diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index 9aa86635..724baeb7 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -38,7 +38,7 @@ body: id: screenshots attributes: label: Screenshots, Videos, or Pastebins - description: If applicable, add screenshots and/or a short video to help explain your problem. You can use https://0bin.net for long error messages or logs. + description: If applicable, add screenshots and/or a short video to help explain your problem. You can use https://paste.sh for long error messages or logs. - type: textarea id: additional-context attributes: diff --git a/.github/workflows/check-code-with-shellcheck.yml b/.github/workflows/check-code-with-shellcheck.yml index 5f4ecf74..a5cab886 100644 --- a/.github/workflows/check-code-with-shellcheck.yml +++ b/.github/workflows/check-code-with-shellcheck.yml @@ -10,7 +10,7 @@ jobs: name: Github Actions runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 - name: Run Shellcheck uses: ludeeus/action-shellcheck@master with: diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index bf04e1f8..85629c25 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -11,7 +11,7 @@ jobs: name: Shellcheck testing runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v5 - name: shellcheck uses: reviewdog/action-shellcheck@v1 with: @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: spelling or typos - uses: actions/checkout@v3 + uses: actions/checkout@v5 - name: misspell uses: reviewdog/action-misspell@v1 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 73b413bc..959f3876 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ **Please note that BOTH disks need to be imported for the VM to function properly.** -- Check the latest commits here: https://github.com/nextcloud/vm/commits/master +- Check the latest commits here: https://github.com/nextcloud/vm/commits/main - Documentation can be found here: https://docs.hanssonit.se/s/W6fMouPiqQz3_Mog/virtual-machines-vm/d/W7Du9uPiqQz3_Mr1/nextcloud-vm-machine-configuration PR's are more than welcome. Happy Nextclouding! @@ -10,6 +10,13 @@ PR's are more than welcome. Happy Nextclouding! ### Different versions If you run Hyper-V or want 500 GB, 1 TB or 2 TB VM you can download it from [T&M Hansson IT's shop](https://shop.hanssonit.se/product-category/virtual-machine/nextcloud/). +## All future releases + +### Full changelog: +- [VM](https://github.com/nextcloud/vm/releases/) +- [Nextcloud](https://nextcloud.com/changelog/) + + ## 26.0.0 ### Full changelog: @@ -241,7 +248,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - Add the Azure kernel for Hyper-V VMs - Shorten the time files are stored in trashbin (can still be configured) - Escape all Apache Log dirs correctly -- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) +- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) - Minor bugfixes and improvements - And more... @@ -265,7 +272,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - ClamAV - improve weekly full-scan tremendously - Update geoblock database - april - Speed up the network check if the network already works -- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) +- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) - Minor bugfixes and improvements ### Full changelog: @@ -292,7 +299,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - Don't break update when enabling app - Fix not enabled PECL extensions - Prevent apps from breaking the update due to incompatibility -- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) +- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) - Minor bugfixes and improvements ### Full changelog: @@ -305,7 +312,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - Ask to get the latest `update.sh` script when running updates from `menu.sh` - Allow to reinstall Bitwarden RS also if local files are present - Updated geoblock database files -- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) +- Made some enhancements to scripts in the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) - Minor bugfixes and improvements ### Full changelog: @@ -377,7 +384,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - Allow to reinstall automatic updates - Improved partition check during the install-script - Fixed some typo's -- Added more options to the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) and made some enhancements +- Added more options to the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) and made some enhancements - Minor bugfixes and improvements @@ -415,7 +422,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - Fixed problems with static-ip - Added Docker migrate script - Fixed and issue with ClamAV -- Added more options to the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) and made some enhancements +- Added more options to the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) and made some enhancements - Minor bugfixes and improvements ### Full changelog: @@ -438,7 +445,7 @@ This release is quite huge, including Ubuntu 22.04 (minimal), PHP-FPM 8.1, and P - SMBmount: Introduce the option to customize the mount before adding as external storage to Nextcloud - SMBmount: Add the option to utilize inotify to actively watch over externally changed files and folders - Repository: cleanup by removing duplicate scripts and not-needed functions -- Repository: added the [not-supported folder](https://github.com/nextcloud/vm/tree/master/not-supported) with additional options like creating a SMB-server +- Repository: added the [not-supported folder](https://github.com/nextcloud/vm/tree/main/not-supported) with additional options like creating a SMB-server - Minor bugfixes and improvements diff --git a/README.md b/README.md index 447d6d34..4461bd35 100644 --- a/README.md +++ b/README.md @@ -17,12 +17,12 @@ Server installation. Simplified. :cloud: -------------------- ## Dependencies: -(Ubuntu Server 22.04 LTS *minimal* 64-bit) +(Ubuntu Server 24.04 LTS *minimal* 64-bit)
-(Linux Kernel: 5.15) +(Linux Kernel: 6.8) - Apache 2.4 -- PostgreSQL 14 -- PHP-FPM 8.1 +- PostgreSQL 16 +- PHP-FPM 8.3 - Redis Memcache (latest stable version from PECL) - PHP-igbinary (latest stable version from PECL - PHP-smbclient (latest stable version from PECL) @@ -32,15 +32,15 @@ Server installation. Simplified. :cloud: * [Create a PR](https://help.github.com/articles/creating-a-pull-request/) and improve the code * Report [your issue](https://github.com/nextcloud/vm/issues/new) * Help us with [existing issues](https://github.com/nextcloud/vm/issues) -* Test what's not yet released into the stable VM. Please have a look at [this subfolder](https://github.com/nextcloud/vm/tree/master/not-supported) for further information. +* Test what's not yet released into the stable VM. Please have a look at [this subfolder](https://github.com/nextcloud/vm/tree/main/not-supported) for further information. * Write scripts so that the release process becomes automated with [Vagrant](https://www.vagrantup.com/docs/getting-started/), [Terraform](https://www.terraform.io/) or similar * **[Donate](https://shop.hanssonit.se/product-category/donate/) or buy our [pre-configured VMs](https://shop.hanssonit.se/product-category/virtual-machine/): 500 GB, 1 TB, 2TB for both VMware, Hyper-V and [more](https://docs.hanssonit.se/s/W6fMouPiqQz3_Mog/virtual-machines-vm/d/W7Du9uPiqQz3_Mr1/nextcloud-vm-machine-configuration?currentPageId=bls17dahv0jgrltpif20)** **FYI** -Developed by [Daniel Hansson](https://github.com/enoch85) and the Nextcloud community. Nextcloud GmbH does not offer support for the VM in the [master branch](https://github.com/nextcloud/vm/tree/master) (full-version), as we only support manual tarball/zip-package installations. You can download the official Nextcloud VM appliance ([also from this repo](https://github.com/nextcloud/vm/tree/official-basic-vm)) from [our website](https://download.nextcloud.com/vm/Official-Nextcloud-VM.zip) to get a stripped down version for testing if you rather want to skip all the manual steps in our documentation. +Developed by [Daniel Hansson](https://github.com/enoch85) and the Nextcloud community. Nextcloud GmbH does not offer support for the VM in the [main branch](https://github.com/nextcloud/vm/tree/main) (full-version), as we only support manual tarball/zip-package installations. You can download the official Nextcloud VM appliance ([also from this repo](https://github.com/nextcloud/vm/tree/official-basic-vm)) from [our website](https://download.nextcloud.com/vm/Official-Nextcloud-VM.zip) to get a stripped down version for testing if you rather want to skip all the manual steps in our documentation. -If you want support regarding the full-version VM in master, please contact our partner [Hansson IT](https://www.hanssonit.se/nextcloud-vm). +If you want support regarding the full-version VM in main, please contact our partner [Hansson IT](https://www.hanssonit.se/nextcloud-vm). ## Full documentation * [VM](https://docs.hanssonit.se/s/W6fMouPiqQz3_Mog/virtual-machines-vm/d/W6fMquPiqQz3_Moi/nextcloud-vm) (the easiest option) @@ -66,7 +66,7 @@ Please keep in mind that this is only intended for testing and might crash your The `nextcloud_install_production.sh` script can be run as part of Vagrant provisioning. -See [this subrepo](https://github.com/nextcloud/vm/tree/master/vagrant) for more information. +See [this subrepo](https://github.com/nextcloud/vm/tree/main/vagrant) for more information. Please report any issues you can find. Improvements are welcome! @@ -106,17 +106,18 @@ Please report any issues you can find. Improvements are welcome! * You? :) ## Special thanks to -* [Ezra Holm](https://github.com/ezraholm50) @ [Tech and Me](https://www.techandme.se) +* Ezra Holm @ [Tech and Me](https://www.techandme.se) * [Luis Guzman](https://github.com/Ark74) @ [SwITNet](https://switnet.net) * [Stefan Heitmüller](https://github.com/morph027) @ [morph027's Blog](https://morph027.gitlab.io/) * [Lorenzo Faleschini](https://github.com/penzoiders) * [Georg Großmann](https://github.com/ggeorgg) * [liao20081228](https://github.com/liao20081228) * [aaaskew](https://github.com/aaaskew) +* IP address data powered by [IPinfo](https://ipinfo.io/) -[Nextcloud Server]: https://bit.ly/2CHIUkA -[app store]: https://bit.ly/2HUy4v9 -[\*nix]: https://bit.ly/2UaCC7b -[A+ security-rated]: https://bit.ly/2mvlyJ3 -[Collabora Online]: https://bit.ly/2WjVVZ8 -[ONLYOFFICE]: https://bit.ly/2FA0TKj +[Nextcloud Server]: http://shortio.hanssonit.se/r1Rx0GqXa9 +[app store]: http://shortio.hanssonit.se/Rz1GEXt9dL +[\*nix]: http://shortio.hanssonit.se/52hOTQbhdh +[A+ security-rated]: http://shortio.hanssonit.se/aMTjg0SJi3 +[Collabora Online]: http://shortio.hanssonit.se/IKjBoOfQOT +[ONLYOFFICE]: http://shortio.hanssonit.se/oRLShCfRK3 diff --git a/addons/0-byte-files.sh b/addons/0-byte-files.sh index d4de307d..d7971d29 100644 --- a/addons/0-byte-files.sh +++ b/addons/0-byte-files.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Check for 0-Byte files" # shellcheck source=lib.sh diff --git a/addons/automatic_updates.sh b/addons/automatic_updates.sh index 7ca3c874..bd7c9460 100644 --- a/addons/automatic_updates.sh +++ b/addons/automatic_updates.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Automatic Updates" @@ -42,7 +42,7 @@ mkdir -p "$VMLOGS"/updates crontab -u root -l | { cat; echo "0 $AUT_UPDATES_TIME * 1-12 6 $SCRIPTS/update.sh minor >> $VMLOGS/updates/update-\$(date +\%Y-\%m-\%d_\%H:\%M).log 2>&1"; } | crontab -u root - if yesno_box_yes "Do you want to reboot your server after every update? *recommended*" then - sed -i "s|exit|/sbin/shutdown -r +1|g" "$SCRIPTS"/update.sh + sed -i "s|exit|/sbin/shutdown -r +10|g" "$SCRIPTS"/update.sh echo "exit" >> "$SCRIPTS"/update.sh fi diff --git a/addons/cookielifetime.sh b/addons/cookielifetime.sh index b9c1e929..a1f39d66 100644 --- a/addons/cookielifetime.sh +++ b/addons/cookielifetime.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Set Cookie Lifetime" diff --git a/addons/database_shrinking.sh b/addons/database_shrinking.sh index fb5577c9..6d468771 100644 --- a/addons/database_shrinking.sh +++ b/addons/database_shrinking.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/addons/deSEC/desec.sh b/addons/deSEC/desec.sh index 4355ff4a..1bdba972 100644 --- a/addons/deSEC/desec.sh +++ b/addons/deSEC/desec.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="deSEC Registration" @@ -140,9 +140,9 @@ then # Add DNS renewals with the deSEC hoock script print_text_in_color "$ICyan" "Preparing for DNS-renewals..." mkdir -p "$SCRIPTS"/deSEC - curl_to_dir "https://raw.githubusercontent.com/nextcloud/vm/master/addons/deSEC" "hook.sh" "$SCRIPTS"/deSEC + curl_to_dir "https://raw.githubusercontent.com/nextcloud/vm/main/addons/deSEC" "hook.sh" "$SCRIPTS"/deSEC chmod +x "$SCRIPTS"/deSEC/hook.sh - curl_to_dir "https://raw.githubusercontent.com/nextcloud/vm/master/addons/deSEC" ".dedynauth" "$SCRIPTS"/deSEC + curl_to_dir "https://raw.githubusercontent.com/nextcloud/vm/main/addons/deSEC" ".dedynauth" "$SCRIPTS"/deSEC check_command sed -i "s|DEDYN_TOKEN=.*|DEDYN_TOKEN=$DEDYNAUTHTOKEN|g" "$SCRIPTS"/deSEC/.dedynauth check_command sed -i "s|DEDYN_NAME=.*|DEDYN_NAME=$DEDYNDOMAIN|g" "$SCRIPTS"/deSEC/.dedynauth msg_box "DNS updates for deSEC are now set. This means you don't have to open any ports (80|443) for the renewal process since deSEC TLS renewals will be run with a built in hook. \ @@ -150,7 +150,7 @@ The hook files will end up in $SCRIPTS/deSEC, please don't touch that folder unl You can read more about it here: https://github.com/desec-io/desec-certbot-hook Please remember that you still need to open the port you choose to make your server publicly available. -You can read more about that here: https://goo.gl/iUGE2U" +You can read more about that here: http://shortio.hanssonit.se/ffOQOXS6Kh" # Run the TLS script run_script LETS_ENC activate-tls diff --git a/addons/deSEC/desec_subdomain.sh b/addons/deSEC/desec_subdomain.sh index 83ccf0a2..bf81f371 100644 --- a/addons/deSEC/desec_subdomain.sh +++ b/addons/deSEC/desec_subdomain.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="deSEC Subdomain" diff --git a/addons/deSEC/remove_desec.sh b/addons/deSEC/remove_desec.sh index 0c8dfe53..c17ec584 100644 --- a/addons/deSEC/remove_desec.sh +++ b/addons/deSEC/remove_desec.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="deSEC Removal" diff --git a/addons/fix_invalid_modification_time.sh b/addons/fix_invalid_modification_time.sh index c48ef820..212fb5fa 100644 --- a/addons/fix_invalid_modification_time.sh +++ b/addons/fix_invalid_modification_time.sh @@ -1,6 +1,7 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ +# Based on: https://raw.githubusercontent.com/nextcloud-gmbh/mtime_fixer_tool_kit/main/solvable_files.sh true SCRIPT_NAME="Fix 'Could not update metadata due to invalid modified time'." @@ -24,9 +25,6 @@ msg_box "OK, let's go! Please note, this script might take several hours to run, depening on the size of your datadir. Don't abort it!" -# Download the script -curl_to_dir https://raw.githubusercontent.com/nextcloud-gmbh/mtime_fixer_tool_kit/master solvable_files.sh $NCPATH - # Run all the needed variables ncdb @@ -38,8 +36,7 @@ fi # Run the script and remove it print_text_in_color "$ICyan" "Running the scan and fixing broken files..." -bash "$NCPATH"/solvable_files.sh "$NCDATA" "$NCDBTYPE" "$NCDBHOST" "$NCDBUSER" "$NCDBPASS" "$NCDB" fix use_birthday verbose -rm "$NCPATH"/solvable_files.sh +run_script ADDONS solvable_files # Scan all files nextcloud_occ files:scan --all diff --git a/addons/locales.sh b/addons/locales.sh index 8bb3e0bb..41fa32f3 100644 --- a/addons/locales.sh +++ b/addons/locales.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Locales" @@ -30,6 +30,14 @@ then elif [ "$KEYBOARD_LAYOUT" = "de" ] then sudo locale-gen "de_DE.UTF-8" && sudo dpkg-reconfigure --frontend=noninteractive locales + # Set a better mirror (only for German servers) + if grep -r archive.ubuntu.com /etc/apt/sources.list + then + sed -i "s|http://archive.ubuntu.com|https://ftp.uni-stuttgart.de|g" /etc/apt/sources.list + elif grep -r de.archive.ubuntu.com /etc/apt/sources.list + then + sed -i "s|http://de.archive.ubuntu.com|https://ftp.uni-stuttgart.de|g" /etc/apt/sources.list + fi elif [ "$KEYBOARD_LAYOUT" = "fr" ] then sudo locale-gen "fr_FR.UTF-8" && sudo dpkg-reconfigure --frontend=noninteractive locales diff --git a/addons/locate_mirror.sh b/addons/locate_mirror.sh index e3074b00..ac67cd26 100644 --- a/addons/locate_mirror.sh +++ b/addons/locate_mirror.sh @@ -1,57 +1,85 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true -SCRIPT_NAME="Locate Mirror" +SCRIPT_NAME="Locate mirror" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh - -# Must be root -root_check - -# Use another method if the new one doesn't work -if [ -z "$REPO" ] -then - REPO=$(apt-get update -q4 && apt-cache policy | grep http | tail -1 | awk '{print $2}') -fi - -# Check where the best mirrors are and update -msg_box "To make downloads as fast as possible when updating Ubuntu \ +SCRIPT_EXPLAINER="To make downloads as fast as possible when updating Ubuntu \ you should download mirrors that are as geographically close to you as possible. Please note that there are no guarantees that the download mirrors \ this script finds will remain for the lifetime of this server. Because of this, we don't recommend that you change the mirror unless you live far away from the default. -This is the method used: https://github.com/jblakeman/apt-select" -msg_box "Your current server repository is: $REPO" +This is the method used: https://github.com/vegardit/fast-apt-mirror.sh" +# Check for errors + debug code and abort if something isn't right +# 1 = ON +# 0 = OFF +DEBUG=0 +debug_mode + +# Must be root +root_check + +# Check if Locate Mirror is already installed +if ! [ -f /usr/local/bin/fast-apt-mirror ] +then + # Ask for installing + install_popup "$SCRIPT_NAME" +else + # Ask for removal or reinstallation + reinstall_remove_menu "$SCRIPT_NAME" + # Removal + rm -f /usr/local/bin/fast-apt-mirror + rm -f /etc/apt/sources.list.backup + # Show successful uninstall if applicable + removal_popup "$SCRIPT_NAME" +fi + +# Install +install_if_not bash +install_if_not curl +install_if_not apt-transport-https +install_if_not ca-certificates +curl_to_dir https://raw.githubusercontent.com/vegardit/fast-apt-mirror.sh/v1/ fast-apt-mirror.sh /usr/local/bin +mv /usr/local/bin/fast-apt-mirror.sh /usr/local/bin/fast-apt-mirror +chmod 755 /usr/local/bin/fast-apt-mirror + +# Check current mirror +CURRENT_MIRROR="$(fast-apt-mirror current)" +msg_box "Current mirror is $CURRENT_MIRROR" + +# Ask if ! yesno_box_no "Do you want to try to find a better mirror?" then - print_text_in_color "$ICyan" "Keeping $REPO as mirror..." + print_text_in_color "$ICyan" "Keeping $CURRENT_MIRROR as mirror..." sleep 1 else - if [[ "$KEYBOARD_LAYOUT" =~ ,|/|_ ]] + if [[ "$KEYBOARD_LAYOUT" =~ ,|/|_ ]] then - msg_box "Your keymap contains more than one language, or a special character. ($KEYBOARD_LAYOUT) -This script can only handle one keymap at the time.\nThe default mirror ($REPO) will be kept." + msg_box "Your keymap (country code) contains more than one language, or a special character. ($KEYBOARD_LAYOUT) +This script can only handle one keymap at the time.\nThe default mirror ($CURRENT_MIRROR) will be kept." exit 1 fi + # Find + FIND_MIRROR="$(fast-apt-mirror find -v --healthchecks 100 --speedtests 10 --country "$KEYBOARD_LAYOUT")" print_text_in_color "$ICyan" "Locating the best mirrors..." - curl_to_dir https://bootstrap.pypa.io get-pip.py /tmp - install_if_not python3 - install_if_not python3-testresources - install_if_not python3-distutils - cd /tmp && python3 get-pip.py - pip install \ - --upgrade pip \ - apt-select - check_command apt-select -m up-to-date -t 4 -c -C "$KEYBOARD_LAYOUT" - sudo cp /etc/apt/sources.list /etc/apt/sources.list.backup && \ - if [ -f sources.list ] + if [ "$CURRENT_MIRROR" != "$FIND_MIRROR" ] then - sudo mv sources.list /etc/apt/ + if yesno_box_yes "Do you want to replace the $CURRENT_MIRROR with $FIND_MIRROR?" + then + # Backup + cp -f /etc/apt/sources.list /etc/apt/sources.list.backup + # Replace + if fast-apt-mirror set "$FIND_MIRROR" + then + msg_box "Your Ubuntu repo was successfully changed to $FIND_MIRROR" + fi + fi + else + msg_box "You already have the fastest mirror available, congrats!" fi - msg_box "The apt-mirror was successfully changed." fi diff --git a/addons/redis-server-ubuntu.sh b/addons/redis-server-ubuntu.sh index cec4b13a..7a16837d 100644 --- a/addons/redis-server-ubuntu.sh +++ b/addons/redis-server-ubuntu.sh @@ -4,7 +4,7 @@ SCRIPT_NAME="Redis Server Ubuntu" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -16,9 +16,9 @@ debug_mode root_check # Check Ubuntu version -if ! version 18.04 "$DISTRO" 22.04.10 +if ! version 18.04 "$DISTRO" 24.04.10 then - msg_box "Your current Ubuntu version is $DISTRO but must be between 18.04 - 22.04.10 to run this script." + msg_box "Your current Ubuntu version is $DISTRO but must be between 18.04 - 24.04.10 to run this script." msg_box "Please contact us to get support for upgrading your server: https://www.hanssonit.se/#contact https://shop.hanssonit.se/" @@ -34,15 +34,40 @@ fi # Check the current PHPVER check_php +if is_this_installed redis-server +then + print_text_in_color "$ICyan" "Removing old Redis server installation..." + if nextcloud_occ_no_check -V + then + # Remove the config from Nextclouds config.php + nextcloud_occ config:system:delete memcache.local + nextcloud_occ config:system:delete memcache.distributed + nextcloud_occ config:system:delete filelocking.enabled + nextcloud_occ config:system:delete memcache.locking + nextcloud_occ config:system:delete redis password + nextcloud_occ config:system:delete redis + # Check that everything is functioning + nextcloud_occ -V + fi + if pecl list | grep -q redis + then + pecl uninstall redis + fi + apt-get purge redis-server -y + apt-get autoremove -y + apt-get autoclean +fi + # Install Redis +print_text_in_color "$ICyan" "Installing Redis server..." install_if_not php"$PHPVER"-dev pecl channel-update pecl.php.net if ! yes no | pecl install -Z redis then - msg_box "PHP module installation failed" + msg_box "Redis PHP module installation failed" exit 1 else - printf "${IGreen}\nPHP module installation OK!${Color_Off}\n" + print_text_in_color "$IGreen" "Redis PHP module installation OK!" fi if [ ! -f $PHP_MODS_DIR/redis.ini ] then @@ -56,26 +81,6 @@ then fi install_if_not redis-server -# Prepare for adding redis configuration -sed -i "s|);||g" $NCPATH/config/config.php - -# Add the needed config to Nextclouds config.php -cat <> $NCPATH/config/config.php - 'memcache.local' => '\\OC\\Memcache\\Redis', - 'filelocking.enabled' => true, - 'memcache.distributed' => '\\OC\\Memcache\\Redis', - 'memcache.locking' => '\\OC\\Memcache\\Redis', - 'redis' => - array ( - 'host' => '$REDIS_SOCK', - 'port' => 0, - 'timeout' => 0.5, - 'dbindex' => 0, - 'password' => '$REDIS_PASS', - ), -); -ADD_TO_CONFIG - ## Redis performance tweaks ## if ! grep -Fxq "vm.overcommit_memory = 1" /etc/sysctl.conf then @@ -95,19 +100,31 @@ fi # sysctl -w net.core.somaxconn=512 # echo "net.core.somaxconn = 512" >> /etc/sysctl.conf #fi + +# Set redis options sed -i "s|# unixsocket .*|unixsocket $REDIS_SOCK|g" $REDIS_CONF sed -i "s|# unixsocketperm .*|unixsocketperm 777|g" $REDIS_CONF sed -i "s|^port.*|port 0|" $REDIS_CONF -sed -i "s|# requirepass .*|requirepass $REDIS_PASS|g" $REDIS_CONF sed -i 's|# rename-command CONFIG ""|rename-command CONFIG ""|' $REDIS_CONF -redis-cli SHUTDOWN +systemctl restart redis-server + +# Add the needed config to Nextclouds config.php +# Redis needs to be set first for the connection, else it will fail. +nextcloud_occ config:system:set redis host --value="$REDIS_SOCK" +nextcloud_occ config:system:set redis port --value=0 +nextcloud_occ config:system:set redis dbindex --value=0 +nextcloud_occ config:system:set redis timeout --value=0.5 + +nextcloud_occ config:system:set memcache.local --value='\OC\Memcache\Redis' +nextcloud_occ config:system:set filelocking.enabled --value='true' +nextcloud_occ config:system:set memcache.distributed --value='\OC\Memcache\Redis' +nextcloud_occ config:system:set memcache.locking --value='\OC\Memcache\Redis' # Secure Redis chown redis:root /etc/redis/redis.conf chmod 600 /etc/redis/redis.conf -apt-get update -q4 & spinner_loading -apt-get autoremove -y -apt-get autoclean - -exit +# Set password +sed -i "s|# requirepass .*|requirepass $REDIS_PASS|g" $REDIS_CONF +nextcloud_occ config:system:set redis password --value="$REDIS_PASS" +systemctl restart redis-server diff --git a/addons/security.sh b/addons/security.sh index 92123a93..471e9bf2 100644 --- a/addons/security.sh +++ b/addons/security.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Extra Security" diff --git a/addons/smtp-mail.sh b/addons/smtp-mail.sh index 2dd24599..83a1c801 100644 --- a/addons/smtp-mail.sh +++ b/addons/smtp-mail.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -148,6 +148,17 @@ fi # Enter the recipient RECIPIENT=$(input_box_flow "Please enter the recipient email address that shall receive all mails.\nE.g. recipient@mail.com") +# Check if the server use self-signed certificates +if yesno_box_no "Does the SMTP-server use self-signed certificates?" +then + SELF_SIGNED_CERT=yes + nextcloud_occ config:system:set mail_smtpstreamoptions ssl allow_self_signed --value=true --type=boolean + nextcloud_occ config:system:set mail_smtpstreamoptions ssl verify_peer --value=false --type=boolean + nextcloud_occ config:system:set mail_smtpstreamoptions ssl verify_peer_name --value=false --type=boolean +else + SELF_SIGNED_CERT=no +fi + # Present what we gathered, if everything okay, write to files msg_box "These are the settings that will be used. Please check that everything seems correct. @@ -156,11 +167,13 @@ Encryption=$PROTOCOL SMTP Port=$SMTP_PORT SMTP Username=$MAIL_USERNAME SMTP Password=$MAIL_PASSWORD -Recipient=$RECIPIENT" +Recipient=$RECIPIENT +Self-signed TLS/SSL certificate=$SELF_SIGNED_CERT" # Ask if everything is okay if ! yesno_box_yes "Does everything look correct?" then + msg_box "OK, please start over by running this script again." exit fi diff --git a/addons/solvable_files.sh b/addons/solvable_files.sh new file mode 100644 index 00000000..4383c58a --- /dev/null +++ b/addons/solvable_files.sh @@ -0,0 +1,99 @@ +#!/bin/bash + +# Based on: https://raw.githubusercontent.com/nextcloud-gmbh/mtime_fixer_tool_kit/main/solvable_files.sh + +true +SCRIPT_NAME="Fix 'Could not update metadata due to invalid modified time'." +# shellcheck source=lib.sh +source /var/scripts/fetch_lib.sh + +# Get needed variables for database management +ncdb + +# Check if root +root_check + +#2023-05-04 Customized the original script to fit the Nextcloud VM users setup. Also fixed some shellcheck issues. + +data_dir="$(realpath "$NCDATA")" +export data_dir +export db_type=$NCDBTYPE +export db_host=$NCDBHOST +export db_user=$NCDBUSER +export db_pwd=$NCDBPASS +export db_name=$NCDB +export action=fix +export scan_action=noscan +export use_birthday=use_birthday +export verbose=verbose + +# In case you're using a different database table prefix, set this to your config's `dbtableprefix` value. +export dbtableprefix="oc_" + +# 1. Return if fs mtime <= 86400 +# 2. Compute username from filepath +# 3. Query mtime from the database with the filename and the username +# 4. Return if mtime_on_fs != mtime_in_db +# 5. Correct the fs mtime with touch (optionally using the files change date/timestamp) +correct_mtime() { + filepath=$NCDATA + + if [ ! -e "$filepath" ] + then + echo "File or directory $filepath does not exist. Skipping." + return + fi + + relative_filepath="${filepath/#$data_dir\//}" + mtime_on_fs="$(stat -c '%Y' "$filepath")" + + username=$relative_filepath + while [ "$(dirname "$username")" != "." ] + do + username=$(dirname "$username") + done + + relative_filepath_without_username="${relative_filepath/#$username\//}" + + base64_relative_filepath="$(printf '%s' "$relative_filepath" | base64)" + base64_relative_filepath_without_username="$(printf '%s' "$relative_filepath_without_username" | base64)" + + if [ "$username" == "__groupfolders" ] + then + mtime_in_db=$(sudo -u postgres psql nextcloud_db --tuples-only --no-align -c "SELECT mtime FROM ${dbtableprefix}storages JOIN ${dbtableprefix}filecache ON ${dbtableprefix}storages.numeric_id = ${dbtableprefix}filecache.storage WHERE ${dbtableprefix}storages.id='local::$data_dir/' AND ${dbtableprefix}filecache.path=CONVERT_FROM(DECODE('$base64_relative_filepath', 'base64'), 'UTF-8')") + else + mtime_in_db=$(sudo -u postgres psql nextcloud_db --tuples-only --no-align -c "SELECT mtime FROM ${dbtableprefix}storages JOIN ${dbtableprefix}filecache ON ${dbtableprefix}storages.numeric_id = ${dbtableprefix}filecache.storage WHERE ${dbtableprefix}storages.id='home::$username' AND ${dbtableprefix}filecache.path=CONVERT_FROM(DECODE('$base64_relative_filepath_without_username', 'base64'), 'UTF-8')") + fi + + if [ "$mtime_in_db" == "" ] + then + echo "No mtime in database. File not indexed. Skipping $filepath" + return + fi + + if [ "$mtime_in_db" != "$mtime_on_fs" ] + then + echo "mtime in database do not match fs mtime (fs: $mtime_on_fs, db: $mtime_in_db). Skipping $filepath" + return + fi + + if [ -e "$filepath" ] + then + newdate=$(stat -c "%w" "$filepath") + if [ "$newdate" == "-" ] + then + newdate=$(stat -c "%z" "$filepath") + touch -c -d "$newdate" "$filepath" + else + touch -c "$filepath" + fi + echo mtime for "$filepath" updated to "$(stat -c "%y" "$filepath")" + elif [ ! -e "$filepath" ] + then + echo "File or directory $filepath does not exist. Skipping." + return + fi +} +export -f correct_mtime + +find "$data_dir" -type f ! -newermt "@86400" -exec bash -c 'correct_mtime "$0"' {} \; diff --git a/apps/adminer.sh b/apps/adminer.sh index e78753bc..10745512 100644 --- a/apps/adminer.sh +++ b/apps/adminer.