freedombone-app-xmpp 46KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206
  1. #!/bin/bash
  2. # _____ _ _
  3. # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
  4. # | __| _| -_| -_| . | . | | . | . | | -_|
  5. # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
  6. #
  7. # Freedom in the Cloud
  8. #
  9. # XMPP functions
  10. #
  11. # The two directories for prosody modules seem necessary.
  12. # Trying to remove /usr/lib/prosody/modules causes problems, and that's
  13. # part of the package install.
  14. #
  15. # License
  16. # =======
  17. #
  18. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  19. #
  20. # This program is free software: you can redistribute it and/or modify
  21. # it under the terms of the GNU Affero General Public License as published by
  22. # the Free Software Foundation, either version 3 of the License, or
  23. # (at your option) any later version.
  24. #
  25. # This program is distributed in the hope that it will be useful,
  26. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  27. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  28. # GNU Affero General Public License for more details.
  29. #
  30. # You should have received a copy of the GNU Affero General Public License
  31. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  32. VARIANTS='full full-vim chat'
  33. IN_DEFAULT_INSTALL=0
  34. SHOW_ON_ABOUT=1
  35. # Directory where XMPP settings are stored
  36. XMPP_DIRECTORY="/var/lib/prosody"
  37. XMPP_PASSWORD=
  38. XMPP_CIPHERS='"EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"'
  39. XMPP_ECC_CURVE='"secp384r1"'
  40. prosody_latest_version='0.10'
  41. prosody_nightly=468
  42. prosody_nightly_hash='c72aaab1182a86090188284f443d2f819889ca242d4e955258ef60f4c7c9a1ba'
  43. prosody_filename=prosody-${prosody_latest_version}-1nightly${prosody_nightly}
  44. prosody_nightly_url="https://prosody.im/nightly/${prosody_latest_version}/latest/${prosody_filename}.tar.gz"
  45. # From https://hg.prosody.im/prosody-modules
  46. prosody_modules_filename='prosody-modules-20180322.tar.gz'
  47. prosody_modules_hash='982d0dfcef98e9cb9cee4cc3801b8ce9a503a32e44c32b99df6fe94545b90072'
  48. xmpp_variables=(ONION_ONLY
  49. INSTALLED_WITHIN_DOCKER
  50. XMPP_CIPHERS
  51. XMPP_ECC_CURVE
  52. XMPP_ECC_CURVE
  53. MY_USERNAME
  54. MY_EMAIL_ADDRESS
  55. DEFAULT_DOMAIN_NAME
  56. XMPP_DOMAIN_CODE)
  57. function logging_on_xmpp {
  58. if [ -d /etc/prosody ]; then
  59. if [ ! -d /var/log/prosody ]; then
  60. mkdir /var/log/prosody
  61. chown root:adm /var/log/prosody
  62. fi
  63. if ! grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  64. sed -i 's|info = "/dev/null";|info = "/var/log/prosody/prosody.log";|g' /etc/prosody/prosody.cfg.lua
  65. sed -i 's|error = "/dev/null";|error = "/var/log/prosody/prosody.err";|g' /etc/prosody/prosody.cfg.lua
  66. sed -i 's|levels = { "error" }; to = "/dev/null";|levels = { "error" }; to = "syslog";|g' /etc/prosody/prosody.cfg.lua
  67. fi
  68. fi
  69. }
  70. function logging_off_xmpp {
  71. if [ -d /etc/prosody ]; then
  72. if grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  73. sed -i 's|info = "/var/log/prosody/prosody.log";|info = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  74. sed -i 's|error = "/var/log/prosody/prosody.err";|error = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  75. sed -i 's|levels = { "error" }; to = "syslog";|levels = { "error" }; to = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  76. $REMOVE_FILES_COMMAND /var/log/prosody/*
  77. rm -rf /var/log/prosody
  78. fi
  79. fi
  80. }
  81. function xmpp_add_onion_address {
  82. domain_name="$1"
  83. onion_address="$2"
  84. if [ ${#domain_name} -eq 0 ]; then
  85. return
  86. fi
  87. if [ ${#onion_address} -eq 0 ]; then
  88. return
  89. fi
  90. if ! grep "${onion_address}" /etc/prosody/prosody.cfg.lua; then
  91. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  92. sed -i "s|[\"${domain_name}\"].*|[\"${domain_name}\"] = \"${onion_address}\";|g" /etc/prosody/prosody.cfg.lua
  93. else
  94. sed -i "/onions_map = {/a [\"${domain_name}\"] = \"${onion_address}\";" /etc/prosody/prosody.cfg.lua
  95. fi
  96. systemctl restart prosody
  97. fi
  98. }
  99. function xmpp_add_onion_address_interactive {
  100. data=$(mktemp 2>/dev/null)
  101. dialog --backtitle $"Freedombone Control Panel" \
  102. --title $"Add an ICANN to Onion domain mapping" \
  103. --form $"Sepecify an ICANN domain name and its equivalent onion address\\n" 9 50 2 \
  104. $"Domain:" 1 1 "" 1 18 26 25 \
  105. $"Onion address:" 2 1 "" 2 18 26 25 \
  106. 2> "$data"
  107. sel=$?
  108. case $sel in
  109. 1) rm -f "$data"
  110. return;;
  111. 255) rm -f "$data"
  112. return;;
  113. esac
  114. domain_name=$(sed -n 1p < "$data")
  115. onion_address=$(sed -n 2p < "$data")
  116. rm -f "$data"
  117. if [[ "$onion_address" != *".onion" ]]; then
  118. return
  119. fi
  120. if [[ "$domain_name" != *"."* ]]; then
  121. return
  122. fi
  123. xmpp_add_onion_address "$domain_name" "$onion_address"
  124. dialog --title $"Add an ICANN to Onion domain mapping" \
  125. --msgbox $"${domain_name} -> ${onion_address} added" 6 70
  126. }
  127. function xmpp_remove_onion_address {
  128. domain_name="$1"
  129. if [ ${#domain_name} -eq 0 ]; then
  130. return
  131. fi
  132. xmpp_changed=
  133. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  134. sed -i "/[\"${domain_name}\"]/d" /etc/prosody/prosody.cfg.lua
  135. xmpp_changed=1
  136. fi
  137. if grep -q "= \"${domain_name}\";" /etc/prosody/prosody.cfg.lua; then
  138. sed -i "/= \"${domain_name}\";/d" /etc/prosody/prosody.cfg.lua
  139. xmpp_changed=1
  140. fi
  141. if [ $xmpp_changed ]; then
  142. systemctl restart prosody
  143. fi
  144. }
  145. function xmpp_remove_onion_address_interactive {
  146. data=$(mktemp 2>/dev/null)
  147. dialog --title $"Remove ICANN to Onion domain mapping" \
  148. --backtitle $"Freedombone Control Panel" \
  149. --inputbox $'Enter the domain name or onion address to be removed' 8 60 2>"$data"
  150. sel=$?
