freedombone-app-xmpp 43KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # XMPP functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2014-2017 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. VARIANTS='full full-vim chat'
  31. IN_DEFAULT_INSTALL=0
  32. SHOW_ON_ABOUT=1
  33. # Directory where XMPP settings are stored
  34. XMPP_DIRECTORY="/var/lib/prosody"
  35. XMPP_PASSWORD=
  36. XMPP_CIPHERS='"EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA"'
  37. XMPP_ECC_CURVE='"secp384r1"'
  38. prosody_latest_version='0.10'
  39. prosody_nightly=410
  40. prosody_nightly_hash='9cf3db6a09895a744d72eb90b4a635758a710afe1a16b78506c7139c4e7211eb'
  41. prosody_filename=prosody-${prosody_latest_version}-1nightly${prosody_nightly}
  42. prosody_nightly_url="https://prosody.im/nightly/${prosody_latest_version}/latest/${prosody_filename}.tar.gz"
  43. # From https://hg.prosody.im/prosody-modules
  44. prosody_modules_filename='prosody-modules-20170514.tar.gz'
  45. prosody_modules_hash='ef404c203317cc0de6da7aaec4f21765a57f630adfbf082cf2dd92b881c15f86'
  46. xmpp_variables=(ONION_ONLY
  47. INSTALLED_WITHIN_DOCKER
  48. XMPP_CIPHERS
  49. XMPP_ECC_CURVE
  50. XMPP_ECC_CURVE
  51. MY_USERNAME
  52. DEFAULT_DOMAIN_NAME
  53. XMPP_DOMAIN_CODE)
  54. function logging_on_xmpp {
  55. if [ -d /etc/prosody ]; then
  56. if [ ! -d /var/log/prosody ]; then
  57. mkdir /var/log/prosody
  58. chown root:adm /var/log/prosody
  59. fi
  60. if ! grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  61. sed -i 's|info = "/dev/null";|info = "/var/log/prosody/prosody.log";|g' /etc/prosody/prosody.cfg.lua
  62. sed -i 's|error = "/dev/null";|error = "/var/log/prosody/prosody.err";|g' /etc/prosody/prosody.cfg.lua
  63. sed -i 's|levels = { "error" }; to = "/dev/null";|levels = { "error" }; to = "syslog";|g' /etc/prosody/prosody.cfg.lua
  64. fi
  65. fi
  66. }
  67. function logging_off_xmpp {
  68. if [ -d /etc/prosody ]; then
  69. if grep -q "/var/log/prosody/prosody.log" /etc/prosody/prosody.cfg.lua; then
  70. sed -i 's|info = "/var/log/prosody/prosody.log";|info = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  71. sed -i 's|error = "/var/log/prosody/prosody.err";|error = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  72. sed -i 's|levels = { "error" }; to = "syslog";|levels = { "error" }; to = "/dev/null";|g' /etc/prosody/prosody.cfg.lua
  73. $REMOVE_FILES_COMMAND /var/log/prosody/*
  74. rm -rf /var/log/prosody
  75. fi
  76. fi
  77. }
  78. function xmpp_add_onion_address {
  79. domain_name="$1"
  80. onion_address="$2"
  81. if [ ${#domain_name} -eq 0 ]; then
  82. return
  83. fi
  84. if [ ${#onion_address} -eq 0 ]; then
  85. return
  86. fi
  87. if ! grep "${onion_address}" /etc/prosody/prosody.cfg.lua; then
  88. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  89. sed -i "s|[\"${domain_name}\"].*|[\"${domain_name}\"] = \"${onion_address}\";|g" /etc/prosody/prosody.cfg.lua
  90. else
  91. sed -i "/onions_map = {/a [\"${domain_name}\"] = \"${onion_address}\";" /etc/prosody/prosody.cfg.lua
  92. fi
  93. systemctl restart prosody
  94. fi
  95. }
  96. function xmpp_add_onion_address_interactive {
  97. data=$(tempfile 2>/dev/null)
  98. trap "rm -f $data" 0 1 2 5 15
  99. dialog --backtitle $"Freedombone Control Panel" \
  100. --title $"Add an ICANN to Onion domain mapping" \
  101. --form $"Sepecify an ICANN domain name and its equivalent onion address\n" 9 50 2 \
  102. $"Domain:" 1 1 "" 1 18 26 25 \
  103. $"Onion address:" 2 1 "" 2 18 26 25 \
  104. 2> $data
  105. sel=$?
  106. case $sel in
  107. 1) return;;
  108. 255) return;;
  109. esac
  110. domain_name=$(cat $data | sed -n 1p)
  111. onion_address=$(cat $data | sed -n 2p)
  112. if [[ "$onion_address" != *".onion" ]]; then
  113. return
  114. fi
  115. if [[ "$domain_name" != *"."* ]]; then
  116. return
  117. fi
  118. xmpp_add_onion_address "$domain_name" "$onion_address"
  119. dialog --title $"Add an ICANN to Onion domain mapping" \
  120. --msgbox $"${domain_name} -> ${onion_address} added" 6 70
  121. }
  122. function xmpp_remove_onion_address {
  123. domain_name="$1"
  124. if [ ${#domain_name} -eq 0 ]; then
  125. return
  126. fi
  127. xmpp_changed=
  128. if grep -q "[\"${domain_name}\"]" /etc/prosody/prosody.cfg.lua; then
  129. sed -i "/[\"${domain_name}\"]/d" /etc/prosody/prosody.cfg.lua
  130. xmpp_changed=1
  131. fi
  132. if grep -q "= \"${domain_name}\";" /etc/prosody/prosody.cfg.lua; then
  133. sed -i "/= \"${domain_name}\";/d" /etc/prosody/prosody.cfg.lua
  134. xmpp_changed=1
  135. fi
  136. if [ $xmpp_changed ]; then
  137. systemctl restart prosody
  138. fi
  139. }
  140. function xmpp_remove_onion_address_interactive {
  141. data=$(tempfile 2>/dev/null)
  142. trap "rm -f $data" 0 1 2 5 15
  143. dialog --title $"Remove ICANN to Onion domain mapping" \
  144. --backtitle $"Freedombone Control Panel" \
  145. --inputbox $'Enter the domain name or onion address to be removed' 8 60 2>$data
  146. sel=$?
