mirror of
https://github.com/nextcloud/vm.git
synced 2025-10-26 11:27:32 +00:00
deSEC magic (#1725)
Co-authored-by: Peter Thomassen <4242683+peterthomassen@users.noreply.github.com> Co-authored-by: szaimen <szaimen@e.mail.de>
This commit is contained in:
Daniel Hansson
GitHub
parent
389324c428
commit
8083698866
110
addons/desec.sh
Normal file
110
addons/desec.sh
Normal file
@ -0,0 +1,110 @@
|
||||
#!/bin/bash
|
||||
|
||||
# T&M Hansson IT AB © - 2021, https://www.hanssonit.se/
|
||||
|
||||
true
|
||||
SCRIPT_NAME="deSEC Registration"
|
||||
SCRIPT_EXPLAINER="This script will automatically register a domain of your liking, secure it with TLS, and set it to automatically update your external IP address with DDNS."
|
||||
# shellcheck source=lib.sh
|
||||
source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh)
|
||||
|
||||
# Enter the subdomain
|
||||
msg_box "Please enter the subdomain (*example*.dedyn.io) that you want to use"
|
||||
while :
|
||||
do
|
||||
SUBDEDYN=$(input_box_flow "Please enter the subdomain (*example*.dedyn.io) that you want to use \
|
||||
The only allowed characters for the username are:
|
||||
'a-z', 'A-Z', and '0-9'")
|
||||
if [[ "$SUBDEDYN" == *" "* ]]
|
||||
then
|
||||
msg_box "Please don't use spaces."
|
||||
elif [ "${SUBDEDYN//[A-Za-z0-9]}" ]
|
||||
then
|
||||
msg_box "Allowed characters for the username are:\na-z', 'A-Z', and '0-9'\n\nPlease try again."
|
||||
else
|
||||
DEDYNDOMAIN="$SUBDEDYN.dedyn.io"
|
||||
# Check for SOA record
|
||||
if host -t SOA "$DEDYNDOMAIN" >/dev/null 2>&1
|
||||
then
|
||||
if ! yesno_box_yes "Sorry, but it seems like $DEDYNDOMAIN is taken. Do you want to try again?"
|
||||
then
|
||||
exit
|
||||
fi
|
||||
else
|
||||
break
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
### TODO, is it possible to check if the email address already exists with deSEC? In that case we could skip this whole info and replace it with a function instead.
|
||||
# Email address
|
||||
msg_box "You will now be prompted to enter an email address. It's very important that the email address you enter it a 100% valid one! deSEC will verify your email address by sending you a verification link.
|
||||
|
||||
Every 6 months you will get an email asking you to confirm your domain. If you don't react within a few weeks, your domain will be destroyed!"
|
||||
|
||||
msg_box "Please note: If you already created an account with deSEC you can't use the same email adress in this script as you won't get an email with a captcha. In that case, please use your already existing account to setup your domain at the deSEC website.
|
||||
|
||||
Another option is to use another email address in this setup, and then email the deSEC suport that you want to merge your two accounts together, or delete the first one.
|
||||
|
||||
In other words, the email address used in this script has to be uniqe, and can not be registred with deSEC since before."
|
||||
|
||||
VALIDEMAIL=$(input_box_flow "Please enter a valid email address. NOT a fake or a temporary one.")
|
||||
|
||||
msg_box "If you later want to log into your deSEC account, you need to set a login password here: https://desec.io/reset-password
|
||||
|
||||
You don't need to do this now."
|
||||
|
||||
# Register the domain
|
||||
curl -X POST https://desec.io/api/v1/auth/ \
|
||||
--header "Content-Type: application/json" --data @- <<EOF
|
||||
{
|
||||
"email": "$VALIDEMAIL",
|
||||
"password": null,
|
||||
"domain": "$DEDYNDOMAIN"
|
||||
}
|
||||
EOF
|
||||
|
||||
# Ask user to check email and confirm to get the token
|
||||
msg_box "If the registration was successful you should have got an email with your auth token.
|
||||
|
||||
Please copy that and enter it in the next box after you hit OK."
|
||||
|
||||
# Check if DEDYNAUTH is valid
|
||||
while :
|
||||
do
|
||||
DEDYNAUTHTOKEN=$(input_box_flow "Please enter your auth token (update password) for deSEC, exactly as it was displayed (use correct casing, no extra spaces).")
|
||||
if [ "$(curl -s -o /dev/null -w '%{http_code}' --header "Authorization: Token $DEDYNAUTHTOKEN" https://desec.io/api/v1/auth/account/)" -eq 401 ]
|
||||
then
|
||||
if ! yesno_box_yes "Sorry, but it seems like the auth token (update password) is incorrect. Do you want to try again?"
