|
|
@@ -0,0 +1,164 @@
|
|
|
+#!/bin/bash
|
|
|
+
|
|
|
+set -eux
|
|
|
+
|
|
|
+if [[ ! -f /app/data/synapse/homeserver.yaml ]]; then
|
|
|
+ echo "=> Detected first run"
|
|
|
+
|
|
|
+ # create dirs (for whatever reason the nginx dir couldn't get created by nginx)
|
|
|
+ mkdir -p /app/data/synapse \
|
|
|
+ /app/data/nginx/fastcgi \
|
|
|
+ /run/nginx_log \
|
|
|
+ /run/synapse \
|
|
|
+ /run/turn_log \
|
|
|
+ /app/data/appservice/config /app/data/appservice/db
|
|
|
+
|
|
|
+ # copy matrix-appservice-webhooks config
|
|
|
+# cp /app/code/matrix-appservice-webhooks/config/sample.yaml /app/data/appservice/config/config.yaml
|
|
|
+# ln -sf /app/data/appservice/appservice-registration-webhooks.yaml /app/data/synapse/appservice-registration-webhooks.yaml
|
|
|
+
|
|
|
+ # create certs
|
|
|
+ openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out /app/data/synapse/${APP_DOMAIN}.tls.crt -keyout /app/data/synapse/${APP_DOMAIN}.tls.key -subj "/C=DE/ST=Germany/L=Germany/O=Example/OU=Example/CN=${APP_DOMAIN}"
|
|
|
+
|
|
|
+ # fix permissions
|
|
|
+ chown -R www-data.www-data /run/synapse \
|
|
|
+ /run/turn_log \
|
|
|
+ /app/data
|
|
|
+
|
|
|
+ # copy turn config
|
|
|
+ cp /usr/share/coturn/examples/etc/turnserver.conf /app/data/turnserver.conf
|
|
|
+
|
|
|
+ # copy email templates for matrix
|
|
|
+ cp -r /app/code/synapse/synapse/res/templates /app/data/templates
|
|
|
+
|
|
|
+ # set default TURN listening port
|
|
|
+ if [ -z ${TURN_TLS_PORT+x} ]; then TURN_TLS_PORT="3478"; else echo "TURN_TLS_PORT is set to '$TURN_TLS_PORT'"; fi
|
|
|
+
|
|
|
+ cd /app/data/synapse
|
|
|
+ python3 -m synapse.app.homeserver \
|
|
|
+ --server-name ${APP_DOMAIN} \
|
|
|
+ --config-path homeserver.yaml \
|
|
|
+ --report-stats=no \
|
|
|
+ --generate-config
|
|
|
+
|
|
|
+ # synapse config
|
|
|
+ sed -i "s/server_name:.*/server_name: ${APP_DOMAIN}/" homeserver.yaml
|
|
|
+ sed -i "s/#public_baseurl:.*/public_baseurl: https:\/\/${APP_DOMAIN}/" homeserver.yaml
|
|
|
+ sed -i "s/web_client:.*/web_client: False/" homeserver.yaml
|
|
|
+ sed -i "s/bind_addresses: \['::1'.*/bind_addresses: \['0.0.0.0'\]/" homeserver.yaml
|
|
|
+ sed -i "s/sqlite3/psycopg2/" homeserver.yaml
|
|
|
+ sed -i "s/ database: .*/ user: ${POSTGRESQL_USERNAME}\n password: ${POSTGRESQL_PASSWORD}\n database: ${POSTGRESQL_DATABASE}\n host: ${POSTGRESQL_HOST}\n cp_min: 5\n cp_max: 10/" homeserver.yaml
|
|
|
+ sed -i "s/#enable_registration:.*/enable_registration: True/" homeserver.yaml
|
|
|
+ sed -i "s/#password_providers:/password_providers:/" homeserver.yaml
|
|
|
+ sed -i 's/# - module: "ldap_auth_provider.LdapAuthProvider"/ - module: "ldap_auth_provider.LdapAuthProvider"/' homeserver.yaml
|
|
|
+ sed -i 's/# config:/ config:/' homeserver.yaml
|
|
|
+ sed -i 's/# enabled: true/ enabled: true/' homeserver.yaml
|
|
|
+ sed -i "s,# uri: .*, uri: \"${LDAP_URL}\"," homeserver.yaml
|
|
|
+ sed -i 's/# start_tls: true/ start_tls: false/' homeserver.yaml
|
|
|
+ sed -i 's/# base: "ou=users,dc=example,dc=com"/ base: "ou=users,dc=cloudron"/' homeserver.yaml
|
|
|
+ sed -i 's/# attributes:/ attributes:/' homeserver.yaml
|
|
|
+ sed -i 's/# uid: "cn"/ uid: "username"/' homeserver.yaml
|
|
|
+ sed -i 's/# mail: "email"/ mail: "mail"/' homeserver.yaml
|
|
|
+ sed -i 's/# name: "givenName"/ name: "username"/' homeserver.yaml