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Adminer" @@ -28,6 +28,7 @@ else # Removal check_external_ip # Check that the script can see the external IP (apache fails otherwise) a2disconf adminer.conf + restart_webserver rm -f $ADMINER_CONF rm -rf $ADMINERDIR check_command apt-get purge adminer -y @@ -51,12 +52,16 @@ a2enmod ssl # Install Adminer apt-get update -q4 & spinner_loading install_if_not adminer -curl_to_dir "http://www.adminer.org" "latest.php" "$ADMINERDIR" -curl_to_dir "https://raw.githubusercontent.com/Niyko/Hydra-Dark-Theme-for-Adminer/master" "adminer.css" "$ADMINERDIR" -ln -s "$ADMINERDIR"/latest.php "$ADMINERDIR"/adminer.php +curl_to_dir "https://download.adminerevo.org/latest/adminer" "adminer-pgsql.zip" "$ADMINERDIR" +install_if_not unzip +# Unzip the latest version +unzip "$ADMINERDIR"/adminer-pgsql.zip -d "$ADMINERDIR" +rm -f "$ADMINERDIR"/adminer-pgsql.zip +# curl_to_dir "https://raw.githubusercontent.com/Niyko/Hydra-Dark-Theme-for-Adminer/master" "adminer.css" "$ADMINERDIR" +mv "$ADMINERDIR"/adminer-pgsql.php "$ADMINERDIR"/adminer.php -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi @@ -64,6 +69,46 @@ fi # Get PHP version for the conf file check_php +# shellcheck disable=2154 + +# Add ability to add plugins easily +cat << ADMINER_CREATE_PLUGIN > "$ADMINER_CONF_PLUGIN" + "$ADMINER_CONF" RewriteEngine On @@ -107,7 +152,7 @@ Listen 9443 DirectoryIndex adminer.php - AllowOverride None + AllowOverride All # Only allow connections from localhost: Require ip $GATEWAY/24 @@ -130,7 +175,6 @@ The script will exit." exit 1 else # Allow local access: - check_command sed -i "s|local all postgres peer|local all postgres md5|g" /etc/postgresql/*/main/pg_hba.conf restart_webserver diff --git a/apps/bitwarden_mailconfig.sh b/apps/bitwarden_mailconfig.sh index 47eb33b4..46eb759d 100644 --- a/apps/bitwarden_mailconfig.sh +++ b/apps/bitwarden_mailconfig.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Bitwarden Mail Configuration" diff --git a/apps/bitwarden_registration.sh b/apps/bitwarden_registration.sh index c37aeee5..8f1bc414 100644 --- a/apps/bitwarden_registration.sh +++ b/apps/bitwarden_registration.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Bitwarden Registration" diff --git a/apps/bpytop.sh b/apps/bpytop.sh index 7fe9e57c..117e6cee 100644 --- a/apps/bpytop.sh +++ b/apps/bpytop.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="BPYTOP" diff --git a/apps/clamav.sh b/apps/clamav.sh index 67fee1db..3aaa6c4f 100644 --- a/apps/clamav.sh +++ b/apps/clamav.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="ClamAV" @@ -101,7 +101,7 @@ install_and_enable_app files_antivirus nextcloud_occ config:app:set files_antivirus av_mode --value="socket" nextcloud_occ config:app:set files_antivirus av_socket --value="/var/run/clamav/clamd.ctl" nextcloud_occ config:app:set files_antivirus av_stream_max_length --value="1048576000" -nextcloud_occ config:app:set files_antivirus av_max_file_size --value="-1" +nextcloud_occ config:app:set files_antivirus av_max_file_size --value="1048576000" nextcloud_occ config:app:set files_antivirus av_infected_action --value="only_log" # Create av notification script @@ -198,7 +198,7 @@ esac cat << CLAMAV_REPORT > "$SCRIPTS"/clamav-fullscan.sh #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ source /var/scripts/fetch_lib.sh @@ -246,6 +246,11 @@ fi INFECTED_FILES_LOG="\$(sed -n '/----------- SCAN SUMMARY -----------/,\$p' $VMLOGS/clamav-fullscan.log)" INFECTED_FILES="\$(grep 'FOUND$' $VMLOGS/clamav-fullscan.log)" +if [ -z "$INFECTED_FILES" ] +then + INFECTED_FILES="No infected files found" +fi + # Send notification if ! send_mail "Your weekly full-scan ClamAV report" "\$INFECTED_FILES_LOG\n \$INFECTED_FILES" diff --git a/apps/collabora_docker.sh b/apps/collabora_docker.sh index e0c3812c..cb59e030 100644 --- a/apps/collabora_docker.sh +++ b/apps/collabora_docker.sh @@ -1,12 +1,12 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Collabora (Docker)" SCRIPT_EXPLAINER="This script will install the Collabora Office Server bundled with Docker" # shellcheck source=lib.sh -source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # To work with https://github.com/nextcloud/richdocuments/pull/2235 # Check for errors + debug code and abort if something isn't right @@ -57,7 +57,7 @@ NCDOMAIN=$(nextcloud_occ_no_check config:system:get overwrite.cli.url | sed 's|h # Curl the library another time to get the correct https_conf # shellcheck source=lib.sh -source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # Get all needed variables from the library nc_update @@ -135,8 +135,8 @@ a2enmod proxy_http a2enmod ssl a2enmod headers -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi diff --git a/apps/collabora_integrated.sh b/apps/collabora_integrated.sh index fdd2c3fa..e933ac8f 100644 --- a/apps/collabora_integrated.sh +++ b/apps/collabora_integrated.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Collabora (Integrated)" diff --git a/apps/extract.sh b/apps/extract.sh index b003d263..382b816b 100644 --- a/apps/extract.sh +++ b/apps/extract.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/apps/face-recognition.sh b/apps/face-recognition.sh index 77c51ac3..e30d6ac2 100644 --- a/apps/face-recognition.sh +++ b/apps/face-recognition.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Redirect to Recognize" diff --git a/apps/fail2ban.sh b/apps/fail2ban.sh index e79e2259..b2c887f0 100644 --- a/apps/fail2ban.sh +++ b/apps/fail2ban.sh @@ -1,11 +1,11 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ -# Inspired by https://github.com/nextcloud/nextcloudpi/blob/master/etc/nextcloudpi-config.d/fail2ban.sh +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ +# Inspired by https://github.com/nextcloud/nextcloudpi/blob/main/etc/nextcloudpi-config.d/fail2ban.sh true SCRIPT_NAME="Fail2ban" -SCRIPT_EXPLAINER="Fail2ban provides extra Brute Force protextion for Nextcloud. +SCRIPT_EXPLAINER="Fail2ban provides extra Brute Force protection for Nextcloud. It scans the Nextcloud and SSH log files and bans IPs that show malicious \ signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to \ @@ -221,7 +221,7 @@ fi # Create Fail2ban report script cat << FAIL2BAN_REPORT > "$SCRIPTS/daily_fail2ban_report.sh" #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Look for ip addresses BANNED_IPS=\$(grep "Ban " /var/log/fail2ban.log | grep "\$(date +%Y-%m-%d)" \ diff --git a/apps/fulltextsearch.sh b/apps/fulltextsearch.sh index 13bf983a..1c8d5b9c 100644 --- a/apps/fulltextsearch.sh +++ b/apps/fulltextsearch.sh @@ -1,19 +1,18 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ -# SwITNet Ltd © - 2023, https://switnet.net/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ +# SwITNet Ltd © - 2024, https://switnet.net/ true SCRIPT_NAME="Full Text Search" -SCRIPT_EXPLAINER="Full Text Search provides OpenSearch for Nextcloud, which makes it possible to search for text inside files." +SCRIPT_EXPLAINER="Full Text Search provides ElastichSearch for Nextcloud, which makes it possible to search for text inside files." # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh # Get all needed variables from the library -ncdb nc_update -opensearch_install -ncdomain +ncdb +fulltextsearch_install # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -24,24 +23,41 @@ debug_mode # Must be root root_check -# Nextcloud 21 is required. -lowest_compatible_nc 21 +# Nextcloud 26 is required. +lowest_compatible_nc 26 # Check if Full Text Search is already installed -if ! does_this_docker_exist "$nc_fts" && ! does_this_docker_exist "$opens_fts" && ! is_app_installed fulltextsearch +if ! does_this_docker_exist docker.elastic.co/elasticsearch/elasticsearch && ! is_app_installed fulltextsearch then # Ask for installing install_popup "$SCRIPT_NAME" else # Ask for removal or reinstallation reinstall_remove_menu "$SCRIPT_NAME" + # Remove live service + systemctl stop "$FULLTEXTSEARCH_SERVICE" + systemctl disable "$FULLTEXTSEARCH_SERVICE" + rm -f "$FULLTEXTSEARCH_SERVICE" # Reset Full Text Search to be able to index again, and also remove the app to be able to install it again - nextcloud_occ_no_check fulltextsearch:reset + nextcloud_occ_no_check fulltextsearch:stop + install_if_not expect + REMOVE_FTS_INDEX=$(expect -c " + set timeout 3 + spawn sudo -u www-data php $NCPATH/occ fulltextsearch:reset + expect \"Do you really want to reset your indexed documents ? (y/N)\" + send \"y\r\" + expect \"Please confirm this destructive operation by typing 'reset ALL ALL':\" + send \"reset ALL ALL\r\" + expect eof + ") + echo "$REMOVE_FTS_INDEX" + apt -y purge expect # Drop database tables sudo -Hiu postgres psql "$NCDB" -c "DROP TABLE oc_fulltextsearch_ticks;" sudo -Hiu postgres psql "$NCDB" -c "DROP TABLE oc_fulltextsearch_index;" sudo -Hiu postgres psql "$NCDB" -c "DELETE FROM oc_migrations WHERE app='fulltextsearch';" sudo -Hiu postgres psql "$NCDB" -c "DELETE FROM oc_preferences WHERE appid='fulltextsearch';" + # Remove apps APPS=(fulltextsearch fulltextsearch_elasticsearch files_fulltextsearch) for app in "${APPS[@]}" do @@ -50,20 +66,26 @@ else nextcloud_occ app:remove "$app" fi done - # Removal Docker image - docker_prune_this "$nc_fts" - docker_prune_volume "esdata" - docker-compose_down "$OPNSDIR/docker-compose.yml" - # Remove configuration files - rm -rf "$RORDIR" - rm -rf "$OPNSDIR" + # Removal Elastichsearch Docker image + docker_prune_this "docker.elastic.co/elasticsearch/elasticsearch" + if docker network ls | grep "$FULLTEXTSEARCH_IMAGE_NAME"-network + then + docker network rm "$FULLTEXTSEARCH_IMAGE_NAME"-network + fi + rm -rf "$FULLTEXTSEARCH_DIR" # Show successful uninstall if applicable removal_popup "$SCRIPT_NAME" - apt-get purge docker-compose -y fi -# Test RAM size (4GB min) + CPUs (min 2) -ram_check 4 FullTextSearch +# Check if version tag is available +if [ -z "$FULLTEXTSEARCH_IMAGE_NAME_LATEST_TAG" ] +then + msg_box "The Elasticsearch version tag is not available, please report this to $ISSUES" + exit 1 +fi + +# Test RAM size (6GB min) + CPUs (min 2) +ram_check 6 FullTextSearch cpu_check 2 FullTextSearch # Make sure there is an Nextcloud installation @@ -89,6 +111,23 @@ then deluser --group solr fi +# Removal Opensearch Docker image +if does_this_docker_exist "$nc_fts" || does_this_docker_exist "$opens_fts" +then + docker_prune_this "$nc_fts" + docker_prune_this "$opens_fts" + docker_prune_volume "esdata" + nextcloud_occ fulltextsearch:migration:24 + if docker network ls | grep opensearch_fts_os-net + then + docker network rm opensearch_fts_os-net + fi + # Remove configuration files + rm -rf "$RORDIR" + rm -rf "$OPNSDIR" + apt-get purge docker-compose -y +fi + # Check if the app is compatible with the current Nextcloud version if ! install_and_enable_app fulltextsearch then @@ -97,98 +136,23 @@ fi # Check & install docker install_docker -install_if_not docker-compose set_max_count -mkdir -p "$OPNSDIR" -docker pull "$opens_fts" -BCRYPT_HASH="$(docker run --rm -it $opens_fts \ - bash -c "plugins/opensearch-security/tools/hash.sh -p $OPNSREST | tr -d ':\n' ")" -# Create configurations YML -# opensearch.yml -cat << YML_OPENSEARCH > $OPNSDIR/opensearch.yml -cluster.name: docker-cluster -# Avoid Docker assigning IP. -network.host: 0.0.0.0 - -# Declaring single node cluster. -discovery.type: single-node - -######## Start Security Configuration ######## -plugins.security.ssl.transport.pemcert_filepath: node.pem -plugins.security.ssl.transport.pemkey_filepath: node-key.pem -plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -plugins.security.ssl.transport.enforce_hostname_verification: false - -# Disable ssl at REST as Fulltextsearch can't accept self-signed CA certs. -plugins.security.ssl.http.enabled: false -#plugins.security.ssl.http.pemcert_filepath: node.pem -#plugins.security.ssl.http.pemkey_filepath: node-key.pem -#plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem -plugins.security.allow_unsafe_democertificates: false -plugins.security.allow_default_init_securityindex: true -plugins.security.authcz.admin_dn: - - 'CN=admin,OU=FTS,O=OPENSEARCH,L=VM,ST=NEXTCLOUD,C=CA' -plugins.security.nodes_dn: - - 'CN=${NCDOMAIN},OU=FTS,O=OPENSEARCH,L=VM,ST=NEXTCLOUD,C=CA' - -plugins.security.audit.type: internal_opensearch -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] -node.max_local_storage_nodes: 1 -######## End Security Configuration ######## -YML_OPENSEARCH - -# internal_users.yml -cat << YML_INTERNAL_USERS > $OPNSDIR/internal_users.yml -_meta: - type: "internalusers" - config_version: 2 - -${INDEX_USER}: - hash: "${BCRYPT_HASH}" - reserved: true - backend_roles: - - "admin" - description: "admin user for fts at opensearch." -YML_INTERNAL_USERS - -# roles_mapping.yml -cat << YML_ROLES_MAPPING > $OPNSDIR/roles_mapping.yml -_meta: - type: "rolesmapping" - config_version: 2 - -# Roles mapping -all_access: - reserved: false - backend_roles: - - "admin" - description: "Maps admin to all_access" -YML_ROLES_MAPPING - -# docker-compose.yml -cat << YML_DOCKER_COMPOSE > $OPNSDIR/docker-compose.yml -version: '3' +mkdir -p "$FULLTEXTSEARCH_DIR" +cat << YML_DOCKER_COMPOSE > "$FULLTEXTSEARCH_DIR/docker-compose.yaml" services: - fts_os-node: - image: opensearchproject/opensearch:1 - container_name: fts_os-node + elasticsearch: + image: docker.elastic.co/elasticsearch/elasticsearch:$FULLTEXTSEARCH_IMAGE_NAME_LATEST_TAG + container_name: $FULLTEXTSEARCH_IMAGE_NAME restart: always - command: - - sh - - -c - - "/usr/share/opensearch/bin/opensearch-plugin list | grep -q ingest-attachment \ - || /usr/share/opensearch/bin/opensearch-plugin install --batch ingest-attachment ; - ./opensearch-docker-entrypoint.sh" + ports: + - 127.0.0.1:9200:9200 environment: - - cluster.name=fts_os-cluster - - node.name=fts_os-node - - bootstrap.memory_lock=true - - "OPENSEARCH_JAVA_OPTS=-Xms1024M -Xmx1024M" + - discovery.type=single-node + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=false + - "ES_JAVA_OPTS=-Xms2g -Xmx2g" + - ELASTIC_PASSWORD=$ELASTIC_USER_PASSWORD ulimits: memlock: soft: -1 @@ -196,87 +160,81 @@ services: nofile: soft: 65536 hard: 65536 - volumes: - - fts_os-data:/usr/share/opensearch/data - - $OPNSDIR/root-ca.pem:/usr/share/opensearch/config/root-ca.pem - - $OPNSDIR/node.pem:/usr/share/opensearch/config/node.pem - - $OPNSDIR/node-key.pem:/usr/share/opensearch/config/node-key.pem - - $OPNSDIR/admin.pem:/usr/share/opensearch/config/admin.pem - - $OPNSDIR/admin-key.pem:/usr/share/opensearch/config/admin-key.pem - - $OPNSDIR/opensearch.yml:/usr/share/opensearch/config/opensearch.yml - - $OPNSDIR/internal_users.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/internal_users.yml - - $OPNSDIR/roles_mapping.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/roles_mapping.yml - ports: - - 127.0.0.1:9200:9200 - - 127.0.0.1:9600:9600 # Performance Analyzer [1] networks: - - fts_os-net + - $FULLTEXTSEARCH_IMAGE_NAME-network volumes: - fts_os-data: - + $FULLTEXTSEARCH_IMAGE_NAME-data: networks: - fts_os-net: - -#[1] https://github.com/opensearch-project/performance-analyzer + $FULLTEXTSEARCH_IMAGE_NAME-network: YML_DOCKER_COMPOSE -# Prepare certs -create_certs "$NCDOMAIN" +# Start the docker image +cd "$FULLTEXTSEARCH_DIR" +docker compose up -d -# Set permissions -chmod 744 -R $OPNSDIR +# Check if online +until curl -sS "http://elastic:$ELASTIC_USER_PASSWORD@localhost:9200/_cat/health?h=status" | grep -q "green\|yellow" +do + countdown "Waiting for ElasticSearch to come online, please don't abort..." "10" +done -# Launch docker-compose -cd $OPNSDIR -docker-compose up -d +# Check logs +print_text_in_color "$ICyan" "Checking logs..." +docker logs "$FULLTEXTSEARCH_IMAGE_NAME" -# Wait for bootstrapping -if [ "$(nproc)" -gt 2 ] -then - countdown "Waiting for Docker bootstrapping..." "60" -else - countdown "Waiting for Docker bootstrapping..." "120" -fi - -# Make sure password setup is enforced. -docker-compose exec fts_os-node \ - bash -c "cd \ - plugins/opensearch-security/tools/ && \ - bash securityadmin.sh -f \ - ../securityconfig/internal_users.yml \ - -t internalusers \ - -icl \ - -nhnv \ - -cacert ../../../config/root-ca.pem \ - -cert ../../../config/admin.pem \ - -key ../../../config/admin-key.pem && \ - chmod 0600 ../../../config/root-ca.pem ../../../config/admin.pem ../../../config/admin-key.pem" - -docker logs $fts_node +countdown "Waiting a bit more before testing..." "10" # Get Full Text Search app for nextcloud install_and_enable_app fulltextsearch install_and_enable_app fulltextsearch_elasticsearch install_and_enable_app files_fulltextsearch -chown -R www-data:www-data $NC_APPS_PATH +chown -R www-data:www-data "$NC_APPS_PATH" # Final setup nextcloud_occ fulltextsearch:configure '{"search_platform":"OCA\\FullTextSearch_Elasticsearch\\Platform\\ElasticSearchPlatform"}' -nextcloud_occ fulltextsearch_elasticsearch:configure "{\"elastic_host\":\"http://${INDEX_USER}:${OPNSREST}@localhost:9200\",\"elastic_index\":\"${INDEX_USER}-index\"}" +nextcloud_occ fulltextsearch_elasticsearch:configure "{\"elastic_host\":\"http://elastic:$ELASTIC_USER_PASSWORD@localhost:9200\",\"elastic_index\":\"${NEXTCLOUD_INDEX}\"}" nextcloud_occ files_fulltextsearch:configure "{\"files_pdf\":\"1\",\"files_office\":\"1\"}" +# Add SystemD service for live indexing +cat << SYSTEMCTL_FTS > "/etc/systemd/system/$FULLTEXTSEARCH_SERVICE" +[Unit] +Description=Elasticsearch Worker for Nextcloud FullTextSearch +After=network.target + +[Service] +User=www-data +Group=www-data +WorkingDirectory=$NCPATH +ExecStart=/usr/bin/php $NCPATH/occ fulltextsearch:live -q +ExecStop=/usr/bin/php $NCPATH/occ fulltextsearch:stop +Nice=19 +Restart=always + +[Install] +WantedBy=multi-user.target +SYSTEMCTL_FTS + # Wait further for cache for index to work countdown "Waiting for a few seconds before indexing starts..." "10" if nextcloud_occ fulltextsearch:test then + # Turn off swap temporarily https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html + print_text_in_color "Turning of swap temporarily..." + swapoff -a if nextcloud_occ fulltextsearch:index < /dev/null then msg_box "Full Text Search was successfully installed!" + # Enable the live service + systemctl enable "$FULLTEXTSEARCH_SERVICE" + systemctl start "$FULLTEXTSEARCH_SERVICE" fi else msg_box "There seems to be an issue with the Full Text Search test. Please report this to $ISSUES." fi +# Turn on swap again +swapon -a + # Make sure the script exists exit diff --git a/apps/imaginary.sh b/apps/imaginary.sh index cd8be0e8..c477982e 100644 --- a/apps/imaginary.sh +++ b/apps/imaginary.sh @@ -1,8 +1,8 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE +# https://github.com/nextcloud/vm/blob/main/LICENSE true SCRIPT_NAME="Imaginary Docker" @@ -21,14 +21,21 @@ debug_mode root_check # Check recources -ram_check 4 -cpu_check 2 +# If we can calculate the cpu and ram, then set it to the lowest possible, if not, then hardcode it to a recomended minimum. +if which nproc >/dev/null 2>&1 +then + ram_check 2 Imaginary + cpu_check 2 Imaginary +else + ram_check 4 Imaginary + cpu_check 2 Imaginary +fi # Compatible with NC24 and above lowest_compatible_nc 26 # Check if Imaginary is already installed -if ! does_this_docker_exist nextcloud/aio-imaginary +if ! does_this_docker_exist nextcloud/aio-imaginary && ! does_this_docker_exist ghcr.io/nextcloud-releases/aio-imaginary then # Ask for installing install_popup "$SCRIPT_NAME" @@ -39,7 +46,8 @@ else if yesno_box_yes "Do you want to remove the Imaginary and all it's settings?" then # Remove docker container - docker_prune_this 'nextcloud/aio-imaginary' + docker_prune_this 'nextcloud/aio-imaginary' 'imaginary' + docker_prune_this 'ghcr.io/nextcloud-releases/aio-imaginary' 'imaginary' # reset the preview formats nextcloud_occ config:system:delete "preview_imaginary_url" nextcloud_occ config:system:delete "enabledPreviewProviders" @@ -62,13 +70,13 @@ else fi # Remove everything that is related to previewgenerator -if is_app_enabled previewgenerator +if crontab -u www-data -l | grep -q "preview:pre-generate" then if yesno_box_yes "We noticed that you have Preview Generator enabled. Imagniary replaces this, and the old app Preview Generator is now legacy.\nWe recommend you to remove it. Do you want to do that?" then # Remove the app - nextcloud_occ app:remove previewgenerator - # Reset the cronjob + nextcloud_occ_no_check app:remove previewgenerator + # Remove the cronjob crontab -u www-data -l | grep -v 'preview:pre-generate' | crontab -u www-data - # Remove dependecies DEPENDENCY=(php-imagick php"$PHPVER"-imagick libmagickcore-6.q16-3-extra imagemagick-6.q16-extra) @@ -90,8 +98,10 @@ This will most likely clear a lot of space! Also, pre-generated previews are not rm -rfv "$NCDATA"/appdata_*/preview/* print_text_in_color "$ICyan" "Scanning Nextclouds appdata directory after removing all previews. \ This can take a while..." + # Don't execute the update before all cronjobs are finished + check_running_cronjobs nextcloud_occ files:scan-app-data preview -vvv - msg_box "All previews were successfully removed." + print_text_in_color "$IGreen" "All previews were successfully removed." fi # Remove log rm -f "$VMLOGS"/previewgenerator.log @@ -101,8 +111,8 @@ fi install_docker # Pull and start -docker pull nextcloud/aio-imaginary:latest -docker run -t -d -p 127.0.0.1:9000:9000 --restart always --name imaginary nextcloud/aio-imaginary -concurrency 50 -enable-url-source -log-level debug +docker pull ghcr.io/nextcloud-releases/aio-imaginary:latest +docker run -t -d -p 127.0.0.1:9000:9000 --restart always --name imaginary ghcr.io/nextcloud-releases/aio-imaginary –cap-add=sys_nice -concurrency 50 -enable-url-source -return-size -log-level debug # Test if imaginary is working countdown "Testing if it works in 3 sedonds" "3" @@ -133,6 +143,7 @@ fi # Set providers (https://github.com/nextcloud/server/blob/master/lib/private/Preview/Imaginary.php#L60) # https://github.com/nextcloud/vm/issues/2465 +# Already enabled: https://github.com/nextcloud/server/blob/5e96228eb1f7999a327dacab22055ec2aa8e28a3/lib/private/Preview/Imaginary.php#L60 nextcloud_occ config:system:set enabledPreviewProviders 0 --value="OC\\Preview\\Imaginary" nextcloud_occ config:system:set enabledPreviewProviders 1 --value="OC\\Preview\\Image" nextcloud_occ config:system:set enabledPreviewProviders 2 --value="OC\\Preview\\MarkDown" @@ -140,13 +151,16 @@ nextcloud_occ config:system:set enabledPreviewProviders 3 --value="OC\\Preview\\ nextcloud_occ config:system:set enabledPreviewProviders 4 --value="OC\\Preview\\TXT" nextcloud_occ config:system:set enabledPreviewProviders 5 --value="OC\\Preview\\OpenDocument" nextcloud_occ config:system:set enabledPreviewProviders 6 --value="OC\\Preview\\Movie" +nextcloud_occ config:system:set enabledPreviewProviders 7 --value="OC\\Preview\\Krita" +nextcloud_occ config:system:set enabledPreviewProviders 8 --value="OC\Preview\ImaginaryPDF" nextcloud_occ config:system:set preview_imaginary_url --value="http://127.0.0.1:9000" # Set general values nextcloud_occ config:system:set preview_max_x --value="2048" nextcloud_occ config:system:set preview_max_y --value="2048" -nextcloud_occ config:system:set jpeg_quality --value="60" nextcloud_occ config:system:set preview_max_memory --value="256" +nextcloud_occ config:system:set preview_format --value="webp" +nextcloud_occ config:app:set preview webp_quality --value="65" if docker logs imaginary then diff --git a/apps/midnight-commander.sh b/apps/midnight-commander.sh index 002a060b..f90fd31b 100644 --- a/apps/midnight-commander.sh +++ b/apps/midnight-commander.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/apps/netdata.sh b/apps/netdata.sh index e47673ff..f02d2b5e 100644 --- a/apps/netdata.sh +++ b/apps/netdata.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Netdata" @@ -22,16 +22,6 @@ debug_mode # Must be sudo root_check -# Can't be run as pure root user -if [ -z "$UNIXUSER" ] -then - msg_box "You can't run this script as a pure root user. You need to issue the following command: -sudo -u regular_user sudo bash $SCRIPTS/menu.sh - -Then choose Additional Apps --> Netdata" - exit 1 -fi - # Check if netdata is already installed if ! [ -d /etc/netdata ] then @@ -63,6 +53,8 @@ else rm -rf /etc/netdata apt-get purge netdata -y apt-get autoremove -y + rm -rf /var/cache/netdata + rm -rf /var/log/netdata # Show successful uninstall if applicable removal_popup "$SCRIPT_NAME" fi @@ -71,8 +63,8 @@ fi is_process_running dpkg is_process_running apt apt-get update -q4 & spinner_loading -curl_to_dir https://my-netdata.io kickstart.sh $SCRIPTS -sudo -u "$UNIXUSER" bash $SCRIPTS/kickstart.sh --reinstall-even-if-unsafe --non-interactive --no-updates --stable-channel --disable-cloud +curl_to_dir https://get.netdata.cloud kickstart.sh $SCRIPTS +bash $SCRIPTS/kickstart.sh --reinstall-even-if-unsafe --non-interactive --no-updates --stable-channel --disable-cloud rm -f $SCRIPTS/kickstart.sh # Check Netdata instructions after script is done diff --git a/apps/notify_push.sh b/apps/notify_push.sh index cc5452c1..7cca8a85 100644 --- a/apps/notify_push.sh +++ b/apps/notify_push.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -39,16 +39,14 @@ then exit 1 fi # Check TLS -NCDOMAIN=$(nextcloud_occ_no_check config:system:get overwrite.cli.url | sed 's|https://||;s|/||') -if ! curl -s https://"$NCDOMAIN"/status.php | grep -q 'installed":true' +check_nextcloud_https "Notify Push" + +# Get the NCDOMAIN variable +if [ -z "$NCDOMAIN" ] then - msg_box "It seems like Nextcloud is not installed or that you don't use https on: -$NCDOMAIN. -Please install Nextcloud and make sure your domain is reachable, or activate TLS -on your domain to be able to run this script. -If you use the Nextcloud VM you can use the Let's Encrypt script to get TLS and activate your Nextcloud domain." - exit 1 + ncdomain fi + # Check apache conf if ! [ -f "$SITES_AVAILABLE/$NCDOMAIN.conf" ] then diff --git a/apps/onlyoffice_docker.sh b/apps/onlyoffice_docker.sh index 3a45dac4..df5a1b1e 100644 --- a/apps/onlyoffice_docker.sh +++ b/apps/onlyoffice_docker.sh @@ -31,6 +31,7 @@ else nextcloud_occ config:system:delete allow_local_remote_servers nextcloud_occ config:system:delete onlyoffice nextcloud_occ config:system:delete onlyoffice jwt_secret + nextcloud_occ config:app:delete onlyoffice jwt_secret nextcloud_occ config:system:delete onlyoffice jwt_header # Show successful uninstall if applicable removal_popup "$SCRIPT_NAME" @@ -151,8 +152,8 @@ a2enmod proxy_http a2enmod ssl a2enmod headers -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi @@ -262,6 +263,7 @@ then # Allow remote servers with local addresses e.g. in federated shares, webcal services and more nextcloud_occ config:system:set allow_local_remote_servers --value="true" nextcloud_occ config:system:set onlyoffice jwt_secret --value="$ONLYOFFICE_SECRET" + nextcloud_occ config:app:set onlyoffice jwt_secret --value="$ONLYOFFICE_SECRET" nextcloud_occ config:system:set onlyoffice jwt_header --value="AuthorizationJwt" # Add prune command add_dockerprune diff --git a/apps/onlyoffice_integrated.sh b/apps/onlyoffice_integrated.sh index bef13d52..f507a664 100644 --- a/apps/onlyoffice_integrated.sh +++ b/apps/onlyoffice_integrated.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="OnlyOffice (Integrated)" @@ -89,7 +89,7 @@ sleep 2 if install_and_enable_app documentserver_community then chown -R www-data:www-data "$NC_APPS_PATH" - nextcloud_occ config:app:set onlyoffice DocumentServerUrl --value="$(nextcloud_occ_no_check config:system:get overwrite.cli.url)index.php/apps/documentserver_community/" + nextcloud_occ config:app:set onlyoffice DocumentServerUrl --value="$(nextcloud_occ_no_check config:system:get overwrite.cli.url)/index.php/apps/documentserver_community/" msg_box "OnlyOffice was successfully installed." else msg_box "The documentserver_community app failed to install. Please try again later. diff --git a/apps/pico_cms.sh b/apps/pico_cms.sh index cb9b966c..16825655 100644 --- a/apps/pico_cms.sh +++ b/apps/pico_cms.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -214,8 +214,8 @@ a2enmod proxy_http a2enmod ssl a2enmod headers -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi diff --git a/apps/previewgenerator.sh b/apps/previewgenerator.sh deleted file mode 100644 index 901ba26b..00000000 --- a/apps/previewgenerator.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/bash - -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ -# GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE - -true -SCRIPT_NAME="Fix LEGACY Preview Generator" -# shellcheck source=lib.sh -source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) - -####### TEMPORARY 2023-04-01 ####### - -run_script APP imaginary diff --git a/apps/recognize.sh b/apps/recognize.sh index a3a6a808..951b82c3 100644 --- a/apps/recognize.sh +++ b/apps/recognize.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Recognize for Nextcloud" @@ -27,26 +27,6 @@ fi # Compatible with NC26 and above lowest_compatible_nc 26 -# Check if suspicious_login are installed -# https://github.com/nextcloud/recognize/issues/676 -if is_app_enabled suspicious_login -then - msg_box "Since you have the app Suspicious Login Detection installed, you can't install Recognize. The reason is that it will cause issues with cron.php.\nIf you choose 'No' the installer will exit" - if yesno_box_no "Do you want to disable Suspicious Login to be able to install Recognize?" - then - nextcloud_occ app:disable suspicious_login - if ! [ -f /etc/fail2ban/filter.d/nextcloud.conf ] || ! is_this_installed fail2ban - then - if yesno_box_yes "Do you want to install Fail2ban (IP blocking in Linux) instead?" - then - run_script APP fail2ban - fi - fi - else - exit - fi -fi - # Check if face-recognition is installed and ask to remove it if is_app_installed facerecognition then @@ -58,7 +38,7 @@ then 4. Install We will run the uninstaller for you now, then exit." - wget https://raw.githubusercontent.com/nextcloud/vm/master/old/face-recognition.sh && bash face-recognition.sh && rm -f face-recognition.sh + wget https://raw.githubusercontent.com/nextcloud/vm/main/old/face-recognition.sh && bash face-recognition.sh && rm -f face-recognition.sh exit fi diff --git a/apps/smbmount.sh b/apps/smbmount.sh index 9fb236b5..60ae6b8c 100644 --- a/apps/smbmount.sh +++ b/apps/smbmount.