|
||||
then
|
||||
exit
|
||||
fi
|
||||
else
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# Ask user if DynDNS should be added to the domain
|
||||
if yesno_box_yes "Do you want to add automatic updates of your WAN IP using ddclient?
|
||||
Please note: this will reset any configuration that might be already in place with ddclient."
|
||||
then
|
||||
# Add DynDNS
|
||||
# WANIP6=$(curl -s -k -m 5 https://ipv6bot.whatismyipaddress.com)
|
||||
# curl --user "$DEDYNDOMAIN":"$DEDYNAUTHTOKEN" \
|
||||
# https://update.dedyn.io/?myipv4="$WANIP4"\&myipv6="$WANIP6" >/dev/null 2>&1
|
||||
export DEDYNDOMAIN
|
||||
export DEDYNAUTHTOKEN
|
||||
run_script NETWORK ddclient-configuration
|
||||
fi
|
||||
|
||||
# Ask if the user wants to add TLS (use script)
|
||||
if yesno_box_yes "Do you want to set this domain as your Nextcoud domain \
|
||||
and activate TLS for your Nextcloud using Let's Encrypt?"
|
||||
then
|
||||
export DEDYNDOMAIN # Not needed since already exported but added for readability
|
||||
run_script LETS_ENC activate-tls
|
||||
fi
|
||||
|
||||
# Make sure they are gone
|
||||
unset DEDYNDOMAIN
|
||||
unset DEDYNAUTHTOKEN
|
||||
@ -16,8 +16,11 @@ debug_mode
|
||||
root_check
|
||||
|
||||
# Information
|
||||
# Information
|
||||
msg_box "Before we begin the installation of your TLS certificate you need to:
|
||||
if [ -n "$DEDYNDOMAIN" ]
|
||||
then
|
||||
TLSDOMAIN="$DEDYNDOMAIN"
|
||||
else
|
||||
msg_box "Before we begin the installation of your TLS certificate you need to:
|
||||
|
||||
1. Have a domain like: cloud.example.com
|
||||
If you want to get a domain at a fair price, please check this out: https://store.binero.se/?lang=en-US
|
||||
@ -29,30 +32,31 @@ It's also possible to automatically open ports with UPNP, if you have that enabl
|
||||
PLEASE NOTE:
|
||||
This script can be run again by executing: sudo bash $SCRIPTS/menu.sh, and choose 'Server Configuration' --> 'Activate TLS'"
|
||||
|
||||
if ! yesno_box_yes "Are you sure you want to continue?"
|
||||
then
|
||||
msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \
|
||||
if ! yesno_box_yes "Are you sure you want to continue?"
|
||||
then
|
||||
msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \
|
||||
bash /var/scripts/menu.sh and choose 'Server Configuration' --> 'Activate TLS'"
|
||||
exit
|
||||
fi
|
||||
exit
|
||||
fi
|
||||
|
||||
if ! yesno_box_yes "Have you opened port 80 and 443 in your router, or are you using UPNP?"
|
||||
then
|
||||
msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \
|
||||
if ! yesno_box_yes "Have you opened port 80 and 443 in your router, or are you using UPNP?"
|
||||
then
|
||||
msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \
|
||||
bash /var/scripts/menu.sh and choose 'Server Configuration' --> 'Activate TLS'"
|
||||
exit
|
||||
fi
|
||||
exit
|
||||
fi
|
||||
|
||||
if ! yesno_box_yes "Do you have a domain that you will use?"
|
||||
then
|
||||
msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \
|
||||
if ! yesno_box_yes "Do you have a domain that you will use?"
|
||||
then
|
||||
msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \
|
||||
bash /var/scripts/menu.sh and choose 'Server Configuration' --> 'Activate TLS'"
|
||||
exit
|
||||
fi
|
||||
exit
|
||||
fi
|
||||
|
||||
# Nextcloud Main Domain (activate-tls.sh)
|
||||
TLSDOMAIN=$(input_box_flow "Please enter the domain name you will use for Nextcloud.
|
||||
# Nextcloud Main Domain (activate-tls.sh)
|
||||
TLSDOMAIN=$(input_box_flow "Please enter the domain name you will use for Nextcloud.
