freedombone/src/freedombone-app-matrix

#!/bin/bash
#
# .---.                  .              .
# |                      |              |
# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
#
#                    Freedom in the Cloud
#
# matrix server
#
# https://raw.githubusercontent.com/silvio/docker-matrix
#
# License
# =======
#
# Copyright (C) 2016 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

VARIANTS='full full-vim chat'

IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=1

MATRIX_DATA_DIR='/var/lib/matrix'
MATRIX_PORT=8448
MATRIX_REPO="https://github.com/matrix-org/synapse"
MATRIX_COMMIT='f5a4001bb116c468cc5e8e0ae04a1c570e2cb171'
REPORT_STATS="no"
MATRIX_SECRET=

matrix_variables=(ONION_ONLY
                  MY_USERNAME
                  MATRIX_SECRET
                  DEFAULT_DOMAIN_NAME)

function matrix_nginx {
    matrix_changed=
    matrix_proxy_str=' \
    location /matrix { \
        proxy_pass https://localhost:8448; \
        proxy_buffering on; \
    }'
    turn_proxy_str=' \
    location /turn { \
        proxy_pass https://localhost:3478; \
        proxy_buffering on; \
    }'

    if [[ $ONION_ONLY != 'no' ]]; then
        matrix_proxy_str=' \
    location /matrix { \
        proxy_pass http://localhost:8448; \
        proxy_buffering on; \
    }'
        turn_proxy_str=' \
    location /turn { \
        proxy_pass http://localhost:3478; \
        proxy_buffering on; \
    }'
    fi

    if [ ! -f /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME} ]; then
        matrix_nginx_site=/etc/nginx/sites-available/$DEFAULT_DOMAIN_NAME
        if [[ $ONION_ONLY == "no" ]]; then
            function_check nginx_http_redirect
            nginx_http_redirect $DEFAULT_DOMAIN_NAME
            echo 'server {' >> $matrix_nginx_site
            echo '  listen 443 ssl;' >> $matrix_nginx_site
            echo '  listen [::]:443 ssl;' >> $matrix_nginx_site
            echo "  server_name $DEFAULT_DOMAIN_NAME;" >> $matrix_nginx_site
            echo '' >> $matrix_nginx_site
            echo '  # Security' >> $matrix_nginx_site
            function_check nginx_ssl
            nginx_ssl $DEFAULT_DOMAIN_NAME

            function_check nginx_disable_sniffing
            nginx_disable_sniffing $DEFAULT_DOMAIN_NAME

            echo '  add_header Strict-Transport-Security max-age=15768000;' >> $matrix_nginx_site
            echo '' >> $matrix_nginx_site
            echo '  # Logs' >> $matrix_nginx_site
            echo '  access_log /dev/null;' >> $matrix_nginx_site
            echo '  error_log /dev/null;' >> $matrix_nginx_site
            echo '' >> $matrix_nginx_site
            echo '  # Root' >> $matrix_nginx_site
            echo "  root /var/www/$DEFAULT_DOMAIN_NAME/htdocs;" >> $matrix_nginx_site
            echo '' >> $matrix_nginx_site
            echo '  # Index' >> $matrix_nginx_site
            echo '  index index.html;' >> $matrix_nginx_site
            echo '' >> $matrix_nginx_site
            echo '  # Location' >> $matrix_nginx_site
            echo '  location / {' >> $matrix_nginx_site
            function_check nginx_limits
            nginx_limits $DEFAULT_DOMAIN_NAME '15m'
            echo '  }' >> $matrix_nginx_site
            echo '' >> $matrix_nginx_site
            echo '  # Restrict access that is unnecessary anyway' >> $matrix_nginx_site
            echo '  location ~ /\.(ht|git) {' >> $matrix_nginx_site
            echo '    deny all;' >> $matrix_nginx_site
            echo '  }' >> $matrix_nginx_site
            echo '}' >> $matrix_nginx_site
        else
            echo -n '' > $matrix_nginx_site
        fi
        echo 'server {' >> $matrix_nginx_site
        echo "    listen 127.0.0.1:$MATRIX_PORT default_server;" >> $matrix_nginx_site
        echo "    server_name $DEFAULT_DOMAIN_NAME;" >> $matrix_nginx_site
        echo '' >> $matrix_nginx_site
        function_check nginx_disable_sniffing
        nginx_disable_sniffing $DEFAULT_DOMAIN_NAME
        echo '' >> $matrix_nginx_site
        echo '  # Logs' >> $matrix_nginx_site
        echo '  access_log /dev/null;' >> $matrix_nginx_site
        echo '  error_log /dev/null;' >> $matrix_nginx_site
        echo '' >> $matrix_nginx_site
        echo '  # Root' >> $matrix_nginx_site
        echo "  root /var/www/$DEFAULT_DOMAIN_NAME/htdocs;" >> $matrix_nginx_site
        echo '' >> $matrix_nginx_site
        echo '  # Location' >> $matrix_nginx_site
        echo '  location / {' >> $matrix_nginx_site
        function_check nginx_limits
        nginx_limits $DEFAULT_DOMAIN_NAME '15m'
        echo '  }' >> $matrix_nginx_site
        echo '' >> $matrix_nginx_site
        echo '  # Restrict access that is unnecessary anyway' >> $matrix_nginx_site
        echo '  location ~ /\.(ht|git) {' >> $matrix_nginx_site
        echo '    deny all;' >> $matrix_nginx_site
        echo '  }' >> $matrix_nginx_site
        echo '}' >> $matrix_nginx_site

