diff --git a/doc/EN/index.org b/doc/EN/index.org index 893757a5..f48edf86 100644 --- a/doc/EN/index.org +++ b/doc/EN/index.org @@ -45,7 +45,7 @@ After installation it's possible that you might want some advice on how to run y If you find bugs, or want to add a new app to this system see the [[./devguide.html][Developers Guide]]. -Ready made disk images which can be copied onto USB or microSD drives are [[./downloads/v3][available here]. +Ready made disk images which can be copied onto USB or microSD drives are [[./downloads/current][available here]]. #+BEGIN_CENTER This site can also be accessed via a Tor browser at http://pazyv7nkllp76hqr.onion. This documentation is under the [[https://www.gnu.org/licenses/fdl-1.3.txt][GNU Free Documentation License version 1.3]] diff --git a/doc/EN/mesh.org b/doc/EN/mesh.org index 9054839c..e8667b1f 100644 --- a/doc/EN/mesh.org +++ b/doc/EN/mesh.org @@ -54,6 +54,7 @@ The Freedombone mesh roughly follows MondoNet's ten social specifications: - Voice chat (VoIP) and video calls - Private and public sharing of files - Blogging + - Collaborative editing of documents and presentations - Creating and broadcasting audio media/podcasts - Social network stream. Follow/unfollow other peers - No network administration required @@ -97,7 +98,7 @@ wget https://freedombone.net/downloads/current/freedombone-meshclient-i386.img.x wget https://freedombone.net/downloads/current/freedombone-meshclient-i386.img.xz.sig gpg --verify freedombone-meshclient-i386.img.xz.sig sha256sum freedombone-meshclient-i386.img.xz -995dd64538f46f6abf83ba258cca6cb82a72399cb9a099caeafc1de947ef795c +61e474afae14774d7aa479b6727fd5e77bdc1854e547b3c5b630bf10542a9581 unxz freedombone-meshclient-i386.img.xz sudo dd if=/dev/zero of=/dev/sdX bs=1M count=8 sudo dd bs=1M if=freedombone-meshclient-i386.img of=/dev/sdX conv=fdatasync @@ -113,7 +114,7 @@ wget https://freedombone.net/downloads/current/freedombone-meshclient-insecure-i wget https://freedombone.net/downloads/current/freedombone-meshclient-insecure-i386.img.xz.sig gpg --verify freedombone-meshclient-insecure-i386.img.xz.sig sha256sum freedombone-meshclient-insecure-i386.img.xz -b06e6ff5e56577025e6b994fe0bb28f02da7d2905ac32a2f38d7d074ffe801fc +fec843303d7d280859f75f7a8edccd70512915a34d4cc0787b5de7d8fbde5c81 unxz freedombone-meshclient-insecure-i386.img.xz sudo dd if=/dev/zero of=/dev/sdX bs=1M count=8 sudo dd bs=1M if=freedombone-meshclient-insecure-i386.img of=/dev/sdX conv=fdatasync @@ -154,7 +155,7 @@ wget https://freedombone.net/downloads/current/freedombone.tar.gz wget https://freedombone.net/downloads/current/freedombone.tar.gz.sig gpg --verify freedombone.tar.gz.sig sha256sum freedombone.tar.gz -fd0b3fe1527de893f4ece7ffe95fdf0c41e635a3f82d22a51b707c1aee541e88 +e2715e27b142a21fa257eab15778ddc96f86fda70f8d91d47c4c9aa19f22e272 tar -xzvf freedombone.tar.gz cd freedombone git checkout stretch @@ -241,27 +242,17 @@ sudo openvpn myclient.ovpn Where /myclient.ovpn/ comes from your VPN provider and with the password "/freedombone/". ** Connecting two meshes over the internet via a VPN tunnel -Maybe the internet exists, but you don't care about getting any content from it and just want to use it as a way to connect mesh networks from different geographical locations together. VPN configuration, pem and stunnel files exist within the home directory. Edit the configuration with: +Maybe the