|
|
|
+ sed -i 's/#max_upload_size:.*/max_upload_size: "100M"/' homeserver.yaml
|
|
|
+ sed -i 's/#auto_join_rooms:/auto_join_rooms:/' homeserver.yaml
|
|
|
+ sed -i 's/# - "#example:example.com"/ - "#example:example.com"/' homeserver.yaml
|
|
|
+ sed -i "s/example:example.com/discuss:${APP_DOMAIN}/" homeserver.yaml
|
|
|
+ sed -i "s/turn_allow_guests:.*/turn_allow_guests: False/" homeserver.yaml
|
|
|
+ sed -i "s/enable_group_creation:.*/enable_group_creation: True/" homeserver.yaml
|
|
|
+ sed -i "s/enable_group_creation:.*/enable_group_creation: True/" homeserver.yaml
|
|
|
+ sed -i "s/#url_preview_enabled:.*/url_preview_enabled: true/" homeserver.yaml
|
|
|
+ sed -i "s/#url_preview_ip_range_blacklist.*/url_preview_ip_range_blacklist:\n - '127.0.0.0\/8'\n - '10.0.0.0\/8'/" homeserver.yaml
|
|
|
+
|
|
|
+ sed -i "s/## Server ##/## Server ##\n\nno_tls: True/" homeserver.yaml
|
|
|
+
|
|
|
+ # also enable the tls port, not quite sure why this is needed, but without it, no integratiosn are possible
|
|
|
+ #sed -i "s/#- port: 8448/- port: 8448/" homeserver.yaml
|
|
|
+ #sed -i "s/# type: http/ type: http/" homeserver.yaml
|
|
|
+ #sed -i "s/# tls: true/ tls: true/" homeserver.yaml
|
|
|
+ #sed -i "s/# resources:/ resources:/" homeserver.yaml
|
|
|
+ #sed -i "s/# - names: \[client, federation\]/ - names: \[client, federation\]/" homeserver.yaml
|
|
|
+ #sed -i "s/#tls_certificate_path:/tls_certificate_path:/" homeserver.yaml
|
|
|
+ #sed -i "s/#tls_private_key_path:/tls_private_key_path:/" homeserver.yaml
|
|
|
+
|
|
|
+
|
|
|
+ # get synapse log name and set path
|
|
|
+ LOG_CONFIG=$(ls *.log.config)
|
|
|
+ sed -i "s/log_file: .*/log_file: \"\/run\/synapse\/homeserver.log\"/" homeserver.yaml
|
|
|
+ sed -i "s/ filename:.*/ filename: \/run\/synapse\/homeserver.log/" ${LOG_CONFIG}
|
|
|
+
|
|
|
+
|
|
|
+ # coturn
|
|
|
+ TURNPWD=$(pwgen -s 64 1)
|
|
|
+ sed -i "s/#tls-listening-port=5349/tls-listening-port=3478/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#realm=mycompany.org/realm=${APP_DOMAIN}/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#lt-cred-mech/lt-cred-mech/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#use-auth-secret/use-auth-secret/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#lt-cred-mech/lt-cred-mech/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#static-auth-secret=.*/static-auth-secret=${TURNPWD}/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#turn_uris: .*/turn_uris: [\"turn:${APP_DOMAIN}:${TURN_TLS_PORT}?transport=udp\", \"turn:${APP_DOMAIN}:${TURN_TLS_PORT}?transport=tcp\"]/" homeserver.yaml
|
|
|
+ sed -i "s/#turn_shared_secret: .*/turn_shared_secret: \"${TURNPWD}\"/" homeserver.yaml
|
|
|
+ sed -i "s/#cipher-list=.*/cipher-list=\"HIGH\"/" /app/data/turnserver.conf
|
|
|
+ sed -i "s/#log-file=.*/log-file=\/run\/turn_log\/turn.log/" /app/data/turnserver.conf
|
|
|
+
|
|
|
+
|
|
|
+ # get cert names from synapse
|
|
|
+ TLS_CRT=$(ls *.tls.crt)
|
|
|
+ TLS_KEY=$(ls *.tls.key)
|
|
|
+ #TLS_DH=$(ls *.tls.dh)
|
|
|
+ sed -i "s,#cert=.*,cert=/app/data/synapse/${TLS_CRT}," /app/data/turnserver.conf
|
|
|
+ sed -i "s,#pkey=.*,pkey=/app/data/synapse/${TLS_KEY}," /app/data/turnserver.conf
|
|
|
+ #sed -i "s,#dh-file=.*,dh-file=/app/data/synapse/${TLS_DH}," /app/data/turnserver.conf