        if [ ! -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
            function_check create_site_certificate
            create_site_certificate $DEFAULT_DOMAIN_NAME 'yes'
        fi

        nginx_ensite $DEFAULT_DOMAIN_NAME
        matrix_changed=1
    fi

    if ! grep "localhost:${MATRIX_PORT}" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}; then
        sed -i "s|:443 ssl;|:443 ssl;${matrix_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
        sed -i "s| default_server;| default_server;${matrix_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
        matrix_changed=1
    fi
    if ! grep "localhost:${TURN_PORT}" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}; then
        sed -i "s|:443 ssl;|:443 ssl;${turn_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
        sed -i "s| default_server;| default_server;${turn_proxy_str}|g" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
        matrix_changed=1
    fi

    if [ $matrix_changed ]; then
        systemctl restart nginx
        # wait for nginx to start otherwise user add fails later
        sleep 5
    fi

}

function matrix_generate_synapse_file {
    local filepath="${1}"

    cd /etc/matrix
    python -m synapse.app.homeserver \
           --config-path "${filepath}" \
           --generate-config \
           --report-stats ${REPORT_STATS} \
           --server-name ${DEFAULT_DOMAIN_NAME}
}

function matrix_configure_homeserver_yaml {
    local turnkey="${1}"
    local filepath="${2}"

    local ymltemp="$(mktemp)"

    awk -v TURNURIES="turn_uris: [\"turn:${DEFAULT_DOMAIN_NAME}/turn?transport=udp\", \"turn:${DEFAULT_DOMAIN_NAME}/turn?transport=tcp\"]" \
        -v TURNSHAREDSECRET="turn_shared_secret: \"${turnkey}\"" \
        -v PIDFILE="pid_file: ${MATRIX_DATA_DIR}/homeserver.pid" \
        -v DATABASE="database: \"${MATRIX_DATA_DIR}/homeserver.db\"" \
        -v LOGFILE="log_file: \"/dev/null\"" \
        -v MEDIASTORE="media_store_path: \"${MATRIX_DATA_DIR}/media_store\"" \
        '{
        sub(/turn_shared_secret: "YOUR_SHARED_SECRET"/, TURNSHAREDSECRET);
        sub(/turn_uris: \[\]/, TURNURIES);
        sub(/pid_file: \/homeserver.pid/, PIDFILE);
        sub(/database: "\/homeserver.db"/, DATABASE);
        sub(/log_file: "\/homeserver.log"/, LOGFILE);
        sub(/media_store_path: "\/media_store"/, MEDIASTORE);
        print;
        }' "${filepath}" > "${ymltemp}"

    mv ${ymltemp} "${filepath}"