  151. case $sel in
  152. 0) domain_name=$(<"$data")
  153. if [[ "$domain_name" != *"."* ]]; then
  154. rm -f "$data"
  155. return
  156. fi
  157. xmpp_remove_onion_address "$domain_name"
  158. dialog --title $"Remove an ICANN to Onion domain mapping" \
  159. --msgbox $"${domain_name} removed" 6 70
  160. ;;
  161. esac
  162. rm -f "$data"
  163. }
  164. function configure_interactive_xmpp {
  165. W=(1 $"Add an ICANN to onion domain mapping"
  166. 2 $"Remove an ICANN to onion domain mapping")
  167. while true
  168. do
  169. # shellcheck disable=SC2068
  170. selection=$(dialog --backtitle $"Freedombone Administrator Control Panel" --title $"XMPP" --menu $"Choose an operation, or ESC to exit:" 10 60 2 "${W[@]}" 3>&2 2>&1 1>&3)
  171. if [ ! "$selection" ]; then
  172. break
  173. fi
  174. case $selection in
  175. 1) xmpp_add_onion_address_interactive;;
  176. 2) xmpp_remove_onion_address_interactive;;
  177. esac
  178. done
  179. }
  180. function remove_user_xmpp {
  181. remove_username="$1"
  182. "${PROJECT_NAME}-pass" -u "$remove_username" --rmapp xmpp
  183. if [[ "$ONION_ONLY" != "no" ]]; then
  184. DOMAIN=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  185. else
  186. DOMAIN=${HOSTNAME}
  187. fi
  188. prosodyctl deluser "${remove_username}@${DOMAIN}"
  189. }
  190. function add_user_xmpp_client {
  191. new_username="$1"
  192. new_user_password="$2"
  193. if [ -f /usr/local/bin/profanity ]; then
  194. XMPP_CLIENT_DIR=/home/$new_username/.local/share/profanity
  195. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  196. if [ ! -d "$XMPP_CLIENT_DIR" ]; then
  197. mkdir -p "$XMPP_CLIENT_DIR"
  198. fi
  199. if [ ! -d "/home/$new_username/.config/profanity" ]; then
  200. mkdir -p "/home/$new_username/.config/profanity"
  201. fi
  202. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$new_username" "$new_username@$HOSTNAME")
  203. { echo "[${new_username}@${HOSTNAME}]";
  204. echo 'enabled=true';
  205. echo "jid=${new_username}@${HOSTNAME}";
  206. echo "server=$XMPP_ONION_HOSTNAME";
  207. echo "pgp.keyid=$MY_GPG_PUBLIC_KEY_ID";
  208. echo 'resource=profanity';
  209. echo "muc.service=conference.${HOSTNAME}";
  210. echo "muc.nick=${new_username}";
  211. echo 'presence.last=online';
  212. echo 'presence.login=online';
  213. echo 'priority.online=0';
  214. echo 'priority.chat=0';
  215. echo 'priority.away=0';
  216. echo 'priority.xa=0';
  217. echo 'priority.dnd=0'; } > "$XMPP_CLIENT_ACCOUNTS"
  218. echo '[connection]' > "/home/$new_username/.config/profanity/profrc"
  219. if [[ $ONION_ONLY != "no" ]]; then
  220. echo "account=${new_username}@${XMPP_ONION_HOSTNAME}" >> "/home/$new_username/.config/profanity/profrc"
  221. else
  222. echo "account=${new_username}@${HOSTNAME}" >> "/home/$new_username/.config/profanity/profrc"
  223. fi
  224. { echo '';
  225. echo '[plugins]';
  226. echo 'load=prof_omemo_plugin.py;';
  227. echo '';
  228. echo '[otr]';
  229. echo 'policy=opportunistic';
  230. echo 'log=off';
  231. echo '';
  232. echo '[pgp]';
  233. echo 'log=off';
  234. echo '';
  235. echo '[ui]';
  236. echo 'enc.warn=true'; } >> "/home/$new_username/.config/profanity/profrc"
  237. chown -R "$new_username":"$new_username" "/home/$new_username/.local"
  238. chown -R "$new_username":"$new_username" "/home/$new_username/.config"
  239. fi
  240. }
  241. function add_user_xmpp {
  242. new_username="$1"
  243. new_user_password="$2"
  244. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  245. "${PROJECT_NAME}-pass" -u "$new_username" -a xmpp -p "$new_user_password"
  246. if [[ "$ONION_ONLY" != "no" ]]; then
  247. DOMAIN_NAME=$XMPP_ONION_HOSTNAME
  248. else
  249. DOMAIN_NAME=$HOSTNAME
  250. fi
  251. EMAIL_ADDRESS="$new_username@$DOMAIN_NAME"
  252. if [ ${#new_user_password} -eq 0 ]; then
  253. prosodyctl adduser "$EMAIL_ADDRESS"
  254. else
  255. if ! prosodyctl register "$new_username" "$DOMAIN_NAME" "$new_user_password"; then
  256. exit 653456375
  257. fi
  258. fi
  259. # add the xmpp address to email headers
  260. if [ -f "/home/$new_username/.muttrc" ]; then
  261. if ! grep -q "Jabber-ID" "/home/$new_username/.muttrc"; then
  262. echo "my_hdr Jabber-ID: $EMAIL_ADDRESS" >> "/home/$new_username/.muttrc"
  263. else
  264. sed -i "s|my_hdr Jabber-ID.*|my_hdr Jabber-ID: $EMAIL_ADDRESS|g" "/home/$new_username/.muttrc"
  265. fi
  266. fi
  267. add_user_xmpp_client "$new_username" "$new_user_password"
  268. echo '0'
  269. }
  270. function install_interactive_xmpp {
  271. echo -n ''
  272. APP_INSTALLED=1
  273. }
  274. function change_password_xmpp {
  275. curr_username="$1"
  276. new_user_password="$2"
  277. read_config_param DEFAULT_DOMAIN_NAME
  278. "${PROJECT_NAME}-pass" -u "$curr_username" -a xmpp -p "$new_user_password"
  279. # TODO: this is currently interactive. Really there needs to be a
  280. # non-interactive password change option for prosodyctl
  281. clear
  282. echo ''
  283. echo $'Currently Prosody requires password changes to be done interactively'
  284. prosodyctl passwd "${curr_username}@${DEFAULT_DOMAIN_NAME}"
  285. if [ -f /usr/local/bin/profanity ]; then
  286. XMPP_CLIENT_DIR=/home/$curr_username/.local/share/profanity
  287. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  288. if [ -f "$XMPP_CLIENT_ACCOUNTS" ]; then
  289. sed -i "s|password=.*|password=$new_user_password|g" "$XMPP_CLIENT_ACCOUNTS"
  290. fi
  291. fi
  292. }
  293. function reconfigure_xmpp {
  294. echo -n ''
  295. }
  296. function update_prosody_modules {
  297. if [ ! "$1" ]; then
