diff --git a/addons/desec.sh b/addons/desec.sh new file mode 100644 index 00000000..b606187a --- /dev/null +++ b/addons/desec.sh @@ -0,0 +1,110 @@ +#!/bin/bash + +# T&M Hansson IT AB © - 2021, https://www.hanssonit.se/ + +true +SCRIPT_NAME="deSEC Registration" +SCRIPT_EXPLAINER="This script will automatically register a domain of your liking, secure it with TLS, and set it to automatically update your external IP address with DDNS." +# shellcheck source=lib.sh +source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh) + +# Enter the subdomain +msg_box "Please enter the subdomain (*example*.dedyn.io) that you want to use" +while : +do + SUBDEDYN=$(input_box_flow "Please enter the subdomain (*example*.dedyn.io) that you want to use \ +The only allowed characters for the username are: +'a-z', 'A-Z', and '0-9'") + if [[ "$SUBDEDYN" == *" "* ]] + then + msg_box "Please don't use spaces." + elif [ "${SUBDEDYN//[A-Za-z0-9]}" ] + then + msg_box "Allowed characters for the username are:\na-z', 'A-Z', and '0-9'\n\nPlease try again." + else + DEDYNDOMAIN="$SUBDEDYN.dedyn.io" + # Check for SOA record + if host -t SOA "$DEDYNDOMAIN" >/dev/null 2>&1 + then + if ! yesno_box_yes "Sorry, but it seems like $DEDYNDOMAIN is taken. Do you want to try again?" + then + exit + fi + else + break + fi + fi +done + +### TODO, is it possible to check if the email address already exists with deSEC? In that case we could skip this whole info and replace it with a function instead. +# Email address +msg_box "You will now be prompted to enter an email address. It's very important that the email address you enter it a 100% valid one! deSEC will verify your email address by sending you a verification link. + +Every 6 months you will get an email asking you to confirm your domain. If you don't react within a few weeks, your domain will be destroyed!" + +msg_box "Please note: If you already created an account with deSEC you can't use the same email adress in this script as you won't get an email with a captcha. In that case, please use your already existing account to setup your domain at the deSEC website. + +Another option is to use another email address in this setup, and then email the deSEC suport that you want to merge your two accounts together, or delete the first one. + +In other words, the email address used in this script has to be uniqe, and can not be registred with deSEC since before." + +VALIDEMAIL=$(input_box_flow "Please enter a valid email address. NOT a fake or a temporary one.") + +msg_box "If you later want to log into your deSEC account, you need to set a login password here: https://desec.io/reset-password + +You don't need to do this now." + +# Register the domain +curl -X POST https://desec.io/api/v1/auth/ \ + --header "Content-Type: application/json" --data @- </dev/null 2>&1 + export DEDYNDOMAIN + export DEDYNAUTHTOKEN + run_script NETWORK ddclient-configuration +fi + +# Ask if the user wants to add TLS (use script) +if yesno_box_yes "Do you want to set this domain as your Nextcoud domain \ +and activate TLS for your Nextcloud using Let's Encrypt?" +then + export DEDYNDOMAIN # Not needed since already exported but added for readability + run_script LETS_ENC activate-tls +fi + +# Make sure they are gone +unset DEDYNDOMAIN +unset DEDYNAUTHTOKEN diff --git a/lets-encrypt/activate-tls.sh b/lets-encrypt/activate-tls.sh index 8bb57dca..f548cfdf 100644 --- a/lets-encrypt/activate-tls.sh +++ b/lets-encrypt/activate-tls.sh @@ -16,8 +16,11 @@ debug_mode root_check # Information -# Information -msg_box "Before we begin the installation of your TLS certificate you need to: +if [ -n "$DEDYNDOMAIN" ] +then + TLSDOMAIN="$DEDYNDOMAIN" +else + msg_box "Before we begin the installation of your TLS certificate you need to: 1. Have a domain like: cloud.example.com If you want to get a domain at a fair price, please check this out: https://store.binero.se/?lang=en-US @@ -29,30 +32,31 @@ It's also possible to automatically open ports with UPNP, if you have that enabl PLEASE NOTE: This script can be run again by executing: sudo bash $SCRIPTS/menu.sh, and choose 'Server