    if [[ $ONION_ONLY != 'no' ]]; then
        sed -i 's|no_tls: .*|no_tls: True|g' "${filepath}"
    fi
    sed -i 's|enable_registration_captcha.*|enable_registration_captcha: False|g' "${filepath}"
    sed -i "s|database: \".*|database: \"${MATRIX_DATA_DIR}/homeserver.db\"|g" "${filepath}"
    sed -i "s|media_store_path:.*|media_store_path: \"${MATRIX_DATA_DIR}/media_store\"|g" "${filepath}"
    sed -i "s|pid_file:.*|pid_file: \"${MATRIX_DATA_DIR}/homeserver.pid\"|g" "${filepath}"
    sed -i "s|log_file:.*|log_file: \"/dev/null\"|g" "${filepath}"
}

function matrix_diff {
    DIFFPARAMS="${DIFFPARAMS:-Naur}"
    DEFAULT_DOMAIN_NAME="${DEFAULT_DOMAIN_NAME:-demo_server_name}"
    REPORT_STATS="${REPORT_STATS:-no_or_yes}"
    export DEFAULT_DOMAIN_NAME REPORT_STATS

    matrix_generate_synapse_file $INSTALL_DIR/homeserver.synapse.yaml
    diff -${DIFFPARAMS} $INSTALL_DIR/homeserver.synapse.yaml ${MATRIX_DATA_DIR}/homeserver.yaml
    rm $INSTALL_DIR/homeserver.synapse.yaml
}

function matrix_generate {
    breakup="0"
    [[ -z "${DEFAULT_DOMAIN_NAME}" ]] && echo "STOP! environment variable DEFAULT_DOMAIN_NAME must be set" && breakup="1"
    [[ -z "${REPORT_STATS}" ]] && echo "STOP! environment variable REPORT_STATS must be set to 'no' or 'yes'" && breakup="1"
    [[ "${breakup}" == "1" ]] && exit 1

    [[ "${REPORT_STATS}" != "yes" ]] && [[ "${REPORT_STATS}" != "no" ]] && \
        echo "STOP! REPORT_STATS needs to be 'no' or 'yes'" && breakup="1"

    if [ -f ${MATRIX_DATA_DIR}/homeserver.yaml ]; then
        rm ${MATRIX_DATA_DIR}/homeserver.yaml
    fi
    matrix_generate_synapse_file ${MATRIX_DATA_DIR}/homeserver.yaml
    matrix_configure_homeserver_yaml "${turnkey}" ${MATRIX_DATA_DIR}/homeserver.yaml
}

function remove_user_matrix {
    remove_username="$1"

    ${PROJECT_NAME}-pass -u $remove_username --rmapp matrix

    # TODO: There is no user removal script within synapse
}

function add_user_matrix {
    new_username="$1"
    new_user_password="$2"

    ${PROJECT_NAME}-pass -u $new_username -a matrix -p "$new_user_password"

    matrix_nginx
    retval=$(register_new_matrix_user -c ${MATRIX_DATA_DIR}/homeserver.yaml -u "${new_username}" -p "${new_user_password}" -a)
    echo "0"
}

function install_interactive_matrix {
    APP_INSTALLED=1
}

function change_password_matrix {
    curr_username="$1"
    new_user_password="$2"

    #${PROJECT_NAME}-pass -u "$curr_username" -a matrix -p "$new_user_password"
}

function reconfigure_matrix {
    echo -n ''
}

function upgrade_matrix {
    function_check set_repo_commit
    set_repo_commit /etc/matrix "matrix commit" "$MATRIX_COMMIT" $MATRIX_REPO

    pip install --upgrade --process-dependency-links .
    chown -R matrix:matrix /etc/matrix
    chown -R matrix:matrix $MATRIX_DATA_DIR
}

function backup_local_matrix {
    source_directory=/etc/matrix
    if [ -d $source_directory ]; then
        systemctl stop matrix
        function_check backup_directory_to_usb
        backup_directory_to_usb $source_directory matrix
        source_directory=$MATRIX_DATA_DIR
        if [ -d $source_directory ]; then
            backup_directory_to_usb $source_directory matrixdata
        fi
        systemctl start matrix
    fi
}

function restore_local_matrix {
    if [ -d /etc/matrix ]; then
        systemctl stop matrix