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -77,7 +77,7 @@ then msg_box "All $MAX_COUNT slots are occupied. No mounting slots available. Please delete one of the SMB-mounts. If you really want to mount more, you can simply download the smb-mount script \ directly and edit the variable 'MAX_COUNT' to a higher value than $MAX_COUNT by running: -'curl -sLO https://raw.githubusercontent.com/nextcloud/vm/master/apps/smbmount.sh' # Download the script +'curl -sLO https://raw.githubusercontent.com/nextcloud/vm/main/apps/smbmount.sh' # Download the script 'nano smbmount.sh' # Edit MAX_COUNT=$MAX_COUNT to your likings and save the file 'sudo bash smbmount.sh' # Execute the script." "$SUBTITLE" return @@ -340,7 +340,7 @@ We please you to do the math yourself if the number is high enough for your setu fi # Install the inotify PHP extension - # https://github.com/icewind1991/files_inotify/blob/master/README.md + # https://github.com/icewind1991/files_inotify/blob/main/README.md if ! pecl list | grep -q inotify then print_text_in_color "$ICyan" "Installing the PHP inotify extension..." diff --git a/apps/talk.sh b/apps/talk.sh index 3fe2ffe7..4e08a4b0 100644 --- a/apps/talk.sh +++ b/apps/talk.sh @@ -1,12 +1,15 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Nextcloud Talk" -SCRIPT_EXPLAINER="This script installs Nextcloud Talk whcih is a replacement for Teams/Skype and similar.\ -You will also be offered the possibility to install the so-called High-Performance-Backend, which makes it possible to host more video calls than it would be with the standard Talk app. \ -It's called 'Talk Signaling' and you will be offered to install it as part two of this script." +SCRIPT_EXPLAINER="This script installs Nextcloud Talk which is a replacement for Teams/Skype and similar. + +You will also be offered the possibility to install the so-called High-Performance-Backend, which makes it possible to host more video calls than it would be with the standard Talk app. +It's called 'Talk Signaling' and you will be offered to install it as part two of this script. + +And last but not least, Talk Recording is also offered to be installed. It enables recording of sessions in Talk and it's part three of this script." # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh @@ -33,29 +36,47 @@ else # Ask for removal or reinstallation reinstall_remove_menu "$SCRIPT_NAME" # Removal + if [ -f "$SIGNALING_SERVER_CONF" ] + then + SUBDOMAIN=$(input_box_flow "Please enter the subdomain you were using for Talk Signaling, e.g: talk.yourdomain.com. This will be removed.") + if [ -f "$CERTFILES/$SUBDOMAIN/cert.pem" ] + then + yes no | certbot revoke --cert-path "$CERTFILES/$SUBDOMAIN/cert.pem" + REMOVE_OLD="$(find "$LETSENCRYPTPATH/" -name "$SUBDOMAIN*")" + for remove in $REMOVE_OLD + do rm -rf "$remove" + done + fi + fi sed "/# Talk Signaling Server/d" /etc/hosts >/dev/null 2>&1 sed "/127.0.1.1 $SUBDOMAIN/d" /etc/hosts >/dev/null 2>&1 + systemctl stop nats-server + systemctl disable nats-server + deluser nats nextcloud_occ_no_check config:app:delete spreed stun_servers nextcloud_occ_no_check config:app:delete spreed turn_servers nextcloud_occ_no_check config:app:delete spreed signaling_servers + nextcloud_occ_no_check config:app:delete spreed recording_servers nextcloud_occ_no_check app:remove spreed rm -rf \ "$TURN_CONF" \ "$SIGNALING_SERVER_CONF" \ + /etc/signaling \ /etc/nats \ /etc/janus \ /etc/apt/trusted.gpg.d/morph027-janus.asc \ /etc/apt/trusted.gpg.d/morph027-nats-server.asc \ /etc/apt/trusted.gpg.d/morph027-nextcloud-spreed-signaling.asc \ /etc/apt/trusted.gpg.d/morph027-coturn.asc \ - /etc/apt/keyrings/morph027-coturn.asc - /etc/apt/sources.list.d/morph027-nextcloud-spreed-signaling.list\ + /etc/apt/keyrings/morph027-coturn.asc \ + /etc/apt/sources.list.d/morph027-nextcloud-spreed-signaling.list \ /etc/apt/sources.list.d/morph027-janus.list \ /etc/apt/sources.list.d/morph027-nats-server.list \ /etc/apt/sources.list.d/morph027-coturn.list \ - $VMLOGS/talk_apache_error.log \ - $VMLOGS/talk_apache_access.log \ - $VMLOGS/turnserver.log \ + /lib/systemd/system/nats-server.service \ + "$VMLOGS"/talk_apache_error.log \ + "$VMLOGS"/talk_apache_access.log \ + "$VMLOGS"/turnserver.log \ /var/www/html/error APPS=(coturn nats-server janus nextcloud-spreed-signaling) for app in "${APPS[@]}" @@ -66,21 +87,23 @@ else fi done apt-get autoremove -y + docker_prune_this nextcloud/aio-talk-recording + docker_prune_this ghcr.io/nextcloud-releases/aio-talk-recording # Show successful uninstall if applicable removal_popup "$SCRIPT_NAME" fi -# Must be 22.04 -if ! version 20.04 "$DISTRO" 22.04.10 +# Must be 24.04 +if ! version 22.04 "$DISTRO" 24.04.10 then - msg_box "Your current Ubuntu version is $DISTRO but must be between 20.04 - 22.04.10 to install Talk" + msg_box "Your current Ubuntu version is $DISTRO but must be between 22.04 - 24.04.10 to install Talk" msg_box "Please contact us to get support for upgrading your server: https://www.hanssonit.se/#contact https://shop.hanssonit.se/" exit fi -# Nextcloud 19 is required. +# Nextcloud 20 is required. lowest_compatible_nc 20 ####################### TALK (COTURN) @@ -215,7 +238,7 @@ msg_box "You will now be presented with the option to install the Talk Signaling This aims to give you greater performance and ability to have more users in a call at the same time. You can read more here: -https://github.com/strukturag/nextcloud-spreed-signaling/blob/master/README.md +https://github.com/strukturag/nextcloud-spreed-signaling/blob/main/README.md We will use apt packages from https://gitlab.com/morph027 which is a trusted contributor to this repository. @@ -278,7 +301,48 @@ curl -sL -o "/etc/apt/trusted.gpg.d/morph027-nats-server.asc" "https://packaging echo "deb https://packaging.gitlab.io/nats-server nats main" > /etc/apt/sources.list.d/morph027-nats-server.list apt-get update -q4 & spinner_loading install_if_not nats-server +getent passwd nats >/dev/null 2>&1 || adduser \ + --system \ + --shell /usr/sbin/nologin \ + --gecos 'High-Performance server for NATS, the cloud native messaging system.' \ + --group \ + --disabled-password \ + --no-create-home \ + nats + chown nats:nats /etc/nats/nats.conf + +# Check if nats systemd service is in the package or not +if [ ! -f "/lib/systemd/system/nats-server.service" ]; +then +# Generate nats systemd service +cat << NATS_SYSTEMD > /lib/systemd/system/nats-server.service +[Unit] +Description=NATS messaging server +Documentation=https://docs.nats.io/nats-server/ +After=network-online.target + +[Service] +ExecStart=/usr/bin/nats-server --config /etc/nats/nats.conf +User=nats +Group=nats +Restart=on-failure + +[Install] +WantedBy=multi-user.target +NATS_SYSTEMD + if [ -f "/lib/systemd/system/nats-server.service" ]; + then + print_text_in_color "$IGreen" "NATS systemd service was successfully created." + else + print_text_in_color "$IRed" "Unable to create NATS systemd service , exiting..." + print_text_in_color "$IRed" "Please report this issue here $ISSUES" + exit 1 + fi +else + print_text_in_color "$IGreen" "Nats systemd service is already in place, continuing" +fi + start_if_stopped nats-server check_command systemctl enable nats-server @@ -319,24 +383,34 @@ then cat << SIGNALING_CONF_CREATE > "$SIGNALING_SERVER_CONF" [http] listen = 127.0.0.1:8081 + [app] debug = false + [sessions] hashkey = $(openssl rand -hex 16) blockkey = $(openssl rand -hex 16) + [clients] -internalsecret = $(openssl rand -hex 16) +internalsecret = ${TURN_INTERNAL_SECRET} + [backend] -allowed = ${TURN_DOMAIN} +backends = backend-1 allowall = false -secret = ${NC_SECRET} timeout = 10 connectionsperhost = 8 + +[backend-1] +url = https://${TURN_DOMAIN} +secret = ${SIGNALING_SECRET} + [nats] -url = nats://localhost:4222 +url = nats://127.0.0.1:4222 + [mcu] type = janus url = ws://127.0.0.1:8188 + [turn] apikey = ${JANUS_API_KEY} secret = ${TURN_SECRET} @@ -361,17 +435,17 @@ a2enmod headers a2enmod remoteip # Allow CustomLog -touch $VMLOGS/talk_apache_access.log -touch $VMLOGS/talk_apache_error.log -chown www-data:www-data $VMLOGS/talk_apache_error.log $VMLOGS/talk_apache_access.log +touch "$VMLOGS"/talk_apache_access.log +touch "$VMLOGS"/talk_apache_error.log +chown root:adm "$VMLOGS"/talk_apache_* # Prep the error page mkdir -p /var/www/html/error echo "Hi there! :) If you see this page, the Apache2 proxy for $SCRIPT_NAME is up and running." > /var/www/html/error/404_proxy.html chown -R www-data:www-data /var/www/html/error -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi @@ -403,8 +477,8 @@ then # Logs LogLevel warn - CustomLog \${APACHE_LOG_DIR}/access.log combined - ErrorLog \${APACHE_LOG_DIR}/error.log + CustomLog $VMLOGS/talk_apache_access.log common + ErrorLog $VMLOGS/talk_apache_error.log # Just in case - see below SSLProxyEngine On @@ -467,7 +541,7 @@ else fi # Set signaling server strings -SIGNALING_SERVERS_STRING="{\"servers\":[{\"server\":\"https://$SUBDOMAIN/\",\"verify\":true}],\"secret\":\"$NC_SECRET\"}" +SIGNALING_SERVERS_STRING="{\"servers\":[{\"server\":\"https://$SUBDOMAIN/\",\"verify\":true}],\"secret\":\"$SIGNALING_SECRET\"}" nextcloud_occ config:app:set spreed signaling_servers --value="$SIGNALING_SERVERS_STRING" --output json # Add to /etc/hosts @@ -483,6 +557,51 @@ then msg_box "Installation failed. :/\n\nPlease run this script again to uninstall if you want to clean the system, or choose to reinstall if you want to try again.\n\nLogging can be found by typing: journalctl -lfu signaling" exit 1 else - msg_box "Congratulations, everything is working as intended! The installation succeeded.\n\nLogging can be found by typing: journalctl -lfu signaling" - exit 0 + msg_box "Congratulations, everything is working as intended! The Talk Signaling installation succeeded.\n\nLogging can be found by typing: journalctl -lfu signaling" +fi + +####### Talk recording +if ! yesno_box_yes "Do you want install Talk Recording to be able to record your calls?" +then + exit +fi + +# Nextcloud 26 is required. +lowest_compatible_nc 26 + +# It's pretty recource intensive +cpu_check 4 "Talk Recording" +ram_check 4 "Talk Recording" + +print_text_in_color "$ICyan" "Setting up Talk recording..." + +# Pull and start +docker pull ghcr.io/nextcloud-releases/aio-talk-recording:latest +docker run -t -d -p "$TURN_RECORDING_HOST":"$TURN_RECORDING_HOST_PORT":"$TURN_RECORDING_HOST_PORT" \ +--restart always \ +--name talk-recording \ +--shm-size=2GB \ +-e NC_DOMAIN="${TURN_DOMAIN}" \ +-e HPB_DOMAIN="${SUBDOMAIN}" \ +-e HPB_PATH=/ \ +-e TZ="$(cat /etc/timezone)" \ +-e RECORDING_SECRET="${TURN_RECORDING_SECRET}" \ +-e INTERNAL_SECRET="${TURN_INTERNAL_SECRET}" \ +ghcr.io/nextcloud-releases/aio-talk-recording:latest + +# Talk recording +if [ -d "$NCPATH/apps/spreed" ] +then + if does_this_docker_exist ghcr.io/nextcloud-releases/aio-talk-recording + then + install_if_not netcat-traditional + while ! nc -z "$TURN_RECORDING_HOST" "$TURN_RECORDING_HOST_PORT" + do + print_text_in_color "$ICyan" "Waiting for Talk Recording to become available..." + sleep 5 + done + # Set values in Nextcloud + RECORDING_SERVERS_STRING="{\"servers\":[{\"server\":\"http://$TURN_RECORDING_HOST:$TURN_RECORDING_HOST_PORT/\",\"verify\":false}],\"secret\":\"$TURN_RECORDING_SECRET\"}" + nextcloud_occ_no_check config:app:set spreed recording_servers --value="$RECORDING_SERVERS_STRING" --output json + fi fi diff --git a/apps/tmbitwarden.sh b/apps/tmbitwarden.sh index b455620a..a088b6fa 100644 --- a/apps/tmbitwarden.sh +++ b/apps/tmbitwarden.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Bitwarden" @@ -102,7 +102,6 @@ https://imgur.com/a/3ytwvp6" # Install Docker install_docker -install_if_not docker-compose # Create bitwarden user if ! id "$BITWARDEN_USER" >/dev/null 2>&1 @@ -182,7 +181,7 @@ USERGROUPID=$(id -g $BITWARDEN_USER) sed -i "s|database_docker_volume:.*|database_docker_volume: true|g" "$BITWARDEN_HOME"/bwdata/config.yml sed -i "s|LOCAL_UID=.*|LOCAL_UID=$USERID|g" "$BITWARDEN_HOME"/bwdata/env/uid.env sed -i "s|LOCAL_GID=.*|LOCAL_GID=$USERGROUPID|g" "$BITWARDEN_HOME"/bwdata/env/uid.env -# Get Subdomain from config.yml and change it to https +# Get subdomain from config.yml and change it to https SUBDOMAIN=$(grep ^url "$BITWARDEN_HOME"/bwdata/config.yml) SUBDOMAIN=${SUBDOMAIN##*url: http://} sed -i "s|^url: .*|url: https://$SUBDOMAIN|g" "$BITWARDEN_HOME"/bwdata/config.yml @@ -241,8 +240,8 @@ a2enmod ssl a2enmod headers a2enmod remoteip -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi diff --git a/apps/vaultwarden.sh b/apps/vaultwarden.sh index d5ee9772..2552c856 100644 --- a/apps/vaultwarden.sh +++ b/apps/vaultwarden.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Vaultwarden (formerly Bitwarden RS)" @@ -122,8 +122,8 @@ a2enmod ssl a2enmod headers a2enmod remoteip -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi diff --git a/apps/vaultwarden_admin-panel.sh b/apps/vaultwarden_admin-panel.sh index 461d138a..7a381699 100644 --- a/apps/vaultwarden_admin-panel.sh +++ b/apps/vaultwarden_admin-panel.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Vaultwarden (formerly Bitwarden RS) Admin Panel" diff --git a/apps/webmin.sh b/apps/webmin.sh index 69ecd916..a3ef171a 100644 --- a/apps/webmin.sh +++ b/apps/webmin.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Webmin" diff --git a/apps/whiteboard.sh b/apps/whiteboard.sh index cf2781d4..aa7ee671 100644 --- a/apps/whiteboard.sh +++ b/apps/whiteboard.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/disk/change-to-zfs-mount-generator.sh b/disk/change-to-zfs-mount-generator.sh index 7ec75ba1..dae0d0a4 100644 --- a/disk/change-to-zfs-mount-generator.sh +++ b/disk/change-to-zfs-mount-generator.sh @@ -1,11 +1,11 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # https://wiki.archlinux.org/index.php/ZFS#Using_zfs-mount-generator -# Tested on Ubuntu 20.04 +# Tested on Ubuntu 22.04 -# This script came to life when we were having issues with importing the ZFS pool (ncdata) on Ubuntu 20.04. +# This script came to life when we were having issues with importing the ZFS pool (ncdata) on Ubuntu 22.04. # After some forum reading and some digging on Github, this is the result. # The intention here is to make the import process more robust, and less prune to fail # Essentially, changing from 'zfs-mount.service' to 'zfs-mount-generator' which by many has been working better. @@ -18,12 +18,12 @@ source /var/scripts/fetch_lib.sh # Check if root root_check -# Needs to be Ubuntu 20.04 and Multiverse +# Needs to be Ubuntu 22.04 and Multiverse check_distro_version check_multiverse # Import if missing and export again to import it with UUID -# https://github.com/nextcloud/vm/blob/master/lib.sh#L1233 +# https://github.com/nextcloud/vm/blob/main/lib.sh#L1233 # Set a different name for the pool (if used outside of this repo) # export POOLNAME=ncdata zpool_import_if_missing diff --git a/disk/create-daily-zfs-prune.sh b/disk/create-daily-zfs-prune.sh index 4c37c3ee..f4058760 100644 --- a/disk/create-daily-zfs-prune.sh +++ b/disk/create-daily-zfs-prune.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Create daily ZFS prune script" diff --git a/disk/format-chosen.sh b/disk/format-chosen.sh index 88ed1b03..212a192c 100644 --- a/disk/format-chosen.sh +++ b/disk/format-chosen.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Format Chosen Disk" @@ -10,7 +10,7 @@ source /var/scripts/fetch_lib.sh # Check if root root_check -# Needs to be Ubuntu 20.04 and Multiverse +# Needs to be Ubuntu 22.04 and Multiverse check_distro_version check_multiverse @@ -43,9 +43,13 @@ elif [ "$SYSVENDOR" == "Xen" ]; then SYSNAME="Xen/XCP-NG" DEVTYPE=xvdb -elif [[ "$SYSVENDOR" == "QEMU" || "$SYSVENDOR" == "Red Hat" ]]; +elif [[ "$SYSVENDOR" == "QEMU" ]]; then - SYSNAME="KVM/QEMU" + SYSNAME="Proxmox/QEMU" + DEVTYPE=sdb +elif [ "$SYSVENDOR" == "Red Hat" ]; +then + SYSNAME="Red Hat" DEVTYPE=vdb elif [ "$SYSVENDOR" == "DigitalOcean" ]; then @@ -99,7 +103,7 @@ while done [[ -z "${devtype_present+x}" ]] do - printf "${BRed}$DEVTYPE is not a valid disk. Please try again.${Color_Off}\n" + print_text_in_color "$BRed" "$DEVTYPE is not a valid disk. Please try again." : done @@ -172,13 +176,18 @@ then check_command zpool create -f -o ashift=12 "$POOLNAME" "$DISKTYPE" check_command zpool set failmode=continue "$POOLNAME" check_command zfs set mountpoint="$MOUNT_" "$POOLNAME" - check_command zfs set compression=lz4 "$POOLNAME" + check_command zfs set compression=zstd "$POOLNAME" check_command zfs set sync=standard "$POOLNAME" check_command zfs set xattr=sa "$POOLNAME" check_command zfs set primarycache=all "$POOLNAME" check_command zfs set atime=off "$POOLNAME" check_command zfs set recordsize=128k "$POOLNAME" check_command zfs set logbias=latency "$POOLNAME" + if [ -d /sys/firmware/efi ] + then + # dnodesize can't boot on BIOS, only UEFI mode + check_command zfs set dnodesize=auto "$POOLNAME" + fi else msg_box "It seems like /dev/$DEVTYPE does not exist. diff --git a/disk/format-sdb.sh b/disk/format-sdb.sh index f74255c3..81475c4d 100644 --- a/disk/format-sdb.sh +++ b/disk/format-sdb.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Format sdb" @@ -10,7 +10,7 @@ source /var/scripts/fetch_lib.sh # Check if root root_check -# Needs to be Ubuntu 20.04 and Multiverse +# Needs to be Ubuntu 22.04 and Multiverse check_distro_version check_multiverse @@ -43,9 +43,13 @@ elif [ "$SYSVENDOR" == "Xen" ]; then SYSNAME="Xen/XCP-NG" DEVTYPE=xvdb -elif [[ "$SYSVENDOR" == "QEMU" || "$SYSVENDOR" == "Red Hat" ]]; +elif [[ "$SYSVENDOR" == "QEMU" ]]; then - SYSNAME="KVM/QEMU" + SYSNAME="Proxmox/QEMU" + DEVTYPE=sdb +elif [ "$SYSVENDOR" == "Red Hat" ]; +then + SYSNAME="Red Hat" DEVTYPE=vdb elif [ "$SYSVENDOR" == "DigitalOcean" ]; then @@ -155,13 +159,18 @@ then check_command zpool create -f -o ashift=12 "$POOLNAME" "$DISKTYPE" check_command zpool set failmode=continue "$POOLNAME" check_command zfs set mountpoint="$MOUNT_" "$POOLNAME" - check_command zfs set compression=lz4 "$POOLNAME" + check_command zfs set compression=zstd "$POOLNAME" check_command zfs set sync=standard "$POOLNAME" check_command zfs set xattr=sa "$POOLNAME" check_command zfs set primarycache=all "$POOLNAME" check_command zfs set atime=off "$POOLNAME" check_command zfs set recordsize=128k "$POOLNAME" check_command zfs set logbias=latency "$POOLNAME" + if [ -d /sys/firmware/efi ] + then + # dnodesize can't boot on BIOS, only UEFI mode + check_command zfs set dnodesize=auto "$POOLNAME" + fi else msg_box "It seems like /dev/$DEVTYPE does not exist. diff --git a/disk/prune_zfs_snaphots.sh b/disk/prune_zfs_snaphots.sh index 3bd6d322..a6132918 100644 --- a/disk/prune_zfs_snaphots.sh +++ b/disk/prune_zfs_snaphots.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Prune ZFS Snapshots" @@ -36,7 +36,7 @@ and avoid a fatal crash. Please check $VMLOGS/zfs_prune.log for the results." # On screen information msg_box "Your disk space is almost full (more than 70% or less than 100GB left). -To solve that, we will now delete ZFS snapshots older than 4 weeks +To solve that, we will now delete ZFS snapshots older than 2 days. The script will also delete everything in trashbin for all users to free up some space." countdown "To abort, please press CTRL+C within 10 seconds." 10 @@ -59,7 +59,7 @@ The script will also delete everything in trashbin for all users to free up some fi # Prune snapshots touch $VMLOGS/zfs_prune.log - ./zfs-prune-snapshots.sh 2d ncdata >> $VMLOGS/zfs_prune.log + ./zfs-prune-snapshots.sh 2d ncdata | tee -a $VMLOGS/zfs_prune.log # Create daily prune to avoid disk being full again if [ ! -f "$SCRIPTS/daily-zfs-prune.sh" ] then diff --git a/disk/smart-monitoring.sh b/disk/smart-monitoring.sh index 4f86f3d0..07fac88f 100644 --- a/disk/smart-monitoring.sh +++ b/disk/smart-monitoring.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -114,7 +114,7 @@ then cat << SMART_NOTIFICATION > "$SCRIPTS/smart-notification.sh" #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -161,7 +161,7 @@ $SCRIPTS/smart-notification.sh -s (S/../.././01|L/../../6/02)" > /etc/smartd.con cat << SMART_NOTIFICATION > "$SCRIPTS/smart-notification.sh" #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/geoblockdat/2020-09-Maxmind-Country-IPv4.dat b/geoblockdat/2020-09-Maxmind-Country-IPv4.dat deleted file mode 100644 index 699dfc8a..00000000 Binary files a/geoblockdat/2020-09-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2020-09-Maxmind-Country-IPv6.dat b/geoblockdat/2020-09-Maxmind-Country-IPv6.dat deleted file mode 100644 index 7bf81149..00000000 Binary files a/geoblockdat/2020-09-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2020-11-Maxmind-Country-IPv4.dat b/geoblockdat/2020-11-Maxmind-Country-IPv4.dat deleted file mode 100644 index e40ef1a3..00000000 Binary files a/geoblockdat/2020-11-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2020-11-Maxmind-Country-IPv6.dat b/geoblockdat/2020-11-Maxmind-Country-IPv6.dat deleted file mode 100644 index 5db8956e..00000000 Binary files a/geoblockdat/2020-11-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-01-Maxmind-Country-IPv4.dat b/geoblockdat/2021-01-Maxmind-Country-IPv4.dat deleted file mode 100644 index dfc78265..00000000 Binary files a/geoblockdat/2021-01-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-01-Maxmind-Country-IPv6.dat b/geoblockdat/2021-01-Maxmind-Country-IPv6.dat deleted file mode 100644 index 42ed2856..00000000 Binary files a/geoblockdat/2021-01-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-02-Maxmind-Country-IPv4.dat b/geoblockdat/2021-02-Maxmind-Country-IPv4.dat deleted file mode 100644 index 1b56be23..00000000 Binary files a/geoblockdat/2021-02-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-02-Maxmind-Country-IPv6.dat b/geoblockdat/2021-02-Maxmind-Country-IPv6.dat deleted file mode 100644 index 42ed2856..00000000 Binary files a/geoblockdat/2021-02-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-04-Maxmind-Country-IPv4.dat b/geoblockdat/2021-04-Maxmind-Country-IPv4.dat deleted file mode 100644 index f2dcf4d5..00000000 Binary files a/geoblockdat/2021-04-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-04-Maxmind-Country-IPv6.dat b/geoblockdat/2021-04-Maxmind-Country-IPv6.dat deleted file mode 100644 index 5606e464..00000000 Binary files a/geoblockdat/2021-04-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-06-Maxmind-Country-IPv4.dat b/geoblockdat/2021-06-Maxmind-Country-IPv4.dat deleted file mode 100644 index 32459c7c..00000000 Binary files a/geoblockdat/2021-06-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-06-Maxmind-Country-IPv6.dat b/geoblockdat/2021-06-Maxmind-Country-IPv6.dat deleted file mode 100644 index f12688a0..00000000 Binary files a/geoblockdat/2021-06-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-08-Maxmind-Country-IPv4.dat b/geoblockdat/2021-08-Maxmind-Country-IPv4.dat deleted file mode 100644 index 32459c7c..00000000 Binary files a/geoblockdat/2021-08-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-08-Maxmind-Country-IPv6.dat b/geoblockdat/2021-08-Maxmind-Country-IPv6.dat deleted file mode 100644 index e7108639..00000000 Binary files a/geoblockdat/2021-08-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-10-Maxmind-Country-IPv4.dat b/geoblockdat/2021-10-Maxmind-Country-IPv4.dat deleted file mode 100644 index 90d5fc63..00000000 Binary files a/geoblockdat/2021-10-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-10-Maxmind-Country-IPv6.dat b/geoblockdat/2021-10-Maxmind-Country-IPv6.dat deleted file mode 100644 index 9eb5b231..00000000 Binary files a/geoblockdat/2021-10-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2021-12-Maxmind-Country-IPv4.dat b/geoblockdat/2021-12-Maxmind-Country-IPv4.dat deleted file mode 100644 index 9db49fc3..00000000 Binary files a/geoblockdat/2021-12-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2021-12-Maxmind-Country-IPv6.dat b/geoblockdat/2021-12-Maxmind-Country-IPv6.dat deleted file mode 100644 index 4d63c091..00000000 Binary files a/geoblockdat/2021-12-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2022-03-Maxmind-Country-IPv4.dat b/geoblockdat/2022-03-Maxmind-Country-IPv4.dat deleted file mode 100644 index 84f5dc14..00000000 Binary files a/geoblockdat/2022-03-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2022-03-Maxmind-Country-IPv6.dat b/geoblockdat/2022-03-Maxmind-Country-IPv6.dat deleted file mode 100644 index 53a0e2c9..00000000 Binary files a/geoblockdat/2022-03-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2022-06-Maxmind-Country-IPv4.dat b/geoblockdat/2022-06-Maxmind-Country-IPv4.dat deleted file mode 100644 index 961b0913..00000000 Binary files a/geoblockdat/2022-06-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2022-06-Maxmind-Country-IPv6.dat b/geoblockdat/2022-06-Maxmind-Country-IPv6.dat deleted file mode 100644 index bd8a09bb..00000000 Binary files a/geoblockdat/2022-06-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2022-08-Maxmind-Country-IPv4.dat b/geoblockdat/2022-08-Maxmind-Country-IPv4.dat deleted file mode 100644 index a0a60541..00000000 Binary files a/geoblockdat/2022-08-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2022-08-Maxmind-Country-IPv6.dat b/geoblockdat/2022-08-Maxmind-Country-IPv6.dat deleted file mode 100644 index bedc2491..00000000 Binary files a/geoblockdat/2022-08-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/2022-11-Maxmind-Country-IPv4.dat b/geoblockdat/2022-11-Maxmind-Country-IPv4.dat deleted file mode 100644 index a8349c15..00000000 Binary files a/geoblockdat/2022-11-Maxmind-Country-IPv4.dat and /dev/null differ diff --git a/geoblockdat/2022-11-Maxmind-Country-IPv6.dat b/geoblockdat/2022-11-Maxmind-Country-IPv6.dat deleted file mode 100644 index 168a2a24..00000000 Binary files a/geoblockdat/2022-11-Maxmind-Country-IPv6.dat and /dev/null differ diff --git a/geoblockdat/README.md b/geoblockdat/README.md deleted file mode 100644 index 9656a177..00000000 --- a/geoblockdat/README.md +++ /dev/null @@ -1,22 +0,0 @@ -# What is this folder about? -This folder is only meant for storing GeoIP Legacy Databases which are used by the [geoip script](https://github.com/nextcloud/vm/blob/master/network/geoblock.sh). - -All .dat files in this folder are from https://www.miyuru.lk/geoiplegacy and converted by Miyuru Sankalpa. - -## How to add updated Database files in here? -1. Check if the files were updated by Miyuru Sankalpa by visiting [twitter](https://twitter.com/miyurulk) or verifying the **Last Updated** tag on his [website](https://www.miyuru.lk/geoiplegacy) -2. If the files were updated, download the newest [Maxmind Country IPv4](https://dl.miyuru.lk/geoip/maxmind/country/maxmind4.dat.gz) and [Maxmind Country IPv6](https://dl.miyuru.lk/geoip/maxmind/country/maxmind6.dat.gz) files -3. Extract them -4. Create a PR with those updated database files, add them to this folder and follow this naming scheme: - -### Naming scheme: -**for IPv4:**
-`yyyy-mm-Maxmind-Country-IPv4.dat`
-**for IPv6:**
-`yyyy-mm-Maxmind-Country-IPv6.dat`
-_(Year and month should be chosen based on when the files were updated by Sankalpa)_

-**One example is:**
-`2020-09-Maxmind-Country-IPv4.dat`
-and
-`2020-09-Maxmind-Country-IPv6.dat`