internet exists, but you don't care about getting any content from it and just want to use it as a way to connect mesh networks from different geographical locations together. -#+begin_src bash -nano ~/client.ovpn -#+end_src +In your home directory on a system connected via ethernet to an internet router you'll find a file called *vpn.tar.gz*. If you want another mesh to be able to connect to yours then send them this file and get them to uncompress it into their home directory also on an internet gateway machine. If they have an external IP address or domain name for your router then they will be able to VPN connect using the *Connect Meshes* icon. They should also forward port 653 from their internet router to the mesh gateway machine. -Edit the IP address or domain for the mesh that you wish to connect to within the /route/ command: +#+BEGIN_CENTER +[[file:images/mesh_connect.jpg]] +#+END_CENTER -#+begin_src bash -route [mesh IP or domain] 255.255.255.255 net_gateway -#+end_src +You should create a new *vpn.tar.gz* file for every other mesh which wants to be able to connect to yours. If you are prompted for a password it is 'freedombone'. -Then you can connect to the other mesh with: - -#+begin_src bash -cd /home/fbone -sudo stunnel stunnel-client.conf -sudo openvpn client.ovpn -#+end_src - -Using the password "/freedombone/". From a deep packet inspection point of view the traffic going over the internet will just look like any other TLS connection to a server. +From a deep packet inspection point of view the traffic going over the internet between mesh gateways will just look like any other TLS connection to a server. ** Mobile devices (phones, etc) To allow mobile devices to connect to the mesh you will need a second wifi adapter connected to your laptop/netbook/SBC. Plug in a second wifi adapter then reboot the system. The second adaptor will then create a wifi hotspot which mobile devices can connect to. The hotspot name also contains its local IP address (eg. "/mesh-192.168.1.83/"). @@ -303,6 +294,21 @@ One important point is that by default the microphone is turned off. When doing At present video doesn't work reliably, but text and voice chat do work well. +** Collaborative document editing +The mesh system includes the ability to collaboratively edit various sorts of documents using CryptPad. CryptPad is an almost peer-to-peer system in that it is designed for a client/server environment but that the server aspect of it is very minimal and limited to orchestrating the connected clients. With CryptPad installed on each mesh peer it effectively enables peer-to-peer collaborative editing. Documents are ephemeral and forgotten unless they're exported or copy-pasted to permanent storage. + +#+BEGIN_CENTER +[[file:images/mesh_cryptpad1.jpg]] +#+END_CENTER + +To create a document click on the CryptPad icon. Depending upon the specifications of your system it may take a few seconds to load, so don't be too disturned if the browser contents look blank for a while. Select _Rich Text Pad_ and give yourself a username. + +#+BEGIN_CENTER +[[file:images/mesh_cryptpad2.jpg]] +#+END_CENTER + +If you have the chat system running you can then copy and paste the URL for your pad into the chat, and the other user can then open the link and edit the document with you. You can repeat that for however many other users you wish to be able to