        temp_restore_dir=/root/tempmatrix
        function_check restore_directory_from_usb
        restore_directory_from_usb $temp_restore_dir matrix
        cp -r $temp_restore_dir/etc/matrix/* /etc/matrix
        if [ ! "$?" = "0" ]; then
            function_check backup_unmount_drive
            backup_unmount_drive
            exit 3783
        fi
        rm -rf $temp_restore_dir
        chown -R matrix:matrix /etc/matrix

        temp_restore_dir=/root/tempmatrixdata
        restore_directory_from_usb $temp_restore_dir matrixdata
        cp -r $temp_restore_dir$MATRIX_DATA_DIR/* $MATRIX_DATA_DIR
        if [ ! "$?" = "0" ]; then
            function_check backup_unmount_drive
            backup_unmount_drive
            exit 78352
        fi
        rm -rf $temp_restore_dir
        chown -R matrix:matrix $MATRIX_DATA_DIR

        systemctl start matrix
    fi
}

function backup_remote_matrix {
    source_directory=/etc/matrix
    if [ -d $source_directory ]; then
        systemctl stop matrix
        function_check backup_directory_to_friend
        backup_directory_to_friend $source_directory matrix
        source_directory=$MATRIX_DATA_DIR
        if [ -d $source_directory ]; then
            backup_directory_to_friend $source_directory matrixdata
        fi
        systemctl start matrix
    fi
}

function restore_remote_matrix {
    if [ -d /etc/matrix ]; then
        systemctl stop matrix

        temp_restore_dir=/root/tempmatrix
        function_check restore_directory_from_friend
        restore_directory_from_friend $temp_restore_dir matrix
        cp -r $temp_restore_dir/etc/matrix/* /etc/matrix
        if [ ! "$?" = "0" ]; then
            exit 38935
        fi
        rm -rf $temp_restore_dir
        chown -R matrix:matrix /etc/matrix

        temp_restore_dir=/root/tempmatrixdata
        restore_directory_from_friend $temp_restore_dir matrixdata
        cp -r $temp_restore_dir$MATRIX_DATA_DIR/* $MATRIX_DATA_DIR
        if [ ! "$?" = "0" ]; then
            exit 60923
        fi
        rm -rf $temp_restore_dir
        chown -R matrix:matrix $MATRIX_DATA_DIR

        systemctl start matrix
    fi
}

function remove_matrix {
    firewall_remove ${MATRIX_PORT}
    systemctl stop matrix

    function_check remove_turn
    remove_turn

    systemctl disable matrix
    if [ -f /etc/systemd/system/matrix.service ]; then
        rm /etc/systemd/system/matrix.service
    fi
    apt-get -y remove --purge coturn
    cd /etc/matrix
    pip uninstall .
    rm -rf $MATRIX_DATA_DIR
    rm -rf /etc/matrix
    deluser matrix
    delgroup matrix
    remove_onion_service matrix ${MATRIX_PORT}

    sed -i "/location \/matrix {/,/}/d" /etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}
    systemctl restart nginx

    remove_completion_param install_matrix
    sed -i '/matrix/d' $COMPLETION_FILE
}

function install_matrix {
    if [ ! -d $INSTALL_DIR ]; then
        mkdir -p $INSTALL_DIR
    fi

    if [[ ${ONION_ONLY} == 'no' ]]; then
        if [ ! -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
            echo $'Obtaining certificate for the main domain'
            create_site_certificate ${DEFAULT_DOMAIN_NAME} 'yes'
        fi
    fi

    export DEBIAN_FRONTEND=noninteractive
    apt-get -yq install coreutils \
            curl file gcc git libevent-2.0-5 \
            libevent-dev libffi-dev libffi6 \
            libgnutls28-dev libjpeg62-turbo \
            libjpeg62-turbo-dev libldap-2.4-2 \
            libldap2-dev libsasl2-dev \
            libsqlite3-dev libssl-dev \
            libssl1.0.0 libtool libxml2 \
            libxml2-dev libxslt1-dev libxslt1.1 \
            make python python-dev \
            python-pip python-psycopg2 \
            python-virtualenv sqlite unzip \
            zlib1g zlib1g-dev