  298. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  299. return
  300. fi
  301. fi
  302. if [ ! -d /usr/lib/prosody ]; then
  303. return
  304. fi
  305. if [ ! -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  306. # Obtain the modules
  307. if [ -f ~/freedombone/image_build/$prosody_modules_filename ]; then
  308. cp ~/freedombone/image_build/$prosody_modules_filename "$INSTALL_DIR"
  309. else
  310. if [ -f "/home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename" ]; then
  311. cp "/home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename" "$INSTALL_DIR"
  312. fi
  313. fi
  314. if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  315. cd "$INSTALL_DIR" || exit 246824684
  316. # Check the hash
  317. curr_hash=$(sha256sum "$INSTALL_DIR/$prosody_modules_filename" | awk -F ' ' '{print $1}')
  318. if [[ "$curr_hash" != "$prosody_modules_hash" ]]; then
  319. echo $'Prosody modules hash does not match'
  320. exit 83562
  321. else
  322. # Extract the modules
  323. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  324. rm -rf "$INSTALL_DIR/prosody-modules"
  325. fi
  326. tar -xzvf $prosody_modules_filename
  327. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  328. systemctl stop prosody
  329. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  330. mkdir -p /var/lib/prosody/prosody-modules
  331. fi
  332. cp -r "$INSTALL_DIR/prosody-modules/"* /var/lib/prosody/prosody-modules/
  333. cp -r "$INSTALL_DIR/prosody-modules/"* /usr/lib/prosody/modules/
  334. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  335. chown -R prosody:prosody /usr/lib/prosody/modules
  336. systemctl start prosody
  337. else
  338. echo $'Prosody modules not extracted'
  339. exit 72524
  340. fi
  341. fi
  342. fi
  343. fi
  344. if ! grep -q '"vcard"' /etc/prosody/prosody.cfg.lua; then
  345. systemctl stop prosody
  346. sed -i '/"pep"/a "vcard";' /etc/prosody/prosody.cfg.lua
  347. systemctl start prosody
  348. fi
  349. if ! grep -q "omemo_all_access" /etc/prosody/prosody.cfg.lua; then
  350. sed -i '/"pep";/a "omemo_all_access"; -- Fix for PEP with OMEMO' /etc/prosody/prosody.cfg.lua
  351. sed -i 's|"omemo_all_access";| "omemo_all_access";|g' /etc/prosody/prosody.cfg.lua
  352. fi
  353. if ! grep -q "omemo_all_access" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  354. sed -i '/"pep";/a "omemo_all_access"; -- Fix for PEP with OMEMO' /etc/prosody/conf.avail/xmpp.cfg.lua
  355. sed -i 's|"omemo_all_access";| "omemo_all_access";|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  356. fi
  357. }
  358. function prosody_daemon_restart_script {
  359. # On rare occasions the daemon appears to get stuck
  360. # i.e. still active, but not accepting connections
  361. # This ensures that it will unstick itself at least once per day
  362. if [ -f /etc/cron.daily/prosody ]; then
  363. rm /etc/cron.daily/prosody
  364. fi
  365. if [ ! -f /etc/cron.hourly/prosody ]; then
  366. { echo '#!/bin/bash';
  367. echo "is_active=\$(systemctl is-active prosody)";
  368. echo "if [[ \"\$is_active\" != 'active' ]]; then";
  369. echo ' systemctl restart prosody'
  370. echo 'fi'; } > /etc/cron.hourly/prosody
  371. chmod +x /etc/cron.hourly/prosody
  372. fi
  373. }
  374. function upgrade_xmpp {
  375. if [ -d /etc/letsencrypt ]; then
  376. prosody_groups=$(groups prosody)
  377. if [[ "$prosody_groups" != *'ssl-cert'* ]]; then
  378. usermod -a -G ssl-cert prosody
  379. fi
  380. fi
  381. prosody_daemon_restart_script
  382. function_check update_prosody_modules
  383. update_prosody_modules
  384. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  385. xmpp_contact_info /etc/prosody/prosody.cfg.lua
  386. if grep -q "/etc/ssl/certs/xmpp.dhparam" /etc/prosody/prosody.cfg.lua; then
  387. cp /etc/ssl/certs/xmpp.dhparam /etc/prosody/xmpp.dhparam
  388. chown prosody:prosody /etc/prosody/xmpp.dhparam
  389. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/prosody.cfg.lua
  390. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  391. fi
  392. if grep -q "/etc/ssl/private/xmpp.key" /etc/prosody/prosody.cfg.lua; then
  393. if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem" ]; then
  394. sed -i "s|/etc/ssl/private/xmpp.key|/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/prosody/prosody.cfg.lua
  395. fi
  396. fi
  397. if grep -q "/etc/ssl/certs/xmpp.crt" /etc/prosody/prosody.cfg.lua; then
  398. if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem" ]; then
  399. sed -i "s|/etc/ssl/certs/xmpp.crt|/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/prosody/prosody.cfg.lua
  400. fi
  401. fi
  402. curr_prosody_filename=$(grep "prosody_filename" "$COMPLETION_FILE" | awk -F ':' '{print $2}')
  403. if [[ "$curr_prosody_filename" != "$prosody_filename" ]]; then
  404. if [ -d "${INSTALL_DIR}/${prosody_filename}" ]; then
  405. # ensure that the binaries have not been overwritten
  406. # by an operating system upgrade
  407. cd "${INSTALL_DIR}/${prosody_filename}" || exit 462846284
  408. make prefix=/usr install
  409. else
  410. cd "$INSTALL_DIR" || exit 23681468
  411. # Try to get the source from the project repo
  412. if [ -f "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  413. cp "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  414. else
  415. if [ -f "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  416. cp "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  417. else
  418. wget $prosody_nightly_url
  419. fi
  420. fi
  421. if [ ! -f "${INSTALL_DIR}/${prosody_filename}.tar.gz" ]; then