  147. case $sel in
  148. 0) domain_name=$(<$data)
  149. if [[ "$domain_name" != *"."* ]]; then
  150. return
  151. fi
  152. xmpp_remove_onion_address "$domain_name"
  153. dialog --title $"Remove an ICANN to Onion domain mapping" \
  154. --msgbox $"${domain_name} removed" 6 70
  155. ;;
  156. esac
  157. }
  158. function configure_interactive_xmpp {
  159. while true
  160. do
  161. data=$(tempfile 2>/dev/null)
  162. trap "rm -f $data" 0 1 2 5 15
  163. dialog --backtitle $"Freedombone Control Panel" \
  164. --title $"XMPP" \
  165. --radiolist $"Choose an operation:" 12 70 3 \
  166. 1 $"Add an ICANN to onion domain mapping" off \
  167. 2 $"Remove an ICANN to onion domain mapping" off \
  168. 3 $"Return to administrator control panel" on 2> $data
  169. sel=$?
  170. case $sel in
  171. 1) return;;
  172. 255) return;;
  173. esac
  174. case $(cat $data) in
  175. 1) xmpp_add_onion_address_interactive;;
  176. 2) xmpp_remove_onion_address_interactive;;
  177. 3) break;;
  178. esac
  179. done
  180. }
  181. function remove_user_xmpp {
  182. remove_username="$1"
  183. ${PROJECT_NAME}-pass -u $remove_username --rmapp xmpp
  184. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  185. if [[ $ONION_ONLY != "no" ]]; then
  186. ${PROJECT_NAME}-rmxmpp -e "${remove_username}@${XMPP_ONION_HOSTNAME}"
  187. else
  188. ${PROJECT_NAME}-rmxmpp -e "${remove_username}@${HOSTNAME}"
  189. fi
  190. }
  191. function add_user_xmpp_client {
  192. new_username="$1"
  193. new_user_password="$2"
  194. if [ -f /usr/local/bin/profanity ]; then
  195. XMPP_CLIENT_DIR=/home/$new_username/.local/share/profanity
  196. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  197. if [ ! -d $XMPP_CLIENT_DIR ]; then
  198. mkdir -p $XMPP_CLIENT_DIR
  199. fi
  200. if [ ! -d /home/$new_username/.config/profanity ]; then
  201. mkdir -p /home/$new_username/.config/profanity
  202. fi
  203. MY_GPG_PUBLIC_KEY_ID=$(gpg_pubkey_from_email "$new_username" "$new_username@$HOSTNAME")
  204. echo "[${new_username}@${HOSTNAME}]" > $XMPP_CLIENT_ACCOUNTS
  205. echo 'enabled=true' >> $XMPP_CLIENT_ACCOUNTS
  206. echo "jid=${new_username}@${HOSTNAME}" >> $XMPP_CLIENT_ACCOUNTS
  207. echo "server=$XMPP_ONION_HOSTNAME" >> $XMPP_CLIENT_ACCOUNTS
  208. echo "pgp.keyid=$GPG_PUBLIC_KEY_ID" >> $XMPP_CLIENT_ACCOUNTS
  209. echo 'resource=profanity' >> $XMPP_CLIENT_ACCOUNTS
  210. echo "muc.service=conference.${HOSTNAME}" >> $XMPP_CLIENT_ACCOUNTS
  211. echo "muc.nick=${new_username}" >> $XMPP_CLIENT_ACCOUNTS
  212. echo 'presence.last=online' >> $XMPP_CLIENT_ACCOUNTS
  213. echo 'presence.login=online' >> $XMPP_CLIENT_ACCOUNTS
  214. echo 'priority.online=0' >> $XMPP_CLIENT_ACCOUNTS
  215. echo 'priority.chat=0' >> $XMPP_CLIENT_ACCOUNTS
  216. echo 'priority.away=0' >> $XMPP_CLIENT_ACCOUNTS
  217. echo 'priority.xa=0' >> $XMPP_CLIENT_ACCOUNTS
  218. echo 'priority.dnd=0' >> $XMPP_CLIENT_ACCOUNTS
  219. echo '[connection]' > /home/$new_username/.config/profanity/profrc
  220. if [[ $ONION_ONLY != "no" ]]; then
  221. echo "account=${new_username}@${XMPP_ONION_HOSTNAME}" >> /home/$new_username/.config/profanity/profrc
  222. else
  223. echo "account=${new_username}@${HOSTNAME}" >> /home/$new_username/.config/profanity/profrc
  224. fi
  225. echo '' >> /home/$new_username/.config/profanity/profrc
  226. echo '[plugins]' >> /home/$new_username/.config/profanity/profrc
  227. echo 'load=prof_omemo_plugin.py;' >> /home/$new_username/.config/profanity/profrc
  228. echo '' >> /home/$new_username/.config/profanity/profrc
  229. echo '[otr]' >> /home/$new_username/.config/profanity/profrc
  230. echo 'policy=opportunistic' >> /home/$new_username/.config/profanity/profrc
  231. echo 'log=off' >> /home/$new_username/.config/profanity/profrc
  232. echo '' >> /home/$new_username/.config/profanity/profrc
  233. echo '[pgp]' >> /home/$new_username/.config/profanity/profrc
  234. echo 'log=off' >> /home/$new_username/.config/profanity/profrc
  235. echo '' >> /home/$new_username/.config/profanity/profrc
  236. echo '[ui]' >> /home/$new_username/.config/profanity/profrc
  237. echo 'enc.warn=true' >> /home/$new_username/.config/profanity/profrc
  238. chown -R $new_username:$new_username /home/$new_username/.local
  239. chown -R $new_username:$new_username /home/$new_username/.config
  240. fi
  241. }
  242. function add_user_xmpp {
  243. new_username="$1"
  244. new_user_password="$2"
  245. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  246. ${PROJECT_NAME}-pass -u $new_username -a xmpp -p "$new_user_password"
  247. if [[ $ONION_ONLY != "no" ]]; then
  248. ${PROJECT_NAME}-addxmpp -e "$new_username@$XMPP_ONION_HOSTNAME" -p "$new_user_password"
  249. else
  250. ${PROJECT_NAME}-addxmpp -e "$new_username@$HOSTNAME" -p "$new_user_password"
  251. fi
  252. if [ ! "$?" = "0" ]; then
  253. echo '1'
  254. return
  255. fi
  256. add_user_xmpp_client "$new_username" "$new_user_password"
  257. echo '0'
  258. }
  259. function install_interactive_xmpp {
  260. echo -n ''
  261. APP_INSTALLED=1
  262. }
  263. function change_password_xmpp {
  264. curr_username="$1"
  265. new_user_password="$2"
  266. read_config_param DEFAULT_DOMAIN_NAME
  267. ${PROJECT_NAME}-pass -u $curr_username -a xmpp -p "$new_user_password"
  268. # TODO: this is currently interactive. Really there needs to be a
  269. # non-interactive password change option for prosodyctl
  270. clear
  271. echo ''