Configuration' --> 'Activate TLS'" -if ! yesno_box_yes "Are you sure you want to continue?" -then - msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \ + if ! yesno_box_yes "Are you sure you want to continue?" + then + msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \ bash /var/scripts/menu.sh and choose 'Server Configuration' --> 'Activate TLS'" - exit -fi + exit + fi -if ! yesno_box_yes "Have you opened port 80 and 443 in your router, or are you using UPNP?" -then - msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \ + if ! yesno_box_yes "Have you opened port 80 and 443 in your router, or are you using UPNP?" + then + msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \ bash /var/scripts/menu.sh and choose 'Server Configuration' --> 'Activate TLS'" - exit -fi + exit + fi -if ! yesno_box_yes "Do you have a domain that you will use?" -then - msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \ + if ! yesno_box_yes "Do you have a domain that you will use?" + then + msg_box "OK, but if you want to run this script later, just execute this in your CLI: sudo \ bash /var/scripts/menu.sh and choose 'Server Configuration' --> 'Activate TLS'" - exit -fi + exit + fi -# Nextcloud Main Domain (activate-tls.sh) -TLSDOMAIN=$(input_box_flow "Please enter the domain name you will use for Nextcloud. + # Nextcloud Main Domain (activate-tls.sh) + TLSDOMAIN=$(input_box_flow "Please enter the domain name you will use for Nextcloud. Make sure it looks like this:\nyourdomain.com, or cloud.yourdomain.com") +fi msg_box "Before continuing, please make sure that you have you have edited the DNS settings for $TLSDOMAIN, \ and opened port 80 and 443 directly to this servers IP. A full extensive guide can be found here: diff --git a/menu/server_configuration.sh b/menu/server_configuration.sh index b2fd8c11..71227bbd 100644 --- a/menu/server_configuration.sh +++ b/menu/server_configuration.sh @@ -48,6 +48,7 @@ choice=$(whiptail --title "$TITLE" --checklist \ $CHECKLIST_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ "Static IP" "(Set static IP in Ubuntu with netplan.io)" OFF \ "Security" "(Add extra security based on this http://goo.gl/gEJHi7)" OFF \ +"deSEC" "(Automatically get a domain from desec.io, configure ddclient and activate TLS)" ON \ "DDclient Configuration" "(Use ddclient for automatic DDNS updates)" OFF \ "Activate TLS" "(Enable HTTPS with Let's Encrypt)" "$ACTIVATE_TLS_SWITCH" \ "GeoBlock" "(Only allow certain countries to access your server)" OFF \ @@ -64,35 +65,45 @@ case "$choice" in print_text_in_color "$ICyan" "Downloading the Security script..." run_script ADDONS security ;;& + *"deSEC"*) + print_text_in_color "$ICyan" "Downloading the deSEC script..." + run_script ADDONS desec + ;;& *"DDclient Configuration"*) - print_text_in_color "$ICyan" "Downloading the DDclient Configuration script..." - run_script NETWORK ddclient-configuration + if [[ "$choice" != *"deSEC"* ]] + then + print_text_in_color "$ICyan" "Downloading the DDclient Configuration script..." + run_script NETWORK ddclient-configuration + fi ;;& *"Activate TLS"*) - SUBTITLE="Activate TLS" - msg_box "The following script will install a trusted + if [[ "$choice" != *"deSEC"* ]] + then + SUBTITLE="Activate TLS" + msg_box "The following script will install a trusted TLS certificate through Let's Encrypt. It's recommended to use TLS (https) together with Nextcloud. Please open port 80 and 443 to this servers IP before you continue. More information can be found here: https://www.techandme.se/open-port-80-443/" "$SUBTITLE" - if yesno_box_yes "Do you want to install TLS?" "$SUBTITLE" - then - if [ -f $SCRIPTS/activate-tls.sh ] + if yesno_box_yes "Do you want to install TLS?" "$SUBTITLE" then - bash $SCRIPTS/activate-tls.sh + if [ -f $SCRIPTS/activate-tls.sh ] + then + bash $SCRIPTS/activate-tls.sh + else + print_text_in_color "$ICyan" "Downloading the Let's Encrypt script..." + download_script LETS_ENC activate-tls + bash $SCRIPTS/activate-tls.sh + fi else - print_text_in_color "$ICyan" "Downloading the Let's Encrypt script..." - download_script LETS_ENC activate-tls - bash $SCRIPTS/activate-tls.sh + msg_box "OK, but if you want to run it later, just type: sudo bash $SCRIPTS/activate-tls.sh" "$SUBTITLE" fi - else - msg_box "OK, but if you want to run it later, just type: sudo bash $SCRIPTS/activate-tls.sh" "$SUBTITLE" + + # Just make sure it is gone + rm -f "$SCRIPTS/test-new-config.sh" fi - - # Just make sure it is gone - rm -f "$SCRIPTS/test-new-config.sh" ;;& *"GeoBlock"*) print_text_in_color "$ICyan" "Downloading the Geoblock script..." diff --git a/network/ddclient-configuration.sh b/network/ddclient-configuration.sh index 0fca1673..fbfbbcff 100644 --- a/network/ddclient-configuration.sh +++ b/network/ddclient-configuration.sh @@ -19,7 +19,10 @@ debug_mode root_check # Check if ddclient is already installed -if ! is_this_installed ddclient +if [ -n "$DEDYNDOMAIN" ] +then + print_text_in_color "$ICyan" "Setting up ddclient for deSEC..." +elif ! is_this_installed ddclient then # Ask for installing install_popup "$SCRIPT_NAME" @@ -48,7 +51,11 @@ then exit 1 fi -choice=$(whiptail --title "$TITLE" --menu \ +if [ -n "$DEDYNDOMAIN" ] +then + choice="deSEC" +else + choice=$(whiptail --title "$TITLE" --menu \ "Please choose your DynDNS-Provider.\nYou have to setup an account before you can start.\n If your DDNS provider isn't already supported, please open a new issue here:\n$ISSUES $MENU_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ @@ -57,6 +64,7 @@ $MENU_GUIDE\n\n$RUN_LATER_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \ "Duck DNS" "(duckdns.org)" \ "No-IP" "(noip.com)" \ "Strato" "(strato.de)" 3>&1 1>&2 2>&3) +fi case "$choice" in "Cloudflare") @@ -107,44 +115,51 @@ case "$choice" in ;; esac -# Instructions -msg_box "Before you can continue, you have to access $PROVIDER and $INSTRUCTIONS.\n\nHere is a guide:\n$GUIDE" - -# Ask if everything is prepared -if ! yesno_box_yes "Are you ready to continue?" +if [ -n "$DEDYNDOMAIN" ] then - exit -fi + HOSTNAME="$DEDYNDOMAIN" + LOGIN="$DEDYNDOMAIN" + PASSWORD="$DEDYNAUTHTOKEN" +else + # Instructions + msg_box "Before you can continue, you have to access $PROVIDER and $INSTRUCTIONS.\n\nHere is a guide:\n$GUIDE" -# Enter your Hostname -HOSTNAME=$(input_box_flow "Please enter the Host that you want to configure DDNS for.\nE.g. 'example.com'") + # Ask if everything is prepared + if ! yesno_box_yes "Are you ready to continue?" + then + exit + fi -# Enter your login -LOGIN=$(input_box_flow "Please enter the login for your DDNS provider.\nIt will be most likely the domain \ + # Enter your Hostname + HOSTNAME=$(input_box_flow "Please enter the Host that you want to configure DDNS for.\nE.g. 'example.com'") + + # Enter your login + LOGIN=$(input_box_flow "Please enter the login for your DDNS provider.\nIt will be most likely the domain \ or registered email address depending on your DDNS Provider.\nE.g. 'example.com' or 'mail@example.com' If you are not sure, please refer to the documentation of your DDNS provider.") -# Enter your password -PASSWORD=$(input_box_flow "Please enter the password or api-key that you've got for DynDNS from your DDNS provider. + # Enter your password + PASSWORD=$(input_box_flow "Please enter the password or api-key that you've got for DynDNS from your DDNS provider. If you are not sure, please refer to the documentation of your DDNS provider.") -# Present what we gathered -msg_box "You will see now a list of all entered information. Please check that everything seems correct.\n + # Present what we gathered + msg_box "You will see now a list of all entered information. Please check that everything seems correct.\n Provider=$PROVIDER Host=$HOSTNAME Login=$LOGIN Password=$PASSWORD" -# If everything okay, write to file -if ! yesno_box_yes "Do you want to proceed?" -then - exit -fi + # If everything okay, write to file + if ! yesno_box_yes "Do you want to proceed?" + then + exit + fi -# needed for cloudflare to work -if [ "$PROVIDER" = "Cloudflare" ] -then - install_if_not libjson-any-perl + # needed for cloudflare to work + if [ "$PROVIDER" = "Cloudflare" ] + then + install_if_not libjson-any-perl + fi fi # Write information to ddclient.conf