|
|
|
+
|
|
|
+ # set up email
|
|
|
+ sed -i 's/#email:/email:/' homeserver.yaml
|
|
|
+ sed -i 's/# enable_notifs: false/ enable_notifs: true/' homeserver.yaml
|
|
|
+ sed -i 's/# smtp_host: \"localhost\"/ smtp_host: \"${MAIL_SMTP_SERVER}\"/' homeserver.yaml
|
|
|
+ sed -i 's/# smtp_port: .*/ smtp_port: ${MAIL_SMTP_PORT}/' homeserver.yaml
|
|
|
+ sed -i 's/# smtp_user: \"exampleusername\"/ smtp_user: \"${MAIL_SMTP_USERNAME}\"/' homeserver.yaml
|
|
|
+ sed -i 's/# smtp_pass: \"examplepassword\"/ smtp_pass: \"${MAIL_SMTP_PASSWORD}\"/' homeserver.yaml
|
|
|
+ sed -i 's/# require_transport_security: False/ require_transport_security: false/' homeserver.yaml
|
|
|
+ sed -i "s/# notif_from: .*/ notif_from: \"Your Friendly Matrix Home Server <${MAIL_FROM}>\"/" homeserver.yaml
|
|
|
+ sed -i 's/# app_name: Matrix/ app_name: Matrix/' homeserver.yaml
|
|
|
+ sed -i 's/# notif_template_html: .*/ notif_template_html: notif_mail.html/' homeserver.yaml
|
|
|
+ sed -i 's/# notif_template_text: .*/ notif_template_text: notif_mail.txt/' homeserver.yaml
|
|
|
+ sed -i 's/# notif_for_new_users: True/ notif_for_new_users: True/' homeserver.yaml
|
|
|
+
|
|
|
+ sed -i "s,#tls_fingerprints:.*,tls_fingerprints: [{sha256: \"${TLS_FINGERPRINT}\"}]," homeserver.yaml
|
|
|
+
|
|
|
+
|
|
|
+fi
|
|
|
+
|
|
|
+# logs
|
|
|
+mkdir -p /run/nginx_log /run/synapse /run/turn_log
|
|
|
+
|
|
|
+# fix permissions
|
|
|
+chown -R www-data.www-data /run/synapse /run/turn_log /app/data
|
|
|
+cd /app/data/synapse
|
|
|
+
|
|
|
+# check if TURN port has changed and update it
|
|
|
+if [ -z ${TURN_TLS_PORT+x} ]; then TURN_TLS_PORT="3478"; fi
|
|
|
+sed -i "s/turn_uris: .*/turn_uris: [\"turn:${APP_DOMAIN}:${TURN_TLS_PORT}?transport=udp\", \"turn:${APP_DOMAIN}:${TURN_TLS_PORT}?transport=tcp\"]/" homeserver.yaml
|
|
|
+sed -i "s/tls-listening-port=.*/tls-listening-port=${TURN_TLS_PORT}/" /app/data/turnserver.conf
|
|
|
+
|
|
|
+# check if certificate changed and update fingerprint
|
|
|
+TLS_FINGERPRINT=$(openssl s_client -connect ${APP_DOMAIN}:${TURN_TLS_PORT} < /dev/null 2> /dev/null | openssl x509 -outform DER | openssl sha256 -binary | base64 | tr -d '=')
|
|
|
+sed -i "s,^tls_fingerprints:.*,tls_fingerprints: [{sha256: \"${TLS_FINGERPRINT}\"}]," homeserver.yaml
|
|
|
+
|
|
|
+gosu www-data turnserver -c /app/data/turnserver.conf --daemon -v
|
|
|
+
|
|
|
+# update user and pass in case they changed
|
|
|
+sed -i "s/ user: .*/ user: ${POSTGRESQL_USERNAME}/" homeserver.yaml
|
|
|
+sed -i "s/ password: .*/ password: ${POSTGRESQL_PASSWORD}/" homeserver.yaml
|
|
|
+sed -i "s/ database: .*/ database: ${POSTGRESQL_DATABASE}/" homeserver.yaml
|
|
|
+sed -i "s, uri: .*, uri: \"${LDAP_URL}\"," homeserver.yaml
|
|
|
+
|
|
|
+#update email settings in case they changed
|
|
|
+sed -i "s/ smtp_host:.*/ smtp_host: \"${MAIL_SMTP_SERVER}\"/" homeserver.yaml
|
|
|
+sed -i "s/ smtp_port:.*/ smtp_port: ${MAIL_SMTP_PORT}/" homeserver.yaml
|
|
|
+sed -i "s/ smtp_user:.*/ smtp_user: \"${MAIL_SMTP_USERNAME}\"/" homeserver.yaml
|
|
|
+sed -i "s/ smtp_pass:.*/ smtp_pass: \"${MAIL_SMTP_PASSWORD}\"/" homeserver.yaml
|
|
|
+
|
|
|
+gosu www-data python3 -m synapse.app.homeserver --config-path homeserver.yaml &> /dev/null &
|
|
|
+
|
|
|
+exec /usr/sbin/nginx -g 'daemon off;'
|
Jannick Knudsen
5 rokov pred