  272. echo $'Currently Prosody requires password changes to be done interactively'
  273. prosodyctl passwd ${curr_username}@${DEFAULT_DOMAIN_NAME}
  274. if [ -f /usr/local/bin/profanity ]; then
  275. XMPP_CLIENT_DIR=/home/$curr_username/.local/share/profanity
  276. XMPP_CLIENT_ACCOUNTS=$XMPP_CLIENT_DIR/accounts
  277. if [ -f $XMPP_CLIENT_ACCOUNTS ]; then
  278. sed -i "s|password=.*|password=$new_user_password|g" $XMPP_CLIENT_ACCOUNTS
  279. fi
  280. fi
  281. }
  282. function reconfigure_xmpp {
  283. echo -n ''
  284. }
  285. function update_prosody_modules {
  286. if [ ! $1 ]; then
  287. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  288. return
  289. fi
  290. fi
  291. if [ ! -d /usr/lib/prosody ]; then
  292. return
  293. fi
  294. if [ ! -f $INSTALL_DIR/$prosody_modules_filename ]; then
  295. # Obtain the modules
  296. if [ -f ~/freedombone/image_build/$prosody_modules_filename ]; then
  297. cp ~/freedombone/image_build/$prosody_modules_filename $INSTALL_DIR
  298. else
  299. if [ -f /home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename ]; then
  300. cp /home/$MY_USERNAME/freedombone/image_build/$prosody_modules_filename $INSTALL_DIR
  301. fi
  302. fi
  303. if [ -f $INSTALL_DIR/$prosody_modules_filename ]; then
  304. cd $INSTALL_DIR
  305. # Check the hash
  306. curr_hash=$(sha256sum $INSTALL_DIR/$prosody_modules_filename | awk -F ' ' '{print $1}')
  307. if [[ "$curr_hash" != "$prosody_modules_hash" ]]; then
  308. echo $'Prosody modules hash does not match'
  309. exit 83562
  310. else
  311. # Extract the modules
  312. if [ -d $INSTALL_DIR/prosody-modules ]; then
  313. rm -rf $INSTALL_DIR/prosody-modules
  314. fi
  315. tar -xzvf $prosody_modules_filename
  316. if [ -d $INSTALL_DIR/prosody-modules ]; then
  317. systemctl stop prosody
  318. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  319. mkdir -p /var/lib/prosody/prosody-modules
  320. fi
  321. cp -r $INSTALL_DIR/prosody-modules/* /var/lib/prosody/prosody-modules/
  322. cp -r $INSTALL_DIR/prosody-modules/* /usr/lib/prosody/modules/
  323. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  324. chown -R prosody:prosody /usr/lib/prosody/modules
  325. systemctl start prosody
  326. else
  327. echo $'Prosody modules not extracted'
  328. exit 72524
  329. fi
  330. fi
  331. fi
  332. fi
  333. if ! grep -q '"vcard"' /etc/prosody/prosody.cfg.lua; then
  334. systemctl stop prosody
  335. sed -i '/"pep"/a "vcard";' /etc/prosody/prosody.cfg.lua
  336. systemctl start prosody
  337. fi
  338. }
  339. function upgrade_xmpp {
  340. if [ -d /etc/letsencrypt ]; then
  341. prosody_groups=$(groups prosody)
  342. if [[ "$prosody_groups" != *'ssl-cert'* ]]; then
  343. usermod -a -G ssl-cert prosody
  344. fi
  345. fi
  346. function_check update_prosody_modules
  347. update_prosody_modules
  348. curr_prosody_filename=$(cat $COMPLETION_FILE | grep "prosody_filename" | awk -F ':' '{print $2}')
  349. if [[ "$curr_prosody_filename" != "$prosody_filename" ]]; then
  350. if [ -d ${INSTALL_DIR}/${prosody_filename} ]; then
  351. # ensure that the binaries have not been overwritten
  352. # by an operating system upgrade
  353. cd ${INSTALL_DIR}/${prosody_filename}
  354. make prefix=/usr install
  355. else
  356. cd $INSTALL_DIR
  357. # Try to get the source from the project repo
  358. if [ -f /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  359. cp /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  360. else
  361. if [ -f /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  362. cp /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  363. else
  364. wget $prosody_nightly_url
  365. fi
  366. fi
  367. if [ ! -f ${INSTALL_DIR}/${prosody_filename}.tar.gz ]; then
  368. echo $"Failed to download prosody nightly $prosody_nightly_url"
  369. return
  370. fi
  371. hash_value=$(sha256sum ${INSTALL_DIR}/${prosody_filename}.tar.gz | awk -F ' ' '{print $1}')
  372. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  373. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  374. echo $'Unexpected hash value for prosody nightly download'
  375. return
  376. fi
  377. tar -xzvf ${INSTALL_DIR}/${prosody_filename}.tar.gz
  378. cd ${INSTALL_DIR}/${prosody_filename}
  379. ./configure --ostype=debian --prefix=/usr
  380. make prefix=/usr
  381. make prefix=/usr install
  382. if [ -f /usr/local/bin/prosody ]; then
  383. echo $'Failed to build prosody nightly to /usr/bin'
  384. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  385. rm -rf ${INSTALL_DIR}/${prosody_filename}
  386. return
  387. fi
  388. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  389. fi
  390. # add onion addresses for known servers
  391. if ! grep -q "onions_map =" /etc/prosody/prosody.cfg.lua; then
  392. echo '' >> /etc/prosody/prosody.cfg.lua
  393. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  394. fi
  395. set_completion_param "prosody_filename" "${prosody_filename}"
  396. fi
  397. cp -r $INSTALL_DIR/prosody-modules/* /var/lib/prosody/prosody-modules/
  398. chown -R prosody:prosody /var/lib/prosody/prosody-modules
  399. systemctl restart prosody
  400. }
  401. function backup_local_xmpp {
  402. source_directory=/var/lib/prosody
  403. if [ -d $source_directory ]; then
  404. dest_directory=xmpp
  405. function_check backup_directory_to_usb
  406. backup_directory_to_usb $source_directory $dest_directory
  407. fi