    pip install --upgrade pip
    pip install --upgrade python-ldap
    pip install --upgrade lxml

    if [ ! -d /etc/matrix ]; then
        function_check git_clone
        git_clone $MATRIX_REPO /etc/matrix
        if [ ! -d /etc/matrix ]; then
            echo $'Unable to clone matrix repo'
            exit 6724683
        fi
    fi

    cd /etc/matrix
    git checkout $MATRIX_COMMIT -b $MATRIX_COMMIT
    set_completion_param "matrix commit" "$MATRIX_COMMIT"
    if [ ! -d $INSTALL_DIR/matrix ]; then
        mkdir -p $INSTALL_DIR/matrix
    fi
    pip install --upgrade --process-dependency-links . -b $INSTALL_DIR/matrix
    if [ ! "$?" = "0" ]; then
        exit 782542
    fi

    function_check install_turn
    install_turn
    MATRIX_SECRET="${turnkey}"

    function_check matrix_generate
    matrix_generate

    if [[ -z ${MATRIX_DATA_DIR}/homeserver.yaml ]]; then
        echo $'homeserver.yaml is zero size'
        exit 783724
    fi

    groupadd matrix
    useradd -c "Matrix system account" -d $MATRIX_DATA_DIR -m -r -g matrix matrix

    chmod -R 700 /var/lib/matrix/homeserver.yaml
    chown -R matrix:matrix /etc/matrix
    chown -R matrix:matrix $MATRIX_DATA_DIR

    echo '[Unit]' > /etc/systemd/system/matrix.service
    echo 'Description=Synapse Matrix homeserver' >> /etc/systemd/system/matrix.service
    echo 'After=network.target nginx.target' >> /etc/systemd/system/matrix.service
    echo '' >> /etc/systemd/system/matrix.service
    echo '[Service]' >> /etc/systemd/system/matrix.service
    echo 'Type=simple' >> /etc/systemd/system/matrix.service
    echo 'User=matrix' >> /etc/systemd/system/matrix.service
    echo "WorkingDirectory=/etc/matrix" >> /etc/systemd/system/matrix.service
    echo "ExecStart=/usr/bin/python -m synapse.app.homeserver --config-path ${MATRIX_DATA_DIR}/homeserver.yaml" >> /etc/systemd/system/matrix.service
    echo 'Restart=always' >> /etc/systemd/system/matrix.service
    echo 'RestartSec=10' >> /etc/systemd/system/matrix.service
    echo '' >> /etc/systemd/system/matrix.service
    echo '[Install]' >> /etc/systemd/system/matrix.service
    echo 'WantedBy=multi-user.target' >> /etc/systemd/system/matrix.service
    systemctl enable matrix
    systemctl daemon-reload
    systemctl start matrix

    if [ -f /var/lib/matrix/homeserver.db ]; then
        chmod -R 700 /var/lib/matrix/homeserver.db
    fi

    update_default_domain

    firewall_add matrix ${MATRIX_PORT}

    MATRIX_ONION_HOSTNAME=$(add_onion_service matrix ${MATRIX_PORT} ${MATRIX_PORT})
    if [ ! ${MATRIX_PASSWORD} ]; then
        if [ -f ${IMAGE_PASSWORD_FILE} ]; then
            MATRIX_PASSWORD="$(printf `cat $IMAGE_PASSWORD_FILE`)"
        else
            MATRIX_PASSWORD="$(create_password ${MINIMUM_PASSWORD_LENGTH})"
        fi
    fi

    rm -rf ${MATRIX_DATA_DIR}/Maildir
    rm -rf ${MATRIX_DATA_DIR}/.mutt
    rm -f ${MATRIX_DATA_DIR}/.muttrc
    rm -f ${MATRIX_DATA_DIR}/.mutt-alias
    rm -f ${MATRIX_DATA_DIR}/.procmailrc
    rm -f ${MATRIX_DATA_DIR}/.emacs-mutt

    matrix_nginx

    if [[ $(add_user_matrix "${MY_USERNAME}" "${MATRIX_PASSWORD}") != "0" ]]; then
        echo $'Failed to add matrix admin user';
        exit 879352
    fi

    APP_INSTALLED=1
}