edit. + ** Social Network Patchwork is available as a social networking system for the mesh. Like all social network systems it has a stream of posts and you can follow or unfollow other users. You can also send private messages to other users with end-to-end encryption. diff --git a/img/avatars/connect.jpg b/img/avatars/connect.jpg new file mode 100644 index 00000000..c68690da Binary files /dev/null and b/img/avatars/connect.jpg differ diff --git a/img/icon_cryptpad.png b/img/icon_cryptpad.png new file mode 100644 index 00000000..9f7714fe Binary files /dev/null and b/img/icon_cryptpad.png differ diff --git a/img/mesh_connect.jpg b/img/mesh_connect.jpg new file mode 100644 index 00000000..2db3f497 Binary files /dev/null and b/img/mesh_connect.jpg differ diff --git a/img/mesh_cryptpad1.jpg b/img/mesh_cryptpad1.jpg new file mode 100644 index 00000000..5c6984c4 Binary files /dev/null and b/img/mesh_cryptpad1.jpg differ diff --git a/img/mesh_cryptpad2.jpg b/img/mesh_cryptpad2.jpg new file mode 100644 index 00000000..5a4ed7bc Binary files /dev/null and b/img/mesh_cryptpad2.jpg differ diff --git a/src/freedombone-app-cryptpad b/src/freedombone-app-cryptpad index 135fa962..5f648627 100755 --- a/src/freedombone-app-cryptpad +++ b/src/freedombone-app-cryptpad @@ -215,6 +215,165 @@ function remove_cryptpad { userdel -r cryptpad } +function mesh_install_cryptpad { + if [[ $VARIANT != "meshclient" && $VARIANT != "meshusb" ]]; then + return + fi + + if [ ! -d $rootdir/var/www/cryptpad ]; then + mkdir $rootdir/var/www/cryptpad + fi + if [ -d $rootdir$CRYPTPAD_DIR ]; then + rm -rf $rootdir$CRYPTPAD_DIR + fi + + git_clone $CRYPTPAD_REPO $rootdir$CRYPTPAD_DIR + + if [ ! -d $rootdir$CRYPTPAD_DIR ]; then + echo $'Unable to clone cryptpad repo' + exit 783251 + fi + + if [ -f $rootdir/root/$PROJECT_NAME/img/icon_cryptpad.png ]; then + cp $rootdir/root/$PROJECT_NAME/img/icon_cryptpad.png $rootdir$CRYPTPAD_DIR/icon_cryptpad.png + fi + + # an unprivileged user to run as + chroot "$rootdir" useradd -d $CRYPTPAD_DIR/ cryptpad + + cd $rootdir$CRYPTPAD_DIR + git checkout $CRYPTPAD_COMMIT -b $CRYPTPAD_COMMIT + + chroot "$rootdir" chown -R cryptpad:cryptpad $CRYPTPAD_DIR + + cryptpad_nginx_site=$rootdir/etc/nginx/sites-available/cryptpad + echo 'server {' > $cryptpad_nginx_site + echo " listen 80 default_server;" >> $cryptpad_nginx_site + echo " server_name P${PEER_ID}.local;" >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' # Logs' >> $cryptpad_nginx_site + echo ' access_log /dev/null;' >> $cryptpad_nginx_site + echo ' error_log /dev/null;' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' # Root' >> $cryptpad_nginx_site + echo " root $CRYPTPAD_DIR;" >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' index index.html;' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' add_header X-XSS-Protection "1; mode=block";' >> $cryptpad_nginx_site + echo ' add_header X-Content-Type-Options nosniff;' >> $cryptpad_nginx_site + echo ' add_header X-Frame-Options SAMEORIGIN;' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' if ($uri = /pad/inner.html) {' >> $cryptpad_nginx_site + echo " set \$scriptSrc \"'self' 'unsafe-eval' 'unsafe-inline'\";" >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location = /cryptpad_websocket {' >> $cryptpad_nginx_site + echo " proxy_pass http://localhost:$CRYPTPAD_PORT;" >> $cryptpad_nginx_site + echo ' proxy_set_header