  408. }
  409. function restore_local_xmpp {
  410. if [ -d /var/lib/prosody ]; then
  411. echo $"Restoring xmpp settings"
  412. temp_restore_dir=/root/tempxmpp
  413. function_check restore_directory_from_usb
  414. restore_directory_from_usb $temp_restore_dir xmpp
  415. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  416. if [ ! "$?" = "0" ]; then
  417. function_check set_user_permissions
  418. set_user_permissions
  419. function_check backup_unmount_drive
  420. backup_unmount_drive
  421. exit 725
  422. fi
  423. rm -rf $temp_restore_dir
  424. systemctl restart prosody
  425. chown -R prosody:prosody /var/lib/prosody/*
  426. echo $"Restore of xmpp settings complete"
  427. fi
  428. }
  429. function backup_remote_xmpp {
  430. if [ -d /var/lib/prosody ]; then
  431. echo $"Backing up the xmpp settings"
  432. backup_directory_to_friend /var/lib/prosody xmpp
  433. echo $"Backup of xmpp settings complete"
  434. fi
  435. }
  436. function restore_remote_xmpp {
  437. if [ -d /var/lib/prosody ]; then
  438. echo $"Restoring xmpp settings"
  439. temp_restore_dir=/root/tempxmpp
  440. function_check restore_directory_from_friend
  441. restore_directory_from_friend $temp_restore_dir xmpp
  442. cp -r $temp_restore_dir/var/lib/prosody/* /var/lib/prosody
  443. if [ ! "$?" = "0" ]; then
  444. exit 725
  445. fi
  446. rm -rf $temp_restore_dir
  447. systemctl restart prosody
  448. chown -R prosody:prosody /var/lib/prosody/*
  449. echo $"Restore of xmpp settings complete"
  450. fi
  451. }
  452. function configure_firewall_for_xmpp {
  453. if [ ! -d /etc/prosody ]; then
  454. return
  455. fi
  456. if [[ $(is_completed $FUNCNAME) == "1" ]]; then
  457. return
  458. fi
  459. if [[ $INSTALLED_WITHIN_DOCKER == "yes" ]]; then
  460. # docker does its own firewalling
  461. return
  462. fi
  463. if [[ $ONION_ONLY != "no" ]]; then
  464. return
  465. fi
  466. firewall_add XMPP 5222 tcp
  467. firewall_add XMPP 5223 tcp
  468. firewall_add XMPP 5269 tcp
  469. firewall_add XMPP 5280 tcp
  470. firewall_add XMPP 5281 tcp
  471. mark_completed $FUNCNAME
  472. }
  473. function remove_xmpp {
  474. remove_profanity
  475. remove_movim
  476. firewall_remove 5222 tcp
  477. firewall_remove 5223 tcp
  478. firewall_remove 5269 tcp
  479. firewall_remove 5280 tcp
  480. firewall_remove 5281 tcp
  481. function_check remove_onion_service
  482. remove_onion_service xmpp 5222 5223 5269
  483. apt-get -yq remove --purge prosody
  484. if [ -f $INSTALL_DIR/$prosody_modules_filename ]; then
  485. rm $INSTALL_DIR/$prosody_modules_filename
  486. fi
  487. if [ -d $INSTALL_DIR/prosody-modules ]; then
  488. rm -rf $INSTALL_DIR/prosody-modules
  489. fi
  490. if [ -d /etc/prosody ]; then
  491. rm -rf /etc/prosody
  492. fi
  493. if [ -d /var/lib/prosody ]; then
  494. rm -rf /var/lib/prosody
  495. fi
  496. if [ -d /usr/lib/prosody ]; then
  497. rm -rf /usr/lib/prosody
  498. fi
  499. if [ -f /usr/local/bin/prosody ]; then
  500. rm /usr/local/bin/prosody
  501. fi
  502. if [ -f /usr/local/bin/prosodyctl ]; then
  503. rm /usr/local/bin/prosodyctl
  504. fi
  505. groupdel prosody
  506. remove_completion_param install_xmpp
  507. sed -i '/xmpp/d' $COMPLETION_FILE
  508. sed -i '/prosody/d' $COMPLETION_FILE
  509. }
  510. function xmpp_email_headers {
  511. for d in /home/*/ ; do
  512. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  513. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  514. if [ -f /home/$USERNAME/.muttrc ]; then
  515. if ! grep -q "Jabber-ID" /home/$USERNAME/.muttrc; then
  516. echo "my_hdr Jabber-ID: ${USERNAME}@${HOSTNAME}" >> /home/$USERNAME/.muttrc
  517. fi
  518. fi
  519. fi
  520. done
  521. }
  522. function xmpp_modules {
  523. filename=$1
  524. echo 'modules_enabled = {' >> $filename
  525. echo ' "pubsub";' >> $filename
  526. echo ' "pubsub_hub";' >> $filename
  527. echo ' "dialback"; -- s2s dialback support' >> $filename
  528. echo ' "disco"; -- Service discovery' >> $filename
  529. echo ' "private"; -- Private XML storage (for room bookmarks, etc.)' >> $filename
  530. echo ' "version"; -- Replies to server version requests' >> $filename
  531. echo ' "uptime"; -- Report how long server has been running' >> $filename
  532. echo ' "time"; -- Let others know the time here on this server' >> $filename
  533. echo ' "ping"; -- Replies to XMPP pings with pongs' >> $filename
  534. echo ' "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands' >> $filename
  535. echo ' "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.' >> $filename
  536. echo ' "bosh"; -- Enable mod_bosh' >> $filename
  537. echo ' "tls"; -- Enable mod_tls' >> $filename
  538. echo ' "saslauth"; -- Enable mod_saslauth' >> $filename
  539. echo ' "onions"; -- Enable chat via onion service' >> $filename
  540. echo ' "mam"; -- Message archive management' >> $filename
  541. echo ' "csi"; -- Client state indication' >> $filename
  542. echo ' "carbons"; -- Message carbons' >> $filename
  543. echo ' "carbons_adhoc"; -- Message carbons' >> $filename
  544. echo ' "carbons_copies"; -- Message carbons' >> $filename
  545. echo ' "smacks"; -- Stream management' >> $filename
  546. echo ' "smacks_offline"; -- Stream management' >> $filename
  547. echo ' "pep"; -- Personal Eventing Protocol (to support OMEMO)' >> $filename
  548. echo ' "vcard"; -- Personal Eventing Protocol (to support OMEMO)' >> $filename