-_(If the files were updated on September 2020 by Sankalpa)_ diff --git a/lets-encrypt/activate-tls.sh b/lets-encrypt/activate-tls.sh index 19f822f9..dd46920b 100644 --- a/lets-encrypt/activate-tls.sh +++ b/lets-encrypt/activate-tls.sh @@ -4,7 +4,7 @@ SCRIPT_NAME="Activate TLS" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -115,19 +115,41 @@ fi # To get the correct version for the Apache conf file check_php -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi # Fix zero file sizes # See https://github.com/nextcloud/server/issues/3056 -if version 22.04 "$DISTRO" 26.04.10 +if version 24.04 "$DISTRO" 26.04.10 then SETENVPROXY="SetEnv proxy-sendcl 1" fi +# Install Brotli +if version 24.04 "$DISTRO" 26.04.10 +then + if ! [ -f /etc/apache2/conf-available/brotli.conf ] + then + # Install needed packaages + install_if_not brotli + + # Add the config + { + echo "# Brotli support" + echo "" + echo " AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/x-javascript application/javascript application/json application/x-font-ttf application/vnd.ms-fontobject image/x-icon" + echo "" + } > /etc/apache2/conf-available/brotli.conf + + # Enable the config + a2enmod brotli + a2enconf brotli + fi +fi + # Generate nextcloud_tls_domain.conf if [ ! -f "$tls_conf" ] then @@ -137,7 +159,7 @@ then cat << TLS_CREATE > "$tls_conf" RewriteEngine On - RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L] + RewriteRule ^(.*)$ https://%{HTTP_HOST}\$1 [END,NE,R=permanent] @@ -156,7 +178,7 @@ then SSLEngine on SSLCompression off SSLProtocol -all +TLSv1.2 $TLS13 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 SSLHonorCipherOrder off SSLSessionTickets off ServerSignature off @@ -166,33 +188,41 @@ then CustomLog \${APACHE_LOG_DIR}/access.log combined ErrorLog \${APACHE_LOG_DIR}/error.log + # Document root folder DocumentRoot $NCPATH + # The Nextcloud folder Options Indexes FollowSymLinks - AllowOverride None - ### include all .htaccess - Include $NCPATH/.htaccess - Include $NCPATH/config/.htaccess - Include $NCDATA/.htaccess - ### + AllowOverride All Require all granted Satisfy Any + # This is to include all the Nextcloud rules due to that we use PHP-FPM and .htaccess aren't read + Include $NCPATH/.htaccess + + + # Deny access to your data directory + + Require all denied + + + # Deny access to the Nextcloud config folder + + Require all denied Dav off - SetEnv HOME $NCPATH - SetEnv HTTP_HOME $NCPATH - - # The following lines prevent .htaccess and .htpasswd files from being - # viewed by Web clients. + # The following lines prevent .htaccess and .htpasswd files from being viewed by Web clients. Require all denied + SetEnv HOME $NCPATH + SetEnv HTTP_HOME $NCPATH + # Disable HTTP TRACE method. TraceEnable off # Disable HTTP TRACK method. @@ -207,8 +237,8 @@ then ### LOCATION OF CERT FILES ### - SSLCertificateChainFile $CERTFILES/$TLSDOMAIN/chain.pem - SSLCertificateFile $CERTFILES/$TLSDOMAIN/cert.pem + # SSLCertificateChainFile $CERTFILES/$TLSDOMAIN/chain.pem + SSLCertificateFile $CERTFILES/$TLSDOMAIN/fullchain.pem SSLCertificateKeyFile $CERTFILES/$TLSDOMAIN/privkey.pem SSLOpenSSLConfCmd DHParameters $DHPARAMS_TLS @@ -236,8 +266,11 @@ then if certbot certonly --manual --text --key-type ecdsa --renew-by-default --server https://acme-v02.api.letsencrypt.org/directory --no-eff-email --agree-tos --preferred-challenges dns --manual-auth-hook "$SCRIPTS"/deSEC/hook.sh --manual-cleanup-hook "$SCRIPTS"/deSEC/hook.sh -d "$DEDYNDOMAIN" then # Generate DHparams cipher - if [ ! -f "$DHPARAMS_TLS" ] + if [ -f "$DHPARAMS_TLS" ] then + rm -f "$DHPARAMS_TLS" + openssl dhparam -out "$DHPARAMS_TLS" 2048 + else openssl dhparam -out "$DHPARAMS_TLS" 2048 fi # Choose which port for public access @@ -296,8 +329,11 @@ else if [ -d "$CERTFILES" ] then # Generate DHparams cipher - if [ ! -f "$DHPARAMS_TLS" ] + if [ -f "$DHPARAMS_TLS" ] then + rm -f "$DHPARAMS_TLS" + openssl dhparam -out "$DHPARAMS_TLS" 2048 + else openssl dhparam -out "$DHPARAMS_TLS" 2048 fi # Activate new config @@ -317,7 +353,7 @@ Please consider showing them your gratitude: https://letsencrypt.org/become-a-sponsor/ If you want to contribute to these scripts, have a look here: -https://github.com/nextcloud/vm/tree/master/lets-encrypt" +https://github.com/nextcloud/vm/tree/main/lets-encrypt" exit 0 fi else diff --git a/lets-encrypt/test-new-config.sh b/lets-encrypt/test-new-config.sh index 75a0903e..ec0a0766 100644 --- a/lets-encrypt/test-new-config.sh +++ b/lets-encrypt/test-new-config.sh @@ -4,7 +4,7 @@ SCRIPT_NAME="Test New Configuration" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -34,8 +34,10 @@ then sed -i "s|env\[HOSTNAME\] = .*|env[HOSTNAME] = $(hostname -f)|g" "$PHP_POOL_DIR"/nextcloud.conf fi -# Set trusted domains -run_script NETWORK trusted +# Set the domain as trusted +add_to_trusted_domains "$FQDOMAIN" +nextcloud_occ config:system:set overwrite.cli.url --value="https://$FQDOMAIN" +nextcloud_occ maintenance:update:htaccess # Add crontab cat << CRONTAB > "$SCRIPTS/letsencryptrenew.sh" diff --git a/lib.sh b/lib.sh index f54db31d..5133e9d2 100644 --- a/lib.sh +++ b/lib.sh @@ -1,40 +1,25 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE +# https://github.com/nextcloud/vm/blob/main/LICENSE # shellcheck disable=SC2034 true # see https://github.com/koalaman/shellcheck/wiki/Directive -##### LEGACY ##### -## Remove 2022-09-01 -NCPATH=/var/www/nextcloud -NCPASS=nextcloud -NCUSER=ncadmin -PGDB_USER=nextcloud_db_user -if [ -f "$NCPATH"/config/config.php ] -then - NCCONFIGDBPASS="$(grep 'dbpassword' "$NCPATH"/config/config.php | awk '{print $3}' | sed "s/[',]//g")" - NCCONFIGDB="$(grep 'dbname' "$NCPATH"/config/config.php | awk '{print $3}' | sed "s/[',]//g")" -fi - - ## VARIABLES # Dirs SCRIPTS=/var/scripts -NCPATH=/var/www/nextcloud HTML=/var/www +NCPATH="$HTML"/nextcloud POOLNAME=ncdata NCDATA=/mnt/"$POOLNAME" SNAPDIR=/var/snap/spreedme GPGDIR=/tmp/gpg SHA256_DIR=/tmp/sha256 BACKUP=/mnt/NCBACKUP -RORDIR=/opt/es/ -OPNSDIR=/opt/opensearch NC_APPS_PATH=$NCPATH/apps VMLOGS=/var/log/nextcloud @@ -60,7 +45,6 @@ SYSVENDOR=$(cat /sys/devices/virtual/dmi/id/sys_vendor) # Network IFACE=$(ip r | grep "default via" | awk '{print $5}') IFACE2=$(ip -o link show | awk '{print $2,$9}' | grep 'UP' | cut -d ':' -f 1) -REPO=$(grep "^deb " /etc/apt/sources.list | grep http | awk '{print $2}' | head -1) ADDRESS=$(hostname -I | cut -d ' ' -f 1) WANIP4=$(curl -s -k -m 5 -4 https://api64.ipify.org) INTERFACES="/etc/netplan/nextcloud.yaml" @@ -70,8 +54,8 @@ INTERNET_DNS="9.9.9.9" # Default Quad9 DNS servers, overwritten by the systemd global DNS defined servers, if set DNS1="9.9.9.9" DNS2="149.112.112.112" -NONO_PORTS=(22 25 53 80 443 1024 3012 3306 5178 5179 5432 7867 7983 8983 10000 8081 8443 9443 9000 9980 9090 9200 9600) -# 9000 9980 9090 9200 9600 are local docker ports, don't remember if they are needed here or not. +NONO_PORTS=(22 25 53 80 443 1024 3012 3306 5178 5179 5432 7867 7983 8983 10000 8081 8443 9443 9000 9980 9090 9200 9600 1234) +# 9000 9980 9090 9200 9600 1234 are local docker ports, don't remember if they are needed here or not. use_global_systemd_dns() { if [ -f "/etc/systemd/resolved.conf" ] then @@ -102,7 +86,7 @@ Confirm by pressing [ENTER]. Cancel by pressing [ESC]." MENU_GUIDE="Navigate with the [ARROW] keys and confirm by pressing [ENTER]. Cancel by pressing [ESC]." RUN_LATER_GUIDE="You can view this script later by running 'sudo bash $SCRIPTS/menu.sh'." # Repo -GITHUB_REPO="https://raw.githubusercontent.com/nextcloud/vm/master" +GITHUB_REPO="https://raw.githubusercontent.com/nextcloud/vm/main" STATIC="$GITHUB_REPO/static" LETS_ENC="$GITHUB_REPO/lets-encrypt" APP="$GITHUB_REPO/apps" @@ -114,7 +98,6 @@ DISK="$GITHUB_REPO/disk" NETWORK="$GITHUB_REPO/network" VAGRANT_DIR="$GITHUB_REPO/vagrant" NOT_SUPPORTED_FOLDER="$GITHUB_REPO/not-supported" -GEOBLOCKDAT="$GITHUB_REPO/geoblockdat" NCREPO="https://download.nextcloud.com/server/releases" ISSUES="https://github.com/nextcloud/vm/issues" # User information @@ -146,9 +129,14 @@ nc_update() { NCVERSION=$(curl -s -m 900 $NCREPO/ | sed --silent 's/.*href="nextcloud-\([^"]\+\).zip.asc".*/\1/p' | sort --version-sort | tail -1) STABLEVERSION="nextcloud-$NCVERSION" NCMAJOR="${NCVERSION%%.*}" + CURRENTMAJOR="${CURRENTVERSION%%.*}" NCBAD=$((NCMAJOR-2)) NCNEXT="$((${CURRENTVERSION%%.*}+1))" } +maxmind_geoip() { + # shellcheck source=/dev/null + source <(curl -sL https://shortio.hanssonit.se/t3vm7ro4CP) +} # Set the hour for automatic updates. This would be 18:00 as only the hour is configurable. AUT_UPDATES_TIME="18" # Keys @@ -164,17 +152,23 @@ HTTP_CONF="nextcloud_http_domain_self_signed.conf" # Collabora App HTTPS_CONF="$SITES_AVAILABLE/$SUBDOMAIN.conf" HTTP2_CONF="/etc/apache2/mods-available/http2.conf" +# GeoBlock +GEOBLOCK_MOD_CONF="/etc/apache2/conf-available/geoblock.conf" +GEOBLOCK_MOD="/etc/apache2/mods-available/maxminddb.load" +GEOBLOCK_DIR="/usr/share/GeoIP" # PHP-FPM -PHPVER=8.1 +PHPVER=8.3 PHP_FPM_DIR=/etc/php/$PHPVER/fpm PHP_INI=$PHP_FPM_DIR/php.ini PHP_POOL_DIR=$PHP_FPM_DIR/pool.d PHP_MODS_DIR=/etc/php/"$PHPVER"/mods-available +opcache_interned_strings_buffer_value=24 # Notify push NOTIFY_PUSH_SERVICE_PATH="/etc/systemd/system/notify_push.service" # Adminer ADMINERDIR=/usr/share/adminer ADMINER_CONF="$SITES_AVAILABLE/adminer.conf" +ADMINER_CONF_PLUGIN="$ADMINERDIR/extra_plugins.php" # Redis REDIS_CONF=/etc/redis/redis.conf REDIS_SOCK=/var/run/redis/redis-server.sock @@ -184,21 +178,23 @@ SPAMHAUS=/etc/spamhaus.wl ENVASIVE=/etc/apache2/mods-available/mod-evasive.load APACHE2=/etc/apache2/apache2.conf # Full text Search -opensearch_install() { - INDEX_USER=$(gen_passwd "$SHUF" '[:lower:]') - OPNSREST=$(gen_passwd "$SHUF" "A-Za-z0-9") +fulltextsearch_install() { + FULLTEXTSEARCH_DIR="$SCRIPTS"/fulltextsearch + NEXTCLOUD_INDEX=$(gen_passwd "$SHUF" '[:lower:]') + ELASTIC_USER_PASSWORD=$(gen_passwd "$SHUF" '[:lower:]') + FULLTEXTSEARCH_IMAGE_NAME=fulltextsearch_es01 + FULLTEXTSEARCH_SERVICE=nextcloud-fulltext-elasticsearch-worker.service + # Gets the version from the latest tag here: https://github.com/docker-library/official-images/blob/master/library/elasticsearch + FULLTEXTSEARCH_IMAGE_NAME_LATEST_TAG="$(curl -s -m 900 https://raw.githubusercontent.com/docker-library/official-images/refs/heads/master/library/elasticsearch | grep "Tags:" | head -1 | awk '{print $2}')" + # Legacy, changed 2023-09-21 + DOCKER_IMAGE_NAME=es01 + # Legacy, not used at all + RORDIR=/opt/es/ + OPNSDIR=/opt/opensearch nc_fts="ark74/nc_fts" - opens_fts="opensearchproject/opensearch:1" + opens_fts="opensearchproject/opensearch" fts_node="fts_os-node" } -create_certs(){ - download_script APP opensearch_certs - check_command sed -i "s|__NCDOMAIN__|$1|" "$SCRIPTS"/opensearch_certs.sh - check_command mv "$SCRIPTS"/opensearch_certs.sh "$OPNSDIR" - check_command cd "$OPNSDIR" - check_command bash opensearch_certs.sh - rm -f "$OPNSDIR"/opensearch_certs.sh -} # Name in trusted_config ncdomain() { NCDOMAIN=$(nextcloud_occ_no_check config:system:get overwrite.cli.url | sed 's|https://||;s|/||') @@ -209,10 +205,14 @@ turn_install() { TURN_PORT=3478 TURN_DOMAIN=$(sudo -u www-data /var/www/nextcloud/occ config:system:get overwrite.cli.url | sed 's|https://||;s|/||') SHUF=$(shuf -i 25-29 -n 1) - TURN_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9@#*") - JANUS_API_KEY=$(gen_passwd "$SHUF" "a-zA-Z0-9@#*") - NC_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9@#*") + TURN_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9") + JANUS_API_KEY=$(gen_passwd "$SHUF" "a-zA-Z0-9") + SIGNALING_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9") SIGNALING_SERVER_CONF=/etc/signaling/server.conf + TURN_INTERNAL_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9") + TURN_RECORDING_SECRET=$(gen_passwd "$SHUF" "a-zA-Z0-9") + TURN_RECORDING_HOST=127.0.0.1 + TURN_RECORDING_HOST_PORT=1234 } ## FUNCTIONS @@ -390,60 +390,68 @@ something is wrong here. Please report this to $ISSUES" fi } +metadefender-scan() { +# Usage: +# metadefender-scan.sh $PATH $APIKEY, for example: +hash="$(sha256sum "$1")" +hash="${hash%% *}" +apikey=7283aa9bbcee83132506659a4e5675bb +curl "https://api.metadefender.com/v4/hash/$hash" -H "apikey: $apikey" +} + # Used in geoblock.sh -get_newest_dat_files() { - # IPv4 - IPV4_NAME=$(curl -s https://github.com/nextcloud/vm/tree/master/geoblockdat \ - | grep -oP '202[0-9]-[01][0-9]-Maxmind-Country-IPv4\.dat' | sort -r | head -1) - if [ -z "$IPV4_NAME" ] +download_geoip_mmdb() { + # Rate limit to 1 hour, we have 24 requests per day + if [ -f "$GEOBLOCK_DIR/IPInfo-Country.mmdb" ] then - print_text_in_color "$IRed" "Could not get the latest IPv4 name. Not updating the .dat file" - sleep 1 - else - if ! [ -f "$SCRIPTS/$IPV4_NAME" ] + if [ "$(( $(date +"%s") - $(stat -c "%Y" "$GEOBLOCK_DIR/IPInfo-Country.mmdb") ))" -lt "3600" ] then - print_text_in_color "$ICyan" "Downloading new IPv4 dat file..." - sleep 1 - curl_to_dir "$GEOBLOCKDAT" "$IPV4_NAME" "$SCRIPTS" - mkdir -p /usr/share/GeoIP - rm -f /usr/share/GeoIP/GeoIP.dat - check_command cp "$SCRIPTS/$IPV4_NAME" /usr/share/GeoIP - check_command mv "/usr/share/GeoIP/$IPV4_NAME" /usr/share/GeoIP/GeoIP.dat - chown root:root /usr/share/GeoIP/GeoIP.dat - chmod 644 /usr/share/GeoIP/GeoIP.dat - find /var/scripts -type f -regex \ -"$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv4\.dat" -not -name "$IPV4_NAME" -delete - else - print_text_in_color "$ICyan" "The latest IPv4 dat file is already downloaded." - sleep 1 + print_text_in_color "$IGreen" "No need to update $GEOBLOCK_DIR/IPInfo-Country.mmdb since it's newer than 1 hour." + return 1 fi - fi - # IPv6 - IPV6_NAME=$(curl -s https://github.com/nextcloud/vm/tree/master/geoblockdat \ - | grep -oP '202[0-9]-[01][0-9]-Maxmind-Country-IPv6\.dat' | sort -r | head -1) - if [ -z "$IPV6_NAME" ] + elif [ -f "$GEOBLOCK_DIR/GeoLite2-Country.mmdb" ] then - print_text_in_color "$IRed" "Could not get the latest IPv6 name. Not updating the .dat file" - sleep 1 - else - if ! [ -f "$SCRIPTS/$IPV6_NAME" ] - then - print_text_in_color "$ICyan" "Downloading new IPv6 dat file..." - sleep 1 - curl_to_dir "$GEOBLOCKDAT" "$IPV6_NAME" "$SCRIPTS" - mkdir -p /usr/share/GeoIP - rm -f /usr/share/GeoIP/GeoIPv6.dat - check_command cp "$SCRIPTS/$IPV6_NAME" /usr/share/GeoIP - check_command mv "/usr/share/GeoIP/$IPV6_NAME" /usr/share/GeoIP/GeoIPv6.dat - chown root:root /usr/share/GeoIP/GeoIPv6.dat - chmod 644 /usr/share/GeoIP/GeoIPv6.dat - find /var/scripts -type f -regex \ -"$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv6\.dat" -not -name "$IPV6_NAME" -delete - else - print_text_in_color "$ICyan" "The latest IPv6 dat file is already downloaded." - sleep 1 - fi + print_text_in_color "$ICyan" "Replacing Maxmind with IPInfo GeoIP database..." fi + + # Download or update current GeoIP DB + maxmind_geoip + export x8v8GyVQg2UejdPh + print_text_in_color "$ICyan" "Downloading latest GeoIP database from https://ipinfo.io..." + if ! curl -sfL https://ipinfo.io/data/free/country.mmdb?token="$x8v8GyVQg2UejdPh" -o "$GEOBLOCK_DIR"/IPInfo-Country.mmdb + then + print_text_in_color "$IRed" "Failed downloading GeoIP database from IPInfo, trying plan B..." + export MwKfcYATm43NMT + export i9HL69SLnp4ymy + { + echo "GEOIPUPDATE_ACCOUNT_ID=$MwKfcYATm43NMT" + echo "GEOIPUPDATE_LICENSE_KEY=$i9HL69SLnp4ymy" + echo "GEOIPUPDATE_EDITION_IDS=GeoLite2-Country" + echo "GEOIPUPDATE_FREQUENCY=0" + echo "GEOIPUPDATE_PRESERVE_FILE_TIMES=1" + echo "GEOIPUPDATE_VERBOSE=1" + } > /tmp/dockerenv + unset MwKfcYATm43NMT + unset i9HL69SLnp4ymy + install_docker + if docker run --name maxmind --env-file /tmp/dockerenv -v "$GEOBLOCK_DIR":"$GEOBLOCK_DIR" ghcr.io/maxmind/geoipupdate + then + docker rm -f maxmind + rm -f /tmp/dockerenv + # Since only one mmdb file can exist at the same time due to Apache "if" confitions, remove IPInfos config + rm -f "$GEOBLOCK_DIR"/IPInfo-Country.mmdb + print_text_in_color "$IGreen" "Maxmind GeoIP database downloaded!" + else + docker rm -f maxmind + rm -f /tmp/dockerenv + print_text_in_color "$IRed" "Rate limit for Maxmind GeoIP database reached! Can't continue from here, please report this to $ISSUES" + fi + else + # Since only one mmdb file can exist at the same time due to Apache "if" confitions, remove MaxMinds config + rm -f "$GEOBLOCK_DIR"/GeoLite2-Country.mmdb + return 0 + fi + unset x8v8GyVQg2UejdPh } # Check if process is runnnig: is_process_running dpkg @@ -467,19 +475,28 @@ done check_running_cronjobs() { while [ -n "$(pgrep -f nextcloud/cron.php)" ] do - countdown "Waiting for the Nextcloud cronjob to finish..." "30" + # Check if virus scan is running, could take ages for it to finish... + if ! pgrep -f clamd + then + # If not running, then keep waiting + countdown "Waiting for the Nextcloud cronjob to finish..." "30" + else + # If virus scan is running, then wait a bit longer, and kill it to release cron.php + countdown "Waiting for the Nextcloud cronjob and virusscan to finish..." "120" + pkill -f clamd + fi done } # Checks if site is reachable with a HTTP 200 status site_200() { -print_text_in_color "$ICyan" "Checking connection..." +print_text_in_color "$ICyan" "Checking connection to ${1}..." CURL_STATUS="$(curl -LI "${1}" -o /dev/null -w '%{http_code}\n' -s)" if [[ "$CURL_STATUS" = "200" ]] then return 0 else - print_text_in_color "$IRed" "curl didn't produce a 200 status, is ${1} reachable?" + msg_box "curl didn't produce a 200 status, is ${1} reachable? Please report this to $ISSUES." return 1 fi } @@ -504,7 +521,8 @@ You can use this site to check if the IP seems correct: https://www.whatsmydns.n fi # Is the DNS record same as the external IP address of the server? - if dig +short "${1}" @resolver1.opendns.com | grep -q "$WANIP4" + DIG="$(dig +short "${1}" @resolver1.opendns.com)" + if [ "$DIG" = "$WANIP4" ] then print_text_in_color "$IGreen" "DNS seems correct when checking with dig!" else @@ -704,10 +722,10 @@ version(){ [[ $2 != "$h" && $2 != "$t" ]] } -if ! version 20.04 "$DISTRO" 22.04.10 +if ! version 22.04 "$DISTRO" 24.04.10 then print_text_in_color "$IRed" "Your current Ubuntu version is $DISTRO but must be between \ -20.04 - 22.04.10 to run this script." +22.04 - 24.04.10 to run this script." print_text_in_color "$ICyan" "Please contact us for support upgrading your server:" print_text_in_color "$ICyan" "https://www.hanssonit.se/#contact" print_text_in_color "$ICyan" "https://shop.hanssonit.se/" @@ -759,27 +777,37 @@ fi # Check if Nextcloud is installed with TLS check_nextcloud_https() { - if ! nextcloud_occ_no_check config:system:get overwrite.cli.url | grep -q "https" +if ! nextcloud_occ_no_check config:system:get overwrite.cli.url | grep -q "https" +then + # Check if it's used by any of the Documentserver apps and adopt the message to that + if [ "$1" == 'Collabora (Docker)' ] || [ "$1" == 'OnlyOffice (Docker)' ] then - if [ "$1" == 'Collabora (Docker)' ] || [ "$1" == 'OnlyOffice (Docker)' ] + ncdomain + if ! curl -s https://"$NCDOMAIN"/status.php | grep -q 'installed":true' then msg_box "Sorry, but Nextcloud needs to be run on HTTPS. You can easily activate TLS (HTTPS) by running the Let's Encrypt script. -More info here: https://bit.ly/37wRCin +More info here: http://shortio.hanssonit.se/1EAgBmPyFc To run this script again, just exectue 'sudo bash $SCRIPTS/menu.sh' and choose: Additional Apps --> Documentserver --> $1." exit - else + fi + else + # Adopt the error message to anything else but the Documentserver apps + ncdomain + if ! curl -s https://"$NCDOMAIN"/status.php | grep -q 'installed":true' + then msg_box "Sorry, but Nextcloud needs to be run on HTTPS. You can easily activate TLS (HTTPS) by running the Let's Encrypt script. -More info here: https://bit.ly/37wRCin +More info here: http://shortio.hanssonit.se/1EAgBmPyFc To run this script again, just exectue 'sudo bash $SCRIPTS/menu.sh' and choose: Additional Apps --> $1." exit fi fi +fi } restart_webserver() { @@ -841,7 +869,7 @@ local standalone="certbot certonly --standalone --pre-hook \"systemctl stop apa #tls-alpn-01 local tls_alpn_01="certbot certonly --preferred-challenges tls-alpn-01 $default_le" #dns -local dns="certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns $default_le" +local dns="certbot certonly --manual --preferred-challenges dns $default_le" local methods=(standalone dns) for f in "${methods[@]}" @@ -1074,16 +1102,16 @@ remove_from_trusted_domains() { } check_distro_version() { -# Subṕport Ubuntu 22.0.4 jammy, and Ubuntu 20.04 focal. +# Support Ubuntu 22.04 jammy, and Ubuntu 24.04 noble. # Check Ubuntu version -if [ "${CODENAME}" == "jammy" ] || [ "${CODENAME}" == "focal" ] +if [ "${CODENAME}" == "jammy" ] || [ "${CODENAME}" == "noble" ] then OS=1 elif lsb_release -i | grep -ic "Ubuntu" &> /dev/null then OS=1 -elif uname -a | grep -ic "jammy" &> /dev/null || uname -a | grep -ic "focal" &> /dev/null +elif uname -a | grep -ic "jammy" &> /dev/null || uname -a | grep -ic "noble" &> /dev/null then OS=1 elif uname -v | grep -ic "Ubuntu" &> /dev/null @@ -1100,8 +1128,8 @@ You can find the download link here: https://www.ubuntu.com/download/server" exit 1 fi -if ! version 20.04 "$DISTRO" 22.04.10; then - msg_box "Your current Ubuntu version is $DISTRO but must be between 20.04 - 22.04.10 to run this script." +if ! version 22.04 "$DISTRO" 24.04.10; then + msg_box "Your current Ubuntu version is $DISTRO but must be between 22.04 - 24.04.10 to run this script." msg_box "Please contact us to get support for upgrading your server: https://www.hanssonit.se/#contact https://shop.hanssonit.se/product/upgrade-ubuntu-os-between-major-versions/" @@ -1132,6 +1160,12 @@ fi install_if_not() { if ! dpkg-query -W -f='${Status}' "${1}" | grep -q "ok installed" then + # https://askubuntu.com/questions/1235914/hash-sum-mismatch-error-due-to-identical-sha1-and-md5-but-different-sha256#1242739 + #if ! -f /etc/gcrypt/hwf.deny ] + #then + # mkdir -p /etc/gcrypt + # echo all > /etc/gcrypt/hwf.deny + #fi apt-get update -q4 & spinner_loading && RUNLEVEL=1 apt-get install "${1}" -y fi } @@ -1200,14 +1234,37 @@ $ISSUES and include the output of the error message. Thank you!" \ fi } -# Example: nextcloud_occ 'maintenance:mode --on' + +# Example: nextcloud_occ_no_check 'maintenance:mode --on' nextcloud_occ() { -check_command sudo -u www-data php "$NCPATH"/occ "$@"; +# Check it maintenance:mode is enabled +if sudo -u www-data php "$NCPATH"/occ maintenance:mode | grep -q enabled >/dev/null 2>&1 +then + # Disable maintenance:mode + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off >/dev/null 2>&1 + # Run the actual command + check_command sudo -u www-data php "$NCPATH"/occ "$@"; + # Enable maintenance:mode again + sudo -u www-data php "$NCPATH"/occ maintenance:mode --on >/dev/null 2>&1 +else + check_command sudo -u www-data php "$NCPATH"/occ "$@"; +fi } # Example: nextcloud_occ_no_check 'maintenance:mode --on' nextcloud_occ_no_check() { -sudo -u www-data php "$NCPATH"/occ "$@"; +# Check it maintenance:mode is enabled +if sudo -u www-data php "$NCPATH"/occ maintenance:mode | grep -q enabled >/dev/null 2>&1 +then + # Disable maintenance:mode + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off >/dev/null 2>&1 + # Run the actual command + sudo -u www-data php "$NCPATH"/occ "$@"; + # Enable maintenance:mode again + sudo -u www-data php "$NCPATH"/occ maintenance:mode --on >/dev/null 2>&1 +else + sudo -u www-data php "$NCPATH"/occ "$@"; +fi } # Backwards compatibility (2020-10-08) @@ -1231,7 +1288,7 @@ version(){ [[ $2 != "$h" && $2 != "$t" ]] } -if version 20.04 "$DISTRO" 22.04.10 +if version 22.04 "$DISTRO" 24.04.10 then print_text_in_color "$ICyan" "Testing if network is OK..." if site_200 github.com @@ -1256,7 +1313,7 @@ then fi fi else - msg_box "Your current Ubuntu version is $DISTRO but must be between 20.04 - 22.04.10 to run this script." + msg_box "Your current Ubuntu version is $DISTRO but must be between 22.04 - 24.04.10 to run this script." msg_box "Please contact us to get support for upgrading your server: https://www.hanssonit.se/#contact https://shop.hanssonit.se/" @@ -1359,7 +1416,7 @@ fi print_text_in_color "$ICyan" "Checking SHA256 checksum..." mkdir -p "$SHA256_DIR" curl_to_dir "$NCREPO" "$STABLEVERSION.tar.bz2.sha256" "$SHA256_DIR" -SHA256SUM="$(tail "$SHA256_DIR"/"$STABLEVERSION".tar.bz2.sha256 | awk '{print$1}')" +SHA256SUM="$(tail "$SHA256_DIR"/"$STABLEVERSION".tar.bz2.sha256 | awk '{print$1}' | head -1)" if ! echo "$SHA256SUM" "$STABLEVERSION.tar.bz2" | sha256sum -c then msg_box "The SHA256 checksums of $STABLEVERSION.tar.bz2 didn't match, please try again." @@ -1428,7 +1485,7 @@ If it still fails, please report this issue to: $ISSUES." fi } -# Run any script in ../master +# Run any script in ../main # call like: run_main_script name_of_script run_main_script() { run_script GITHUB_REPO "${1}" @@ -1476,7 +1533,7 @@ any_key() { lowest_compatible_nc() { # .ocdata needs to exist to be able to check version, occ relies on everytihgn working -until [ -f "$NCDATA"/.ocdata ] +until [ -f "$NCDATA"/.ocdata ] || [ -f "$NCDATA"/.ncdata ] do # SUPPORT LEGACY: If it's not in the standard path, check for existing datadir in config.php if [ -f "$NCPATH"/config/config.php ] @@ -1489,7 +1546,7 @@ do If you think this is a bug, please report it to $ISSUES" else # Check again an break if found - if [ -f "$NCDATA"/.ocdata ] + if [ -f "$NCDATA"/.ocdata ] || [ -f "$NCDATA"/.ncdata ] then break fi @@ -1520,7 +1577,7 @@ or experience other issues then please report this to $ISSUES" # Download the latest updater # cd $NCPATH -# curl sLO https://github.com/nextcloud/updater/archive/master.zip +# curl sLO https://github.com/nextcloud/updater/archive/main.zip # install_if_not unzip # unzip -q master.zip # rm master.zip* @@ -1541,10 +1598,8 @@ fi # Check new version # shellcheck source=lib.sh -if [ -z "$NCVERSION" ] -then - nc_update -fi +source /var/scripts/fetch_lib.sh +nc_update if [ "${CURRENTVERSION%%.*}" -ge "$1" ] then sleep 1 @@ -1712,10 +1767,11 @@ then "storage-driver": "overlay2" } OVERLAY2 -fi -systemctl daemon-reload -systemctl restart docker.service + # Only restart if changed + systemctl daemon-reload + systemctl restart docker.service +fi } # Remove all dockers excluding one @@ -1739,15 +1795,22 @@ fi } # Remove selected Docker image -# docker_prune_this 'collabora/code' 'onlyoffice/documentserver' 'ark74/nc_fts' 'nextcloud/aio-imaginary' +# docker_prune_this 'collabora/code' 'onlyoffice/documentserver' 'ark74/nc_fts' 'imaginary' docker_prune_this() { if does_this_docker_exist "$1" then if yesno_box_yes "Do you want to remove $1?" then - docker stop "$(docker container ls -a | grep "$1" | awk '{print $1}' | tail -1)" - docker rm "$(docker container ls -a | grep "$1" | awk '{print $1}' | tail -1)" --volumes + CONTAINER="$(docker container ls -a | grep "$1" | awk '{print $1}' | tail -1)" + if [ -z "$CONTAINER" ] + then + # Special solution if the container name is scrambled, then search for the actual name instead + CONTAINER="$(docker container ls -a | grep "$2" | awk '{print $1}' | tail -1)" + fi + docker stop "$CONTAINER" + docker rm "$CONTAINER" docker image prune -a -f + docker system prune -a -f else msg_box "OK, this script will now exit, but there's still leftovers to cleanup. You can run it again at any time." exit @@ -1791,19 +1854,21 @@ fi docker_update_specific() { if is_docker_running && docker ps -a --format "{{.Names}}" | grep -q "^$1$" then - docker run --rm --name temporary_watchtower -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower --cleanup --run-once "$1" - print_text_in_color "$IGreen" "$2 docker image just got updated!" - echo "Docker image just got updated! We just updated $2 docker image automatically! $(date +%Y%m%d)" >> "$VMLOGS"/update.log + if docker run --rm --name temporary_watchtower -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower --cleanup --run-once "$1" + then + print_text_in_color "$IGreen" "$2 docker image just got updated!" + echo "Docker image just got updated! We just updated $2 docker image automatically! $(date +%Y%m%d)" >> "$VMLOGS"/update.log + fi fi } -# docker-compose_update 'fts_os-node' 'Full Text Search' "$OPNSDIR" +# docker-compose_update 'fulltextsearch-elasticsearch' 'Full Text Search' "$FTSDIR" # (docker conainter name = $1, the name in text = $2 , docker-compose directory = $3) docker-compose_update() { if is_docker_running && docker ps -a --format "{{.Names}}" | grep -q "^$1$" then cd "$3" - docker-compose pull - docker-compose up -d --remove-orphans + docker compose pull + docker compose up -d --remove-orphans docker image prune -a -f print_text_in_color "$IGreen" "$2 docker image just got updated!" echo "Docker image just got updated! We just updated $2 docker image automatically! $(date +%Y%m%d)" >> "$VMLOGS"/update.log @@ -1826,10 +1891,14 @@ printf "%b%s%b\n" "$1" "$2" "$Color_Off" } # Apply patch -# git_apply_patch 15992 server 16.0.2 +# App: +# git_apply_patch "319" "fulltextsearch_elasticsearch" "27.1.1" "$NCPATH/apps/fulltextsearch_elasticsearch" +# Server: +# git_apply_patch "15992" "server" "16.0.2" "$NCPATH" # 1 = pull # 2 = repository -# Nextcloud version +# 3 = Nextcloud version +# 4 = Folder on system git_apply_patch() { if [ -z "$NCVERSION" ] then @@ -1839,7 +1908,7 @@ if [[ "$CURRENTVERSION" = "$3" ]] then curl_to_dir "https://patch-diff.githubusercontent.com/raw/nextcloud/${2}/pull" "${1}.patch" "/tmp" install_if_not git - cd "$NCPATH" + cd "${4}" if git apply --check /tmp/"${1}".patch >/dev/null 2>&1 then print_text_in_color "$IGreen" "Applying patch https://github.com/nextcloud/${2}/pull/${1} ..." @@ -1967,7 +2036,7 @@ zpool_import_if_missing() { # ZFS needs to be installed if ! is_this_installed zfsutils-linux then - print_text_in_color "$IRed" "This function is only intened to be run if you have ZFS installed." + print_text_in_color "$IRed" "This function is only intended to be run if you have ZFS installed." return 1 elif [ -z "$POOLNAME" ] then @@ -1998,7 +2067,7 @@ fi check_free_space() { if vgs &>/dev/null then - FREE_SPACE=$(vgs | grep ubuntu-vg | awk '{print $7}' | grep g | grep -oP "[0-9]+[\.,][0-9]" | sed 's|\.||') + FREE_SPACE=$(vgs | grep ubuntu-vg | awk '{print $7}' | grep g | grep -oP "[0-9]+[\.,][0-9]" | sed 's|[.,]||') fi if [ -z "$FREE_SPACE" ] then @@ -2066,6 +2135,15 @@ then elif grep 8.3 <<< "$GETPHP" >/dev/null 2>&1 then export PHPVER=8.3 +elif grep 8.4 <<< "$GETPHP" >/dev/null 2>&1 +then + export PHPVER=8.4 +elif grep 8.5 <<< "$GETPHP" >/dev/null 2>&1 +then + export PHPVER=8.5 +elif grep 8.6 <<< "$GETPHP" >/dev/null 2>&1 +then + export PHPVER=8.6 fi # Export other PHP variables based on PHPVER @@ -2126,7 +2204,7 @@ add_trusted_key_and_repo() { check_distro_version # Do the magic - if version 22.04 "$DISTRO" 22.04.10 + if version 22.04 "$DISTRO" 24.04.10 then # New recommended way not using apt-key print_text_in_color "$ICyan" "Adding trusted key in /etc/apt/keyrings/$1..." diff --git a/menu/additional_apps.sh b/menu/additional_apps.sh index a90719d6..8e9fcdcb 100644 --- a/menu/additional_apps.sh +++ b/menu/additional_apps.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Additional Apps Menu" @@ -50,14 +50,13 @@ $CHECKLIST_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ "LDAP" "(Windows Active directory for Nextcloud)" OFF \ "Notify Push" "(High Performance Files Backend for Nextcloud)" OFF \ "Netdata" "(Real-time server monitoring in Web GUI)" OFF \ -"FullTextSearch" "(Search for text inside documents [4GB RAM])" OFF \ +"FullTextSearch" "(Search for text inside documents [6GB RAM])" OFF \ "BPYTOP" "(Real-time server monitoring in CLI)" OFF \ "ClamAV" "(Antivirus for Nextcloud and files)" OFF \ "Midnight Commander" "(CLI file manager)" OFF \ "Pico CMS" "(Lightweight CMS integration in Nextcloud)" OFF \ "Whiteboard" "(Whiteboard for Nextcloud)" OFF \ -"Extract" "(Archive extraction for Nextcloud)" OFF \ -"PDF Annotations" "(Annotate PDF files in Nextcloud)" OFF 3>&1 1>&2 2>&3) +"Extract" "(Archive extraction for Nextcloud)" OFF 3>&1 1>&2 2>&3) case "$choice" in *"Documentserver"*) @@ -143,10 +142,6 @@ to finish the setup once this script is done." "$SUBTITLE" print_text_in_color "$ICyan" "Downloading the SMB-mount script..." run_script APP smbmount ;;& - *"PDF Annotations"*) - print_text_in_color "$ICyan" "Downloading the PDF Annotations script..." - run_script APP pdfannotate - ;;& *) ;; esac diff --git a/menu/bitwarden_menu.sh b/menu/bitwarden_menu.sh index 13389dfb..c77de393 100644 --- a/menu/bitwarden_menu.sh +++ b/menu/bitwarden_menu.