X-Real-IP $remote_addr;' >> $cryptpad_nginx_site + echo ' proxy_set_header Host $host;' >> $cryptpad_nginx_site + echo ' proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' # WebSocket support (nginx 1.4)' >> $cryptpad_nginx_site + echo ' proxy_http_version 1.1;' >> $cryptpad_nginx_site + echo ' proxy_set_header Upgrade $http_upgrade;' >> $cryptpad_nginx_site + echo ' proxy_set_header Connection upgrade;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + + echo ' location ^~ /customize.dist/ {' >> $cryptpad_nginx_site + echo ' # This is needed in order to prevent infinite recursion between /customize/ and the root' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo ' location ^~ /customize/ {' >> $cryptpad_nginx_site + echo ' rewrite ^/customize/(.*)$ $1 break;' >> $cryptpad_nginx_site + echo ' try_files /customize/$uri /customize.dist/$uri;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo ' location = /api/config {' >> $cryptpad_nginx_site + echo ' default_type text/javascript;' >> $cryptpad_nginx_site + echo ' rewrite ^.*$ /customize/api/config break;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ^~ /blob/ {' >> $cryptpad_nginx_site + echo ' try_files $uri =404;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ^~ /register/ {' >> $cryptpad_nginx_site + echo ' try_files $uri =404;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ^~ /login/ {' >> $cryptpad_nginx_site + echo ' try_files $uri =404;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ^~ /about.html {' >> $cryptpad_nginx_site + echo ' try_files $uri =404;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ^~ /contact.html {' >> $cryptpad_nginx_site + echo ' try_files $uri =404;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ^~ /what-is-cryptpad.html {' >> $cryptpad_nginx_site + echo ' try_files $uri =404;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' location ~ ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard|file|media)$ {' >> $cryptpad_nginx_site + echo ' rewrite ^(.*)$ $1/ redirect;' >> $cryptpad_nginx_site + echo ' }' >> $cryptpad_nginx_site + echo '' >> $cryptpad_nginx_site + echo ' try_files /www/$uri /www/$uri/index.html /customize/$uri;' >> $cryptpad_nginx_site + echo '}' >> $cryptpad_nginx_site + + cd $rootdir$CRYPTPAD_DIR + + get_npm_arch + + cat < $rootdir/usr/bin/install_cryptpad +#!/bin/bash +cd $CRYPTPAD_DIR +npm install --arch=$NPM_ARCH --build-from-source +npm install --arch=$NPM_ARCH -g bower@1.8.0 +chown -R cryptpad:cryptpad $CRYPTPAD_DIR +su -c 'bower install' - cryptpad +cp config.example.js config.js +EOF + chmod +x $rootdir/usr/bin/install_cryptpad + chroot "$rootdir" /usr/bin/install_cryptpad + + if [ ! -f $rootdir$CRYPTPAD_DIR/config.js ]; then + echo $'Cryptpad config file not found' + exit 628252 + fi + + rm $rootdir/usr/bin/install_cryptpad + + sed -i "s|httpPort:.*|httpPort: $CRYPTPAD_PORT,|g" $rootdir$CRYPTPAD_DIR/config.js + sed -i "s|// domain:|domain:|g" $rootdir$CRYPTPAD_DIR/config.js + sed -i 's|openFileLimit:.*|openFileLimit: 1024,|g' $rootdir$CRYPTPAD_DIR/config.js + sed -i "s|domain:.