  549. echo ' "e2e_policy"; -- To support OMEMO' >> $filename
  550. echo ' "pep_vcard_avatar"; -- Personal Eventing Protocol (to support OMEMO)' >> $filename
  551. echo ' "blocklist"; -- Privacy lists' >> $filename
  552. echo ' "privacy_lists"; -- Privacy lists' >> $filename
  553. echo ' "blocking"; -- Blocking command' >> $filename
  554. echo ' "roster"; -- Roster versioning' >> $filename
  555. echo ' "offline_email"; -- If offline send to email' >> $filename
  556. echo ' "offline"; -- Store offline messages' >> $filename
  557. echo ' "http";' >> $filename
  558. echo ' "http_upload";' >> $filename
  559. echo ' "websocket";' >> $filename
  560. echo ' "throttle_presence"; -- Reduce battery and bandwidth usage' >> $filename
  561. echo ' "filter_chatstates"; -- Reduce battery and bandwidth usage' >> $filename
  562. echo '};' >> $filename
  563. }
  564. function xmpp_onion_addresses {
  565. filename=$1
  566. echo 'onions_map = {' >> $filename
  567. echo ' ["anonymitaet-im-inter.net"] = "rwf5skuv5vqzcdit.onion";' >> $filename
  568. echo ' ["autistici.org"] = "wi7qkxyrdpu5cmvr.onion";' >> $filename
  569. echo ' ["jabber.calyxinstitute.org"] = "ijeeynrc6x2uy5ob.onion";' >> $filename
  570. echo ' ["jabber.ccc.de"] = "okj7xc6j2szr2y75.onion";' >> $filename
  571. echo ' ["cloak.dk"] = "m2dsl4banuimpm6c.onion";' >> $filename
  572. echo ' ["jabber.cryptoparty.is"] = "cryjabkbdljzohnp.onion";' >> $filename
  573. echo ' ["daemons.cf"] = "daemon4jidu2oig6.onion";' >> $filename
  574. echo ' ["dukgo.com"] = "wlcpmruglhxp6quz.onion";' >> $filename
  575. echo ' ["evil.im"] = "evilxro6nvjuvxqo.onion";' >> $filename
  576. echo ' ["xmpp.evil.im"] = "evilxro6nvjuvxqo.onion";' >> $filename
  577. echo ' ["inventati.org"] = "wi7qkxyrdpu5cmvr.onion";' >> $filename
  578. echo ' ["jabber.ipredator.se"] = "3iffdebkzzkpgipa.onion";' >> $filename
  579. echo ' ["jabber-germany.de"] = "dbbrphko5tqcpar3.onion";' >> $filename
  580. echo ' ["kode.im"] = "ihkw7qy3tok45dun.onion";' >> $filename
  581. echo ' ["im.koderoot.net"] = "ihkw7qy3tok45dun.onion";' >> $filename
  582. echo ' ["adb-centralen.se"] = "37x6i3wgr2jyublb.onion";' >> $filename
  583. echo ' ["joelpurra.se"] = "37x6i3wgr2jyublb.onion";' >> $filename
  584. echo ' ["nordberg.se"] = "37x6i3wgr2jyublb.onion";' >> $filename
  585. echo ' ["jabber.lqdn.fr"] = "jabber63t4r2qi57.onion";' >> $filename
  586. echo ' ["jabber.otr.im"] = "5rgdtlawqkcplz75.onion";' >> $filename
  587. echo ' ["otromundo.cf"] = "arauemwe2utqqzye.onion";' >> $filename
  588. echo ' ["patchcord.be"] = "xsydhi3dnbjuatpz.onion";' >> $filename
  589. echo ' ["riseup.net"] = "4cjw6cwpeaeppfqz.onion";' >> $filename
  590. echo ' ["xmpp.riseup.net"] = "4cjw6cwpeaeppfqz.onion";' >> $filename
  591. echo ' ["rows.io"] = "yz6yiv2hxyagvwy6.onion";' >> $filename
  592. echo ' ["xmpp.rows.io"] = "yz6yiv2hxyagvwy6.onion";' >> $filename
  593. echo ' ["securejabber.me"] = "giyvshdnojeivkom.onion";' >> $filename
  594. echo ' ["so36.net"] = "s4fgy24e2b5weqdb.onion";' >> $filename
  595. echo ' ["jabber.so36.net"] = "s4fgy24e2b5weqdb.onion";' >> $filename
  596. echo ' ["jabber.systemli.org"] = "x5tno6mwkncu5m3h.onion";' >> $filename
  597. echo ' ["taolo.ga"] = "l3ybpw4vs6ie5rv2.onion";' >> $filename
  598. echo ' ["tchncs.de"] = "duvfmyqmdlyvc3mi.onion";' >> $filename
  599. echo ' ["wtfismyip.com"] = "ofkztxcohimx34la.onion";' >> $filename
  600. echo ' ["prosody.xmpp.is"] = "y2qmqomqpszzryei.onion";' >> $filename
  601. echo ' ["xndr.de"] = "trcubpttd6zkc3tf.onion";' >> $filename
  602. echo ' ["trashserver.net"] = "m4c722bvc2r7brnn.onion";' >> $filename
  603. echo '};' >> $filename
  604. }
  605. function xmpp_create_config {
  606. echo "admins = { \"$MY_USERNAME@$DEFAULT_DOMAIN_NAME\" }" > /etc/prosody/prosody.cfg.lua
  607. echo 'plugin_paths = { "/var/lib/prosody/prosody-modules" }' >> /etc/prosody/prosody.cfg.lua
  608. echo '' >> /etc/prosody/prosody.cfg.lua
  609. xmpp_modules /etc/prosody/prosody.cfg.lua
  610. echo '' >> /etc/prosody/prosody.cfg.lua
  611. xmpp_onion_addresses /etc/prosody/prosody.cfg.lua
  612. echo '' >> /etc/prosody/prosody.cfg.lua
  613. echo 'allow_registration = false;' >> /etc/prosody/prosody.cfg.lua
  614. echo '' >> /etc/prosody/prosody.cfg.lua
  615. echo 'daemonize = true;' >> /etc/prosody/prosody.cfg.lua
  616. echo '' >> /etc/prosody/prosody.cfg.lua
  617. echo 'pidfile = "/var/run/prosody/prosody.pid";' >> /etc/prosody/prosody.cfg.lua
  618. echo '' >> /etc/prosody/prosody.cfg.lua
  619. echo 'https_ports = { 5281 }' >> /etc/prosody/prosody.cfg.lua
  620. echo 'https_interfaces = { "*" }' >> /etc/prosody/prosody.cfg.lua
  621. echo 'https_ssl = {' >> /etc/prosody/prosody.cfg.lua
  622. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  623. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  624. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  625. else
  626. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  627. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  628. fi
  629. echo " curve = $XMPP_ECC_CURVE;" >> /etc/prosody/prosody.cfg.lua
  630. echo " ciphers = $XMPP_CIPHERS;" >> /etc/prosody/prosody.cfg.lua
  631. echo ' options = {"no_sslv2", "no_sslv3" };' >> /etc/prosody/prosody.cfg.lua
  632. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  633. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  634. else
  635. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  636. fi