  422. echo $"Failed to download prosody nightly $prosody_nightly_url"
  423. return
  424. fi
  425. hash_value=$(sha256sum "${INSTALL_DIR}/${prosody_filename}.tar.gz" | awk -F ' ' '{print $1}')
  426. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  427. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  428. echo $'Unexpected hash value for prosody nightly download'
  429. return
  430. fi
  431. tar -xzvf "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  432. cd "${INSTALL_DIR}/${prosody_filename}" || exit 246872468246
  433. ./configure --ostype=debian --prefix=/usr
  434. make prefix=/usr
  435. make prefix=/usr install
  436. if [ -f /usr/local/bin/prosody ]; then
  437. echo $'Failed to build prosody nightly to /usr/bin'
  438. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  439. rm -rf "${INSTALL_DIR:?}/${prosody_filename}"
  440. return
  441. fi
  442. rm "${INSTALL_DIR:?}/${prosody_filename}.tar.gz"
  443. fi
  444. # add onion addresses for known servers
  445. if ! grep -q "onions_map =" /etc/prosody/prosody.cfg.lua; then
  446. echo '' >> /etc/prosody/prosody.cfg.lua
  447. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  448. fi
  449. set_completion_param "prosody_filename" "${prosody_filename}"
  450. fi
  451. cp -r "$INSTALL_DIR/prosody-modules/"* /var/lib/prosody/prosody-modules/
  452. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  453. systemctl restart prosody
  454. }
  455. function backup_local_xmpp {
  456. source_directory=/var/lib/prosody
  457. if [ -d $source_directory ]; then
  458. dest_directory=xmpp
  459. function_check backup_directory_to_usb
  460. backup_directory_to_usb $source_directory $dest_directory
  461. fi
  462. }
  463. function restore_local_xmpp {
  464. if [ -d /var/lib/prosody ]; then
  465. echo $"Restoring xmpp settings"
  466. temp_restore_dir=/root/tempxmpp
  467. function_check restore_directory_from_usb
  468. restore_directory_from_usb $temp_restore_dir xmpp
  469. if [ -d $temp_restore_dir/var/lib/prosody ]; then
  470. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  471. else
  472. cp -r $temp_restore_dir/* /var/lib/prosody/
  473. fi
  474. # shellcheck disable=SC2181
  475. if [ ! "$?" = "0" ]; then
  476. function_check set_user_permissions
  477. set_user_permissions
  478. function_check backup_unmount_drive
  479. backup_unmount_drive
  480. exit 725
  481. fi
  482. rm -rf $temp_restore_dir
  483. systemctl restart prosody
  484. chown -R prosody:prosody /var/lib/prosody/*
  485. echo $"Restore of xmpp settings complete"
  486. fi
  487. }
  488. function backup_remote_xmpp {
  489. if [ -d /var/lib/prosody ]; then
  490. echo $"Backing up the xmpp settings"
  491. backup_directory_to_friend /var/lib/prosody xmpp
  492. echo $"Backup of xmpp settings complete"
  493. fi
  494. }
  495. function restore_remote_xmpp {
  496. if [ -d /var/lib/prosody ]; then
  497. echo $"Restoring xmpp settings"
  498. temp_restore_dir=/root/tempxmpp
  499. function_check restore_directory_from_friend
  500. restore_directory_from_friend $temp_restore_dir xmpp
  501. if [ -d $temp_restore_dir/var/lib/prosody ]; then
  502. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  503. else
  504. cp -r $temp_restore_dir/* /var/lib/prosody/
  505. fi
  506. # shellcheck disable=SC2181
  507. if [ ! "$?" = "0" ]; then
  508. exit 725
  509. fi
  510. rm -rf $temp_restore_dir
  511. systemctl restart prosody
  512. chown -R prosody:prosody /var/lib/prosody/*
  513. echo $"Restore of xmpp settings complete"
  514. fi
  515. }
  516. function configure_firewall_for_xmpp {
  517. if [ ! -d /etc/prosody ]; then
  518. return
  519. fi
  520. if [[ $(is_completed "${FUNCNAME[0]}") == "1" ]]; then
  521. return
  522. fi
  523. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  524. # docker does its own firewalling
  525. return
  526. fi
  527. if [[ $ONION_ONLY != "no" ]]; then
  528. return
  529. fi
  530. firewall_add XMPP 5222 tcp
  531. firewall_add XMPP 5223 tcp
  532. firewall_add XMPP 5269 tcp
  533. firewall_add XMPP 5280 tcp
  534. firewall_add XMPP 5281 tcp
  535. mark_completed "${FUNCNAME[0]}"
  536. }
  537. function remove_xmpp {
  538. remove_profanity
  539. remove_movim
  540. firewall_remove 5222 tcp
  541. firewall_remove 5223 tcp
  542. firewall_remove 5269 tcp
  543. firewall_remove 5280 tcp
  544. firewall_remove 5281 tcp
  545. function_check remove_onion_service
  546. remove_onion_service xmpp 5222 5223 5269
  547. sed -i '/HiddenServiceVersion 2/d' $ONION_SERVICES_FILE
  548. apt-mark -q unhold prosody
  549. apt-get -yq remove --purge prosody
  550. rm /etc/cron.daily/prosody
  551. if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  552. rm "$INSTALL_DIR/$prosody_modules_filename"
  553. fi
  554. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  555. rm -rf "$INSTALL_DIR/prosody-modules"
  556. fi
  557. if [ -d /etc/prosody ]; then
  558. rm -rf /etc/prosody
  559. fi
  560. if [ -d /var/lib/prosody ]; then
  561. rm -rf /var/lib/prosody
  562. fi
  563. if [ -d /usr/lib/prosody ]; then
  564. rm -rf /usr/lib/prosody
  565. fi
  566. if [ -f /usr/local/bin/prosody ]; then
  567. rm /usr/local/bin/prosody
  568. fi
  569. if [ -f /usr/local/bin/prosodyctl ]; then
  570. rm /usr/local/bin/prosodyctl
  571. fi
  572. groupdel prosody
  573. remove_completion_param install_xmpp
  574. sed -i '/xmpp/d' "$COMPLETION_FILE"
  575. sed -i '/prosody/d' "$COMPLETION_FILE"
  576. rm /etc/avahi/services/xmpp.service
  577. rm /etc/avahi/services/xmpp-server.service
  578. systemctl restart avahi-daemon
  579. }