*|domain: 'http://P${PEER_ID}.local',|g" $rootdir$CRYPTPAD_DIR/config.js + + chroot "$rootdir" chown -R cryptpad:cryptpad $CRYPTPAD_DIR + + # daemon + echo '[Unit]' > $rootdir/etc/systemd/system/cryptpad.service + echo 'Description=Cryptpad' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'After=syslog.target' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'After=network.target' >> $rootdir/etc/systemd/system/cryptpad.service + echo '' >> $rootdir/etc/systemd/system/cryptpad.service + echo '[Service]' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'User=cryptpad' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'Group=cryptpad' >> $rootdir/etc/systemd/system/cryptpad.service + echo "WorkingDirectory=$CRYPTPAD_DIR" >> $rootdir/etc/systemd/system/cryptpad.service + echo "ExecStart=/usr/local/bin/node $CRYPTPAD_DIR/server.js" >> $rootdir/etc/systemd/system/cryptpad.service + echo 'Environment=PATH=/usr/bin:/usr/local/bin' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'Environment=NODE_ENV=production' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'Restart=on-failure' >> $rootdir/etc/systemd/system/cryptpad.service + echo '' >> $rootdir/etc/systemd/system/cryptpad.service + echo '[Install]' >> $rootdir/etc/systemd/system/cryptpad.service + echo 'WantedBy=multi-user.target' >> $rootdir/etc/systemd/system/cryptpad.service + chroot "$rootdir" systemctl enable cryptpad.service +} + function install_cryptpad_main { if [[ $(app_is_installed cryptpad_main) == "1" ]]; then return @@ -320,10 +479,6 @@ function install_cryptpad_main { echo ' try_files $uri =404;' >> $cryptpad_nginx_site echo ' }' >> $cryptpad_nginx_site echo '' >> $cryptpad_nginx_site - echo ' location ^~ /contact.html {' >> $cryptpad_nginx_site - echo ' try_files $uri =404;' >> $cryptpad_nginx_site - echo ' }' >> $cryptpad_nginx_site - echo '' >> $cryptpad_nginx_site echo ' location ^~ /what-is-cryptpad.html {' >> $cryptpad_nginx_site echo ' try_files $uri =404;' >> $cryptpad_nginx_site echo ' }' >> $cryptpad_nginx_site diff --git a/src/freedombone-app-pihole b/src/freedombone-app-pihole index 7b9a8c6b..0ce715a0 100755 --- a/src/freedombone-app-pihole +++ b/src/freedombone-app-pihole @@ -135,7 +135,7 @@ function pihole_change_upstream_dns { data=$(tempfile 2>/dev/null) trap "rm -f $data" 0 1 2 5 15 dialog --backtitle $"Ad Blocker Upstream DNS" \ - --radiolist $"Pick a domain name service (DNS):" 25 50 16 \ + --radiolist $"Pick a domain name service (DNS):" 28 50 19 \ 1 $"Digital Courage" on \ 2 $"German Privacy Foundation 1" off \ 3 $"German Privacy Foundation 2" off \ @@ -151,7 +151,10 @@ function pihole_change_upstream_dns { 13 $"PowerNS" off \ 14 $"ValiDOM" off \ 15 $"Freie Unzensierte" off \ - 16 $"Google" off 2> $data + 16 $"DNS.Watch" off \ + 17 $"uncensoreddns.org" off \ + 18 $"Lorraine Data Network" off \ + 19 $"Google" off 2> $data sel=$? case $sel in 1) exit 1;; @@ -203,8 +206,19 @@ function pihole_change_upstream_dns { 15) PIHOLE_DNS1='85.25.149.144' PIHOLE_DNS2='87.106.37.196' ;; - 16) PIHOLE_DNS1='8.8.8.8' + 16) PIHOLE_DNS1='84.200.69.80' + PIHOLE_DNS2='84.200.70.40' + ;; + 17) PIHOLE_DNS1='91.239.100.100' + PIHOLE_DNS2='89.233.43.71' + ;; + 18) PIHOLE_DNS1='80.67.188.188' + PIHOLE_DNS2='89.234.141.66' + ;; + 19) PIHOLE_DNS1='8.8.8.8' PIHOLE_DNS2='4.4.4.4' + dialog --title $"WARNING" \ + --msgbox $"\nGoogle's main purpose for providing DNS resolvers is to spy upon people and know which sites they are visiting.\n\nThis is something to consider, and you should only really be using Google DNS as a last resort if other resolvers are unavailable." 