|
||||
Make sure it looks like this:\nyourdomain.com, or cloud.yourdomain.com")
|
||||
fi
|
||||
|
||||
msg_box "Before continuing, please make sure that you have you have edited the DNS settings for $TLSDOMAIN, \
|
||||
and opened port 80 and 443 directly to this servers IP. A full extensive guide can be found here:
|
||||
|
||||
@ -48,6 +48,7 @@ choice=$(whiptail --title "$TITLE" --checklist \
|
||||
$CHECKLIST_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
|
||||
"Static IP" "(Set static IP in Ubuntu with netplan.io)" OFF \
|
||||
"Security" "(Add extra security based on this http://goo.gl/gEJHi7)" OFF \
|
||||
"deSEC" "(Automatically get a domain from desec.io, configure ddclient and activate TLS)" ON \
|
||||
"DDclient Configuration" "(Use ddclient for automatic DDNS updates)" OFF \
|
||||
"Activate TLS" "(Enable HTTPS with Let's Encrypt)" "$ACTIVATE_TLS_SWITCH" \
|
||||
"GeoBlock" "(Only allow certain countries to access your server)" OFF \
|
||||
@ -64,35 +65,45 @@ case "$choice" in
|
||||
print_text_in_color "$ICyan" "Downloading the Security script..."
|
||||
run_script ADDONS security
|
||||
;;&
|
||||
*"deSEC"*)
|
||||
print_text_in_color "$ICyan" "Downloading the deSEC script..."
|
||||
run_script ADDONS desec
|
||||
;;&
|
||||
*"DDclient Configuration"*)
|
||||
print_text_in_color "$ICyan" "Downloading the DDclient Configuration script..."
|
||||
run_script NETWORK ddclient-configuration
|
||||
if [[ "$choice" != *"deSEC"* ]]
|
||||
then
|
||||
print_text_in_color "$ICyan" "Downloading the DDclient Configuration script..."
|
||||
run_script NETWORK ddclient-configuration
|
||||
fi
|
||||
;;&
|
||||
*"Activate TLS"*)
|
||||
SUBTITLE="Activate TLS"
|
||||
msg_box "The following script will install a trusted
|
||||
if [[ "$choice" != *"deSEC"* ]]
|
||||
then
|
||||
SUBTITLE="Activate TLS"
|
||||
msg_box "The following script will install a trusted
|
||||
TLS certificate through Let's Encrypt.
|
||||
It's recommended to use TLS (https) together with Nextcloud.
|
||||
Please open port 80 and 443 to this servers IP before you continue.
|
||||
More information can be found here:
|
||||
https://www.techandme.se/open-port-80-443/" "$SUBTITLE"
|
||||
|
||||
if yesno_box_yes "Do you want to install TLS?" "$SUBTITLE"
|
||||
then
|
||||
if [ -f $SCRIPTS/activate-tls.sh ]
|
||||
if yesno_box_yes "Do you want to install TLS?" "$SUBTITLE"
|
||||
then
|
||||
bash $SCRIPTS/activate-tls.sh
|
||||
if [ -f $SCRIPTS/activate-tls.sh ]
|
||||
then
|
||||
bash $SCRIPTS/activate-tls.sh
|
||||
else
|
||||
print_text_in_color "$ICyan" "Downloading the Let's Encrypt script..."
|
||||
download_script LETS_ENC activate-tls
|
||||
bash $SCRIPTS/activate-tls.sh
|
||||
fi
|
||||
else
|
||||
print_text_in_color "$ICyan" "Downloading the Let's Encrypt script..."
|
||||
download_script LETS_ENC activate-tls
|
||||
bash $SCRIPTS/activate-tls.sh
|
||||
msg_box "OK, but if you want to run it later, just type: sudo bash $SCRIPTS/activate-tls.sh" "$SUBTITLE"
|
||||
fi
|
||||
else
|
||||
msg_box "OK, but if you want to run it later, just type: sudo bash $SCRIPTS/activate-tls.sh" "$SUBTITLE"
|
||||
|
||||
# Just make sure it is gone
|
||||
rm -f "$SCRIPTS/test-new-config.sh"
|
||||
fi
|
||||
|
||||
# Just make sure it is gone
|
||||
rm -f "$SCRIPTS/test-new-config.sh"
|
||||
;;&
|
||||
*"GeoBlock"*)
|
||||
print_text_in_color "$ICyan" "Downloading the Geoblock script..."
|
||||
|
||||
@ -19,7 +19,10 @@ debug_mode
|
||||
root_check
|
||||
|
||||
# Check if ddclient is already installed
|
||||
if ! is_this_installed ddclient
|
||||
if [ -n "$DEDYNDOMAIN" ]
|
||||
then
|
||||
print_text_in_color "$ICyan" "Setting up ddclient for deSEC..."