  637. echo "}" >> /etc/prosody/prosody.cfg.lua
  638. echo '' >> /etc/prosody/prosody.cfg.lua
  639. echo 'ssl = {' >> /etc/prosody/prosody.cfg.lua
  640. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  641. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  642. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  643. else
  644. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  645. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  646. fi
  647. echo " curve = $XMPP_ECC_CURVE;" >> /etc/prosody/prosody.cfg.lua
  648. echo ' depth = "2";' >> /etc/prosody/prosody.cfg.lua
  649. echo " ciphers = $XMPP_CIPHERS;" >> /etc/prosody/prosody.cfg.lua
  650. echo ' options = {"no_sslv2", "no_sslv3" };' >> /etc/prosody/prosody.cfg.lua
  651. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  652. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  653. else
  654. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  655. fi
  656. echo '}' >> /etc/prosody/prosody.cfg.lua
  657. echo '' >> /etc/prosody/prosody.cfg.lua
  658. echo 'c2s_require_encryption = true' >> /etc/prosody/prosody.cfg.lua
  659. echo 's2s_require_encryption = true' >> /etc/prosody/prosody.cfg.lua
  660. echo '' >> /etc/prosody/prosody.cfg.lua
  661. echo 's2s_secure_auth = false' >> /etc/prosody/prosody.cfg.lua
  662. echo '' >> /etc/prosody/prosody.cfg.lua
  663. echo 'authentication = "internal_hashed"' >> /etc/prosody/prosody.cfg.lua
  664. echo '' >> /etc/prosody/prosody.cfg.lua
  665. echo 'storage = "sql"' >> /etc/prosody/prosody.cfg.lua
  666. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }' >> /etc/prosody/prosody.cfg.lua
  667. echo '' >> /etc/prosody/prosody.cfg.lua
  668. echo 'log = {' >> /etc/prosody/prosody.cfg.lua
  669. echo ' info = "/dev/null";' >> /etc/prosody/prosody.cfg.lua
  670. echo ' error = "/dev/null";' >> /etc/prosody/prosody.cfg.lua
  671. echo ' { levels = { "error" }; to = "/dev/null"; };' >> /etc/prosody/prosody.cfg.lua
  672. echo '}' >> /etc/prosody/prosody.cfg.lua
  673. echo '' >> /etc/prosody/prosody.cfg.lua
  674. if [[ $ONION_ONLY != 'no' ]]; then
  675. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"" >> /etc/prosody/prosody.cfg.lua
  676. else
  677. echo "VirtualHost \"${DEFAULT_DOMAIN_NAME}\"" >> /etc/prosody/prosody.cfg.lua
  678. fi
  679. echo ' ssl = {' >> /etc/prosody/prosody.cfg.lua
  680. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  681. echo " certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";" >> /etc/prosody/prosody.cfg.lua
  682. echo " key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";" >> /etc/prosody/prosody.cfg.lua
  683. else
  684. echo " certificate = \"/etc/ssl/certs/xmpp.crt\";" >> /etc/prosody/prosody.cfg.lua
  685. echo " key = \"/etc/ssl/private/xmpp.key\";" >> /etc/prosody/prosody.cfg.lua
  686. fi
  687. echo " curve = $XMPP_ECC_CURVE;" >> /etc/prosody/prosody.cfg.lua
  688. echo ' depth = "2";' >> /etc/prosody/prosody.cfg.lua
  689. echo " ciphers = $XMPP_CIPHERS;" >> /etc/prosody/prosody.cfg.lua
  690. echo ' options = {"no_sslv2", "no_sslv3" };' >> /etc/prosody/prosody.cfg.lua
  691. if [ -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  692. echo " dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  693. else
  694. echo " dhparam = \"/etc/ssl/certs/xmpp.dhparam\";" >> /etc/prosody/prosody.cfg.lua
  695. fi
  696. echo ' }' >> /etc/prosody/prosody.cfg.lua
  697. echo '' >> /etc/prosody/prosody.cfg.lua
  698. echo 'Include "conf.d/*.cfg.lua"' >> /etc/prosody/prosody.cfg.lua
  699. echo 'http_upload_path = "/var/lib/prosody/http_uploads"' >> /etc/prosody/prosody.cfg.lua
  700. echo 'http_upload_file_size_limit = 307200' >> /etc/prosody/prosody.cfg.lua
  701. echo '' >> /etc/prosody/prosody.cfg.lua
  702. echo "Component \"chat.${DEFAULT_DOMAIN_NAME}\" \"muc\"" >> /etc/prosody/prosody.cfg.lua
  703. echo ' name = "Chatrooms"' >> /etc/prosody/prosody.cfg.lua
  704. echo ' modules_enabled = {' >> /etc/prosody/prosody.cfg.lua
  705. echo ' "muc_limits";' >> /etc/prosody/prosody.cfg.lua
  706. echo ' "muc_log";' >> /etc/prosody/prosody.cfg.lua
  707. echo ' "mam_muc";' >> /etc/prosody/prosody.cfg.lua
  708. echo ' "muc_log_http";' >> /etc/prosody/prosody.cfg.lua
  709. echo ' }' >> /etc/prosody/prosody.cfg.lua
  710. echo 'storage = { muc_log = "sql"; }' >> /etc/prosody/prosody.cfg.lua
  711. echo 'sql = { driver = "SQLite3", database = "prosody.sqlite" }' >> /etc/prosody/prosody.cfg.lua
  712. echo 'muc_event_rate = 0.5;' >> /etc/prosody/prosody.cfg.lua
  713. echo 'muc_burst_factor = 10;' >> /etc/prosody/prosody.cfg.lua
  714. echo 'muc_log_by_default = false;' >> /etc/prosody/prosody.cfg.lua
  715. echo 'muc_log_all_rooms = false;' >> /etc/prosody/prosody.cfg.lua
  716. echo 'max_archive_query_results = 10;' >> /etc/prosody/prosody.cfg.lua
  717. echo 'max_history_messages = 10;' >> /etc/prosody/prosody.cfg.lua
  718. }
  719. function install_xmpp_nightly {
  720. if [ ! -d $INSTALL_DIR ]; then
  721. mkdir -p $INSTALL_DIR
  722. fi
  723. cd $INSTALL_DIR
  724. # Try to get the source from the project repo
  725. if [ -f /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  726. cp /root/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  727. else
  728. if [ -f /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz ]; then
  729. cp /home/${MY_USERNAME}/${PROJECT_NAME}/image_build/${prosody_filename}.tar.gz .
