "${DEFAULT_DOMAIN_NAME}" 'yes'
  873. if [[ "$ONION_ONLY" == 'no' ]]; then
  874. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}" pem)" == "0" ]]; then
  875. echo $'LetsEncrypt cert could not be obtained for xmpp'
  876. exit 72342
  877. fi
  878. fi
  879. fi
  880. apt-get -yq install lua-sec lua-bitop lua5.1 liblua5.1-dev
  881. apt-get -yq install libidn11-dev libssl-dev lua-dbi-sqlite3
  882. apt-get -yq install mercurial
  883. apt-get -yq install prosody
  884. if [ ! -f /usr/bin/hg ]; then
  885. echo $"Couldn't install mercurial"
  886. exit 52825
  887. fi
  888. if [ ! -d /etc/prosody ]; then
  889. echo $"ERROR: prosody does not appear to have installed. $CHECK_MESSAGE"
  890. exit 52367
  891. fi
  892. groupadd prosody
  893. if [ ! -d /var/lib/prosody/http_uploads ]; then
  894. mkdir -p /var/lib/prosody/http_uploads
  895. fi
  896. if [ ! -d /etc/prosody/conf.d ]; then
  897. mkdir -p /etc/prosody/conf.d
  898. fi
  899. chmod -R 700 /etc/prosody/conf.d
  900. chown -R prosody /var/lib/prosody
  901. chown -R prosody /etc/prosody/conf.d
  902. # install modules
  903. update_prosody_modules initial
  904. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  905. echo $'No prosody modules available'
  906. exit 82634
  907. fi
  908. # create a certificate
  909. if [ ! -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  910. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  911. "${PROJECT_NAME}-addcert" -h xmpp --dhkey "${DH_KEYLENGTH}"
  912. CHECK_HOSTNAME=xmpp
  913. check_certificates xmpp
  914. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  915. echo $'Failed to create xmpp certificate'
  916. exit 72352
  917. fi
  918. if [ ! -f /etc/ssl/private/xmpp.key ]; then
  919. echo $'Failed to create xmpp private certificate'
  920. exit 36829
  921. fi
  922. chmod g=rX /etc/ssl/private/xmpp.key
  923. chmod g=rX /etc/ssl/certs/xmpp.*
  924. fi
  925. fi
  926. groupadd default
  927. chmod 600 /etc/shadow
  928. chmod 600 /etc/gshadow
  929. usermod -g default prosody
  930. chmod 0000 /etc/shadow
  931. chmod 0000 /etc/gshadow
  932. chown root:default /etc/ssl/private/xmpp.*
  933. chown root:default /etc/ssl/certs/xmpp.*
  934. chown root:default "/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.*"
  935. chown root:default "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.*"
  936. cp -a /etc/prosody/conf.avail/example.com.cfg.lua /etc/prosody/conf.avail/xmpp.cfg.lua
  937. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}" pem)" == "1" ]]; then
  938. sed -i "s|key =.*|key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  939. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  940. else
  941. sed -i "s|key =.*|key = \"/etc/ssl/private/xmpp.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  942. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/xmpp.crt\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  943. fi
  944. if ! grep -q "xmpp.dhparam" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  945. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}")" == "1" ]]; then
  946. sed -i "/certificate =/a\\ dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" /etc/prosody/conf.avail/xmpp.cfg.lua
  947. else
  948. sed -i '/certificate =/a\\ dhparam = "/etc/ssl/certs/xmpp.dhparam";' /etc/prosody/conf.avail/xmpp.cfg.lua
  949. fi
  950. fi
  951. if ! grep -q 'options = {"no_sslv2", "no_sslv3" }' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  952. sed -i '/certificate =/a\ options = {"no_sslv2", "no_sslv3" };' /etc/prosody/conf.avail/xmpp.cfg.lua
  953. fi
  954. if ! grep -q 'ciphers =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  955. sed -i "/certificate =/a\\ ciphers = $XMPP_CIPHERS;" /etc/prosody/conf.avail/xmpp.cfg.lua
  956. fi
  957. if ! grep -q 'depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  958. sed -i '/certificate =/a\ depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua
  959. fi
  960. if ! grep -q 'curve =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  961. sed -i "/certificate =/a\\ curve = $XMPP_ECC_CURVE;" /etc/prosody/conf.avail/xmpp.cfg.lua
  962. fi
  963. sed -i "s/example.com/$DEFAULT_DOMAIN_NAME/g" /etc/prosody/conf.avail/xmpp.cfg.lua
  964. sed -i 's/enabled = false -- Remove this line to enable this host//g' /etc/prosody/conf.avail/xmpp.cfg.lua
  965. if ! grep -q "modules_enabled" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  966. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  967. xmpp_modules /etc/prosody/conf.avail/xmpp.cfg.lua
  968. fi
  969. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  970. if ! grep -q "c2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  971. echo 'c2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  972. else
  973. sed -i 's|c2s_require_encryption.*|c2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  974. fi
  975. if ! grep -q "s2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  976. echo 's2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  977. else
  978. sed -i 's|s2s_require_encryption.*|s2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  979. fi
  980. if ! grep -q "allow_unencrypted_plain_auth" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  981. echo 'allow_unencrypted_plain_auth = false' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  982. else
  983. sed -i 's|allow_unencrypted_plain_auth.*|allow_unencrypted_plain_auth = false|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  984. fi
  985. ln -sf /etc/prosody/conf.avail/xmpp.cfg.lua /etc/prosody/conf.d/xmpp.cfg.lua
  986. if [ ! -d /var/lib/tor ]; then
  987. echo $'No Tor installation found. xmpp onion site cannot be configured.'