  580. function xmpp_email_headers {
  581. for d in /home/*/ ; do
  582. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  583. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  584. if [ -f "/home/$USERNAME/.muttrc" ]; then
  585. if ! grep -q "Jabber-ID" "/home/$USERNAME/.muttrc"; then
  586. echo "my_hdr Jabber-ID: ${USERNAME}@${HOSTNAME}" >> "/home/$USERNAME/.muttrc"
  587. fi
  588. fi
  589. fi
  590. done
  591. }
  592. function xmpp_contact_info {
  593. filename="$1"
  594. if grep -q "contact_info =" "$filename"; then
  595. return
  596. fi
  597. { echo 'contact_info = {';
  598. echo "abuse = { \"mailto:${MY_EMAIL_ADDRESS}\", \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  599. echo "admin = { \"mailto:${MY_EMAIL_ADDRESS}\", \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  600. echo "feedback = { \"mailto:${MY_EMAIL_ADDRESS}\", \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  601. echo "security = { \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  602. echo "support = { \"xmpp:${MY_USERNAME}@${HOSTNAME}\" };";
  603. echo '};'; } >> "$filename"
  604. }
  605. function xmpp_modules {
  606. filename="$1"
  607. { echo 'modules_enabled = {';
  608. echo ' "server_contact_info";';
  609. echo ' "pubsub";';
  610. echo ' "pubsub_hub";';
  611. echo ' "dialback"; -- s2s dialback support';
  612. echo ' "disco"; -- Service discovery';
  613. echo ' "private"; -- Private XML storage (for room bookmarks, etc.)';
  614. echo ' "version"; -- Replies to server version requests';
  615. echo ' "uptime"; -- Report how long server has been running';
  616. echo ' "time"; -- Let others know the time here on this server';
  617. echo ' "ping"; -- Replies to XMPP pings with pongs';
  618. echo ' "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands';
  619. echo ' "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.';
  620. echo ' "bosh"; -- Enable mod_bosh';
  621. echo ' "tls"; -- Enable mod_tls';
  622. echo ' "saslauth"; -- Enable mod_saslauth';
  623. echo ' "onions"; -- Enable chat via onion service';
  624. echo ' "mam"; -- Message archive management';
  625. echo ' "csi"; -- Client state indication';
  626. echo ' "carbons"; -- Message carbons';
  627. echo ' "carbons_adhoc"; -- Message carbons';
  628. echo ' "carbons_copies"; -- Message carbons';
  629. echo ' "smacks"; -- Stream management';
  630. echo ' "smacks_offline"; -- Stream management';
  631. echo ' "pep"; -- Personal Eventing Protocol (to support OMEMO)';
  632. echo ' "omemo_all_access"; -- Fix for PEP with OMEMO';
  633. echo ' "vcard"; -- Personal Eventing Protocol (to support OMEMO)';
  634. echo ' "e2e_policy"; -- To support OMEMO';
  635. echo ' "pep_vcard_avatar"; -- Personal Eventing Protocol (to support OMEMO)';
  636. echo ' "blocklist"; -- Privacy lists';
  637. echo ' "privacy_lists"; -- Privacy lists';
  638. echo ' "blocking"; -- Blocking command';
  639. echo ' "roster"; -- Roster versioning';
  640. echo ' "offline_email"; -- If offline send to email';
  641. echo ' "offline"; -- Store offline messages';
  642. echo ' "http";';
  643. echo ' "http_upload";';
  644. echo ' "websocket";';
  645. echo ' "throttle_presence"; -- Reduce battery and bandwidth usage';
  646. echo ' "filter_chatstates"; -- Reduce battery and bandwidth usage';
  647. echo '};'; } >> "$filename"
  648. }
  649. function xmpp_onion_addresses {
  650. filename="$1"
  651. sed -i '/onions_map = {/,/};/d' "$filename"
  652. { echo 'onions_map = {';
  653. echo ' ["anonymitaet-im-inter.net"] = "rwf5skuv5vqzcdit.onion";';
  654. echo ' ["autistici.org"] = "wi7qkxyrdpu5cmvr.onion";';
  655. echo ' ["jabber.calyxinstitute.org"] = "ijeeynrc6x2uy5ob.onion";';
  656. echo ' ["jabber.ccc.de"] = "okj7xc6j2szr2y75.onion";';
  657. echo ' ["cloak.dk"] = "m2dsl4banuimpm6c.onion";';
  658. echo ' ["jabber.cryptoparty.is"] = "cryjabkbdljzohnp.onion";';
  659. echo ' ["daemons.cf"] = "daemon4jidu2oig6.onion";';
  660. echo ' ["dukgo.com"] = "wlcpmruglhxp6quz.onion";';
  661. echo ' ["evil.im"] = "evilxro6nvjuvxqo.onion";';
  662. echo ' ["xmpp.evil.im"] = "evilxro6nvjuvxqo.onion";';
  663. echo ' ["inventati.org"] = "wi7qkxyrdpu5cmvr.onion";';
  664. echo ' ["jabber.ipredator.se"] = "3iffdebkzzkpgipa.onion";';
  665. echo ' ["jabber-germany.de"] = "dbbrphko5tqcpar3.onion";';
  666. echo ' ["kode.im"] = "ihkw7qy3tok45dun.onion";';
  667. echo ' ["im.koderoot.net"] = "ihkw7qy3tok45dun.onion";';
  668. echo ' ["adb-centralen.se"] = "qai7jjjnhbrdiexf.onion";';
  669. echo ' ["joelpurra.se"] = "37x6i3wgr2jyublb.onion";';
  670. echo ' ["nordberg.se"] = "qai7jjjnhbrdiexf.onion";';
  671. echo ' ["jabber.lqdn.fr"] = "jabber63t4r2qi57.onion";';
  672. echo ' ["jabber.otr.im"] = "5rgdtlawqkcplz75.onion";';
  673. echo ' ["otromundo.cf"] = "arauemwe2utqqzye.onion";';
  674. echo ' ["patchcord.be"] = "xsydhi3dnbjuatpz.onion";';
  675. echo ' ["riseup.net"] = "4cjw6cwpeaeppfqz.onion";';
  676. echo ' ["xmpp.riseup.net"] = "4cjw6cwpeaeppfqz.onion";';
  677. echo ' ["rows.io"] = "yz6yiv2hxyagvwy6.onion";';
  678. echo ' ["xmpp.rows.io"] = "yz6yiv2hxyagvwy6.onion";';
  679. echo ' ["securejabber.me"] = "giyvshdnojeivkom.onion";';
  680. echo ' ["so36.net"] = "s4fgy24e2b5weqdb.onion";';
  681. echo ' ["jabber.so36.net"] = "s4fgy24e2b5weqdb.onion";';
  682. echo ' ["jabber.systemli.org"] = "x5tno6mwkncu5m3h.onion";';
  683. echo ' ["taolo.ga"] = "l3ybpw4vs6ie5rv2.onion";';
  684. echo ' ["tchncs.de"] = "duvfmyqmdlyvc3mi.onion";';
  685. echo ' ["wtfismyip.com"] = "ofkztxcohimx34la.onion";';
  686. echo ' ["prosody.xmpp.is"] = "y2qmqomqpszzryei.onion";';