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Bitwarden Menu" diff --git a/menu/desec_menu.sh b/menu/desec_menu.sh index a5aeb553..f7e1b496 100644 --- a/menu/desec_menu.sh +++ b/menu/desec_menu.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="deSEC Menu" diff --git a/menu/documentserver.sh b/menu/documentserver.sh index c4e4f06b..444d6df3 100644 --- a/menu/documentserver.sh +++ b/menu/documentserver.sh @@ -1,9 +1,9 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true -SCRIPT_NAME="Documentserver Menu" +SCRIPT_NAME="Documentserver menu" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh @@ -17,12 +17,12 @@ debug_mode root_check choice=$(whiptail --title "$TITLE" --menu \ -"Which Documentserver do you want to install?\n\nAutomatically configure and install the selected Documentserver. +"Which Documentserver for online editing do you want to install?\n\nWe recomend Collabora with Docker. The subdomain could look like this:\noffice.your-nextcloud.tld\n\nAutomatically configure and install the selected Documentserver. $MENU_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ -"Collabora (Docker)" "(Online editing - Extra Subdomain required)" \ -"Collabora (Integrated)" "(Online editing - No Subdomain required)" \ -"OnlyOffice (Docker)" "(Online editing - Extra Subdomain required)" \ -"OnlyOffice (Integrated)" "(Online editing - No Subdomain required)" 3>&1 1>&2 2>&3) +"Collabora (Docker)" "(Extra Subdomain required)" \ +"Collabora (Integrated)" "(No Subdomain required)" \ +"OnlyOffice (Docker)" "(Extra Subdomain required)" \ +"OnlyOffice (Integrated)" "(No Subdomain required)" 3>&1 1>&2 2>&3) case "$choice" in "Collabora (Docker)") diff --git a/menu/fail2ban_menu.sh b/menu/fail2ban_menu.sh index 694483ff..081e8f9d 100644 --- a/menu/fail2ban_menu.sh +++ b/menu/fail2ban_menu.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Fail2ban Menu" diff --git a/menu/main_menu.sh b/menu/main_menu.sh index e80c9ebe..28c0aeac 100644 --- a/menu/main_menu.sh +++ b/menu/main_menu.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Main Menu" @@ -81,7 +81,7 @@ To upgrade to the latest version, please run: 'sudo bash $SCRIPTS/update.sh' fro download_script STATIC update if [ -n "$REBOOT_SET" ] then - sed -i "s|exit|/sbin/shutdown -r +1|g" "$SCRIPTS"/update.sh + sed -i "s|exit|/sbin/shutdown -r +10|g" "$SCRIPTS"/update.sh fi do_the_update else diff --git a/menu/menu.sh b/menu/menu.sh index 4e0f4c73..fdec675a 100644 --- a/menu/menu.sh +++ b/menu/menu.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Main Menu" diff --git a/menu/nextcloud_configuration.sh b/menu/nextcloud_configuration.sh index 77dd32a1..1fbb088c 100644 --- a/menu/nextcloud_configuration.sh +++ b/menu/nextcloud_configuration.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Nextcloud Configuration Menu" @@ -122,6 +122,11 @@ daily rotate 10 copytruncate } +$VMLOGS/audit.log { +daily +rotate 10 +copytruncate +} NEXTCLOUD_CONF # Set needed ownership for the Nextcloud log folder to work correctly diff --git a/menu/server_configuration.sh b/menu/server_configuration.sh index ea137a51..16f263a4 100644 --- a/menu/server_configuration.sh +++ b/menu/server_configuration.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Server Configuration Menu" diff --git a/menu/startup_configuration.sh b/menu/startup_configuration.sh index 04eedde5..2711fe22 100644 --- a/menu/startup_configuration.sh +++ b/menu/startup_configuration.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Startup Configuration Menu" @@ -37,6 +37,13 @@ else fi # Get the correct apt-mirror +# Handle several sources +FIND_SOURCES="$(find /etc/apt/ -type f -name "*sources*")" +for source in $FIND_SOURCES +do + REPO=$(grep "URIs:" "$source" | grep http | awk '{print $2}' | head -1) +done +# Check if it matches if [ "$REPO" = 'http://archive.ubuntu.com/ubuntu' ] then MIRROR_SWITCH="ON" @@ -59,7 +66,7 @@ choice=$(whiptail --title "$TITLE" --checklist \ $CHECKLIST_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ "Keyboard Layout" "(Change the keyboard layout from '$KEYBOARD_LAYOUT')" "$KEYBOARD_LAYOUT_SWITCH" \ "Timezone" "(Change the timezone from $(cat /etc/timezone))" "$TIMEZONE_SWITCH" \ -"Locate Mirror" "(Change the apt-mirror from $REPO)" OFF 3>&1 1>&2 2>&3) +"Locate Mirror" "(Change the apt repo for better download performance)" "$MIRROR_SWITCH" 3>&1 1>&2 2>&3) case "$choice" in *"Keyboard Layout"*) diff --git a/network/asusnuc/pn51.sh b/network/asusnuc/pn51.sh index de11aae1..a59f404e 100644 --- a/network/asusnuc/pn51.sh +++ b/network/asusnuc/pn51.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Implements this way of doing it: https://askubuntu.com/a/1281319 @@ -46,18 +46,13 @@ mkdir -p "$INSTALLDIR" print_text_in_color "$ICyan" "Checking for newer version of firmware..." if ! curl -k -s https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software | grep "$RVERSION" >/dev/null then - msg_box "It seems like there's a newer version of the Realtek Driver for the LAN network card. - -Please report this to $ISSUES including this link: -https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software - -Thanks!" + print_text_in_color "$ICyan" "Newer firmware for your Realtek card available. Please check here for upgrading: https://github.com/awesometic/realtek-r8125-dkms" fi # Download the driver before it's removed (no internet when it's removed) if [ ! -f "$INSTALLDIR"/r8125-"$RVERSION".tar.bz2 ] then - curl_to_dir https://github.com/nextcloud/vm/raw/master/network/asusnuc r8125-"$RVERSION".tar.bz2 "$INSTALLDIR" + curl_to_dir https://github.com/nextcloud/vm/raw/main/network/asusnuc r8125-"$RVERSION".tar.bz2 "$INSTALLDIR" fi # Install latest driver diff --git a/network/ddclient-configuration.sh b/network/ddclient-configuration.sh index 995e4e1f..106159fb 100644 --- a/network/ddclient-configuration.sh +++ b/network/ddclient-configuration.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/network/geoblock.sh b/network/geoblock.sh index 9948e30a..aeaa08d4 100644 --- a/network/geoblock.sh +++ b/network/geoblock.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -22,40 +22,99 @@ debug_mode root_check # Check if it is already configured -if ! grep -q "^#Geoip-block" /etc/apache2/apache2.conf +if [ ! -f "$GEOBLOCK_MOD_CONF" ] && [ ! -f "$GEOBLOCK_MOD" ] && ! grep -q "^#Geoip-block" /etc/apache2/apache2.conf then # Ask for installing install_popup "$SCRIPT_NAME" else # Ask for removal or reinstallation reinstall_remove_menu "$SCRIPT_NAME" - # Removal + # Remove Apache mod config + rm -f "$GEOBLOCK_MOD_CONF" + # Remove old database files find /var/scripts -type f -regex \ "$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv[46]\.dat" -delete + find "$GEOBLOCK_DIR" -type f -regex \ +"*.dat" -delete + rm -f "$GEOBLOCK_DIR"/IPInfo-Country.mmdb + # Remove Apache2 mod + if [ -f "$GEOBLOCK_MOD" ] + then + a2dismod maxminddb + rm -f "$GEOBLOCK_MOD" + rm -f /usr/lib/apache2/modules/mod_maxminddb.so + fi if is_this_installed libapache2-mod-geoip then a2dismod geoip apt-get purge libapache2-mod-geoip -y fi - apt-get autoremove -y - sed -i "/^#Geoip-block-start/,/^#Geoip-block-end/d" /etc/apache2/apache2.conf - check_command systemctl restart apache2 + # Remove PPA + if grep ^ /etc/apt/sources.list /etc/apt/sources.list.d/* | grep maxmind-ubuntu-ppa + then + install_if_not ppa-purge + yes | ppa-purge maxmind/ppa + rm -f /etc/apt/sources.list.d/maxmind* + fi + # Remove Apache config + if grep "Geoip-block-start" /etc/apache2/apache2.conf + then + sed -i "/^#Geoip-block-start/,/^#Geoip-block-end/d" /etc/apache2/apache2.conf + fi + if [ -f "$GEOBLOCK_MOD_CONF" ] + then + a2disconf geoblock + rm -f "$GEOBLOCK_MOD_CONF" + fi # Show successful uninstall if applicable removal_popup "$SCRIPT_NAME" + # Make sure it's clean from unused packages and files + apt-get purge libmaxminddb0* libmaxminddb-dev* mmdb-bin* apache2-dev* -y + apt-get autoremove -y + check_command systemctl restart apache2 fi -# Install needed tools -install_if_not libapache2-mod-geoip +# Download GeoIP Databases +if ! download_geoip_mmdb +then + exit 1 +fi -# Enable apache mod -check_command a2enmod geoip rewrite +##### GeoIP script (Apache Setup) +# Install requirements +yes | add-apt-repository ppa:maxmind/ppa +apt-get update -q4 & spinner_loading +install_if_not libmaxminddb0 +install_if_not libmaxminddb-dev +install_if_not mmdb-bin +install_if_not apache2-dev + +# maxminddb_module https://github.com/maxmind/mod_maxminddb +cd /tmp +curl_to_dir https://github.com/maxmind/mod_maxminddb/releases/download/1.2.0/ mod_maxminddb-1.2.0.tar.gz /tmp +tar -xzf mod_maxminddb-1.2.0.tar.gz +cd mod_maxminddb-1.2.0 +if ./configure +then + make install + # Delete conf made by module + rm -f /etc/apache2/mods-enabled/maxminddb.conf + # Check if module is enabled + if ! apachectl -M | grep -i "maxminddb" + then + msg_box "Couldn't install the Apache module for MaxMind. Please report this to $ISSUES" + exit 1 + fi + # Cleanup + rm -rf mod_maxminddb-1.2.0 mod_maxminddb-1.2.0.tar.gz +fi + +# Enable modules +check_command a2enmod rewrite remoteip maxminddb +# Delete conf made by module +rm -f /etc/apache2/mods-enabled/maxminddb.conf check_command systemctl restart apache2 -# Download newest dat files -find /var/scripts -type f -regex \ -"$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv[46]\.dat" -delete -get_newest_dat_files - # Restrict to countries and/or continents choice=$(whiptail --title "$TITLE" --checklist \ "Do you want to restrict to countries and/or continents? @@ -71,7 +130,7 @@ fi if [[ "$choice" = *"Countries"* ]] then # Download csv file - if ! curl_to_dir "https://dev.maxmind.com/csv-files/codes" "iso3166.csv" "$SCRIPTS" + if ! curl_to_dir "https://dev.maxmind.com/static/csv/codes" "iso3166.csv" "$SCRIPTS" then msg_box "Could not download the iso3166.csv file. Please report this to $ISSUES" @@ -158,24 +217,44 @@ then mapfile -t choice <<< "$choice" fi -GEOIP_CONF="#Geoip-block-start - Please don't remove or change this line - - GeoIPEnable On - GeoIPDBFile /usr/share/GeoIP/GeoIP.dat - GeoIPDBFile /usr/share/GeoIP/GeoIPv6.dat +# Create conf +cat << GEOBLOCKCONF_CREATE > "$GEOBLOCK_MOD_CONF" + + MaxMindDBEnable On + + # Check for IPinfo mmdb + + MaxMindDBFile DB $GEOBLOCK_DIR/IPInfo-Country.mmdb + MaxMindDBEnv MM_CONTINENT_CODE DB/continent + MaxMindDBEnv MM_COUNTRY_CODE DB/country + + # Check for Maxmind mmdb + + MaxMindDBFile DB $GEOBLOCK_DIR/GeoLite2-Country.mmdb + MaxMindDBEnv MM_CONTINENT_CODE DB/continent/code + MaxMindDBEnv MM_COUNTRY_CODE DB/country/iso_code + -\n" + + # Geoblock rules +GEOBLOCKCONF_CREATE + +# Add parameters to maxmind conf +echo "" >> "$GEOBLOCK_MOD_CONF" for continent in "${choice[@]}" do - GEOIP_CONF+=" SetEnvIf GEOIP_CONTINENT_CODE $continent AllowCountryOrContinent\n" - GEOIP_CONF+=" SetEnvIf GEOIP_CONTINENT_CODE_V6 $continent AllowCountryOrContinent\n" + echo " SetEnvIf MM_CONTINENT_CODE $continent AllowCountryOrContinent" >> "$GEOBLOCK_MOD_CONF" done for country in "${selected_options[@]}" do - GEOIP_CONF+=" SetEnvIf GEOIP_COUNTRY_CODE $country AllowCountryOrContinent\n" - GEOIP_CONF+=" SetEnvIf GEOIP_COUNTRY_CODE_V6 $country AllowCountryOrContinent\n" + echo " SetEnvIf MM_COUNTRY_CODE $country AllowCountryOrContinent" >> "$GEOBLOCK_MOD_CONF" done -GEOIP_CONF+=" Allow from env=AllowCountryOrContinent +echo " Allow from env=AllowCountryOrContinent" >> "$GEOBLOCK_MOD_CONF" + +# Add allow rules to maxmind conf +cat << GEOBLOCKALLOW_CREATE >> "$GEOBLOCK_MOD_CONF" + + # Specifically allow this Allow from 127.0.0.1/8 Allow from 192.168.0.0/16 Allow from 172.16.0.0/12 @@ -186,13 +265,18 @@ GEOIP_CONF+=" Allow from env=AllowCountryOrContinent Order Deny,Allow Deny from all -#Geoip-block-end - Please don't remove or change this line" -# Write everything to the file -echo -e "$GEOIP_CONF" >> /etc/apache2/apache2.conf + # Logs + LogLevel info + CustomLog "$VMLOGS/geoblock_access.log" common +GEOBLOCKALLOW_CREATE -check_command systemctl restart apache2 +# Enable config +check_command a2enconf geoblock -msg_box "GeoBlock was successfully configured" - -exit +if check_command systemctl restart apache2 +then + msg_box "GeoBlock was successfully configured" +else + msg_box "Something went wrong, please check Apache error logs." +fi diff --git a/network/static_ip.sh b/network/static_ip.sh index a8b957da..afddeacd 100644 --- a/network/static_ip.sh +++ b/network/static_ip.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Use local lib file in case there is no internet connection if printf "Testing internet connection..." && ping github.com -c 2 >/dev/null 2>&1 @@ -186,7 +186,7 @@ network: $IFACE: #object name dhcp4: false # dhcp v4 disable dhcp6: false # dhcp v6 disable - addresses: + addresses: - $LANIP routes: - to: default @@ -198,6 +198,7 @@ IPCONFIG msg_box "These are your settings, please make sure they are correct: $(cat /etc/netplan/nextcloud.yaml)" + chmod 600 /etc/netplan/nextcloud.yaml netplan try set_systemd_resolved_dns "$IFACE" else @@ -208,7 +209,7 @@ network: $IFACE2: #object name dhcp4: false # dhcp v4 disable dhcp6: false # dhcp v6 disable - addresses: + addresses: - $LANIP routes: - to: default @@ -220,6 +221,7 @@ IPCONFIGnonvmware msg_box "These are your settings, please make sure they are correct: $(cat /etc/netplan/nextcloud.yaml)" + chmod 600 /etc/netplan/nextcloud.yaml netplan try set_systemd_resolved_dns "$IFACE2" fi diff --git a/network/trusted.sh b/network/trusted.sh index 6b0e6504..a4bba790 100644 --- a/network/trusted.sh +++ b/network/trusted.sh @@ -1,28 +1,14 @@ #!/bin/bash - -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ - true -SCRIPT_NAME="Trusted" +SCRIPT_NAME="Set trusted domain" # shellcheck source=lib.sh -source /var/scripts/fetch_lib.sh +source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) -# Check for errors + debug code and abort if something isn't right -# 1 = ON -# 0 = OFF -DEBUG=0 -debug_mode +# Removed in NC 26.0.0. -download_script NETWORK update-config -if [ -f $SCRIPTS/update-config.php ] -then - # Change config.php - php $SCRIPTS/update-config.php $NCPATH/config/config.php 'trusted_domains[]' localhost "${ADDRESS[@]}" "$(hostname)" "$(hostname --fqdn)" >/dev/null 2>&1 - php $SCRIPTS/update-config.php $NCPATH/config/config.php overwrite.cli.url https://"$(hostname --fqdn)"/ >/dev/null 2>&1 - - # Change .htaccess accordingly - sed -i "s|RewriteBase /nextcloud|RewriteBase /|g" $NCPATH/.htaccess - - # Cleanup - rm -f $SCRIPTS/update-config.php -fi +# Set trusted domains +nextcloud_occ config:system:set trusted_domains 0 --value="localhost" +nextcloud_occ config:system:set trusted_domains 1 --value="$ADDRESS" +nextcloud_occ config:system:set trusted_domains 2 --value="$(hostname -f)" +nextcloud_occ config:system:set overwrite.cli.url --value="https://$(hostname --fqdn)" +nextcloud_occ maintenance:update:htaccess diff --git a/network/update-config.php b/network/update-config.php deleted file mode 100644 index cf88651f..00000000 --- a/network/update-config.php +++ /dev/null @@ -1,53 +0,0 @@ -#!/usr/bin/php - -# Credit to: https://github.com/jnweiger - - 3) - { - # append [] to the key name, if you need to pass an array object. - if (substr($argv[2], -2) === '[]') - { - $CONFIG[substr($argv[2],0,-2)] = array_slice($argv,3); - } - else - { - $CONFIG[$argv[2]] = $argv[3]; - } - } -else - { - # exactly two parameter given -- means delete. - unset($CONFIG[$argv[2]]); - } - -$text = var_export($CONFIG, true); -## A warning is printed, if argv[1] is not writable. -## PHP does not issue proper errno or strerror() does it? -file_put_contents($argv[1], " diff --git a/nextcloud-startup-script.sh b/nextcloud-startup-script.sh index d497129a..b62f8fd4 100644 --- a/nextcloud-startup-script.sh +++ b/nextcloud-startup-script.sh @@ -1,8 +1,8 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE +# https://github.com/nextcloud/vm/blob/main/LICENSE ######### @@ -482,13 +482,16 @@ else fi # Set correct amount of CPUs for Imaginary -if which nproc >/dev/null 2>&1 +if does_this_docker_exist ghcr.io/nextcloud-releases/aio-imaginary then - nextcloud_occ config:system:set preview_concurrency_new --value="$(nproc)" - nextcloud_occ config:system:set preview_concurrency_all --value="$(($(nproc)*2))" -else - nextcloud_occ config:system:set preview_concurrency_new --value="2" - nextcloud_occ config:system:set preview_concurrency_all --value="4" + if which nproc >/dev/null 2>&1 + then + nextcloud_occ config:system:set preview_concurrency_new --value="$(nproc)" + nextcloud_occ config:system:set preview_concurrency_all --value="$(($(nproc)*2))" + else + nextcloud_occ config:system:set preview_concurrency_new --value="2" + nextcloud_occ config:system:set preview_concurrency_all --value="4" + fi fi # Add temporary fix if needed @@ -514,8 +517,11 @@ rm -f "$SCRIPTS/desec_menu.sh" rm -f "$NCDATA"/*.log find /root "/home/$UNIXUSER" -type f \( -name '*.sh*' -o -name '*.html*' -o -name '*.tar*' -o -name 'results' -o -name '*.zip*' \) -delete -find "$NCPATH" -type f \( -name 'results' -o -name '*.sh*' \) -delete sed -i "s|instruction.sh|nextcloud.sh|g" "/home/$UNIXUSER/.bash_profile" +# TODO: Do we really need this? +# https://github.com/nextcloud/server/issues/48773 +# find "$NCPATH" -type f \( -name 'results' -o -name '*.sh*' \) -delete +find "$NCPATH" -type f \( -name 'results' \) -delete truncate -s 0 \ /root/.bash_history \ @@ -553,20 +559,27 @@ mesg n ROOTNEWPROFILE -# Set trusted domain in config.php -run_script NETWORK trusted +# Set trusted domains +run_script STATIC trusted_domains # Upgrade system print_text_in_color "$ICyan" "System will now upgrade..." bash $SCRIPTS/update.sh minor +# Add missing indices (if any) +nextcloud_occ db:add-missing-indices + # Check if new major is out, and inform on how to update -if version_gt "$NCVERSION" "$CURRENTVERSION" +nc_update +if version_gt "$NCMAJOR" "$CURRENTMAJOR" then msg_box "We noticed that there's a new major release of Nextcloud ($NCVERSION).\nIf you want to update to the latest release instantly, please check this:\n https://docs.hanssonit.se/s/W6fMouPiqQz3_Mog/virtual-machines-vm/d/W7Du9uPiqQz3_Mr1/nextcloud-vm-machine-configuration?currentPageId=W7D3quPiqQz3_MsE" fi +# Repair +nextcloud_occ maintenance:repair --include-expensive + # Cleanup 2 apt-get autoremove -y apt-get autoclean @@ -588,7 +601,7 @@ More info here: https://nextcloud.com/enterprise/ Get your license here: https://shop.hanssonit.se/product/nextcloud-enterprise-license-100-users/" msg_box "TIPS & TRICKS: -1. Publish your server online: https://goo.gl/iUGE2U +1. Publish your server online: http://shortio.hanssonit.se/ffOQOXS6Kh 2. To login to PostgreSQL just type: sudo -u postgres psql nextcloud_db 3. To update this server just type: sudo bash /var/scripts/update.sh 4. Install apps, configure Nextcloud, and server: sudo bash $SCRIPTS/menu.sh" @@ -613,7 +626,7 @@ Login to Nextcloud in your browser: ### PLEASE HIT OK TO REBOOT ###" # Reboot -print_text_in_color "$IGreen" "Installation done, system will now reboot..." +print_text_in_color "$IGreen" "Installation done! Please hit OK to cleanup the setup files, and reboot the system." check_command rm -f "$SCRIPTS/you-can-not-run-the-startup-script-several-times" check_command rm -f "$SCRIPTS/nextcloud-startup-script.sh" if ! reboot diff --git a/nextcloud_install_production.sh b/nextcloud_install_production.sh index 36e0000d..04c6a1c6 100644 --- a/nextcloud_install_production.sh +++ b/nextcloud_install_production.sh @@ -1,8 +1,8 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE +# https://github.com/nextcloud/vm/blob/main/LICENSE # Prefer IPv4 for apt echo 'Acquire::ForceIPv4 "true";' >> /etc/apt/apt.conf.d/99force-ipv4 @@ -28,12 +28,20 @@ else apt-get install curl -y fi +# Install whiptail if not existing +if [ "$(dpkg-query -W -f='${Status}' "whiptail" 2>/dev/null | grep -c "ok installed")" = "1" ] +then + echo "whiptail OK" +else + apt-get install whiptail -y +fi + true SCRIPT_NAME="Nextcloud Install Script" SCRIPT_EXPLAINER="This script is installing all requirements that are needed for Nextcloud to run. It's the first of two parts that are necessary to finish your customized Nextcloud installation." # shellcheck source=lib.sh -source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -53,9 +61,9 @@ is_process_running apt is_process_running dpkg # Check distribution and version -if ! version 22.04 "$DISTRO" 22.04.10 +if ! version 24.04 "$DISTRO" 24.04.10 then - msg_box "This script can only be run on Ubuntu 22.04 (server)." + msg_box "This script can only be run on Ubuntu 24.04 (server)." exit 1 fi @@ -63,17 +71,6 @@ fi # Restart mode: (l)ist only, (i)nteractive or (a)utomatically. sed -i "s|#\$nrconf{restart} = .*|\$nrconf{restart} = 'a';|g" /etc/needrestart/needrestart.conf -# Install needed dependencies -install_if_not lshw -install_if_not net-tools -install_if_not whiptail -install_if_not apt-utils - -# Nice to have dependencies -install_if_not bash-completion -install_if_not htop -install_if_not iputils-ping - # Check for flags if [ "$1" = "" ] then @@ -106,7 +103,8 @@ then if ! does_snapshot_exist "NcVM-installation" && yesno_box_no "Do you want to use LVM snapshots to be able to restore your root partition during upgrades and such? Please note: this feature will not be used by this script but by other scripts later on. For now we will only create a placeholder volume that will be used to let some space for snapshot volumes. -Be aware that you will not be able to use the built-in backup solution if you choose 'No'!" +Be aware that you will not be able to use the built-in backup solution if you choose 'No'! +Enabling this will also force an automatic reboot after running the update script!" then check_free_space if [ "$FREE_SPACE" -ge 50 ] @@ -122,38 +120,6 @@ Be aware that you will not be able to use the built-in backup solution if you ch fi fi -# Download needed libraries before execution of the first script -mkdir -p "$SCRIPTS" -download_script GITHUB_REPO lib -download_script STATIC fetch_lib - -# Set locales -run_script ADDONS locales - -# Create new current user -download_script STATIC adduser -bash "$SCRIPTS"/adduser.sh "nextcloud_install_production.sh" -rm -f "$SCRIPTS"/adduser.sh - -check_universe -check_multiverse - -# Check if key is available -if ! site_200 "$NCREPO" -then - msg_box "Nextcloud repo is not available, exiting..." - exit 1 -fi - -# Test Home/SME function -if home_sme_server -then - msg_box "This is the Home/SME server, function works!" -else - print_text_in_color "$ICyan" "Home/SME Server not detected. No worries, just testing the function." - sleep 3 -fi - # Fix LVM on BASE image if grep -q "LVM" /etc/fstab then @@ -186,6 +152,50 @@ then fi fi +# Install needed dependencies +install_if_not lshw +install_if_not net-tools +install_if_not whiptail +install_if_not apt-utils +install_if_not keyboard-configuration + +# Nice to have dependencies +install_if_not bash-completion +install_if_not htop +install_if_not iputils-ping + +# Download needed libraries before execution of the first script +mkdir -p "$SCRIPTS" +download_script GITHUB_REPO lib +download_script STATIC fetch_lib + +# Set locales +run_script ADDONS locales + +# Create new current user +download_script STATIC adduser +bash "$SCRIPTS"/adduser.sh "nextcloud_install_production.sh" +rm -f "$SCRIPTS"/adduser.sh + +check_universe +check_multiverse + +# Check if key is available +if ! site_200 "$NCREPO" +then + msg_box "Nextcloud repo is not available, exiting..." + exit 1 +fi + +# Test Home/SME function +if home_sme_server +then + msg_box "This is the Home/SME server, function works!" +else + print_text_in_color "$ICyan" "Home/SME Server not detected. No worries, just testing the function." + sleep 3 +fi + # Check if it's a clean server stop_if_installed postgresql stop_if_installed apache2 @@ -375,8 +385,9 @@ a2enmod rewrite \ dir \ authz_core \ alias \ + mpm_event \ ssl - + # We don't use Apache PHP (just to be sure) a2dismod mpm_prefork @@ -500,48 +511,55 @@ download_script STATIC setup_secure_permissions_nextcloud bash "$SECURE" & spinner_loading # Ask to set a custom username -if yesno_box_no "Nextcloud is about to be installed.\nDo you want to change the standard GUI user '$GUIUSER' to something else?" +if [ -z "$PROVISIONING" ] then - while : - do - GUIUSER=$(input_box_flow "Please type in the name of the Web Admin in Nextcloud. + if yesno_box_no "Nextcloud is about to be installed.\nDo you want to change the standard GUI user '$GUIUSER' to something else?" + then + while : + do + GUIUSER=$(input_box_flow "Please type in the name of the Web Admin in Nextcloud. \nThe only allowed characters for the username are: 'a-z', 'A-Z', '0-9', and '_.@-'") - if [[ "$GUIUSER" == *" "* ]] - then - msg_box "Please don't use spaces." - # - has to be escaped otherwise it won't work. - # Inspired by: https://unix.stackexchange.com/a/498731/433213 - elif [ "${GUIUSER//[A-Za-z0-9_.\-@]}" ] - then - msg_box "Allowed characters for the username are:\na-z', 'A-Z', '0-9', and '_.@-'\n\nPlease try again." - else - break - fi - done - while : - do - GUIPASS=$(input_box_flow "Please type in the new password for the new Web Admin ($GUIUSER) in Nextcloud.") - if [[ "$GUIPASS" == *" "* ]] - then - msg_box "Please don't use spaces." - fi - if [ "${GUIPASS//[A-Za-z0-9_.\-@]}" ] - then - msg_box "Allowed characters for the password are:\na-z', 'A-Z', '0-9', and '_.@-'\n\nPlease try again." - else - msg_box "The new Web Admin in Nextcloud is now: $GUIUSER\nThe password is set to: $GUIPASS + if [[ "$GUIUSER" == *" "* ]] + then + msg_box "Please don't use spaces." + # - has to be escaped otherwise it won't work. + # Inspired by: https://unix.stackexchange.com/a/498731/433213 + elif [ "${GUIUSER//[A-Za-z0-9_.\-@]}" ] + then + msg_box "Allowed characters for the username are:\na-z', 'A-Z', '0-9', and '_.@-'\n\nPlease try again." + else + break + fi + done + while : + do + GUIPASS=$(input_box_flow "Please type in the new password for the new Web Admin ($GUIUSER) in Nextcloud.") + if [[ "$GUIPASS" == *" "* ]] + then + msg_box "Please don't use spaces." + fi + if [ "${GUIPASS//[A-Za-z0-9_.\-@]}" ] + then + msg_box "Allowed characters for the password are:\na-z', 'A-Z', '0-9', and '_.@-'\n\nPlease try again." + else + msg_box "The new Web Admin in Nextcloud is now: $GUIUSER\nThe password is set to: $GUIPASS This is used when you login to Nextcloud itself, i.e. on the web." break - fi - done - + fi + done + fi fi # Install Nextcloud -print_text_in_color "$ICyan" "Installing Nextcloud..." +# NC 29 fix ## TODO: is this needed in coming versions? +chown www-data:www-data "$NCPATH"/data +# Normal install +print_text_in_color "$ICyan" "Installing Nextcloud, it might take a while..." cd "$NCPATH" -nextcloud_occ maintenance:install \ +# Don't use nextcloud_occ here as it takes alooong time. +# https://github.com/nextcloud/vm/issues/2542#issuecomment-1700406020 +check_command sudo -u www-data php "$NCPATH"/occ maintenance:install \ --data-dir="$NCDATA" \ --database=pgsql \ --database-name=nextcloud_db \ @@ -549,115 +567,9 @@ nextcloud_occ maintenance:install \ --database-pass="$PGDB_PASS" \ --admin-user="$GUIUSER" \ --admin-pass="$GUIPASS" -echo print_text_in_color "$ICyan" "Nextcloud version:" nextcloud_occ status sleep 3 -echo - -# Prepare cron.php to be run every 5 minutes -crontab -u www-data -l | { cat; echo "*/5 * * * * php -f $NCPATH/cron.php > /dev/null 2>&1"; } | crontab -u www-data - - -# Run the updatenotification on a schedule -nextcloud_occ config:system:set upgrade.disable-web --type=bool --value=true -nextcloud_occ config:app:set updatenotification notify_groups --value="[]" -print_text_in_color "$ICyan" "Configuring update notifications specific for this server..." -download_script STATIC updatenotification -check_command chmod +x "$SCRIPTS"/updatenotification.sh -crontab -u root -l | { cat; echo "59 $AUT_UPDATES_TIME * * * $SCRIPTS/updatenotification.sh > /dev/null 2>&1"; } | crontab -u root - - -# Change values in php.ini (increase max file size) -# max_execution_time -sed -i "s|max_execution_time =.*|max_execution_time = 3500|g" "$PHP_INI" -# max_input_time -sed -i "s|max_input_time =.*|max_input_time = 3600|g" "$PHP_INI" -# memory_limit -sed -i "s|memory_limit =.*|memory_limit = 512M|g" "$PHP_INI" -# post_max -sed -i "s|post_max_size =.*|post_max_size = 1100M|g" "$PHP_INI" -# upload_max -sed -i "s|upload_max_filesize =.*|upload_max_filesize = 1000M|g" "$PHP_INI" - -# Set logging -nextcloud_occ config:system:set log_type --value=file -nextcloud_occ config:system:set logfile --value="$VMLOGS/nextcloud.log" -rm -f "$NCDATA/nextcloud.log" -nextcloud_occ config:system:set loglevel --value=2 -install_and_enable_app admin_audit -nextcloud_occ config:app:set admin_audit logfile --value="$VMLOGS/audit.log" -nextcloud_occ config:system:set log.condition apps 0 --value admin_audit - -# Set SMTP mail -nextcloud_occ config:system:set mail_smtpmode --value="smtp" - -# Forget login/session after 30 minutes -nextcloud_occ config:system:set remember_login_cookie_lifetime --value="1800" - -# Set logrotate (max 10 MB) -nextcloud_occ config:system:set log_rotate_size --value="10485760" - -# Set trashbin retention obligation (save it in trashbin for 60 days or delete when space is needed) -nextcloud_occ config:system:set trashbin_retention_obligation --value="auto, 60" - -# Set versions retention obligation (save versions for 180 days or delete when space is needed) -nextcloud_occ config:system:set versions_retention_obligation --value="auto, 180" - -# Set activity retention obligation (save activity feed for 120 days, defaults to 365 days otherwise) -nextcloud_occ config:system:set activity_expire_days --value="120" - -# Remove simple signup -nextcloud_occ config:system:set simpleSignUpLink.shown --type=bool --value=false - -# Set chunk_size for files app to 100MB (defaults to 10MB) -nextcloud_occ config:app:set files max_chunk_size --value="104857600" - -# Set product name -if home_sme_server -then - PRODUCTNAME="Nextcloud HanssonIT Server" -else - PRODUCTNAME="Nextcloud HanssonIT VM" -fi -if is_app_installed theming -then - if [ "$(nextcloud_occ config:app:get theming productName)" != "$PRODUCTNAME" ] - then - nextcloud_occ config:app:set theming productName --value "$PRODUCTNAME" - fi -fi - -# Enable OPCache for PHP -# https://docs.nextcloud.com/server/14/admin_manual/configuration_server/server_tuning.html#enable-php-opcache -phpenmod opcache -{ -echo "# OPcache settings for Nextcloud" -echo "opcache.enable=1" -echo "opcache.enable_cli=1" -echo "opcache.interned_strings_buffer=16" -echo "opcache.max_accelerated_files=10000" -echo "opcache.memory_consumption=256" -echo "opcache.save_comments=1" -echo "opcache.revalidate_freq=1" -echo "opcache.validate_timestamps=1" -} >> "$PHP_INI" - -# PHP-FPM optimization -# https://geekflare.com/php-fpm-optimization/ -sed -i "s|;emergency_restart_threshold.