|
||||
elif ! is_this_installed ddclient
|
||||
then
|
||||
# Ask for installing
|
||||
install_popup "$SCRIPT_NAME"
|
||||
@ -48,7 +51,11 @@ then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
choice=$(whiptail --title "$TITLE" --menu \
|
||||
if [ -n "$DEDYNDOMAIN" ]
|
||||
then
|
||||
choice="deSEC"
|
||||
else
|
||||
choice=$(whiptail --title "$TITLE" --menu \
|
||||
"Please choose your DynDNS-Provider.\nYou have to setup an account before you can start.\n
|
||||
If your DDNS provider isn't already supported, please open a new issue here:\n$ISSUES
|
||||
$MENU_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
|
||||
@ -57,6 +64,7 @@ $MENU_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
|
||||
"Duck DNS" "(duckdns.org)" \
|
||||
"No-IP" "(noip.com)" \
|
||||
"Strato" "(strato.de)" 3>&1 1>&2 2>&3)
|
||||
fi
|
||||
|
||||
case "$choice" in
|
||||
"Cloudflare")
|
||||
@ -107,44 +115,51 @@ case "$choice" in
|
||||
;;
|
||||
esac
|
||||
|
||||
# Instructions
|
||||
msg_box "Before you can continue, you have to access $PROVIDER and $INSTRUCTIONS.\n\nHere is a guide:\n$GUIDE"
|
||||
|
||||
# Ask if everything is prepared
|
||||
if ! yesno_box_yes "Are you ready to continue?"
|
||||
if [ -n "$DEDYNDOMAIN" ]
|
||||
then
|
||||
exit
|
||||
fi
|
||||
HOSTNAME="$DEDYNDOMAIN"
|
||||
LOGIN="$DEDYNDOMAIN"
|
||||
PASSWORD="$DEDYNAUTHTOKEN"
|
||||
else
|
||||
# Instructions
|
||||
msg_box "Before you can continue, you have to access $PROVIDER and $INSTRUCTIONS.\n\nHere is a guide:\n$GUIDE"
|
||||
|
||||
# Enter your Hostname
|
||||
HOSTNAME=$(input_box_flow "Please enter the Host that you want to configure DDNS for.\nE.g. 'example.com'")
|
||||
# Ask if everything is prepared
|
||||
if ! yesno_box_yes "Are you ready to continue?"
|
||||
then
|
||||
exit
|
||||
fi
|
||||
|
||||
# Enter your login
|
||||
LOGIN=$(input_box_flow "Please enter the login for your DDNS provider.\nIt will be most likely the domain \
|
||||
# Enter your Hostname
|
||||
HOSTNAME=$(input_box_flow "Please enter the Host that you want to configure DDNS for.\nE.g. 'example.com'")
|
||||
|
||||
# Enter your login
|
||||
LOGIN=$(input_box_flow "Please enter the login for your DDNS provider.\nIt will be most likely the domain \
|
||||
or registered email address depending on your DDNS Provider.\nE.g. 'example.com' or 'mail@example.com'
|
||||
If you are not sure, please refer to the documentation of your DDNS provider.")
|
||||
|
||||
# Enter your password
|
||||
PASSWORD=$(input_box_flow "Please enter the password or api-key that you've got for DynDNS from your DDNS provider.
|
||||
# Enter your password
|
||||
PASSWORD=$(input_box_flow "Please enter the password or api-key that you've got for DynDNS from your DDNS provider.
|
||||
If you are not sure, please refer to the documentation of your DDNS provider.")
|
||||
|
||||
# Present what we gathered
|
||||
msg_box "You will see now a list of all entered information. Please check that everything seems correct.\n
|
||||
# Present what we gathered
|
||||
msg_box "You will see now a list of all entered information. Please check that everything seems correct.\n
|
||||
Provider=$PROVIDER
|
||||
Host=$HOSTNAME
|
||||
Login=$LOGIN
|
||||
Password=$PASSWORD"
|
||||
|
||||
# If everything okay, write to file
|
||||
if ! yesno_box_yes "Do you want to proceed?"
|
||||
then
|
||||
exit
|
||||
fi
|
||||
# If everything okay, write to file
|
||||
if ! yesno_box_yes "Do you want to proceed?"
|
||||
then
|
||||
exit
|
||||
fi
|
||||
|
||||
# needed for cloudflare to work
|
||||
if [ "$PROVIDER" = "Cloudflare" ]
|
||||
then
|
||||
install_if_not libjson-any-perl
|
||||
# needed for cloudflare to work
|
||||
if [ "$PROVIDER" = "Cloudflare" ]
|
||||
then
|
||||
install_if_not libjson-any-perl
|
||||
fi
|
||||
fi
|
||||
|
||||
# Write information to ddclient.conf
|
||||
|
||||
Loading…
Reference in New Issue
Block a user