  687. echo ' ["xndr.de"] = "trcubpttd6zkc3tf.onion";';
  688. echo ' ["jabber.cat"] = "sybzodlxacch7st7.onion";';
  689. echo ' ["trashserver.net"] = "m4c722bvc2r7brnn.onion";';
  690. echo '};'; } >> "$filename"
  691. }
  692. function xmpp_create_config {
  693. echo "admins = { \"$MY_USERNAME@$DEFAULT_DOMAIN_NAME\" }" > /etc/prosody/prosody.cfg.lua
  694. echo 'plugin_paths = { "/var/lib/prosody/prosody-modules" }' >> /etc/prosody/prosody.cfg.lua
  695. echo '' >> /etc/prosody/prosody.cfg.lua
  696. xmpp_modules /etc/prosody/prosody.cfg.lua
  697. echo '' >> /etc/prosody/prosody.cfg.lua
  698. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  699. xmpp_contact_info /etc/prosody/prosody.cfg.lua
  700. { echo '';
  701. echo 'allow_registration = false;';
  702. echo '';
  703. echo 'daemonize = true;';
  704. echo '';
  705. echo 'pidfile = "/var/run/prosody/prosody.pid";';
  706. echo '';
  707. echo 'https_ports = { 5281 }';
  708. echo 'https_interfaces = { "*" }';
  709. echo 'https_ssl = {'; } >> /etc/prosody/prosody.cfg.lua
  710. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  711. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  712. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  713. else
  714. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  715. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  716. fi
  717. { echo " curve = $XMPP_ECC_CURVE;";
  718. echo " ciphers = $XMPP_CIPHERS;";
  719. echo ' options = {"no_sslv2", "no_sslv3" };'; } >> /etc/prosody/prosody.cfg.lua
  720. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  721. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  722. else
  723. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  724. fi
  725. { echo "}";
  726. echo '';
  727. echo 'ssl = {'; } >> /etc/prosody/prosody.cfg.lua
  728. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  729. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  730. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  731. else
  732. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  733. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  734. fi
  735. { echo " curve = $XMPP_ECC_CURVE;";
  736. echo ' depth = "2";';
  737. echo " ciphers = $XMPP_CIPHERS;";
  738. echo ' options = {"no_sslv2", "no_sslv3" };'; } >> /etc/prosody/prosody.cfg.lua
  739. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  740. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  741. else
  742. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  743. fi
  744. { echo '}';
  745. echo '';
  746. echo 'c2s_require_encryption = true';
  747. echo 's2s_require_encryption = true';
  748. echo '';
  749. echo 's2s_secure_auth = false';
  750. echo '';
  751. echo 'authentication = "internal_hashed"';
  752. echo '';
  753. echo 'storage = "sql"';
  754. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }';
  755. echo '';
  756. echo 'log = {';
  757. echo ' info = "/dev/null";';
  758. echo ' error = "/dev/null";';
  759. echo ' { levels = { "error" }; to = "/dev/null"; };';
  760. echo '}';
  761. echo ''; } >> /etc/prosody/prosody.cfg.lua
  762. if [[ "$ONION_ONLY" != 'no' ]]; then
  763. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"" >> /etc/prosody/prosody.cfg.lua
  764. else
  765. echo "VirtualHost \"${DEFAULT_DOMAIN_NAME}\"" >> /etc/prosody/prosody.cfg.lua
  766. fi
  767. echo ' ssl = {' >> /etc/prosody/prosody.cfg.lua
  768. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  769. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  770. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  771. else
  772. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  773. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  774. fi
  775. { echo " curve = $XMPP_ECC_CURVE;";
  776. echo ' depth = "2";';
  777. echo " ciphers = $XMPP_CIPHERS;";
  778. echo ' options = {"no_sslv2", "no_sslv3" };'; } >> /etc/prosody/prosody.cfg.lua
  779. if [ -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  780. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  781. else
  782. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  783. fi
  784. { echo ' }';
  785. echo '';
  786. echo 'Include "conf.d/*.cfg.lua"';
  787. echo 'http_upload_path = "/var/lib/prosody/http_uploads"';
  788. echo 'http_upload_file_size_limit = 307200';
  789. echo '';
  790. echo "Component \"chat.${DEFAULT_DOMAIN_NAME}\" \"muc\"";
  791. echo ' restrict_room_creation = true';
  792. echo ' name = "Chatrooms"';
  793. echo ' modules_enabled = {';
  794. echo ' "muc_limits";';
  795. echo ' "muc_log";';
  796. echo ' "mam_muc";';
  797. echo ' "muc_log_http";';
  798. echo ' }';
  799. echo 'storage = { muc_log = "sql"; }';
  800. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }';
  801. echo 'muc_event_rate = 0.5;';
  802. echo 'muc_burst_factor = 10;';
  803. echo 'muc_log_by_default = false;';
  804. echo 'muc_log_all_rooms = false;';
  805. echo 'max_archive_query_results = 10;';
  806. echo 'max_history_messages = 10;'; } >> /etc/prosody/prosody.cfg.lua
  807. }
  808. function install_xmpp_nightly {
  809. if [ ! -d "$INSTALL_DIR" ]; then
  810. mkdir -p "$INSTALL_DIR"
  811. fi
  812. cd "$INSTALL_DIR" || exit 2468274
  813. # Try to get the source from the project repo
  814. if [ -f "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  815. cp "/root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  816. else
  817. if [ -f "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" ]; then
  818. cp "/home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz" .