*|emergency_restart_threshold = 10|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf -sed -i "s|;emergency_restart_interval.*|emergency_restart_interval = 1m|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf -sed -i "s|;process_control_timeout.*|process_control_timeout = 10|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf - -# PostgreSQL values for PHP (https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/linux_database_configuration.html#postgresql-database) -{ -echo "" -echo "[PostgresSQL]" -echo "pgsql.allow_persistent = On" -echo "pgsql.auto_reset_persistent = Off" -echo "pgsql.max_persistent = -1" -echo "pgsql.max_links = -1" -echo "pgsql.ignore_notice = 0" -echo "pgsql.log_notice = 0" -} >> "$PHP_FPM_DIR"/conf.d/20-pdo_pgsql.ini # Install PECL dependencies install_if_not php"$PHPVER"-dev @@ -709,6 +621,115 @@ echo "igbinary.compact_strings=On" restart_webserver fi +# Prepare cron.php to be run every 5 minutes +crontab -u www-data -l | { cat; echo "*/5 * * * * php -f $NCPATH/cron.php > /dev/null 2>&1"; } | crontab -u www-data - + +# Run the updatenotification on a schedule +nextcloud_occ config:system:set upgrade.disable-web --type=bool --value=true +nextcloud_occ config:app:set updatenotification notify_groups --value="[]" +print_text_in_color "$ICyan" "Configuring update notifications specific for this server..." +download_script STATIC updatenotification +check_command chmod +x "$SCRIPTS"/updatenotification.sh +crontab -u root -l | { cat; echo "59 $AUT_UPDATES_TIME * * * $SCRIPTS/updatenotification.sh > /dev/null 2>&1"; } | crontab -u root - + +# Change values in php.ini (increase max file size) +# max_execution_time +sed -i "s|max_execution_time =.*|max_execution_time = 3500|g" "$PHP_INI" +# max_input_time +sed -i "s|max_input_time =.*|max_input_time = 3600|g" "$PHP_INI" +# memory_limit +sed -i "s|memory_limit =.*|memory_limit = 512M|g" "$PHP_INI" +# post_max +sed -i "s|post_max_size =.*|post_max_size = 1100M|g" "$PHP_INI" +# upload_max +sed -i "s|upload_max_filesize =.*|upload_max_filesize = 1000M|g" "$PHP_INI" + +# Set logging +nextcloud_occ config:system:set log_type --value=file +nextcloud_occ config:system:set logfile --value="$VMLOGS/nextcloud.log" +rm -f "$NCDATA/nextcloud.log" +rm -f "$NCPATH/data/nextcloud.log" +nextcloud_occ config:system:set loglevel --value=2 +install_and_enable_app admin_audit +nextcloud_occ config:app:set admin_audit logfile --value="$VMLOGS/audit.log" +nextcloud_occ config:system:set log.condition apps 0 --value admin_audit + +# Set maintenance window for cron +# https://docs.nextcloud.com/server/29/admin_manual/configuration_server/background_jobs_configuration.html#background-jobs +nextcloud_occ config:system:set maintenance_window_start --type=integer --value=2 + +# Set SMTP mail +nextcloud_occ config:system:set mail_smtpmode --value="smtp" + +# Forget login/session after 30 minutes +nextcloud_occ config:system:set remember_login_cookie_lifetime --value="1800" + +# Set logrotate (max 10 MB) +nextcloud_occ config:system:set log_rotate_size --value="10485760" + +# Set trashbin retention obligation (save it in trashbin for 60 days or delete when space is needed) +nextcloud_occ config:system:set trashbin_retention_obligation --value="auto, 60" + +# Set versions retention obligation (save versions for 180 days or delete when space is needed) +nextcloud_occ config:system:set versions_retention_obligation --value="auto, 180" + +# Set activity retention obligation (save activity feed for 120 days, defaults to 365 days otherwise) +nextcloud_occ config:system:set activity_expire_days --value="120" + +# Remove simple signup +nextcloud_occ config:system:set simpleSignUpLink.shown --type=bool --value=false + +# Set chunk_size for files app to 100MB (defaults to 10MB) +nextcloud_occ config:app:set files max_chunk_size --value="104857600" + +# Set product name +if home_sme_server +then + PRODUCTNAME="Nextcloud HanssonIT Server" +else + PRODUCTNAME="Nextcloud HanssonIT VM" +fi +if is_app_installed theming +then + if [ "$(nextcloud_occ config:app:get theming productName)" != "$PRODUCTNAME" ] + then + nextcloud_occ config:app:set theming productName --value "$PRODUCTNAME" + fi +fi + +# Enable OPCache for PHP +# https://docs.nextcloud.com/server/14/admin_manual/configuration_server/server_tuning.html#enable-php-opcache +phpenmod opcache +{ +echo "# OPcache settings for Nextcloud" +echo "opcache.enable=1" +echo "opcache.enable_cli=1" +echo "opcache.interned_strings_buffer=$opcache_interned_strings_buffer_value" +echo "opcache.max_accelerated_files=10000" +echo "opcache.memory_consumption=256" +echo "opcache.save_comments=1" +echo "opcache.revalidate_freq=1" +echo "opcache.validate_timestamps=1" +} >> "$PHP_INI" + +# PHP-FPM optimization +# https://geekflare.com/php-fpm-optimization/ +sed -i "s|;emergency_restart_threshold.*|emergency_restart_threshold = 10|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf +sed -i "s|;emergency_restart_interval.*|emergency_restart_interval = 1m|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf +sed -i "s|;process_control_timeout.*|process_control_timeout = 10|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf + +# PostgreSQL values for PHP (https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/linux_database_configuration.html#postgresql-database) +{ +echo "" +echo "[PostgresSQL]" +echo "pgsql.allow_persistent = On" +echo "pgsql.auto_reset_persistent = Off" +echo "pgsql.max_persistent = -1" +echo "pgsql.max_links = -1" +echo "pgsql.ignore_notice = 0" +echo "pgsql.log_notice = 0" +} >> "$PHP_FPM_DIR"/conf.d/20-pdo_pgsql.ini + # Fix https://github.com/nextcloud/vm/issues/714 print_text_in_color "$ICyan" "Optimizing Nextcloud..." yes | nextcloud_occ db:convert-filecache-bigint @@ -741,71 +762,69 @@ then ### YOUR SERVER ADDRESS ### # ServerAdmin admin@example.com -# ServerName example.com -# ServerAlias subdomain.example.com +# ServerName cloud.example.com ### SETTINGS ### SetHandler "proxy:unix:/run/php/php$PHPVER-fpm.nextcloud.sock|fcgi://localhost" + # Logs + LogLevel warn + CustomLog \${APACHE_LOG_DIR}/access.log combined + ErrorLog \${APACHE_LOG_DIR}/error.log + + # Document root folder DocumentRoot $NCPATH + # The Nextcloud folder Options Indexes FollowSymLinks - AllowOverride None - ### include all .htaccess - Include $NCPATH/.htaccess - Include $NCPATH/config/.htaccess - Include $NCDATA/.htaccess - ### + AllowOverride All Require all granted Satisfy Any + # This is to include all the Nextcloud rules due to that we use PHP-FPM and .htaccess aren't read + Include $NCPATH/.htaccess + + + # Deny access to your data directory + + Require all denied + + + # Deny access to the Nextcloud config folder + + Require all denied Dav off - - # just in case if .htaccess gets disabled - Require all denied - - - # The following lines prevent .htaccess and .htpasswd files from being - # viewed by Web clients. + # The following lines prevent .htaccess and .htpasswd files from being viewed by Web clients. Require all denied + SetEnv HOME $NCPATH + SetEnv HTTP_HOME $NCPATH + # Disable HTTP TRACE method. TraceEnable off - # Disable HTTP TRACK method. RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACK RewriteRule .* - [R=405,L] - SetEnv HOME $NCPATH - SetEnv HTTP_HOME $NCPATH - # Avoid "Sabre\DAV\Exception\BadRequest: expected filesize XXXX got XXXX" RequestReadTimeout body=0 - HTTP_CREATE print_text_in_color "$IGreen" "$SITES_AVAILABLE/$HTTP_CONF was successfully created." fi -# Fix zero file sizes -# See https://github.com/nextcloud/server/issues/3056 -if version 22.04 "$DISTRO" 26.04.10 -then - SETENVPROXY="SetEnv proxy-sendcl 1" -fi - # Generate $TLS_CONF if [ ! -f "$SITES_AVAILABLE"/"$TLS_CONF" ] then @@ -813,7 +832,7 @@ then cat << TLS_CREATE > "$SITES_AVAILABLE/$TLS_CONF" # # RewriteEngine On -# RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L] +# RewriteRule ^(.*)$ https://%{HTTP_HOST}\$1 [END,NE,R=permanent] # @@ -842,53 +861,56 @@ then CustomLog \${APACHE_LOG_DIR}/access.log combined ErrorLog \${APACHE_LOG_DIR}/error.log + # Document root folder DocumentRoot $NCPATH + # The Nextcloud folder Options Indexes FollowSymLinks - AllowOverride None - ### include all .htaccess - Include $NCPATH/.htaccess - Include $NCPATH/config/.htaccess - Include $NCDATA/.htaccess - ### + AllowOverride All Require all granted Satisfy Any + # This is to include all the Nextcloud rules due to that we use PHP-FPM and .htaccess aren't read + Include $NCPATH/.htaccess + + + # Deny access to your data directory + + Require all denied + + + # Deny access to the Nextcloud config folder + + Require all denied Dav off - - # just in case if .htaccess gets disabled - Require all denied - - - # The following lines prevent .htaccess and .htpasswd files from being - # viewed by Web clients. + # The following lines prevent .htaccess and .htpasswd files from being viewed by Web clients. Require all denied + SetEnv HOME $NCPATH + SetEnv HTTP_HOME $NCPATH + # Disable HTTP TRACE method. TraceEnable off - # Disable HTTP TRACK method. RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACK RewriteRule .* - [R=405,L] - SetEnv HOME $NCPATH - SetEnv HTTP_HOME $NCPATH - # Avoid "Sabre\DAV\Exception\BadRequest: expected filesize XXXX got XXXX" RequestReadTimeout body=0 - - # Avoid zero byte files (only works in Ubuntu 22.04 -->>) - $SETENVPROXY + + # Avoid zero byte files (only works in Ubuntu 24.04 -->>) + # See https://github.com/nextcloud/server/issues/3056 + SetEnv proxy-sendcl 1 ### LOCATION OF CERT FILES ### SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem @@ -919,7 +941,7 @@ $CHECKLIST_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ "Mail" "" ON \ "Deck" "" ON \ "Collectives" "" ON \ -"Suspicios Login detetion" "" ON \ +"Suspicious Login detection" "" ON \ "IssueTemplate" "" OFF \ "Group-Folders" "" OFF 3>&1 1>&2 2>&3) fi @@ -960,8 +982,9 @@ case "$choice" in ;;& *"Collectives"*) install_and_enable_app collectives + install_if_not php"$PHPVER"-sqlite3 ;;& - *"Suspicios Login detetion"*) + *"Suspicious Login detection"*) install_and_enable_app suspicios_login ;;& *"Group-Folders"*) @@ -1028,11 +1051,11 @@ fi # Fix Realtek on PN51 if asuspn51 then - if ! version 22.04 "$DISTRO" 22.04.10 + if ! version 24.04 "$DISTRO" 24.04.10 then # Upgrade Realtek drivers print_text_in_color "$ICyan" "Upgrading Realtek firmware..." - curl_to_dir https://raw.githubusercontent.com/nextcloud/vm/master/network/asusnuc pn51.sh "$SCRIPTS" + curl_to_dir https://raw.githubusercontent.com/nextcloud/vm/main/network/asusnuc pn51.sh "$SCRIPTS" bash "$SCRIPTS"/pn51.sh fi fi diff --git a/nextcloud_update.sh b/nextcloud_update.sh index a6acd649..684442cf 100644 --- a/nextcloud_update.sh +++ b/nextcloud_update.sh @@ -4,14 +4,14 @@ # DO NOT USE THIS SCRIPT WHEN UPDATING NEXTCLOUD / YOUR SERVER! RUN `sudo bash /var/scripts/update.sh` INSTEAD. # ################################################################################################################# -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE +# https://github.com/nextcloud/vm/blob/main/LICENSE true SCRIPT_NAME="Nextcloud Update Script" # shellcheck source=lib.sh -source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # Get all needed variables from the library ncdb @@ -32,9 +32,13 @@ root_check is_process_running apt is_process_running dpkg -# Automatically restart services (Ubuntu 22.04) -if ! version 16.04.10 "$DISTRO" 20.04.10 +# Automatically restart services (Ubuntu 24.04) +if ! version 16.04.10 "$DISTRO" 22.04.10 then + if [ ! -f /etc/needrestart/needrestart.conf ] + then + install_if_not needrestart + fi if ! grep -rq "{restart} = 'a'" /etc/needrestart/needrestart.conf then # Restart mode: (l)ist only, (i)nteractive or (a)utomatically. @@ -147,7 +151,7 @@ then then check_command systemctl stop docker fi - nextcloud_occ maintenance:mode --on + sudo -u www-data php "$NCPATH"/occ maintenance:mode --on if does_snapshot_exist "NcVM-startup" then check_command lvremove /dev/ubuntu-vg/NcVM-startup -y @@ -155,7 +159,7 @@ then then if ! lvremove /dev/ubuntu-vg/NcVM-snapshot -y then - nextcloud_occ maintenance:mode --off + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off start_if_stopped docker notify_admin_gui "Update failed!" \ "Could not remove NcVM-snapshot - Please reboot your server! $(date +%T)" @@ -166,7 +170,7 @@ This should work again after a reboot of your server." fi if ! lvcreate --size 5G --snapshot --name "NcVM-snapshot" /dev/ubuntu-vg/ubuntu-lv then - nextcloud_occ maintenance:mode --off + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off start_if_stopped docker notify_admin_gui "Update failed!" \ "Could not create NcVM-snapshot - Please reboot your server! $(date +%T)" @@ -177,12 +181,12 @@ It should then start working again." fi if ! lvrename /dev/ubuntu-vg/NcVM-snapshot /dev/ubuntu-vg/NcVM-snapshot-pending then - nextcloud_occ maintenance:mode --off + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off start_if_stopped docker msg_box "Could not rename the snapshot before starting the update. Please reboot your system!" exit 1 fi - nextcloud_occ maintenance:mode --off + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off start_if_stopped docker fi @@ -249,6 +253,10 @@ then fi fi +# Since the branch change, always get the latest update script +download_script STATIC update +chmod +x $SCRIPTS/update.sh + # Ubuntu 16.04 is deprecated check_distro_version @@ -323,6 +331,10 @@ then apt-mark hold veracrypt fi +# Enter maintenance:mode +print_text_in_color "$IGreen" "Enabling maintenance:mode..." +sudo -u www-data php "$NCPATH"/occ maintenance:mode --on + # Upgrade Talk repositrory if Talk is installed (2022-12-26) if is_this_installed nextcloud-spreed-signaling then @@ -333,14 +345,34 @@ fi # Upgrade OS dependencies export DEBIAN_FRONTEND=noninteractive ; apt-get dist-upgrade -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" +# Temporary fix for PHP 2023-08-27 +# There's a bug in PHP 8.1.21 which causes server to crash +# If you're on Ondrejs PPA, PHP isn't updated, so do that here instead +apt-mark unhold php* >/dev/null 2>&1 +apt-get update -q4 +export DEBIAN_FRONTEND=noninteractive ; apt-get upgrade -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" +apt-mark hold php* >/dev/null 2>&1 + +# Improve Apache for PHP-FPM +if is_this_installed php"$PHPVER"-fpm +then + if [ -d "$PHP_FPM_DIR" ] + then + # Just make sure that MPM_EVENT is default + a2dismod mpm_prefork + a2enmod mpm_event + restart_webserver + fi +fi + # Fix Realtek on PN51 if asuspn51 then - if ! version 22.04 "$DISTRO" 22.04.10 + if ! version 24.04 "$DISTRO" 24.04.10 then # Upgrade Realtek drivers print_text_in_color "$ICyan" "Upgrading Realtek firmware..." - curl_to_dir https://raw.githubusercontent.com/nextcloud/vm/master/network/asusnuc pn51.sh "$SCRIPTS" + curl_to_dir https://raw.githubusercontent.com/nextcloud/vm/main/network/asusnuc pn51.sh "$SCRIPTS" bash "$SCRIPTS"/pn51.sh fi fi @@ -356,7 +388,7 @@ then then bash "$NETDATA_UPDATER_PATH" else - curl_to_dir https://raw.githubusercontent.com/netdata/netdata/master/packaging/installer/ netdata-updater.sh "$SCRIPTS" + curl_to_dir https://raw.githubusercontent.com/netdata/netdata/main/packaging/installer/ netdata-updater.sh "$SCRIPTS" bash "$SCRIPTS"/netdata-updater.sh rm -f "$SCRIPTS"/netdata-updater.sh fi @@ -383,7 +415,15 @@ fi # Fix PHP error message mkdir -p /tmp/pear/cache -# Update Redis PHP extension (18.04 --> 20.04 since 16.04 already is deprecated in the top of this script) +# Just in case PECLs XML are bad +if ! pecl channel-update pecl.php.net +then + curl_to_dir http://pecl.php.net channel.xml /tmp + pear channel-update /tmp/channel.xml + rm -f /tmp/channel.xml +fi + +# Update Redis PHP extension (18.04 -->, since 16.04 already is deprecated in the top of this script) print_text_in_color "$ICyan" "Trying to upgrade the Redis PECL extension..." # Check current PHP version @@ -396,7 +436,7 @@ then then install_if_not php"$PHPVER"-dev fi - pecl channel-update pecl.php.net + yes no | pecl upgrade redis systemctl restart redis-server.service fi @@ -529,16 +569,35 @@ restart_webserver if [ -d "$ADMINERDIR" ] then print_text_in_color "$ICyan" "Updating Adminer..." - rm -f "$ADMINERDIR"/latest.php "$ADMINERDIR"/adminer.php - curl_to_dir "http://www.adminer.org" "latest.php" "$ADMINERDIR" - ln -s "$ADMINERDIR"/latest.php "$ADMINERDIR"/adminer.php + rm -f "$ADMINERDIR"/latest.php "$ADMINERDIR"/adminer.php "$ADMINERDIR"/adminer-pgsql.php + # Download the latest version + curl_to_dir "https://download.adminerevo.org/latest/adminer" "adminer-pgsql.zip" "$ADMINERDIR" + install_if_not unzip + # Unzip the latest version + unzip "$ADMINERDIR"/adminer-pgsql.zip -d "$ADMINERDIR" + rm -f "$ADMINERDIR"/adminer-pgsql.zip + mv "$ADMINERDIR"/adminer-pgsql.php "$ADMINERDIR"/adminer.php fi -# Get newest dat files for geoblock.sh +# Get latest Maxmind databse for Geoblock if grep -q "^#Geoip-block" /etc/apache2/apache2.conf then - get_newest_dat_files - check_command systemctl restart apache2 + if grep -c GeoIPDBFile /etc/apache2/apache2.conf + then + msg_box "We have updated GeoBlock to a new version which isn't compatible with the old one. Please reinstall with the menu script to get the latest version." + notify_admin_gui \ +"GeoBlock needs to be reinstalled!" \ +"We have updated GeoBlock to a new version which isn't compatible with the old one. +Please reinstall with the menu script to get the latest version. + +sudo bash /ar/scripts/menu.sh --> Server Configuration --> GeoBlock" + fi +elif [ -f "$GEOBLOCK_MOD" ] +then + if download_geoip_mmdb + then + print_text_in_color "$IGreen" "GeoBlock database updated!" + fi fi # Update docker containers and remove Watchtower if Bitwarden is present due to compatibility issue @@ -547,6 +606,12 @@ fi # individually depending on which docker containers that exist. if is_docker_running then + # Fix Docker compose issue + if is_this_installed docker-compose + then + apt purge docker-compose -y + install_if_not docker-compose-plugin + fi # To fix https://github.com/nextcloud/vm/issues/1459 we need to remove Watchtower # to avoid updating Bitwarden again, and only update the specified docker images above if docker ps -a --format '{{.Names}}' | grep -Eq "bitwarden"; @@ -614,15 +679,32 @@ $DOCKER_RUN_OUTPUT" if does_this_docker_exist 'onlyoffice/documentserver' then docker_update_specific 'onlyoffice' 'OnlyOffice' - msg_box "OnlyOffice updated the way websockets work, and you need to update your configuration.\n -Please update your Apache2 config to this: https://github.com/nextcloud/vm/blob/master/apps/onlyoffice_docker.sh#L210-L215. -Another option is to reinstall OnlyOffice with the menu script; sudo bash /var/scripts/menu.sh\n -If you need help, please get support here: https://shop.hanssonit.se/product/premium-support-per-30-minutes/" fi fi # Full Text Search - docker_update_specific 'fts_esror' 'Full Text Search' - docker-compose_update 'fts_os-node' 'Full Text Search' "$OPNSDIR" + if [ "${CURRENTVERSION%%.*}" -ge "25" ] + then + fulltextsearch_install + if does_this_docker_exist "$nc_fts" && does_this_docker_exist "$opens_fts" + then + msg_box "Please consider reinstalling FullTextSearch since you seem to have the old (and not working) implemantation by issuing the uninstall script: sudo bash $SCRIPTS/menu.sh --> Additional Apps --> FullTextSearch" + elif [ -d "$FULLTEXTSEARCH_DIR" ] + then + # Check if new name standard is set, and only update if it is (since it contains the latest tag) + if grep -rq "$FULLTEXTSEARCH_IMAGE_NAME" "$FULLTEXTSEARCH_DIR/docker-compose.yaml" + then + if [ -n "$FULLTEXTSEARCH_IMAGE_NAME_LATEST_TAG" ] + then + sed -i "s|image: docker.elastic.co/elasticsearch/elasticsearch:.*|image: docker.elastic.co/elasticsearch/elasticsearch:$FULLTEXTSEARCH_IMAGE_NAME_LATEST_TAG|g" "$FULLTEXTSEARCH_DIR/docker-compose.yaml" + docker-compose_update "$FULLTEXTSEARCH_IMAGE_NAME" 'Full Text Search' "$FULLTEXTSEARCH_DIR" + fi + else + print_text_in_color "$ICyan" "Full Text Search is version based, to upgrade it, please change the version in $FULLTEXTSEARCH_DIR and run 'docker compose pull && docker compose up -d'. Latest tags are here: https://www.docker.elastic.co/r/elasticsearch and release notes here: https://www.elastic.co/guide/en/elasticsearch/reference/current/release-highlights.html" + fi + fi + fi + # Talk Recording + docker_update_specific 'talk-recording' "Talk Recording" # Plex docker_update_specific 'plex' "Plex Media Server" # Imaginary @@ -638,7 +720,7 @@ then for apacheconf in "${LOOLWSDCONF[@]}" do sed -i "s|/loleaflet|/browser|g" "${apacheconf}" - sed -i "s|loleaflet is the|broswer is the|g" "${apacheconf}" + sed -i "s|loleaflet is the|browser is the|g" "${apacheconf}" sed -i "s|loolwsd|coolwsd|g" "${apacheconf}" sed -i "s|/lool|/cool|g" "${apacheconf}" done @@ -668,10 +750,17 @@ then chmod +x "$SCRIPTS"/updatenotification.sh fi +# Disable maintenance:mode +print_text_in_color "$IGreen" "Disabling maintenance:mode..." +sudo -u www-data php "$NCPATH"/occ maintenance:mode --off + +# Make all previous files executable +print_text_in_color "$ICyan" "Finding all executable files in $NC_APPS_PATH" +find_executables="$(find $NC_APPS_PATH -type f -executable)" + # Update all Nextcloud apps if [ "${CURRENTVERSION%%.*}" -ge "15" ] then - nextcloud_occ maintenance:mode --off # Check for upgrades print_text_in_color "$ICyan" "Trying to automatically update all Nextcloud apps..." UPDATED_APPS="$(nextcloud_occ_no_check app:update --all)" @@ -704,15 +793,33 @@ else print_text_in_color "$IGreen" "Your apps are already up to date!" fi -# Restart notify push if existing -if [ -f "$NOTIFY_PUSH_SERVICE_PATH" ] +# Apply correct redirect rule to avoid security check errors +REDIRECTRULE="$(grep -r "\[R=301,L\]" $SITES_AVAILABLE | cut -d ":" -f1)" +if [ -n "$REDIRECTRULE" ] then - systemctl restart notify_push + # Change the redirect rule in all files in Apache available + mapfile -t REDIRECTRULE <<< "$REDIRECTRULE" + for rule in "${REDIRECTRULE[@]}" + do + sed -i "s|{HTTP_HOST} \[R=301,L\]|{HTTP_HOST}\$1 \[END,NE,R=permanent\]|g" "$rule" + done + # Restart Apache + if check_command apachectl configtest + then + restart_webserver + fi fi # Nextcloud 13 is required. lowest_compatible_nc 13 +# Restart notify push if existing +if [ -f "$NOTIFY_PUSH_SERVICE_PATH" ] +then + chmod +x "$NC_APPS_PATH"/notify_push/bin/x86_64/notify_push + systemctl restart notify_push.service +fi + if [ -f /tmp/minor.version ] then NCBAD=$(cat /tmp/minor.version) @@ -799,7 +906,7 @@ then fi ############# Don't upgrade to specific version -DONOTUPDATETO='23.0.0' +DONOTUPDATETO='29.0.0' if [[ "$NCVERSION" == "$DONOTUPDATETO" ]] then msg_box "Due to major bugs with Nextcloud $DONOTUPDATETO we won't upgrade to that version since it's a risk it will break your server. Please try to upgrade again when the next maintenance release is out." @@ -878,6 +985,36 @@ If you need support, please visit https://shop.hanssonit.se/product/upgrade-php- fi fi +# Check if PHP version is compatible with $NCVERSION +# https://github.com/nextcloud/server/issues/29258 +PHP_VER=81 +NC_VER=31 +if [ "${NCVERSION%%.*}" -ge "$NC_VER" ] +then + if [ "$(php -v | head -n 1 | cut -d " " -f 2 | cut -c 1,3)" -lt "$PHP_VER" ] + then +msg_box "Your PHP version isn't compatible with the new version of Nextcloud. Please upgrade your PHP stack and try again. + +If you need support, please visit https://shop.hanssonit.se/product/upgrade-php-version-including-dependencies/" + exit + fi +fi + +# Check if PHP version is compatible with $NCVERSION +# https://github.com/nextcloud/server/issues/29258 +PHP_VER=82 +NC_VER=32 +if [ "${NCVERSION%%.*}" -ge "$NC_VER" ] +then + if [ "$(php -v | head -n 1 | cut -d " " -f 2 | cut -c 1,3)" -lt "$PHP_VER" ] + then +msg_box "Your PHP version isn't compatible with the new version of Nextcloud. Please upgrade your PHP stack and try again. + +If you need support, please visit https://shop.hanssonit.se/product/upgrade-php-version-including-dependencies/" + exit + fi +fi + # Upgrade Nextcloud if ! site_200 "$NCREPO" then @@ -894,6 +1031,7 @@ then fi # Stop Apache2 +print_text_in_color "$ICyan" "Stopping Apache2..." check_command systemctl stop apache2.service # Create backup dir (/mnt/NCBACKUP/) @@ -907,7 +1045,7 @@ if is_this_installed postgresql-common then cd /tmp # Test connection to PostgreSQL - if ! sudo -u postgres psql -c "\q" + if ! sudo -u postgres psql -w -c "\q" then # If it fails, trust the 'postgres' user to be able to perform backup rsync -a /etc/postgresql/*/main/pg_hba.conf "$BACKUP"/pg_hba.conf_BACKUP @@ -1024,7 +1162,6 @@ then send_mail \ "New Nextcloud version found!" \ "We will now start the update to Nextcloud $NCVERSION. $(date +%T)" - nextcloud_occ maintenance:mode --on countdown "Removing old Nextcloud instance in 5 seconds..." "5" rm -rf "$NCPATH" print_text_in_color "$IGreen" "Extracting new package...." @@ -1033,7 +1170,6 @@ then print_text_in_color "$IGreen" "Restoring config to Nextcloud..." rsync -Aaxz "$BACKUP"/config "$NCPATH"/ bash "$SECURE" & spinner_loading - nextcloud_occ maintenance:mode --off # Don't execute the update before all cronjobs are finished check_running_cronjobs # Execute the update @@ -1063,18 +1199,26 @@ then fi if [ "${CURRENTVERSION%%.*}" -ge "23" ] then - # Raise OPCache - if grep -q "opcache.interned_strings_buffer=8" "$PHP_INI" + # Update opcache.interned_strings_buffer + if ! grep -rq opcache.interned_strings_buffer="$opcache_interned_strings_buffer_value" "$PHP_INI" then - sed -i "s|opcache.interned_strings_buffer.*|opcache.interned_strings_buffer=16|g" "$PHP_INI" + sed -i "s|opcache.interned_strings_buffer=.*|opcache.interned_strings_buffer=$opcache_interned_strings_buffer_value|g" "$PHP_INI" + restart_webserver fi fi + if [ "${CURRENTVERSION%%.*}" -ge "27" ] + then + nextcloud_occ dav:sync-system-addressbook + fi else msg_box "Something went wrong with backing up your old Nextcloud instance Please check in $BACKUP if the folders exist." exit 1 fi +# Repair +nextcloud_occ maintenance:repair --include-expensive + # Update Bitwarden if is_docker_running then @@ -1145,7 +1289,6 @@ done # Update all Nextcloud apps a second time (if the old backup was outdated) if [ "${CURRENTVERSION%%.*}" -ge "15" ] then - nextcloud_occ maintenance:mode --off # Check for upgrades print_text_in_color "$ICyan" "Trying to automatically update all Nextcloud apps again..." nextcloud_occ_no_check app:update --all @@ -1179,15 +1322,18 @@ nextcloud_occ config:system:set htaccess.RewriteBase --value="/" nextcloud_occ maintenance:update:htaccess bash "$SECURE" & spinner_loading -# Repair -nextcloud_occ maintenance:repair - # Create $VMLOGS dir if [ ! -d "$VMLOGS" ] then mkdir -p "$VMLOGS" fi +# Make all files in executable again +for executable in $find_executables +do + chmod +x "$executable" +done + CURRENTVERSION_after=$(nextcloud_occ status | grep "versionstring" | awk '{print $3}') if [[ "$NCVERSION" == "$CURRENTVERSION_after" ]] || [ -n "$PRERELEASE_VERSION" ] then @@ -1200,7 +1346,6 @@ To recover your old apps, please check $BACKUP/apps and copy them to $NCPATH/app Thank you for using T&M Hansson IT's updater!" nextcloud_occ status - nextcloud_occ maintenance:mode --off # Restart notify push if existing if [ -f "$NOTIFY_PUSH_SERVICE_PATH" ] then @@ -1218,6 +1363,8 @@ Thank you for using T&M Hansson IT's updater!" if [ -n "$SNAPSHOT_EXISTS" ] then check_command lvrename /dev/ubuntu-vg/NcVM-snapshot-pending /dev/ubuntu-vg/NcVM-snapshot + countdown "Automatically restarting your server in 1 minute since LVM-snapshots are present." "60" + shutdown -r fi exit 0 else diff --git a/not-supported/README.md b/not-supported/README.md index 92a1b85a..206a00a1 100644 --- a/not-supported/README.md +++ b/not-supported/README.md @@ -1,15 +1,15 @@ # What is this subfolder about? -This subdirectory of the Nextcloud VM contains scripts that probably *never* will get merged into the released version, but we keep them here so that users can test, and enjoy the befnefits of having an easy way set up the different software offered in this sub-folder. Freedom of choice basically. +This subdirectory of the Nextcloud VM contains scripts that probably *never* will get merged into the released version, but we keep them here so that users can test, and enjoy the benefits of having an easy way to set up the different software offered in this sub-folder. Freedom of choice basically. ## Can I help? Yes, of course! :)
-Although mostof the scripts might not be 100% ready, we would love to hear your feedback anyway. +Although most of the scripts might not be 100% ready, we would love to hear your feedback anyway. Feedback is especially welcome, if you would like to add some features that these scripts bring in the released version of the NcVM.