  730. else
  731. wget $prosody_nightly_url
  732. fi
  733. fi
  734. if [ ! -f ${INSTALL_DIR}/${prosody_filename}.tar.gz ]; then
  735. echo $"Failed to download prosody nightly $prosody_nightly_url"
  736. exit 78352
  737. fi
  738. hash_value=$(sha256sum ${INSTALL_DIR}/${prosody_filename}.tar.gz | awk -F ' ' '{print $1}')
  739. if [[ "$hash_value" != "$prosody_nightly_hash" ]]; then
  740. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  741. echo $'Unexpected hash value for prosody nightly download'
  742. exit 68224283
  743. fi
  744. tar -xzvf ${INSTALL_DIR}/${prosody_filename}.tar.gz
  745. cd ${INSTALL_DIR}/${prosody_filename}
  746. ./configure --ostype=debian --prefix=/usr
  747. make prefix=/usr
  748. make prefix=/usr install
  749. if [ -f /usr/local/bin/prosody ]; then
  750. echo $'Failed to build prosody nightly to /usr/bin'
  751. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  752. rm -rf ${INSTALL_DIR}/${prosody_filename}
  753. exit 628732
  754. fi
  755. rm ${INSTALL_DIR}/${prosody_filename}.tar.gz
  756. set_completion_param "prosody_filename" "${prosody_filename}"
  757. }
  758. function install_xmpp {
  759. if [ ! -d $INSTALL_DIR ]; then
  760. mkdir -p $INSTALL_DIR
  761. fi
  762. # remove any existing install attempt
  763. if [ -f $INSTALL_DIR/$prosody_modules_filename ]; then
  764. rm $INSTALL_DIR/$prosody_modules_filename
  765. fi
  766. if [ -d $INSTALL_DIR/prosody-modules ]; then
  767. rm -rf $INSTALL_DIR/prosody-modules
  768. fi
  769. update_prosody_modules
  770. # obtain a cert for the default domain
  771. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME} pem)" == "0" ]]; then
  772. create_site_certificate ${DEFAULT_DOMAIN_NAME} 'yes'
  773. if [[ $ONION_ONLY == 'no' ]]; then
  774. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME} pem)" == "0" ]]; then
  775. echo $'LetsEncrypt cert could not be obtained for xmpp'
  776. exit 72342
  777. fi
  778. fi
  779. fi
  780. apt-get -yq install lua-sec lua-bitop lua5.1 liblua5.1-dev
  781. apt-get -yq install libidn11-dev libssl-dev lua-dbi-sqlite3
  782. apt-get -yq install mercurial
  783. apt-get -yq install prosody
  784. if [ ! -f /usr/bin/hg ]; then
  785. echo $"Couldn't install mercurial"
  786. exit 52825
  787. fi
  788. if [ ! -d /etc/prosody ]; then
  789. echo $"ERROR: prosody does not appear to have installed. $CHECK_MESSAGE"
  790. exit 52367
  791. fi
  792. groupadd prosody
  793. if [ ! -d /var/lib/prosody/http_uploads ]; then
  794. mkdir -p /var/lib/prosody/http_uploads
  795. fi
  796. if [ ! -d /etc/prosody/conf.d ]; then
  797. mkdir -p /etc/prosody/conf.d
  798. fi
  799. chmod -R 700 /etc/prosody/conf.d
  800. chown -R prosody /var/lib/prosody
  801. chown -R prosody /etc/prosody/conf.d
  802. # install modules
  803. update_prosody_modules initial
  804. if [ ! -d /var/lib/prosody/prosody-modules ]; then
  805. echo $'No prosody modules available'
  806. exit 82634
  807. fi
  808. # create a certificate
  809. if [ ! -f /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem ]; then
  810. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  811. ${PROJECT_NAME}-addcert -h xmpp --dhkey ${DH_KEYLENGTH}
  812. check_certificates xmpp
  813. if [ ! -f /etc/ssl/certs/xmpp.crt ]; then
  814. echo $'Failed to create xmpp certificate'
  815. exit 72352
  816. fi
  817. if [ ! -f /etc/ssl/private/xmpp.key ]; then
  818. echo $'Failed to create xmpp private certificate'
  819. exit 36829
  820. fi
  821. chmod g=rX /etc/ssl/private/xmpp.key
  822. chmod g=rX /etc/ssl/certs/xmpp.*
  823. fi
  824. fi
  825. groupadd default
  826. chmod 600 /etc/shadow
  827. chmod 600 /etc/gshadow
  828. usermod -g default prosody
  829. chmod 0000 /etc/shadow
  830. chmod 0000 /etc/gshadow
  831. chown root:default /etc/ssl/private/xmpp.*
  832. chown root:default /etc/ssl/certs/xmpp.*
  833. chown root:default /etc/ssl/private/${DEFAULT_DOMAIN_NAME}.*
  834. chown root:default /etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.*
  835. cp -a /etc/prosody/conf.avail/example.com.cfg.lua /etc/prosody/conf.avail/xmpp.cfg.lua
  836. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME} pem)" == "1" ]]; then
  837. sed -i "s|key =.*|key = \"/etc/ssl/private/${DEFAULT_DOMAIN_NAME}.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  838. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.pem\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  839. else
  840. sed -i "s|key =.*|key = \"/etc/ssl/private/xmpp.key\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  841. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/xmpp.crt\";|g" /etc/prosody/conf.avail/xmpp.cfg.lua
  842. fi
  843. if ! grep -q "xmpp.dhparam" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  844. if [[ "$(cert_exists ${DEFAULT_DOMAIN_NAME})" == "1" ]]; then
  845. sed -i "/certificate =/a\ dhparam = \"/etc/ssl/certs/${DEFAULT_DOMAIN_NAME}.dhparam\";" /etc/prosody/conf.avail/xmpp.cfg.lua
  846. else
  847. sed -i '/certificate =/a\ dhparam = "/etc/ssl/certs/xmpp.dhparam";' /etc/prosody/conf.avail/xmpp.cfg.lua
  848. fi