  819. else
  820. wget "$prosody_nightly_url"
  821. fi
  822. fi
  823. if [ ! -f "${INSTALL_DIR}/${prosody_filename}.tar.gz" ]; then
  824. echo $"Failed to download prosody nightly $prosody_nightly_url"
  825. exit 78352
  826. fi
  827. hash_value=$(sha256sum "${INSTALL_DIR}/${prosody_filename}.tar.gz" | awk -F ' ' '{print $1}')
  828. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  829. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  830. echo $'Unexpected hash value for prosody nightly download'
  831. exit 68224283
  832. fi
  833. tar -xzvf "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  834. cd "${INSTALL_DIR}/${prosody_filename}" || exit 7246284245
  835. ./configure --ostype=debian --prefix=/usr
  836. make prefix=/usr
  837. make prefix=/usr install
  838. if [ -f /usr/local/bin/prosody ]; then
  839. echo $'Failed to build prosody nightly to /usr/bin'
  840. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  841. rm -rf "${INSTALL_DIR:?}/${prosody_filename}"
  842. exit 628732
  843. fi
  844. rm "${INSTALL_DIR}/${prosody_filename}.tar.gz"
  845. set_completion_param "prosody_filename" "${prosody_filename}"
  846. }
  847. function install_xmpp {
  848. if [ ! -d "$INSTALL_DIR" ]; then
  849. mkdir -p "$INSTALL_DIR"
  850. fi
  851. # remove any existing install attempt
  852. if [ -f "$INSTALL_DIR/$prosody_modules_filename" ]; then
  853. rm "$INSTALL_DIR/$prosody_modules_filename"
  854. fi
  855. if [ -d "$INSTALL_DIR/prosody-modules" ]; then
  856. rm -rf "$INSTALL_DIR/prosody-modules"
  857. fi
  858. update_prosody_modules
  859. # obtain a cert for the default domain
  860. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}" pem)" == "0" ]]; then
  861. create_site_certificate "${DEFAULT_DOMAIN_NAME}" 'yes'
  862. if [[ "$ONION_ONLY" == 'no' ]]; then
  863. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}" pem)" == "0" ]]; then
  864. echo $'LetsEncrypt cert could not be obtained for xmpp'
  865. exit 72342
  866. fi
  867. fi
  868. fi
  869. apt-get -yq install lua-sec lua-bitop lua5.1 liblua5.1-dev
  870. apt-get -yq install libidn11-dev libssl-dev lua-dbi-sqlite3
  871. apt-get -yq install mercurial
  872. apt-get -yq install prosody
  873. if [ ! -f /usr/bin/hg ]; then
  874. echo $"Couldn't install mercurial"
  875. exit 52825
  876. fi
  877. if [ ! -d /etc/prosody ]; then
  878. echo $"ERROR: prosody does not appear to have installed. $CHECK_MESSAGE"
  879. exit 52367
  880. fi
  881. groupadd prosody
  882. if [ ! -d /var/lib/prosody/http_uploads ]; then
  883. mkdir -p /var/lib/prosody/http_uploads
  884. fi
  885. if [ ! -d /etc/prosody/conf.d ]; then
  886. mkdir -p /etc/prosody/conf.d
  887. fi
  888. chmod -R 700 /etc/prosody/conf.d
  889. chown -R prosody /var/lib/prosody
  890. chown -R prosody /etc/prosody/conf.d
  891. # install modules
  892. update_prosody_modules initial
  893. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  894. echo $'No prosody modules available'
  895. exit 82634
  896. fi
  897. # create a certificate
  898. if [ ! -f "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem" ]; then
  899. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  900. "${PROJECT_NAME}-addcert" -h xmpp --dhkey "${DH_KEYLENGTH}"
  901. CHECK_HOSTNAME=xmpp
  902. check_certificates xmpp
  903. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  904. echo $'Failed to create xmpp certificate'
  905. exit 72352
  906. fi
  907. if [ ! -f /etc/ssl/private/xmpp.key ]; then
  908. echo $'Failed to create xmpp private certificate'
  909. exit 36829
  910. fi
  911. chmod g=rX /etc/ssl/private/xmpp.key
  912. chmod g=rX /etc/ssl/certs/xmpp.*
  913. fi
  914. fi
  915. groupadd default
  916. chmod 600 /etc/shadow
  917. chmod 600 /etc/gshadow
  918. usermod -g default prosody
  919. chmod 0000 /etc/shadow
  920. chmod 0000 /etc/gshadow
  921. chown root:default /etc/ssl/private/xmpp.*
  922. chown root:default /etc/ssl/certs/xmpp.*
  923. chown root:default "/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.*"
  924. chown root:default "/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.*"
  925. cp -a /etc/prosody/conf.avail/example.com.cfg.lua /etc/prosody/conf.avail/xmpp.cfg.lua
  926. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}" pem)" == "1" ]]; then
  927. sed -i "s|key =.*|key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  928. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  929. else
  930. sed -i "s|key =.*|key = \"/etc/ssl/private/xmpp.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  931. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/xmpp.crt\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  932. fi
  933. if ! grep -q "xmpp.dhparam" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  934. if [[ "$(cert_exists "${DEFAULT_DOMAIN_NAME}")" == "1" ]]; then
  935. sed -i "/certificate =/a\\ dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" /etc/prosody/conf.avail/xmpp.cfg.lua
  936. else
  937. sed -i '/certificate =/a\\ dhparam = "/etc/ssl/certs/xmpp.dhparam";' /etc/prosody/conf.avail/xmpp.cfg.lua
  938. fi
  939. fi
  940. if ! grep -q 'options = {"no_sslv2", "no_sslv3" }' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  941. sed -i '/certificate =/a\ options = {"no_sslv2", "no_sslv3" };' /etc/prosody/conf.avail/xmpp.cfg.lua
  942. fi
  943. if ! grep -q 'ciphers =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  944. sed -i "/certificate =/a\\ ciphers = $XMPP_CIPHERS;" /etc/prosody/conf.avail/xmpp.cfg.lua
  945. fi
  946. if ! grep -q 'depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  947. sed -i '/certificate =/a\ depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua
  948. fi
  949. if ! grep -q 'curve =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  950. sed -i "/certificate =/a\\ curve = $XMPP_ECC_CURVE;" /etc/prosody/conf.avail/xmpp.cfg.lua
  951. fi
  952. sed -i "s/example.com/$DEFAULT_DOMAIN_NAME/g" /etc/prosody/conf.avail/xmpp.cfg.lua
  953. sed -i 's/enabled = false -- Remove this line to enable this host//g' /etc/prosody/conf.avail/xmpp.cfg.lua
  954. if ! grep -q "modules_enabled" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  955. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  956. xmpp_modules /etc/prosody/conf.avail/xmpp.cfg.lua
  957. fi
  958. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  959. if ! grep -q "c2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  960. echo 'c2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  961. else
  962. sed -i 's|c2s_require_encryption.*|c2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  963. fi
  964. if ! grep -q "s2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  965. echo 's2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  966. else
  967. sed -i 's|s2s_require_encryption.*|s2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  968. fi
  969. if ! grep -q "allow_unencrypted_plain_auth" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  970. echo 'allow_unencrypted_plain_auth = false' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  971. else
  972. sed -i 's|allow_unencrypted_plain_auth.*|allow_unencrypted_plain_auth = false|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  973. fi
  974. ln -sf /etc/prosody/conf.avail/xmpp.cfg.lua /etc/prosody/conf.d/xmpp.cfg.lua
  975. if [ ! -d /var/lib/tor ]; then
  976. echo $'No Tor installation found. xmpp onion site cannot be configured.'