So, please report back! 🚀 ## How to run this inside my NcVM? We have prepared a menu for you to choose from available options. You can download the menu with the following command:
-`sudo wget https://raw.githubusercontent.com/nextcloud/vm/master/not-supported/not-supported.sh -P /var/scripts`
+`sudo wget https://raw.githubusercontent.com/nextcloud/vm/main/not-supported/not-supported.sh -P /var/scripts`
After downloading the menu, you just run it with the following command:
`sudo bash /var/scripts/not-supported.sh`
Running the not-supported script will show the menu with the latest options to choose from. diff --git a/not-supported/backup-viewer.sh b/not-supported/backup-viewer.sh index 55602415..807eb9a3 100644 --- a/not-supported/backup-viewer.sh +++ b/not-supported/backup-viewer.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/bitlocker-mount.sh b/not-supported/bitlocker-mount.sh index 03dc62f6..c7343d03 100644 --- a/not-supported/bitlocker-mount.sh +++ b/not-supported/bitlocker-mount.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/borgbackup.sh b/not-supported/borgbackup.sh index 032090e2..f288a64b 100644 --- a/not-supported/borgbackup.sh +++ b/not-supported/borgbackup.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) # shellcheck disable=2024 @@ -39,7 +39,7 @@ start_services() { systemctl start postgresql if [ -z "$MAINTENANCE_MODE_ON" ] then - nextcloud_occ_no_check maintenance:mode --off + sudo -u www-data php "$NCPATH"/occ maintenance:mode --off fi start_if_stopped docker # Restart notify push if existing @@ -272,11 +272,11 @@ Please don't restart or shutdown your server until then!" then systemctl stop docker fi - if [ "$(nextcloud_occ_no_check config:system:get maintenance)" = "true" ] + if [ "$(sudo -u www-data php "$NCPATH"/occ config:system:get maintenance)" = "true" ] then MAINTENANCE_MODE_ON=1 fi - nextcloud_occ_no_check maintenance:mode --on + sudo -u www-data php "$NCPATH"/occ maintenance:mode --on # Database export # Not really necessary since the root partition gets backed up but easier to restore on new systems ncdb # get NCDB @@ -445,7 +445,7 @@ Please don't restart or shutdown your server until then!" # Prune system archives inform_user "$ICyan" "Pruning the system archives..." - if ! borg prune --prefix '*_*-NcVM-system-partition' "${BORG_PRUNE_OPTS[@]}" + if ! borg prune --glob-archives '*_*-NcVM-system-partition' "${BORG_PRUNE_OPTS[@]}" then re_rename_snapshot send_error_mail "Some errors were reported by the prune system command." @@ -464,7 +464,7 @@ Please don't restart or shutdown your server until then!" # Prune boot archives inform_user "$ICyan" "Pruning the boot archives..." - if ! borg prune --prefix '*_*-NcVM-boot-partition' "${BORG_PRUNE_OPTS[@]}" + if ! borg prune --glob-archives '*_*-NcVM-boot-partition' "${BORG_PRUNE_OPTS[@]}" then re_rename_snapshot send_error_mail "Some errors were reported by the prune boot command." @@ -485,7 +485,7 @@ Please don't restart or shutdown your server until then!" fi # Prune ncdata archives inform_user "$ICyan" "Pruning the ncdata archives..." - if ! borg prune --prefix '*_*-NcVM-ncdata-partition' "${BORG_PRUNE_OPTS[@]}" + if ! borg prune --glob-archives '*_*-NcVM-ncdata-partition' "${BORG_PRUNE_OPTS[@]}" then re_rename_snapshot send_error_mail "Some errors were reported by the prune ncdata command." @@ -534,7 +534,7 @@ Please don't restart or shutdown your server until then!" # Prune archives inform_user "$ICyan" "Pruning the $DIRECTORY_NAME archives..." - if ! borg prune --prefix "*_*-NcVM-$DIRECTORY_NAME-directory" "${BORG_PRUNE_OPTS[@]}" + if ! borg prune --glob-archives "*_*-NcVM-$DIRECTORY_NAME-directory" "${BORG_PRUNE_OPTS[@]}" then re_rename_snapshot send_error_mail "Some errors were reported by the prune $DIRECTORY_NAME command." @@ -662,7 +662,7 @@ then fi # Check the backup -inform_user "$ICyan" "Checking the backup integity..." +inform_user "$ICyan" "Checking the backup integrity..." # TODO: check how long this takes. If too long, remove the --verifa-data flag if ! borg check --verify-data "$BACKUP_TARGET_DIRECTORY" then diff --git a/not-supported/btrfs-format.sh b/not-supported/btrfs-format.sh index 93a9e2d4..7c698aa4 100644 --- a/not-supported/btrfs-format.sh +++ b/not-supported/btrfs-format.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/btrfs-mount.sh b/not-supported/btrfs-mount.sh index 2cb2ecb7..ffacad18 100644 --- a/not-supported/btrfs-mount.sh +++ b/not-supported/btrfs-mount.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -164,7 +164,7 @@ If you want to cancel, type 'exit' and press [ENTER].") then msg_box "The directory isn't allowed to start with '/mnt/smbshares'" else - echo "UUID=$UUID $MOUNT_PATH btrfs defaults 0 0" >> /etc/fstab + echo "UUID=$UUID $MOUNT_PATH btrfs defaults,nofail 0 0" >> /etc/fstab mkdir -p "$MOUNT_PATH" if ! mount "$MOUNT_PATH" then @@ -313,7 +313,7 @@ fi # Execute the change to a backup drive print_text_in_color "$ICyan" "Adjusting permissions..." -sed -i "/$UUID/s/defaults/defaults,noauto/" /etc/fstab +sed -i "/$UUID/s/defaults,nofail/defaults,noauto/" /etc/fstab chown -R root:root "$MOUNT_PATH" chmod -R 600 "$MOUNT_PATH" umount "$MOUNT_PATH" diff --git a/not-supported/daily-backup-wizard.sh b/not-supported/daily-backup-wizard.sh index dd2f58e1..dad7ead6 100644 --- a/not-supported/daily-backup-wizard.sh +++ b/not-supported/daily-backup-wizard.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -381,6 +381,7 @@ fi # Install needed tools msg_box "We will now install all needed tools, initialize the Borg backup repository and create the daily backup script now." install_if_not borgbackup +apt-get install python3-pyfuse3 --no-install-recommends -y # Initialize the borg backup repository export BORG_PASSPHRASE="$ENCRYPTION_KEY" @@ -415,7 +416,7 @@ check_command umount "$BACKUP_MOUNT" cat << WRITE_BACKUP_SCRIPT > "$BACKUP_SCRIPT_NAME" #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/firewall.sh b/not-supported/firewall.sh index 5c01f1da..b410609f 100644 --- a/not-supported/firewall.sh +++ b/not-supported/firewall.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/monitor-link-shares.sh b/not-supported/monitor-link-shares.sh index 4f99c578..76bb22ea 100644 --- a/not-supported/monitor-link-shares.sh +++ b/not-supported/monitor-link-shares.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Monitor Link Shares" diff --git a/not-supported/not-supported.sh b/not-supported/not-supported.sh index 4a9aa83a..779ccaf8 100644 --- a/not-supported/not-supported.sh +++ b/not-supported/not-supported.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Not-supported Menu" diff --git a/not-supported/not-supported_menu.sh b/not-supported/not-supported_menu.sh index 0a8d7228..b9550a04 100644 --- a/not-supported/not-supported_menu.sh +++ b/not-supported/not-supported_menu.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Not-supported Menu" @@ -32,9 +32,9 @@ $CHECKLIST_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ "NTFS Mount" "(Mount NTFS drives)" OFF \ "NTFS Veracrypt" "(Format, encrypt and mount Veracrypt NTFS drives)" OFF \ "Backup Viewer" "(View your Backups)" OFF \ +"Restic Cloud Backup" "(Backup your server using Restic to multiple clouds)" OFF \ "Daily Backup Wizard" "(Create a Daily Backup script)" OFF \ "Firewall" "(Setting up a firewall)" OFF \ -"Harden SSH" "(Harden SSH configuration)" OFF \ "Monitor Link Shares" "(Monitors the creation of link shares)" OFF \ "Off-Shore Backup Wizard" "(Create an Off-Shore Backup script)" OFF \ "Pi-hole" "(Network wide ads- and tracker blocking)" OFF \ @@ -77,14 +77,14 @@ case "$choice" in print_text_in_color "$ICyan" "Downloading the Daily Backup Wizard script..." run_script NOT_SUPPORTED_FOLDER daily-backup-wizard ;;& + *"Restic Cloud Backup Wizard"*) + print_text_in_color "$ICyan" "Downloading the Cloud Backup Wizard script..." + run_script NOT_SUPPORTED_FOLDER restic-cloud-backup-wizard + ;;& *"Firewall"*) print_text_in_color "$ICyan" "Downloading the Firewall script..." run_script NOT_SUPPORTED_FOLDER firewall ;;& - *"Harden SSH"*) - print_text_in_color "$ICyan" "Downloading the Harden SSH script..." - run_script ADDONS harden-ssh - ;;& *"Monitor Link Shares"*) print_text_in_color "$ICyan" "Monitor Link Shares..." run_script NOT_SUPPORTED_FOLDER monitor-link-shares diff --git a/not-supported/ntfs-format.sh b/not-supported/ntfs-format.sh index 8e2ffbeb..e2b30d5b 100644 --- a/not-supported/ntfs-format.sh +++ b/not-supported/ntfs-format.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/ntfs-mount.sh b/not-supported/ntfs-mount.sh index a18ecdb6..4c9cf5e6 100644 --- a/not-supported/ntfs-mount.sh +++ b/not-supported/ntfs-mount.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/offshore-backup-wizard.sh b/not-supported/offshore-backup-wizard.sh index 74156aa1..cacad0a6 100644 --- a/not-supported/offshore-backup-wizard.sh +++ b/not-supported/offshore-backup-wizard.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -263,7 +263,7 @@ msg_box "We will create the off-shore backup script now." cat << WRITE_BACKUP_SCRIPT > "$BACKUP_SCRIPT_NAME" #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/pi-hole.sh b/not-supported/pi-hole.sh index 017faa73..3dec7c79 100644 --- a/not-supported/pi-hole.sh +++ b/not-supported/pi-hole.sh @@ -1,9 +1,9 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) -# shellcheck disable=2016,2034,2059,2178 +# shellcheck disable=2016,2034,2059,2178,2317 true SCRIPT_NAME="Pi-hole" SCRIPT_EXPLAINER="The Pi-hole® is a DNS sinkhole that protects your devices from unwanted content, \ @@ -21,6 +21,10 @@ debug_mode # Check if root root_check +msg_box "The pi-hole script is unfortunately deprecated as it needs a rewrite since many parts in the upstream pi-hole project changed. +Feel free to subscribe to https://github.com/szaimen/Nextcloud-NAS-Guide/issues/133 in the meantime." +exit 1 + # Check if already installed if ! pihole &>/dev/null then @@ -70,6 +74,8 @@ If you press 'yes', we will remove Pi-hole, its settings and all those listed pr # Make an array from installed applications read -r -a INSTALLED <<< "$INSTALLED" + # /opt/pihole/uninstall.sh edit file and put setupVars variable setupVars="/etc/pihole/setupVars.conf" at 5th line or something + UNINSTALL="/etc/.pihole/automated install/uninstall.sh" # Uninstall pihole; we need to modify it, else it is not unattended if ! [ -f "$UNINSTALL" ] || ! grep -q "######### SCRIPT ###########" "$UNINSTALL" || ! grep -q "removeNoPurge()" "$UNINSTALL" @@ -192,6 +198,9 @@ sed -i "s|getStaticIPv4Settings$|echo getStaticIPv4Settings|" "$SCRIPTS"/pihole- PIHOLE_INTERFACE="$IFACE" export PIHOLE_INTERFACE +# Fix php versions getting hold for pi-hole install script +apt-mark unhold php"$PHPVER"* + # Run the script bash "$SCRIPTS"/pihole-install.sh | tee "$SCRIPTS"/pihole-install.report @@ -217,7 +226,7 @@ mkdir -p "$SCRIPTS" # Insert the new lines into pihole-update.sh cat << PIHOLE_UPDATE > "$SCRIPTS/pihole-update.sh" #!/bin/bash -. <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +. <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin notify_admin_gui "Starting the Pi-hole update." "You will be notified when it is done." # Create backup first @@ -310,8 +319,8 @@ a2enmod ssl a2enmod proxy a2enmod proxy_http -# Only add TLS 1.3 on Ubuntu later than 20.04 -if version 20.04 "$DISTRO" 22.04.10 +# Only add TLS 1.3 on Ubuntu later than 22.04 +if version 22.04 "$DISTRO" 24.04.10 then TLS13="+TLSv1.3" fi @@ -348,6 +357,7 @@ Listen 8094 ProxyRequests off ProxyPass / "http://127.0.0.1:8093/" ProxyPassReverse / "http://127.0.0.1:8093/" + ProxyPreserveHost On ### LOCATION OF CERT FILES ### SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem diff --git a/not-supported/pivpn.sh b/not-supported/pivpn.sh index 14fd4be1..eadc1dcd 100644 --- a/not-supported/pivpn.sh +++ b/not-supported/pivpn.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/plexmediaserver.sh b/not-supported/plexmediaserver.sh index d479919b..760bfbd0 100644 --- a/not-supported/plexmediaserver.sh +++ b/not-supported/plexmediaserver.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -71,6 +71,10 @@ DIRECTORIES=$(find /mnt/ -mindepth 1 -maxdepth 2 -type d | grep -v "/mnt/ncdata" mapfile -t DIRECTORIES <<< "$DIRECTORIES" for directory in "${DIRECTORIES[@]}" do + # Open directory to make sure that it is accessible + ls "$directory" &>/dev/null + + # Continue with the logic if mountpoint -q "$directory" && [ "$(stat -c '%a' "$directory")" = "770" ] then if [ "$(stat -c '%U' "$directory")" = "www-data" ] && [ "$(stat -c '%G' "$directory")" = "www-data" ] @@ -94,7 +98,7 @@ install_docker # Create plex user if ! id plex &>/dev/null then - check_command adduser --no-create-home --quiet --disabled-login --force-badname --gecos "" "plex" + check_command adduser --no-create-home --quiet --disabled-login --uid 1005 --gid 1006 --force-badname --gecos "" "plex" fi PLEX_UID="$(id -u plex)" diff --git a/not-supported/remotedesktop.sh b/not-supported/remotedesktop.sh index de0d6a13..a20fad41 100644 --- a/not-supported/remotedesktop.sh +++ b/not-supported/remotedesktop.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -19,19 +19,19 @@ debug_mode # Check if root root_check +# Don't run this script as root user, because we will need the account +if [ -z "$UNIXUSER" ] +then + msg_box "Please don't run this script as pure root user!" + exit 1 +fi + # Check if xrdp is installed if ! is_this_installed xrdp then # Ask for installing install_popup "$SCRIPT_NAME" XRDP_INSTALL=1 - - # Don't run this script as root user, because we will need the account - if [ -z "$UNIXUSER" ] - then - msg_box "Please don't run this script as pure root user!" - exit 1 - fi # Check if gnome-session is installed if ! is_this_installed gnome-session @@ -47,10 +47,6 @@ If you have already installed a desktop environment, you will not need to instal apt-get install gnome-session --no-install-recommends -y sudo -u "$UNIXUSER" dbus-launch gsettings set org.gnome.desktop.wm.preferences button-layout ":minimize,maximize,close" sudo -u "$UNIXUSER" dbus-launch gsettings set org.gnome.desktop.interface enable-animations false - install_if_not gnome-shell-extension-dash-to-panel - check_command sudo -u "$UNIXUSER" dbus-launch gnome-extensions enable dash-to-panel@jderose9.github.com - install_if_not gnome-shell-extension-arc-menu - sudo -u "$UNIXUSER" dbus-launch gnome-extensions enable arc-menu@linxgem33.com fi fi @@ -347,9 +343,13 @@ This can set your server under risk, though!" "$SUBTITLE" if yesno_box_yes "Do you want to install OnlyOffice Desktop Editors nonetheless?" "$SUBTITLE" then print_text_in_color "$ICyan" "Installing $SUBTITLE" - apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys CB2DE8E5 - echo "deb https://download.onlyoffice.com/repo/debian squeeze main" \ -> /etc/apt/sources.list.d/onlyoffice-desktopeditors.list + # From https://helpcenter.onlyoffice.com/installation/desktop-install-ubuntu.aspx + mkdir -p ~/.gnupg + gpg --no-default-keyring --keyring gnupg-ring:/tmp/onlyoffice.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys CB2DE8E5 + chmod 644 /tmp/onlyoffice.gpg + chown root:root /tmp/onlyoffice.gpg + mv /tmp/onlyoffice.gpg /usr/share/keyrings/onlyoffice.gpg + echo "deb [signed-by=/usr/share/keyrings/onlyoffice.gpg] https://download.onlyoffice.com/repo/debian squeeze main" > "/etc/apt/sources.list.d/onlyoffice-desktopeditors.list" apt-get update -q4 & spinner_loading install_if_not onlyoffice-desktopeditors print_text_in_color "$ICyan" "$SUBTITLE was successfully installed" diff --git a/not-supported/restic-cloud-backup-wizard.sh b/not-supported/restic-cloud-backup-wizard.sh new file mode 100644 index 00000000..8013fecb --- /dev/null +++ b/not-supported/restic-cloud-backup-wizard.sh @@ -0,0 +1,510 @@ +#!/bin/bash + +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ +# Sami Nieminen - 2024 https://nenimein.fi + +# This script helps creating a backup script for your Nextcloud instance to various cloud storage providers. +# It uses Restic to back up your configuration, database and optionally your /mnt/ncdata folder. +# Restic will be downloaded from official binaries to make Azure backups work. +# Server will be set to maintenance mode during backup. +# If you have large amount of files to backup, please run the script interactively before automatic schedule. + +true + +SCRIPT_NAME="restic-cloud-backup" + +# shellcheck source=lib.sh +source /var/scripts/fetch_lib.sh + +# Check for errors + debug code and abort if something isn't right +# 1 = ON +# 0 = OFF +DEBUG=0 +debug_mode + +# Check if root +root_check + +# Variables +BACKUP_SCRIPT_NAME="$SCRIPTS/restic-cloud-backup.sh" +BACKUP_CONFIG="$HOME/.restic_cloud_backup_config" + +# Install restic from official binaries because debian decided to remove Azure backups from binary for some unknown reason :( +# https://forum.restic.net/t/version-0-16-4-and-azure-blob/7864 +# https://salsa.debian.org/go-team/packages/restic/-/tree/master/debian/patches?ref_type=heads +install_restic() { + # Get latest version from GitHub API + print_text_in_color "$ICyan" "Getting latest restic version..." + LATEST_VERSION=$(curl -s https://api.github.com/repos/restic/restic/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') + if [ -z "$LATEST_VERSION" ]; then + msg_box "Failed to get latest restic version. Please try again later." + exit 1 + fi + + # Remove 'v' prefix from version for comparison and binary download + LATEST_VERSION_CLEAN=${LATEST_VERSION#v} + + # Check if restic is already installed with correct version + if [ -x "$(command -v restic)" ]; then + INSTALLED_VERSION=$(restic version | grep "restic" | awk '{print $2}') + print_text_in_color "$ICyan" "Restic $INSTALLED_VERSION is already installed, checking for newer version..." + fi + + # Check if we need to upgrade + if [ -n "$INSTALLED_VERSION" ] && [ "$INSTALLED_VERSION" = "$LATEST_VERSION_CLEAN" ]; then + print_text_in_color "$IGreen" "Latest version $LATEST_VERSION is already installed!" + return 0 + fi + + # Download and install restic + print_text_in_color "$ICyan" "Installing restic $LATEST_VERSION..." + + # Create temp directory + TMP_DIR=$(mktemp -d) + + # Download binary + print_text_in_color "$ICyan" "Downloading restic $LATEST_VERSION..." + if ! curl -L "https://github.com/restic/restic/releases/download/$LATEST_VERSION/restic_${LATEST_VERSION#v}_linux_amd64.bz2" -o "$TMP_DIR/restic.bz2"; then + msg_box "Failed to download restic. Please try again later." + rm -rf "$TMP_DIR" + exit 1 + fi + + # Extract binary + print_text_in_color "$ICyan" "Extracting restic binary to $TMP_DIR" + if ! bunzip2 "$TMP_DIR/restic.bz2"; then + msg_box "Failed to extract restic binary." + rm -rf "$TMP_DIR" + exit 1 + fi + + # Make executable and move to /usr/local/bin + print_text_in_color "$ICyan" "Moving restic binary to /usr/local/bin/" + chmod +x "$TMP_DIR/restic" + if ! mv "$TMP_DIR/restic" /usr/local/bin/; then + msg_box "Failed to install restic binary." + rm -rf "$TMP_DIR" + exit 1 + fi + + # Clean up + rm -rf "$TMP_DIR" + + # Verify installation + if ! restic version | grep -q "$LATEST_VERSION_CLEAN"; then + msg_box "Failed to verify restic installation." + exit 1 + fi + + print_text_in_color "$IGreen" "Successfully installed restic $LATEST_VERSION" + return 0 +} + +# Functions +choose_backup_location() { + BACKUP_TYPE=$(whiptail --title "$TITLE" --menu \ + "Choose backup destination" "$WT_HEIGHT" "$WT_WIDTH" 4 \ + "Backblaze B2" "" \ + "AWS S3" "" \ + "Azure Blob" "" 3>&1 1>&2 2>&3) + + case "$BACKUP_TYPE" in + "Backblaze B2") + B2_ACCOUNT_ID=$(input_box_flow "Enter Backblaze B2 Account ID \nThis is your Application Key keyID:") + B2_ACCOUNT_KEY=$(input_box_flow "Enter Backblaze B2 Account Key \nThis is the Application Key Secret:") + B2_BUCKET_NAME=$(input_box_flow "Enter Backblaze B2 Bucket Name:") + RESTIC_REPOSITORY="b2:$B2_BUCKET_NAME:" + ;; + "AWS S3") + AWS_ACCESS_KEY_ID=$(input_box_flow "Enter AWS Access Key ID:") + AWS_SECRET_ACCESS_KEY=$(input_box_flow "Enter AWS Secret Access Key:") + AWS_DEFAULT_REGION=$(input_box_flow "Enter AWS Region (e.g., us-east-1):") + S3_BUCKET_NAME=$(input_box_flow "Enter S3 Bucket Name:") + RESTIC_REPOSITORY="s3:s3.${AWS_DEFAULT_REGION}.amazonaws.com/${S3_BUCKET_NAME}" + ;; + "Azure Blob") + AZURE_ACCOUNT_NAME=$(input_box_flow "Enter Azure Storage Account Name") + AZURE_ACCOUNT_KEY=$(input_box_flow "Enter Azure Storage Account Key:") + AZURE_CONTAINER_NAME=$(input_box_flow "Enter Azure Storage Account Blob name:") + RESTIC_REPOSITORY="azure:${AZURE_CONTAINER_NAME}:/" + ;; + *) + msg_box "Invalid selection" + exit 1 + ;; + esac + + # Configure restic password + RESTIC_PASSWORD=$(input_box_flow "Enter Restic Repository Password \nSAVE THIS! \nIF YOU LOSE IT YOU WILL NOT BE ABLE TO RESTORE THIS BACKUP:") +} + +choose_backup_scope() { + BACKUP_SCOPE=$(whiptail --title "$TITLE" --menu \ + "Choose what to backup" "$WT_HEIGHT" "$WT_WIDTH" 4 \ + "Minimal" "(Config files and database only)" \ + "Full" "(Config, database and /mnt/ncdata)" 3>&1 1>&2 2>&3) + + case "$BACKUP_SCOPE" in + "Minimal") + BACKUP_NCDATA="no" + ;; + "Full") + BACKUP_NCDATA="yes" + ;; + *) + msg_box "Invalid selection" + exit 1 + ;; + esac +} + +setup_restic_excludes() { + # Variables + RESTIC_EXCLUDES="$HOME/.restic_cloud_backup_excludes" + + # Check if excludes file already exists + if [ -f "$RESTIC_EXCLUDES" ] + then + msg_box "The restic excludes file already exists at $RESTIC_EXCLUDES. It will be used for backups." + if yesno_box_yes "Do you want to edit the existing excludes file?" + then + if [ -x "$(command -v nano)" ] + then + nano "$RESTIC_EXCLUDES" + else + vim "$RESTIC_EXCLUDES" + fi + fi + return 0 + fi + + # Create default excludes file + touch "$RESTIC_EXCLUDES" + chmod 600 "$RESTIC_EXCLUDES" + + # Add default excludes + { + echo "# Restic excludes file" + echo "# One exclude pattern per line" + echo "" + + # Add Nextcloud appdata/preview folder excludes if full backup is selected. + if [ "$BACKUP_NCDATA" = "yes" ] + then + echo "" + echo "# Nextcloud preview cache" + echo "/mnt/ncdata/appdata*/preview/*" + echo "/mnt/ncdata/appdata*/thumbnails/*" + fi + + } > "$RESTIC_EXCLUDES" + + msg_box "A default excludes file has been created at $RESTIC_EXCLUDES. +You can edit this file to add or remove paths that should be excluded from backups. +Each line should contain one path or pattern to exclude." + + if yesno_box_yes "Do you want to edit the excludes file now?" + then + if [ -x "$(command -v nano)" ] + then + nano "$RESTIC_EXCLUDES" + else + vim "$RESTIC_EXCLUDES" + fi + fi + + # Return success + return 0 +} + +# Ask for execution +msg_box "This script helps creating a backup script for your Nextcloud instance to various cloud storage providers. +It uses Restic to back up your configuration, database and optionally your /mnt/ncdata folder. +Restic will be downloaded from official binaries to make Azure backups work. +Server will be set to maintenance mode during backup. +If you have large amount of files to backup, please run the script interactively before automatic schedule." + +if ! yesno_box_yes "Do you want to create a backup script?" +then + exit +fi + +# Check if script already exists +if [ -f "$BACKUP_SCRIPT_NAME" ] +then + msg_box "The backup script already exists. Please rename or delete $BACKUP_SCRIPT_NAME if you want to reconfigure the backup." + exit 1 +fi + +# Install restic if not installed +if ! install_restic; then + msg_box "Failed to install restic. Cannot continue." + exit 1 +fi + +# Configure backup destination +choose_backup_location + +# Choose backup scope +choose_backup_scope + +if ! setup_restic_excludes; then + msg_box "Failed to set up restic excludes file. Cannot continue." + exit 1 +fi + +# Configure retention policy +BACKUP_RETENTION_DAILY=$(input_box_flow "Enter number of daily backups to keep:" "7") +BACKUP_RETENTION_WEEKLY=$(input_box_flow "Enter number of weekly backups to keep:" "4") +BACKUP_RETENTION_MONTHLY=$(input_box_flow "Enter number of monthly backups to keep:" "3") + +# Configure backup time +if yesno_box_yes "Do you want to run the backup at the recommended time 4:00 AM?" +then + BACKUP_TIME="00 04" +else + while : + do + BACKUP_TIME=$(input_box_flow "Enter backup time (mm hh format, e.g. '00 04' for 4:00 AM):") + if echo "$BACKUP_TIME" | grep -qE "^[0-5][0-9] ([01][0-9]|2[0-3])$" + then + break + fi + msg_box "Invalid time format. Please use mm hh format (e.g. '00 04' for 4:00 AM)" + done +fi + +# Save configuration +cat > "$BACKUP_CONFIG" << EOL +BACKUP_TYPE="$BACKUP_TYPE" +BACKUP_SCOPE="$BACKUP_SCOPE" +BACKUP_NCDATA="$BACKUP_NCDATA" +RESTIC_PASSWORD="$RESTIC_PASSWORD" +RESTIC_REPOSITORY="$RESTIC_REPOSITORY" +RESTIC_EXCLUDES="$RESTIC_EXCLUDES" +BACKUP_RETENTION_DAILY="$BACKUP_RETENTION_DAILY" +BACKUP_RETENTION_WEEKLY="$BACKUP_RETENTION_WEEKLY" +BACKUP_RETENTION_MONTHLY="$BACKUP_RETENTION_MONTHLY" + + +# B2 Configuration +B2_ACCOUNT_ID="$B2_ACCOUNT_ID" +B2_ACCOUNT_KEY="$B2_ACCOUNT_KEY" +B2_BUCKET_NAME="$B2_BUCKET_NAME" + +# AWS S3 Configuration +AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" +AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" +AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION" +S3_BUCKET_NAME="$S3_BUCKET_NAME" + +# Azure Blob Configuration +AZURE_ACCOUNT_NAME="$AZURE_ACCOUNT_NAME" +AZURE_ACCOUNT_KEY="$AZURE_ACCOUNT_KEY" +AZURE_CONTAINER_NAME="$AZURE_CONTAINER_NAME" +EOL +chmod 600 "$BACKUP_CONFIG" + +# Create backup script +cat << BACKUP_SCRIPT > "$BACKUP_SCRIPT_NAME" +#!/bin/bash + +true +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ +# Sami Nieminen - 2024 https://nenimein.fi + +# shellcheck source=lib.sh +source /var/scripts/fetch_lib.sh + +# Check for errors + debug code and abort if something isn't right +# 1 = ON +# 0 = OFF +DEBUG=0 +debug_mode + +# Check if root +root_check + +# Get database details +ncdb + +# Ensure VMLOGS directory exists +if [ ! -d "$VMLOGS/restic" ]; then + mkdir -p "$VMLOGS/restic" +fi + +# Define log file +DATE=\$(date +%Y%m%d-%H%M%S) +BACKUP_LOG="$VMLOGS/restic/restic-backup_\${DATE}.log" + +# Load configuration +source "$HOME/.restic_cloud_backup_config" + +# Export environment variables based on backup type +case "$BACKUP_TYPE" in + "Backblaze B2") + export B2_ACCOUNT_ID="$B2_ACCOUNT_ID" + export B2_ACCOUNT_KEY="$B2_ACCOUNT_KEY" + ;; + "AWS S3") + export AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" + export AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" + export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION" + ;; + "Azure Blob") + export AZURE_ACCOUNT_NAME="$AZURE_ACCOUNT_NAME" + export AZURE_ACCOUNT_KEY="$AZURE_ACCOUNT_KEY" + export AZURE_CONTAINER_NAME="$AZURE_CONTAINER_NAME" + ;; +esac + +export RESTIC_REPOSITORY="$RESTIC_REPOSITORY" +export RESTIC_PASSWORD="$RESTIC_PASSWORD" + +# Start logging +{ + echo "\$(date '+%Y-%m-%d %H:%M:%S') Starting Restic backup script" + echo "----------------------------------------" + + # Check if we have network connection + if ! network_ok + then + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: No network connection" + notify_admin_gui "Unable to execute Restic backup" "No network connection." + exit 1 + fi + + # Load backup config + if [ -f "$BACKUP_CONFIG" ] + then + echo "\$(date '+%Y-%m-%d %H:%M:%S') Loading Restic backup configuration" + # shellcheck disable=SC1090 + source "$BACKUP_CONFIG" + else + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Restic Backup configuration not found" + notify_admin_gui "Unable to execute Restic backup" "Configuration file not found." + exit 1 + fi + + # Create backup directory + BACKUP_DIR="/tmp/nextcloud_backup" + echo "\$(date '+%Y-%m-%d %H:%M:%S') Creating backup directory: \$BACKUP_DIR" + mkdir -p "\$BACKUP_DIR" + + # Enable maintenance mode + echo "\$(date '+%Y-%m-%d %H:%M:%S') Enabling maintenance mode" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --on + + # Backup PostgreSQL database + echo "\$(date '+%Y-%m-%d %H:%M:%S') Backing up PostgreSQL database" + if PGPASSWORD="\$NCDBPASS" pg_dump -U "\$NCDBUSER" -h "\$NCDBHOST" -d "\$NCDB" > "\$BACKUP_DIR/nextcloud_db.sql"; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') Database backup completed successfully" + else + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Nextcloud database backup failed" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + notify_admin_gui "Restic backup failed!" "Database backup failed." + exit 1 + fi + + # Backup Nextcloud config + echo "\$(date '+%Y-%m-%d %H:%M:%S') Backing up Nextcloud configuration" + if cp /var/www/nextcloud/config/config.php "\$BACKUP_DIR/"; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') Nextcloud configuration backup completed successfully" + else + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Nextcloud configuration backup failed" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + notify_admin_gui "Restic backup failed!" "Nextcloud configuration backup failed." + exit 1 + fi + + # Initialize repository if needed + echo "\$(date '+%Y-%m-%d %H:%M:%S') Checking/Initializing repository" + if ! restic snapshots; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') Initializing new repository" + if ! restic init; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Restic repository initialization failed" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + notify_admin_gui "Restic backup failed!" "Repository initialization failed." + exit 1 + fi + fi + + # Create backup based on scope + if [ "$BACKUP_NCDATA" = "yes" ] + then + echo "\$(date '+%Y-%m-%d %H:%M:%S') Creating full backup including /mnt/ncdata" + if ! restic backup "\$BACKUP_DIR" /mnt/ncdata --exclude-file="$RESTIC_EXCLUDES"; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Restic full backup failed" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + notify_admin_gui "Restic backup failed!" "Full backup creation failed." + exit 1 + fi + else + echo "\$(date '+%Y-%m-%d %H:%M:%S') Creating minimal backup (config and database only)" + if ! restic backup "\$BACKUP_DIR"; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Restic minimal backup failed" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + notify_admin_gui "Restic backup failed!" "Minimal backup creation failed." + exit 1 + fi + fi + + # Clean up backup directory + echo "\$(date '+%Y-%m-%d %H:%M:%S') Cleaning up temporary backup directory" + rm -rf "\$BACKUP_DIR" + + # Apply retention policy + echo "\$(date '+%Y-%m-%d %H:%M:%S') Applying retention policy" + if ! restic forget --keep-daily "$BACKUP_RETENTION_DAILY" \ + --keep-weekly "$BACKUP_RETENTION_WEEKLY" \ + --keep-monthly "$BACKUP_RETENTION_MONTHLY" --prune; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') WARNING: Failed to apply retention policy" + notify_admin_gui \ + "Restic retention policy not applied!" \ + "The backup completed but repository retention policy failed.\nPlease check the logs at \$BACKUP_LOG" + exit 1 + fi + + # Check repository + echo "\$(date '+%Y-%m-%d %H:%M:%S') Checking repository integrity" + if ! restic check; then + echo "\$(date '+%Y-%m-%d %H:%M:%S') ERROR: Repository check failed" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + notify_admin_gui \ + "Restic repository check failed!" \ + "The backup completed but repository integrity check failed.