  988. exit 877367
  989. fi
  990. if ! grep -q "hidden_service_xmpp" /etc/tor/torrc; then
  991. { echo 'HiddenServiceDir /var/lib/tor/hidden_service_xmpp/';
  992. echo 'HiddenServiceVersion 2';
  993. echo "HiddenServicePort 5222 127.0.0.1:5222";
  994. echo "HiddenServicePort 5269 127.0.0.1:5269"; } >> /etc/tor/torrc
  995. echo $'Added onion site for xmpp chat'
  996. fi
  997. onion_update
  998. wait_for_onion_service 'xmpp'
  999. if [ ! -f /var/lib/tor/hidden_service_xmpp/hostname ]; then
  1000. echo $'xmpp onion site hostname not found'
  1001. exit 65349
  1002. fi
  1003. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  1004. if ! grep -q "${XMPP_ONION_HOSTNAME}" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  1005. { echo '';
  1006. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"";
  1007. echo ' modules_enabled = { "onions" };'; } >> /etc/prosody/conf.avail/xmpp.cfg.lua
  1008. fi
  1009. set_completion_param "xmpp onion domain" "${XMPP_ONION_HOSTNAME}"
  1010. if [ -f "$IMAGE_PASSWORD_FILE" ]; then
  1011. XMPP_PASSWORD="$(printf "%s" "$(cat "$IMAGE_PASSWORD_FILE")")"
  1012. else
  1013. if [ ${#XMPP_PASSWORD} -lt 8 ]; then
  1014. XMPP_PASSWORD="$(create_password "${MINIMUM_PASSWORD_LENGTH}")"
  1015. fi
  1016. fi
  1017. function_check configure_firewall_for_xmpp
  1018. configure_firewall_for_xmpp
  1019. xmpp_email_headers
  1020. update_default_domain
  1021. xmpp_create_config
  1022. # TODO comment this out after debian supports prosody 0.10 or later
  1023. install_xmpp_nightly
  1024. chown -R prosody /etc/prosody
  1025. chown -R prosody /var/lib/prosody
  1026. chown -R prosody /usr/lib/prosody
  1027. chmod -R 700 /etc/prosody/conf.d
  1028. usermod -a -G www-data prosody
  1029. # Avoid STIG failures
  1030. if [ -f /usr/lib/ssl/private/xmpp.key ]; then
  1031. chown root:root /usr/lib/ssl/private/xmpp.key
  1032. fi
  1033. if [ -f /usr/lib/ssl/certs/xmpp.crt ]; then
  1034. chown root:root /usr/lib/ssl/certs/xmpp.crt
  1035. fi
  1036. if [ -f /usr/lib/ssl/certs/xmpp.dhparam ]; then
  1037. chown root:root /usr/lib/ssl/certs/xmpp.dhparam
  1038. fi
  1039. if [ -d /etc/letsencrypt ]; then
  1040. usermod -a -G ssl-cert prosody
  1041. fi
  1042. if [ -f /etc/ssl/certs/xmpp.dhparam ]; then
  1043. cp /etc/ssl/certs/xmpp.dhparam /etc/prosody/xmpp.dhparam
  1044. chown prosody:prosody /etc/prosody/xmpp.dhparam
  1045. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/prosody.cfg.lua
  1046. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  1047. fi
  1048. apt-mark -q hold prosody
  1049. systemctl restart prosody
  1050. if [[ $ONION_ONLY != 'no' ]]; then
  1051. prosodyctl register "$MY_USERNAME" "$XMPP_ONION_HOSTNAME" "$XMPP_PASSWORD"
  1052. else
  1053. prosodyctl register "$MY_USERNAME" "$DEFAULT_DOMAIN_NAME" "$XMPP_PASSWORD"
  1054. fi
  1055. # shellcheck disable=SC2181
  1056. if [ ! "$?" = "0" ]; then
  1057. echo ''
  1058. echo ''
  1059. systemctl status prosody -l
  1060. echo ''
  1061. echo ''
  1062. which prosody
  1063. which prosodyctl
  1064. echo ''
  1065. echo ''
  1066. cat /etc/prosody/prosody.cfg.lua
  1067. echo ''
  1068. echo ''
  1069. cat /etc/prosody/conf.avail/xmpp.cfg.lua
  1070. echo ''
  1071. echo ''
  1072. #remove_xmpp
  1073. echo $'Unable to register prosody user'
  1074. exit 347682
  1075. fi
  1076. prosody_daemon_restart_script
  1077. "${PROJECT_NAME}-pass" -u "$MY_USERNAME" -a xmpp -p "$XMPP_PASSWORD"
  1078. # Add avahi services
  1079. { echo '<?xml version="1.0" standalone="no"?><!--*-nxml-*-->';
  1080. echo '<!DOCTYPE service-group SYSTEM "avahi-service.dtd">';
  1081. echo '<service-group>';
  1082. echo ' <name replace-wildcards="yes">%h XMPP</name>';
  1083. echo ' <service>';
  1084. echo ' <type>_xmpp._tcp</type>';
  1085. echo " <port>5222</port>";
  1086. echo ' </service>';
  1087. echo ' <service>';
  1088. echo ' <type>_xmpp-server._tcp</type>';
  1089. echo " <port>5269</port>";
  1090. echo ' </service>';
  1091. echo '</service-group>'; } > /etc/avahi/services/xmpp.service
  1092. systemctl restart avahi-daemon
  1093. APP_INSTALLED=1
  1094. }
  1095. # NOTE: deliberately no exit 0