  977. exit 877367
  978. fi
  979. if ! grep -q "hidden_service_xmpp" $ONION_SERVICES_FILE; then
  980. { echo 'HiddenServiceDir /var/lib/tor/hidden_service_xmpp/';
  981. echo 'HiddenServiceVersion 2';
  982. echo "HiddenServicePort 5222 127.0.0.1:5222";
  983. echo "HiddenServicePort 5269 127.0.0.1:5269"; } >> $ONION_SERVICES_FILE
  984. echo $'Added onion site for xmpp chat'
  985. fi
  986. onion_update
  987. wait_for_onion_service 'xmpp'
  988. if [ ! -f /var/lib/tor/hidden_service_xmpp/hostname ]; then
  989. echo $'xmpp onion site hostname not found'
  990. exit 65349
  991. fi
  992. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  993. if ! grep -q "${XMPP_ONION_HOSTNAME}" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  994. { echo '';
  995. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"";
  996. echo ' modules_enabled = { "onions" };'; } >> /etc/prosody/conf.avail/xmpp.cfg.lua
  997. fi
  998. set_completion_param "xmpp onion domain" "${XMPP_ONION_HOSTNAME}"
  999. if [ -f "$IMAGE_PASSWORD_FILE" ]; then
  1000. XMPP_PASSWORD="$(printf "%s" "$(cat "$IMAGE_PASSWORD_FILE")")"
  1001. else
  1002. if [ ${#XMPP_PASSWORD} -lt 8 ]; then
  1003. XMPP_PASSWORD="$(create_password "${MINIMUM_PASSWORD_LENGTH}")"
  1004. fi
  1005. fi
  1006. function_check configure_firewall_for_xmpp
  1007. configure_firewall_for_xmpp
  1008. xmpp_email_headers
  1009. update_default_domain
  1010. xmpp_create_config
  1011. # TODO comment this out after debian supports prosody 0.10 or later
  1012. install_xmpp_nightly
  1013. chown -R prosody /etc/prosody
  1014. chown -R prosody /var/lib/prosody
  1015. chown -R prosody /usr/lib/prosody
  1016. chmod -R 700 /etc/prosody/conf.d
  1017. usermod -a -G www-data prosody
  1018. # Avoid STIG failures
  1019. if [ -f /usr/lib/ssl/private/xmpp.key ]; then
  1020. chown root:root /usr/lib/ssl/private/xmpp.key
  1021. fi
  1022. if [ -f /usr/lib/ssl/certs/xmpp.crt ]; then
  1023. chown root:root /usr/lib/ssl/certs/xmpp.crt
  1024. fi
  1025. if [ -f /usr/lib/ssl/certs/xmpp.dhparam ]; then
  1026. chown root:root /usr/lib/ssl/certs/xmpp.dhparam
  1027. fi
  1028. if [ -d /etc/letsencrypt ]; then
  1029. usermod -a -G ssl-cert prosody
  1030. fi
  1031. if [ -f /etc/ssl/certs/xmpp.dhparam ]; then
  1032. cp /etc/ssl/certs/xmpp.dhparam /etc/prosody/xmpp.dhparam
  1033. chown prosody:prosody /etc/prosody/xmpp.dhparam
  1034. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/prosody.cfg.lua
  1035. sed -i 's|/etc/ssl/certs/xmpp.dhparam|/etc/prosody/xmpp.dhparam|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  1036. fi
  1037. apt-mark -q hold prosody
  1038. systemctl restart prosody
  1039. if [[ $ONION_ONLY != 'no' ]]; then
  1040. prosodyctl register "$MY_USERNAME" "$XMPP_ONION_HOSTNAME" "$XMPP_PASSWORD"
  1041. else
  1042. prosodyctl register "$MY_USERNAME" "$DEFAULT_DOMAIN_NAME" "$XMPP_PASSWORD"
  1043. fi
  1044. # shellcheck disable=SC2181
  1045. if [ ! "$?" = "0" ]; then
  1046. echo ''
  1047. echo ''
  1048. systemctl status prosody -l
  1049. echo ''
  1050. echo ''
  1051. which prosody
  1052. which prosodyctl
  1053. echo ''
  1054. echo ''
  1055. cat /etc/prosody/prosody.cfg.lua
  1056. echo ''
  1057. echo ''
  1058. cat /etc/prosody/conf.avail/xmpp.cfg.lua
  1059. echo ''
  1060. echo ''
  1061. #remove_xmpp
  1062. echo $'Unable to register prosody user'
  1063. exit 347682
  1064. fi
  1065. prosody_daemon_restart_script
  1066. "${PROJECT_NAME}-pass" -u "$MY_USERNAME" -a xmpp -p "$XMPP_PASSWORD"
  1067. # Add avahi services
  1068. { echo '<?xml version="1.0" standalone="no"?><!--*-nxml-*-->';
  1069. echo '<!DOCTYPE service-group SYSTEM "avahi-service.dtd">';
  1070. echo '<service-group>';
  1071. echo ' <name replace-wildcards="yes">%h XMPP</name>';
  1072. echo ' <service>';
  1073. echo ' <type>_xmpp._tcp</type>';
  1074. echo " <port>5222</port>";
  1075. echo ' </service>';
  1076. echo ' <service>';
  1077. echo ' <type>_xmpp-server._tcp</type>';
  1078. echo " <port>5269</port>";
  1079. echo ' </service>';
  1080. echo '</service-group>'; } > /etc/avahi/services/xmpp.service
  1081. systemctl restart avahi-daemon
  1082. APP_INSTALLED=1
  1083. }
  1084. # NOTE: deliberately no exit 0