\nPlease check the logs at \$BACKUP_LOG" + exit 1 + fi + + # Disable maintenance mode + echo "\$(date '+%Y-%m-%d %H:%M:%S') Disabling maintenance mode" + sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off + + echo "----------------------------------------" + echo "\$(date '+%Y-%m-%d %H:%M:%S') Backup completed successfully" + notify_admin_gui "Restic backup was successful." "Backup log available at: \$BACKUP_LOG" + +} 2>&1 | tee -a "\$BACKUP_LOG" + +# Check if any errors occurred in the pipeline +if [ \${PIPESTATUS[0]} -ne 0 ]; then + notify_admin_gui "Restic backup failed!" "Please check the logs at \$BACKUP_LOG" + exit 1 +fi +BACKUP_SCRIPT + +# Make backup script executable +chmod 700 "$BACKUP_SCRIPT_NAME" + +# Create cron job +crontab -u root -l | grep -v "$BACKUP_SCRIPT_NAME" | crontab -u root - +crontab -u root -l | { cat; echo "$BACKUP_TIME * * * $BACKUP_SCRIPT_NAME > /dev/null 2>&1"; } | crontab -u root - + +# Final message +msg_box "The backup script has been created successfully! +Location: $BACKUP_SCRIPT_NAME + +The first backup will run automatically at $BACKUP_TIME. +Please make sure to keep your configuration, API keys and Restic password safe!" + +exit 0 diff --git a/not-supported/restore-backup.sh b/not-supported/restore-backup.sh index 4c5c8031..b9d14d1e 100644 --- a/not-supported/restore-backup.sh +++ b/not-supported/restore-backup.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) # shellcheck disable=SC2024 @@ -307,6 +307,7 @@ fi # Install borg print_text_in_color "$ICyan" "Installing borgbackup..." install_if_not borgbackup +apt-get install python3-pyfuse3 --no-install-recommends -y # Enter password while : diff --git a/not-supported/rsyncbackup.sh b/not-supported/rsyncbackup.sh index 461b30a7..ab21a7a0 100644 --- a/not-supported/rsyncbackup.sh +++ b/not-supported/rsyncbackup.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -19,7 +19,6 @@ debug_mode root_check # Variables -LVM_MOUNT="/system" START_TIME=$(date +%s) CURRENT_DATE=$(date --date @"$START_TIME" +"%Y%m%d_%H%M%S") CURRENT_DATE_READABLE=$(date --date @"$START_TIME" +"%d.%m.%Y - %H:%M:%S") @@ -48,14 +47,17 @@ show_drive_usage() { send_error_mail() { if [ -d "$BACKUP_TARGET_DIRECTORY" ] then - inform_user "$ICyan" "Unmounting the off-shore backup drive..." - umount "$BACKUP_MOUNTPOINT" + if [ -z "$DO_NOT_UMOUNT_BACKUP_DRIVES" ] + then + inform_user "$ICyan" "Unmounting the offshore backup drive..." + umount "$BACKUP_MOUNTPOINT" + fi fi if [ -d "$BACKUP_SOURCE_DIRECTORY" ] then - if [ -z "$DO_NOT_UMOUNT_DAILY_BACKUP_DRIVE" ] + if [ -z "$DO_NOT_UMOUNT_BACKUP_DRIVES" ] then - inform_user "$ICyan" "Unmounting the backup drive..." + inform_user "$ICyan" "Unmounting the daily backup drive..." umount "$BACKUP_SOURCE_MOUNTPOINT" fi fi @@ -124,7 +126,7 @@ fi # Check if pending snapshot is existing and cancel the backup in this case. if does_snapshot_exist "NcVM-snapshot-pending" then - DO_NOT_UMOUNT_DAILY_BACKUP_DRIVE=1 + DO_NOT_UMOUNT_BACKUP_DRIVES=1 msg_box "The snapshot pending does exist. Can currently not proceed. Please try again later.\n If you are sure that no update or backup is currently running, you can fix this by rebooting your server." @@ -193,7 +195,7 @@ fi # Check if pending snapshot is existing and cancel the backup in this case. if does_snapshot_exist "NcVM-snapshot-pending" then - DO_NOT_UMOUNT_DAILY_BACKUP_DRIVE=1 + DO_NOT_UMOUNT_BACKUP_DRIVES=1 msg_box "The snapshot pending does exist. Can currently not proceed. Please try again later.\n If you are sure that no update or backup is currently running, you can fix this by rebooting your server." diff --git a/not-supported/smbserver.sh b/not-supported/smbserver.sh index 39c0701e..4d8fb83d 100644 --- a/not-supported/smbserver.sh +++ b/not-supported/smbserver.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -907,7 +907,7 @@ We please you to do the math yourself if the number is high enough for your setu fi # Install the inotify PHP extension - # https://github.com/icewind1991/files_inotify/blob/master/README.md + # https://github.com/icewind1991/files_inotify/blob/main/README.md if ! pecl list | grep -q inotify then print_text_in_color "$ICyan" "Installing the PHP inotify extension..." diff --git a/not-supported/system-restore.sh b/not-supported/system-restore.sh index 704dafeb..be31fadb 100644 --- a/not-supported/system-restore.sh +++ b/not-supported/system-restore.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/tpm2-unlock.sh b/not-supported/tpm2-unlock.sh index 0e6c7e5e..6480afe9 100644 --- a/not-supported/tpm2-unlock.sh +++ b/not-supported/tpm2-unlock.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -8,7 +8,7 @@ SCRIPT_NAME="TPM2 Unlock" SCRIPT_EXPLAINER="This script helps automatically unlocking the root partition during boot \ and securing your GRUB (bootloader)." # shellcheck source=lib.sh -source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -22,8 +22,7 @@ root_check # Check if already installed if is_this_installed clevis-luks || is_this_installed clevis-tpm2 || is_this_installed clevis-initramfs then - msg_box "It seems like clevis-luks is already installed.\nThis script can unfortunately not run twice." - exit 1 + msg_box "It seems like clevis-luks is already installed. We are trying to do the configuration again." else # Ask for installation install_popup "$SCRIPT_NAME" @@ -45,7 +44,7 @@ fi # Test if device is present # https://github.com/noobient/noobuntu/wiki/Full-Disk-Encryption#tpm-2 -if ! dmesg | grep -i "tpm" | grep -q "2\.0" +if ! dmesg | grep -iq "tpm2" then msg_box "No TPM 2.0 device found." exit 1 @@ -99,11 +98,12 @@ PASSWORD=$(input_box_flow "Please enter a new password that will secure your GRU GRUB_PASS="$(echo -e "$PASSWORD\n$PASSWORD" | grub-mkpasswd-pbkdf2 | grep -oP 'grub\.pbkdf2\.sha512\.10000\..*')" if [ -n "${PASSWORD##grub.pbkdf2.sha512.10000.}" ] then - cat << GRUB_CONF >> /etc/grub.d/40_custom - + cat << GRUB_CONF > /etc/grub.d/40_custom +cat << EOF # Password-protect GRUB set superusers="grub" password_pbkdf2 grub $GRUB_PASS +EOF GRUB_CONF # Allow to run the default grub options without requiring the grub password if ! grep -q '^CLASS=.*--unrestricted"' /etc/grub.d/10_linux && grep -q '^CLASS=.*"$' /etc/grub.d/10_linux diff --git a/not-supported/veracrypt-btrfs.sh b/not-supported/veracrypt-btrfs.sh index 2d6575e5..40b08318 100644 --- a/not-supported/veracrypt-btrfs.sh +++ b/not-supported/veracrypt-btrfs.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/not-supported/veracrypt-ntfs.sh b/not-supported/veracrypt-ntfs.sh index 7142a33d..49fe065d 100644 --- a/not-supported/veracrypt-ntfs.sh +++ b/not-supported/veracrypt-ntfs.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/old/face-recognition.sh b/old/face-recognition.sh index 973b7069..dd871337 100644 --- a/old/face-recognition.sh +++ b/old/face-recognition.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true @@ -100,18 +100,18 @@ then fi # Install requirements -if version 20.04 "$DISTRO" 20.04.10 +if version 22.04 "$DISTRO" 22.04.10 then - # https://github.com/matiasdelellis/facerecognition/wiki/PDlib-Installation#ubuntu-focal + # https://github.com/matiasdelellis/facerecognition/wiki/PDlib-Installation#ubuntu-jammy add_trusted_key_and_repo "repo.gpg.key" \ "https://repo.delellis.com.ar" \ "https://repo.delellis.com.ar" \ "focal focal" \ "facerecognition-pdlib.list" install_if_not php"$PHPVER"-pdlib -elif version 22.04 "$DISTRO" 22.04.10 +elif version 24.04 "$DISTRO" 24.04.10 then - # https://github.com/matiasdelellis/facerecognition/wiki/PDlib-Installation#ubuntu-jammy + # https://github.com/matiasdelellis/facerecognition/wiki/PDlib-Installation#ubuntu-noble add_trusted_key_and_repo "repo.gpg.key" \ "https://repo.delellis.com.ar" \ "https://repo.delellis.com.ar" \ diff --git a/old/format-sda-nuc-server.sh b/old/format-sda-nuc-server.sh index 1662763d..f1099feb 100644 --- a/old/format-sda-nuc-server.sh +++ b/old/format-sda-nuc-server.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Format sda NUC Server" @@ -10,7 +10,7 @@ source /var/scripts/fetch_lib.sh # Check if root root_check -# Needs to be Ubuntu 20.04 and Multiverse +# Needs to be Ubuntu 22.04 and Multiverse check_distro_version check_multiverse diff --git a/addons/harden-ssh.sh b/old/harden-ssh.sh similarity index 98% rename from addons/harden-ssh.sh rename to old/harden-ssh.sh index 01184aa8..bf18cd8f 100644 --- a/addons/harden-ssh.sh +++ b/old/harden-ssh.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/old/modsecurity.sh b/old/modsecurity.sh index 534f4583..ef391677 100644 --- a/old/modsecurity.sh +++ b/old/modsecurity.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Modsecurity" diff --git a/old/ntpdate.sh b/old/ntpdate.sh index 7d83b462..0ba2ffd9 100644 --- a/old/ntpdate.sh +++ b/old/ntpdate.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Ntpdate" diff --git a/apps/pdfannotate.sh b/old/pdfannotate.sh similarity index 96% rename from apps/pdfannotate.sh rename to old/pdfannotate.sh index 879e39bd..734389ad 100644 --- a/apps/pdfannotate.sh +++ b/old/pdfannotate.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Copyright © 2021 Simon Lindner (https://github.com/szaimen) true diff --git a/old/previewgenerator.sh b/old/previewgenerator.sh index 6d06ec7e..0902c97b 100644 --- a/old/previewgenerator.sh +++ b/old/previewgenerator.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Preview Generator" @@ -124,10 +124,10 @@ then check_php # Install imagick install_if_not php"$PHPVER"-imagick - if version 22.04 "$DISTRO" 22.04.10 + if version 24.04 "$DISTRO" 24.04.10 then install_if_not libmagickcore-6.q16-6-extra - elif version 20.04 "$DISTRO" 20.04.10 + elif version 22.04 "$DISTRO" 22.04.10 then install_if_not libmagickcore-6.q16-3-extra fi diff --git a/old/spreedme.sh b/old/spreedme.sh index 44de671c..f0217d56 100644 --- a/old/spreedme.sh +++ b/old/spreedme.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Spreedme" diff --git a/old/test_connection.sh b/old/test_connection.sh index a4a1e3d0..82565dc3 100644 --- a/old/test_connection.sh +++ b/old/test_connection.sh @@ -4,7 +4,7 @@ SCRIPT_NAME="Test connection" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON diff --git a/static/adduser.sh b/static/adduser.sh index 9a5a7543..c982b33d 100644 --- a/static/adduser.sh +++ b/static/adduser.sh @@ -4,7 +4,7 @@ SCRIPT_NAME="Add CLI User" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON diff --git a/static/change-ncadmin-profile.sh b/static/change-ncadmin-profile.sh index d7ac6ffe..1bd1adc8 100644 --- a/static/change-ncadmin-profile.sh +++ b/static/change-ncadmin-profile.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Change ncadmin Profile" @@ -39,6 +39,7 @@ then PATH="/home/$UNIXUSER/bin:$PATH" fi bash /var/scripts/instruction.sh +# clear .bash_history by default as a security precaution bash /var/scripts/history.sh sudo -i diff --git a/static/change-root-profile.sh b/static/change-root-profile.sh index 6af21b64..9c838007 100644 --- a/static/change-root-profile.sh +++ b/static/change-root-profile.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Change root Profile" diff --git a/static/change_db_pass.sh b/static/change_db_pass.sh index 03de33ff..ae19a98f 100644 --- a/static/change_db_pass.sh +++ b/static/change_db_pass.sh @@ -7,7 +7,7 @@ source /var/scripts/fetch_lib.sh # Get all needed variables from the library ncdb -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON diff --git a/static/docker_overlay2.sh b/static/docker_overlay2.sh index 03c98590..7922c88d 100644 --- a/static/docker_overlay2.sh +++ b/static/docker_overlay2.sh @@ -4,7 +4,7 @@ SCRIPT_NAME="Change to Docker overlay2" # shellcheck source=lib.sh source /var/scripts/fetch_lib.sh -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # Check for errors + debug code and abort if something isn't right # 1 = ON diff --git a/static/fetch_lib.sh b/static/fetch_lib.sh index f4cf0f1d..56e13293 100644 --- a/static/fetch_lib.sh +++ b/static/fetch_lib.sh @@ -20,7 +20,7 @@ fi mkdir -p /var/scripts if ! [ -f /var/scripts/lib.sh ] then - if ! curl -sfL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh -o /var/scripts/lib.sh + if ! curl -sfL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh -o /var/scripts/lib.sh then print_text_in_color "$IRed" "You don't seem to have an internet \ connection and the local lib isn't available. Hence you cannot run this script." @@ -28,7 +28,7 @@ connection and the local lib isn't available. Hence you cannot run this script." fi elif ! [ -f /var/scripts/nextcloud-startup-script.sh ] then - curl -sfL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh -o /var/scripts/lib.sh + curl -sfL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh -o /var/scripts/lib.sh fi # shellcheck source=lib.sh diff --git a/static/history.sh b/static/history.sh index 1d33917f..f23a07cf 100644 --- a/static/history.sh +++ b/static/history.sh @@ -1,5 +1,7 @@ #!/bin/sh +# Security measure: clear .bash_history by default on login +# For more info: https://github.com/nextcloud/vm/issues/2481#issuecomment-1529175048 truncate -s0 "$HOME/.bash_history" exit 0 diff --git a/static/instruction.sh b/static/instruction.sh index 99b94368..adc38963 100644 --- a/static/instruction.sh +++ b/static/instruction.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ BIGreen='\e[1;92m' # Green IGreen='\e[0;92m' # Green @@ -17,8 +17,8 @@ echo -e "|" "${IGreen}The default sudoer password is: ${BIGreen}nextcloud${IGre cat << INST2 | | | You can find the complete install instructions here: | -| Nextcloud VM = https://bit.ly/2S8eGfS | -| Nextcloud Home/SME Server = https://bit.ly/2k2TNaM | +| Nextcloud VM = http://shortio.hanssonit.se/6xxdsHvhwe | +| Nextcloud Home/SME Server = http://shortio.hanssonit.se/LnrY5GMQYy | | | | Optional: | | If you are running Windows 10 (1809) or later, you can simply use SSH | @@ -28,7 +28,7 @@ cat << INST2 | | | This server could be made maintenance free by using automatic updates | | with the built in update script. If you want automatic updates on | -| a weekly schedule, choose to configure it later during this setup. | +| a monthly schedule, choose to configure it later during this setup. | | | | ###################### T&M Hansson IT - $(date +"%Y") ###################### | +-----------------------------------------------------------------------+ diff --git a/static/nextcloud.sh b/static/nextcloud.sh index 8fe96f55..7f35c67d 100644 --- a/static/nextcloud.sh +++ b/static/nextcloud.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ WANIP6=$(curl -s -k -m 5 -6 https://api64.ipify.org) WANIP4=$(curl -s -k -m 5 -4 https://api64.ipify.org) @@ -11,7 +11,7 @@ figlet -f small Nextcloud echo "https://www.hanssonit.se/nextcloud-vm" echo echo -echo "Hostname: $(hostname -s)" +echo "FQDN: $(hostname -f)" echo "WAN IPv4: $WANIP4" echo "WAN IPv6: $WANIP6" echo "LAN IPv4: $ADDRESS" diff --git a/static/setup_secure_permissions_nextcloud.sh b/static/setup_secure_permissions_nextcloud.sh index c4e3604b..9ffd2aae 100644 --- a/static/setup_secure_permissions_nextcloud.sh +++ b/static/setup_secure_permissions_nextcloud.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Set up Secure Permissions for Nextcloud" diff --git a/static/spamhaus-drop.sh b/static/spamhaus-drop.sh index 60af98d7..1fe0bd92 100644 --- a/static/spamhaus-drop.sh +++ b/static/spamhaus-drop.sh @@ -14,10 +14,10 @@ IPTABLES="/sbin/iptables" # list of known spammers -URLS="https://www.spamhaus.org/drop/drop.lasso https://www.spamhaus.org/drop/edrop.lasso" +URLS="https://www.spamhaus.org/drop/drop.txt https://www.spamhaus.org/drop/edrop.txt" # local cache copy -CACHE_FILE="/tmp/drop.lasso" +CACHE_FILE="/tmp/drop.txt" # iptables custom chain name CHAIN="Spamhaus" @@ -130,8 +130,8 @@ update_iptables() { fi; # iterate through all known spamming hosts - LASSOIP="$(cut -d ' ' -f1 "$CACHE_FILE" | tr -d ';' | awk 'NF > 0')" - for IP in $LASSOIP; do + SPAMIP="$(cut -d ' ' -f1 "$CACHE_FILE" | tr -d ';' | awk 'NF > 0')" + for IP in $SPAMIP; do if [ $LOG_BLOCKLIST_HITS -eq 1 ]; then # add the ip address log rule to the chain $IPTABLES -A "$CHAIN" -p 0 -s "$IP" -j LOG --log-prefix "[SPAMHAUS BLOCK]" -m limit --limit 3/min --limit-burst 10 diff --git a/static/temporary-fix-beginning.sh b/static/temporary-fix-beginning.sh index fffd8d50..8c0f9872 100644 --- a/static/temporary-fix-beginning.sh +++ b/static/temporary-fix-beginning.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Temporary Fix" diff --git a/static/temporary-fix-end.sh b/static/temporary-fix-end.sh index fffd8d50..8c0f9872 100644 --- a/static/temporary-fix-end.sh +++ b/static/temporary-fix-end.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Temporary Fix" diff --git a/static/test_connection.sh b/static/test_connection.sh index c0c48a43..adfb5b5a 100644 --- a/static/test_connection.sh +++ b/static/test_connection.sh @@ -2,7 +2,7 @@ true SCRIPT_NAME="Test Connection (old)" # shellcheck source=lib.sh -source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # This is needed since we removed this from the startup script, or changed name so it can't be downloaded anymore msg_box "You are running an outdated release. diff --git a/static/trusted.sh b/static/trusted.sh deleted file mode 100644 index be17dd98..00000000 --- a/static/trusted.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash -true -SCRIPT_NAME="Set trusted domain" -# shellcheck source=lib.sh -source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) - -# This is needed since we removed this from the startup script, or changed name so it can't be downloaded anymore -msg_box "You are running an outdated release. - -You see this message only to make it possible to run the first startup script, but as time goes, more and more will we incompatible. - -We urge you to download the latest version as soon as possible: https://github.com/nextcloud/vm/releases" diff --git a/static/trusted_domains.sh b/static/trusted_domains.sh new file mode 100644 index 00000000..35d87638 --- /dev/null +++ b/static/trusted_domains.sh @@ -0,0 +1,36 @@ +#!/bin/bash +true +SCRIPT_NAME="Set trusted domain" +# shellcheck source=lib.sh +source /var/scripts/fetch_lib.sh + +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ + +# Check for errors + debug code and abort if something isn't right +# 1 = ON +# 0 = OFF +DEBUG=0 +debug_mode + +# Set trusted domains default +if [ -n "$ADDRESS" ] +then + nextcloud_occ config:system:set trusted_domains 0 --value="localhost" + nextcloud_occ config:system:set trusted_domains 1 --value="$ADDRESS" + nextcloud_occ config:system:set trusted_domains 2 --value="$(hostname)" + nextcloud_occ config:system:set overwrite.cli.url --value="https://$(hostname --fqdn)" + # Also set WAN address if it exists + if [ -n "$WANIP4" ] + then + nextcloud_occ config:system:set trusted_domains 3 --value="$WANIP4" + fi +else + nextcloud_occ config:system:set trusted_domains 0 --value="localhost" + nextcloud_occ config:system:set trusted_domains 1 --value="$(hostname)" + nextcloud_occ config:system:set overwrite.cli.url --value="https://$(hostname --fqdn)" + # Also set WAN address if it exists + if [ -n "$WANIP4" ] + then + nextcloud_occ config:system:set trusted_domains 2 --value="$WANIP4" + fi +fi diff --git a/static/update.sh b/static/update.sh index d79c2051..f66f79f9 100644 --- a/static/update.sh +++ b/static/update.sh @@ -1,11 +1,11 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Update Server + Nextcloud" # shellcheck source=lib.sh -source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # Check for errors + debug code and abort if something isn't right # 1 = ON diff --git a/static/updatenotification.sh b/static/updatenotification.sh index 22daad92..ee43ef5d 100644 --- a/static/updatenotification.sh +++ b/static/updatenotification.sh @@ -1,6 +1,6 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ true SCRIPT_NAME="Update Notification" diff --git a/torrent/create.sh b/torrent/create.sh index 807f3ba0..03c943d7 100644 --- a/torrent/create.sh +++ b/torrent/create.sh @@ -1,17 +1,17 @@ #!/bin/bash -# T&M Hansson IT AB © - 2023, https://www.hanssonit.se/ +# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/ # GNU General Public License v3.0 -# https://github.com/nextcloud/vm/blob/master/LICENSE +# https://github.com/nextcloud/vm/blob/main/LICENSE ######### -## This doesn't seem to work in current state. -## Help is welcome! +## This script will install Transmission, download the latest version of the VM, create a torrent of the file and seed it using Transmission +## Improvments to the script are welcome! # shellcheck source=lib.sh # shellcheck disable=SC2046 -source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) +source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh) # Check for errors + debug code and abort if something isn't right # 1 = ON @@ -26,27 +26,40 @@ root_check install_if_not transmission-cli install_if_not transmission-daemon -# Download the VM -curl -fSLO --retry 3 https://download.kafit.se/s/dnkWptz8AK4JZDM/download -mv download NextcloudVM.zip -chown debian-transmission:debian-transmission NextcloudVM.zip +TRANSMISSION_DL_DIR="/var/lib/transmission-daemon/downloads" +NC_OVA="100GB_Nextcloud-VM_www.hanssonit.se.ova" +VERSION_TAG=31.0.2 +VERSION_HUB=10 + +# Modify transmission service file to fix https://github.com/transmission/transmission/issues/6991 +sed -i "s|Type=notify|Type=simple|g" /etc/systemd/system/multi-user.target.wants/transmission-daemon.service +systemctl daemon-reload + +# Check if NextcloudVM.zip already exists +if [ ! -f "$TRANSMISSION_DL_DIR"/"$NC_OVA" ] +then + # Download the VM only if it doesn't exist + curl_to_dir "https://download.kafit.se/public.php/dav/files/dnkWptz8AK4JZDM/$VERSION_TAG%20-%20HUB%20$VERSION_HUB" "$NC_OVA" "$TRANSMISSION_DL_DIR" +else + echo "$NC_OVA already exists in transmission default downloads directory, skipping download" +fi # Set more memory to sysctl -echo "net.core.rmem_max = 16777216" >> /etc/sysctl.conf -echo "net.core.wmem_max = 4194304" >> /etc/sysctl.conf -sysctl -p +#echo "net.core.rmem_max = 16777216" >> /etc/sysctl.conf +#echo "net.core.wmem_max = 4194304" >> /etc/sysctl.conf +#sysctl -p # Create torrent curl_to_dir "$GITHUB_REPO"/torrent trackers.txt /tmp -transmission-create -o nextcloudvmhanssonit.torrent -c "https://www.hanssonit.se/nextcloud-vm" -t $(cat /tmp/trackers.txt) NextcloudVM.zip +transmission-create -o $TRANSMISSION_DL_DIR/nextcloudvmhanssonit.torrent -c "https://www.hanssonit.se/nextcloud-vm VERSION: $VERSION_TAG HUB: $VERSION_HUB" -t $(cat /tmp/trackers.txt) "$TRANSMISSION_DL_DIR"/"$NC_OVA" # Seed it! -transmission-remote -n 'transmission:transmission' -a nextcloudvmhanssonit.torrent +transmission-remote -n 'transmission:transmission' --torrent="$TRANSMISSION_DL_DIR/nextcloudvmhanssonit.torrent" -a "$TRANSMISSION_DL_DIR/nextcloudvmhanssonit.torrent" --start --verify # Copy it to local NC account install_if_not rsync nextclouduser="$(input_box_flow "Please enter the Nextcloud user that you want to move the finished torrent file to:")" -rsync -av nextcloudvmhanssonit.torrent /mnt/ncdata/"$nextclouduser"/files/ +rsync -av "$TRANSMISSION_DL_DIR"/nextcloudvmhanssonit.torrent /mnt/ncdata/"$nextclouduser"/files/ chown www-data:www-data /mnt/ncdata/"$nextclouduser"/files/nextcloudvmhanssonit.torrent nextcloud_occ files:scan "$nextclouduser" unset nextclouduser diff --git a/torrent/trackers.txt b/torrent/trackers.txt index 2b3a694f..f60a2c8c 100644 --- a/torrent/trackers.txt +++ b/torrent/trackers.txt @@ -1 +1 @@ -http://atrack.pow7.com/announce -t http://bt.henbt.com:2710/announce -t http://bt.pusacg.org:8080/announce -t http://bt2.careland.com.cn:6969/announce -t http://explodie.org:6969/announce -t http://mgtracker.org:2710/announce -t http://mgtracker.org:6969/announce -t http://open.acgtracker.com:1096/announce -t http://open.lolicon.eu:7777/announce -t http://open.touki.ru/announce.php -t http://p4p.arenabg.ch:1337/announce -t http://p4p.arenabg.com:1337/announce -t http://pow7.com:80/announce -t http://retracker.gorcomnet.ru/announce -t http://retracker.krs-ix.ru/announce -t http://retracker.krs-ix.ru:80/announce -t http://secure.pow7.com/announce -t http://t1.pow7.com/announce -t http://t2.pow7.com/announce -t http://thetracker.org:80/announce -t http://torrent.gresille.org/announce -t http://torrentsmd.com:8080/announce -t http://tracker.aletorrenty.pl:2710/announce -t http://tracker.baravik.org:6970/announce -t http://tracker.bittor.pw:1337/announce -t http://tracker.bittorrent.am/announce -t http://tracker.calculate.ru:6969/announce -t http://tracker.dler.org:6969/announce -t http://tracker.dutchtracking.com/announce -t http://tracker.dutchtracking.com:80/announce -t http://tracker.dutchtracking.nl/announce -t http://tracker.dutchtracking.nl:80/announce -t http://tracker.edoardocolombo.eu:6969/announce -t http://tracker.ex.ua/announce -t http://tracker.ex.ua:80/announce -t http://tracker.filetracker.pl:8089/announce -t http://tracker.flashtorrents.org:6969/announce -t http://tracker.grepler.com:6969/announce -t http://tracker.internetwarriors.net:1337/announce -t http://tracker.kicks-ass.net/announce -t http://tracker.kicks-ass.net:80/announce -t http://tracker.kuroy.me:5944/announce -t http://tracker.mg64.net:6881/announce -t http://tracker.opentrackr.org:1337/announce -t http://tracker.skyts.net:6969/announce -t http://tracker.tfile.me/announce -t http://tracker.tiny-vps.com:6969/announce -t http://tracker.tvunderground.org.ru:3218/announce -t http://tracker.yoshi210.com:6969/announce -t http://tracker1.wasabii.com.tw:6969/announce -t http://tracker2.itzmx.com:6961/announce -t http://tracker2.wasabii.com.tw:6969/announce -t http://www.wareztorrent.com/announce -t http://www.wareztorrent.com:80/announce -t https://www.wareztorrent.com/announce -t udp://9.rarbg.com:2710/announce -t udp://9.rarbg.me:2780/announce -t udp://9.rarbg.to:2730/announce -t udp://91.218.230.81:6969/announce -t udp://94.23.183.33:6969/announce -t udp://bt.xxx-tracker.com:2710/announce -t udp://eddie4.nl:6969/announce -t udp://explodie.org:6969/announce -t udp://mgtracker.org:2710/announce -t udp://open.stealth.si:80/announce -t udp://p4p.arenabg.com:1337/announce -t udp://shadowshq.eddie4.nl:6969/announce -t udp://shadowshq.yi.org:6969/announce -t udp://torrent.gresille.org:80/announce -t udp://tracker.aletorrenty.pl:2710/announce -t udp://tracker.bittor.pw:1337/announce -t udp://tracker.coppersurfer.tk:6969/announce -t udp://tracker.eddie4.nl:6969/announce -t udp://tracker.ex.ua:80/announce -t udp://tracker.filetracker.pl:8089/announce -t udp://tracker.flashtorrents.org:6969/announce -t udp://tracker.grepler.com:6969/announce -t udp://tracker.ilibr.org:80/announce -t udp://tracker.internetwarriors.net:1337/announce -t udp://tracker.kicks-ass.net:80/announce -t udp://tracker.kuroy.me:5944/announce -t udp://tracker.leechers-paradise.org:6969/announce -t udp://tracker.mg64.net:2710/announce -t udp://tracker.mg64.net:6969/announce -t udp://tracker.opentrackr.org:1337/announce -t udp://tracker.piratepublic.com:1337/announce -t udp://tracker.sktorrent.net:6969/announce -t udp://tracker.skyts.net:6969/announce -t udp://tracker.tiny-vps.com:6969/announce -t udp://tracker.yoshi210.com:6969/announce -t udp://tracker2.indowebster.com:6969/announce -t udp://tracker4.piratux.com:6969/announce -t udp://zer0day.ch:1337/announce -t udp://zer0day.to:1337/announce +udp://tracker.opentrackr.org:1337/announce -t udp://open.demonii.com:1337/announce -t udp://open.stealth.si:80/announce -t udp://tracker.torrent.eu.org:451/announce -t udp://explodie.org:6969/announce -t udp://exodus.desync.com:6969/announce -t udp://tracker.dump.cl:6969/announce -t udp://tracker-udp.gbitt.info:80/announce -t udp://retracker01-msk-virt.corbina.net:80/announce -t udp://opentracker.io:6969/announce -t udp://open.free-tracker.ga:6969/announce -t udp://isk.richardsw.club:6969/announce -t udp://bt.ktrackers.com:6666/announce -t http://www.torrentsnipe.info:2701/announce -t http://www.genesis-sp.org:2710/announce -t http://tracker810.xyz:11450/announce -t http://tracker.xiaoduola.xyz:6969/announce -t http://tracker.vanitycore.co:6969/announce -t http://tracker.sbsub.com:2710/announce -t http://tracker.moxing.party:6969/announce \ No newline at end of file diff --git a/vagrant/README.md b/vagrant/README.md index 7ab00929..4c326f05 100644 --- a/vagrant/README.md +++ b/vagrant/README.md @@ -1,9 +1,37 @@ # Nextcloud VM with vagrant -This subrepo contains all the Vagrant config to get an Ubuntu 20.04 VM with the latest version of Nextcloud installed. +This subrepo contains all the Vagrant config to get an Ubuntu 24.04 VM with the latest version of Nextcloud installed. **Please note that this is __not__ the preferred way to install Nextcloud. It's also untested in the current state.** # Setup + +## Host setup +Running this cloud image requires you to use libvirt. +Tested working on stock Ubuntu 22.04 LTS + +1. Install `qemu-kvm`, `libvirt-daemon-system`, `bridge-utils`, `libvirt-dev` and `libvirt-clients` packages- + +Then install the vagrant libvirt plugin: `vagrant plugin install vagrant-libvirt` + +Then we need to make sure nested virtualization is initialized, as Nextcloud VM uses QEMU to run apps etc: + +Check that nested virtualization is enabled: +Intel systems: `cat /sys/module/kvm_intel/parameters/nested` +AMD systems: `/sys/module/kvm_amd/parameters/nested` + +Must return Y or 1. + +Following must be done after each reboot: +**Intel setup** +sudo modprobe -r kvm_intel +sudo modprobe kvm_intel nested=1 + +**AMD setup** +sudo modprobe -r kvm_amd +sudo modprobe kvm_amd nested=1 + + +## VM Setup `vagrant up` will install everything Go to [https://localhost:8080/](https://localhost:8080/) and access Nextcloud with credentials `ncadmin / nextcloud` @@ -14,8 +42,8 @@ Go to [https://localhost:8080/](https://localhost:8080/) and access Nextcloud wi - Clones https://github.com/nextcloud/vm - Runs `yes no | sudo bash nextcloud_install_production.sh` which uses the default values for each prompt -See https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh for default values. +See https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh for default values. # Special thanks to -@gjgd for providing https://github.com/gjgd/vagrant-nextcloud which this is based upon - +- @gjgd for providing https://github.com/gjgd/vagrant-nextcloud which this is based upon +- @celeroncool for updating it to 24.04 :) diff --git a/vagrant/Vagrantfile b/vagrant/Vagrantfile index 2e98f90e..22c963da 100644 --- a/vagrant/Vagrantfile +++ b/vagrant/Vagrantfile @@ -1,11 +1,12 @@ Vagrant.configure("2") do |config| - config.vm.box = "ubuntu/focal64" - config.vm.network "forwarded_port", guest: 443, host: 8080 + config.vagrant.plugins = "vagrant-libvirt" + config.vm.box = "cloud-image/ubuntu-24.04" + config.vm.network "forwarded_port", guest: 443, host: 8081 config.vm.provision "shell", path: "install.sh" - config.vm.provider "virtualbox" do |vb| - vb.memory = "2048" - end - config.vm.provider "vmware_desktop" do |v| - v.vmx["memsize"] = "2048" + config.vm.provider "libvirt" do |libvirt| + libvirt.memory = 4096 + libvirt.cpus = 4 + libvirt.nested = true + libvirt.cpu_mode = "host-model" end end diff --git a/vagrant/install.sh b/vagrant/install.sh index 6e4369ec..a12e76cc 100644 --- a/vagrant/install.sh +++ b/vagrant/install.sh @@ -1,12 +1,12 @@ #!/bin/bash true -SCRIPT_NAME="Install NcVM with Vagrant" -# shellcheck source=lib.sh -source /var/scripts/fetch_lib.sh -check_command git clone https://github.com/nextcloud/vm.git +# Clone this repo +git clone https://github.com/nextcloud/vm.git -cd vm || exit && print_text_in_color "$IRed" "Could not cd into the 'vm' folder." +# We need a check here due to Shellcheck +cd vm || exit +# Do the installation sudo bash nextcloud_install_production.sh --provisioning