  849. fi
  850. if ! grep -q 'options = {"no_sslv2", "no_sslv3" }' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  851. sed -i '/certificate =/a\ options = {"no_sslv2", "no_sslv3" };' /etc/prosody/conf.avail/xmpp.cfg.lua
  852. fi
  853. if ! grep -q 'ciphers =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  854. sed -i "/certificate =/a\ ciphers = $XMPP_CIPHERS;" /etc/prosody/conf.avail/xmpp.cfg.lua
  855. fi
  856. if ! grep -q 'depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  857. sed -i '/certificate =/a\ depth = "2";' /etc/prosody/conf.avail/xmpp.cfg.lua
  858. fi
  859. if ! grep -q 'curve =' /etc/prosody/conf.avail/xmpp.cfg.lua; then
  860. sed -i "/certificate =/a\ curve = $XMPP_ECC_CURVE;" /etc/prosody/conf.avail/xmpp.cfg.lua
  861. fi
  862. sed -i "s/example.com/$DEFAULT_DOMAIN_NAME/g" /etc/prosody/conf.avail/xmpp.cfg.lua
  863. sed -i 's/enabled = false -- Remove this line to enable this host//g' /etc/prosody/conf.avail/xmpp.cfg.lua
  864. if ! grep -q "modules_enabled" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  865. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  866. xmpp_modules /etc/prosody/conf.avail/xmpp.cfg.lua
  867. fi
  868. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  869. if ! grep -q "c2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  870. echo 'c2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  871. else
  872. sed -i 's|c2s_require_encryption.*|c2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  873. fi
  874. if ! grep -q "s2s_require_encryption" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  875. echo 's2s_require_encryption = true' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  876. else
  877. sed -i 's|s2s_require_encryption.*|s2s_require_encryption = true|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  878. fi
  879. if ! grep -q "allow_unencrypted_plain_auth" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  880. echo 'allow_unencrypted_plain_auth = false' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  881. else
  882. sed -i 's|allow_unencrypted_plain_auth.*|allow_unencrypted_plain_auth = false|g' /etc/prosody/conf.avail/xmpp.cfg.lua
  883. fi
  884. ln -sf /etc/prosody/conf.avail/xmpp.cfg.lua /etc/prosody/conf.d/xmpp.cfg.lua
  885. if [ ! -d /var/lib/tor ]; then
  886. echo $'No Tor installation found. xmpp onion site cannot be configured.'
  887. exit 877367
  888. fi
  889. if ! grep -q "hidden_service_xmpp" /etc/tor/torrc; then
  890. echo 'HiddenServiceDir /var/lib/tor/hidden_service_xmpp/' >> /etc/tor/torrc
  891. echo "HiddenServicePort 5222 127.0.0.1:5222" >> /etc/tor/torrc
  892. echo "HiddenServicePort 5269 127.0.0.1:5269" >> /etc/tor/torrc
  893. echo $'Added onion site for xmpp chat'
  894. fi
  895. onion_update
  896. wait_for_onion_service 'xmpp'
  897. if [ ! -f /var/lib/tor/hidden_service_xmpp/hostname ]; then
  898. echo $'xmpp onion site hostname not found'
  899. exit 65349
  900. fi
  901. XMPP_ONION_HOSTNAME=$(cat /var/lib/tor/hidden_service_xmpp/hostname)
  902. if ! grep -q "${XMPP_ONION_HOSTNAME}" /etc/prosody/conf.avail/xmpp.cfg.lua; then
  903. echo '' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  904. echo "VirtualHost \"${XMPP_ONION_HOSTNAME}\"" >> /etc/prosody/conf.avail/xmpp.cfg.lua
  905. echo ' modules_enabled = { "onions" };' >> /etc/prosody/conf.avail/xmpp.cfg.lua
  906. fi
  907. set_completion_param "xmpp onion domain" "${XMPP_ONION_HOSTNAME}"
  908. if [ -f $IMAGE_PASSWORD_FILE ]; then
  909. XMPP_PASSWORD="$(printf `cat $IMAGE_PASSWORD_FILE`)"
  910. else
  911. if [ ${#XMPP_PASSWORD} -lt 8 ]; then
  912. XMPP_PASSWORD="$(create_password ${MINIMUM_PASSWORD_LENGTH})"
  913. fi
  914. fi
  915. function_check configure_firewall_for_xmpp
  916. configure_firewall_for_xmpp
  917. xmpp_email_headers
  918. update_default_domain
  919. xmpp_create_config
  920. # TODO comment this out after debian supports prosody 0.10 or later
  921. install_xmpp_nightly
  922. chown -R prosody /etc/prosody
  923. chown -R prosody /var/lib/prosody
  924. chown -R prosody /usr/lib/prosody
  925. chmod -R 700 /etc/prosody/conf.d
  926. usermod -a -G www-data prosody
  927. if [ -d /etc/letsencrypt ]; then
  928. usermod -a -G ssl-cert prosody
  929. fi
  930. systemctl restart prosody
  931. if [[ $ONION_ONLY != 'no' ]]; then
  932. prosodyctl register $MY_USERNAME $XMPP_ONION_HOSTNAME "$XMPP_PASSWORD"
  933. else
  934. prosodyctl register $MY_USERNAME $DEFAULT_DOMAIN_NAME "$XMPP_PASSWORD"
  935. fi
  936. if [ ! "$?" = "0" ]; then
  937. echo ''
  938. echo ''
  939. systemctl status prosody -l
  940. echo ''
  941. echo ''
  942. which prosody
  943. which prosodyctl
  944. echo ''
  945. echo ''
  946. cat /etc/prosody/prosody.cfg.lua
  947. echo ''
  948. echo ''
  949. cat /etc/prosody/conf.avail/xmpp.cfg.lua
  950. echo ''
  951. echo ''
  952. #remove_xmpp
  953. echo $'Unable to register prosody user'
  954. exit 347682
  955. fi
  956. ${PROJECT_NAME}-pass -u $MY_USERNAME -a xmpp -p "$XMPP_PASSWORD"
  957. APP_INSTALLED=1
  958. }
  959. # NOTE: deliberately no exit 0