12 60 ;; 255) exit 1;; esac diff --git a/src/freedombone-app-vpn b/src/freedombone-app-vpn index f10ad362..0d0f051b 100755 --- a/src/freedombone-app-vpn +++ b/src/freedombone-app-vpn @@ -106,13 +106,17 @@ function install_interactive_vpn { } function vpn_change_tls_port { - EXISTING_VPN_TLS_PORT=$VPN_TLS_PORT + if ! grep -q "VPN-TLS" $FIREWALL_CONFIG; then + EXISTING_VPN_TLS_PORT=443 + else + EXISTING_VPN_TLS_PORT=$(cat $FIREWALL_CONFIG | grep "VPN-TLS" | awk -F '=' '{print $2}') + fi data=$(tempfile 2>/dev/null) trap "rm -f $data" 0 1 2 5 15 dialog --title $"VPN Configuration" \ --backtitle $"Freedombone Control Panel" \ - --inputbox $'Change TLS port' 10 50 $VPN_TLS_PORT 2>$data + --inputbox $'Change TLS port' 10 50 $EXISTING_VPN_TLS_PORT 2>$data sel=$? case $sel in 0) @@ -123,7 +127,7 @@ function vpn_change_tls_port { VPN_TLS_PORT=$tlsport write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT" sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel.conf - sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf + sed -i "s|connect =.*|connect = :$VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf for d in /home/*/ ; do USERNAME=$(echo "$d" | awk -F '/' '{print $3}') @@ -134,17 +138,29 @@ function vpn_change_tls_port { done if [ $VPN_TLS_PORT -eq 443 ]; then + if [[ "$PREVIOUS_VPN_TLS_PORT" != "443" ]]; then + firewall_remove VPN-TLS ${EXISTING_VPN_TLS_PORT} + fi systemctl stop nginx systemctl disable nginx else + if [[ "$PREVIOUS_VPN_TLS_PORT" != "$VPN_TLS_PORT" ]]; then + firewall_remove VPN-TLS ${EXISTING_VPN_TLS_PORT} + firewall_add VPN-TLS ${VPN_TLS_PORT} tcp + fi systemctl enable nginx systemctl restart nginx fi systemctl restart stunnel - dialog --title $"VPN Configuration" \ - --msgbox $"TLS port changed to $VPN_TLS_PORT" 6 60 + if [ $VPN_TLS_PORT -eq 443 ]; then + dialog --title $"VPN Configuration" \ + --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60 + else + dialog --title $"VPN Configuration" \ + --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60 + fi fi fi ;; diff --git a/src/freedombone-controlpanel-user b/src/freedombone-controlpanel-user index 5f4fb93c..3f257aad 100755 --- a/src/freedombone-controlpanel-user +++ b/src/freedombone-controlpanel-user @@ -437,9 +437,9 @@ function refresh_gpg_keys { function add_gpg_key { data=$(tempfile 2>/dev/null) trap "rm -f $data" 0 1 2 5 15 - dialog --title $"Add someone's PGP/GPG key" \ + dialog --title $"Enter email address, Key ID or full key below" \ --backtitle $"Freedombone User Control Panel" \ - --inputbox $"Enter their email address or Key ID below" 8 60 2>$data + --editbox $data 8 60 2>$data sel=$? case $sel in 0) @@ -448,18 +448,28 @@ function add_gpg_key { address_is_valid= - if [[ $ADD_EMAIL_ADDRESS == *"@"* && $ADD_EMAIL_ADDRESS == *"."* ]]; then + if [[ "$ADD_EMAIL_ADDRESS" == *"@"* && "$ADD_EMAIL_ADDRESS" == *"."* ]]; then + address_is_valid=1 + fi + if [[ "$ADD_EMAIL_ADDRESS" == "0x"* ]]; then + address_is_valid=1 + fi + publicstr=$"BEGIN PGP PUBLIC KEY BLOCK" + if [[ "$ADD_EMAIL_ADDRESS" == *"$publicstr"* ]]; then address_is_valid=1 - else - if [[ $ADD_EMAIL_ADDRESS == "0x"* ]]; then - address_is_valid=1 - fi fi if [ $address_is_valid ]; then clear - gpg --search-keys "$ADD_EMAIL_ADDRESS" - gpg_set_trust "$ADD_EMAIL_ADDRESS" + if [[ "$ADD_EMAIL_ADDRESS" == *"$publicstr"* ]]; then + echo "$ADD_EMAIL_ADDRESS" | gpg --import + dialog --title $"Add someone's PGP/GPG key" \ + --backtitle $"Freedombone User Control Panel" \ + --msgbox $"GPG public key was imported" 6 50 + else + gpg --search-keys "$ADD_EMAIL_ADDRESS" + gpg_set_trust "$ADD_EMAIL_ADDRESS" + fi else dialog --title $"Unrecognised email address" \ --backtitle $"Freedombone User Control Panel" \ @@ -468,6 +478,7 @@ function add_gpg_key { fi ;; esac + rm $data } function remove_gpg_key { diff --git a/src/freedombone-image b/src/freedombone-image index f5b4fc99..17a57ee8 100755 --- a/src/freedombone-image +++ b/src/freedombone-image @@ -87,8 +87,8 @@ NAMESERVER1='213.73.91.35' NAMESERVER2='85.214.20.141' NAMESERVER3='213.73.91.35' NAMESERVER4='85.214.73.63' -NAMESERVER5='8.8.8.8' -NAMESERVER6='4.4.4.4' +NAMESERVER5='84.200.69.80' +NAMESERVER6='84.200.70.40' # An optional freedombone configuration file CONFIG_FILENAME= diff --git a/src/freedombone-image-customise b/src/freedombone-image-customise index 2c8769e1..3240ea2c 100755 --- a/src/freedombone-image-customise +++ b/src/freedombone-image-customise @@ -697,6 +697,7 @@ initialise_mesh() { install_tox install_web_server install_pelican + mesh_install_cryptpad if [ $ENABLE_ZERONET ]; then install_zeronet fi @@ -896,7 +897,7 @@ function configure_user_interface { #!/bin/bash ethernet_connected=\$(cat /sys/class/net/eth0/carrier) users_list=\$(lstox | awk -F ' ' '{\$1=""; print \$0}' | sed -e 's/^[[:space:]]*//' | sort -d | uniq) -if [ ! \$users_list ]; then +if [ \${#users_list} -eq 0 ]; then no_of_users=0 else no_of_users=\$(echo "\$users_list" | wc -l) @@ -927,6 +928,26 @@ if [ \$no_of_users -gt 0 ]; then chmod +x /home/$MY_USERNAME/Desktop/Users.desktop chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Desktop/Users.desktop + if [ ! -f /home/$MY_USERNAME/Desktop/cryptpad.desktop ]; then + echo '[Desktop Entry]' > /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo 'Name=CryptPad' >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo 'Type=Application' >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo 'Comment=Realtime collaborative editing of documents' >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo "Exec=$BROWSER http://\${HOSTNAME}.local" >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo "Icon=/etc/cryptpad/icon_cryptpad.png" >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo 'Terminal=false' >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + echo 'Categories=Application;' >> /home/$MY_USERNAME/Desktop/cryptpad.desktop + chmod +x /home/$MY_USERNAME/Desktop/cryptpad.desktop + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Desktop/cryptpad.desktop + else + if ! grep -q "\${HOSTNAME}.local" /home/$MY_USERNAME/Desktop/cryptpad.desktop; then + sed -i "s|Exec=.*|Exec=$BROWSER http://\${HOSTNAME}.local|g" /home/$MY_USERNAME/Desktop/cryptpad.desktop + fi + if grep -q "Offline" /home/$MY_USERNAME/Desktop/cryptpad.desktop; then + sed -i 's|Name=.*|Name=CryptPad|g' /home/$MY_USERNAME/Desktop/cryptpad.desktop + fi + fi + if [ ! -f /home/$MY_USERNAME/Desktop/social.desktop ]; then echo '[Desktop Entry]' > /home/$MY_USERNAME/Desktop/social.desktop echo 'Name=Social' >> /home/$MY_USERNAME/Desktop/social.desktop @@ -961,6 +982,18 @@ if [ \$no_of_users -gt 0 ]; then # fi #fi + if [ ! -f /home/$MY_USERNAME/Desktop/vpn.desktop ]; then + echo '[Desktop Entry]' > /home/$MY_USERNAME/Desktop/vpn.desktop + echo 'Type=Application' >> /home/$MY_USERNAME/Desktop/vpn.desktop + echo 'Name=Connect Meshes' >> /home/$MY_USERNAME/Desktop/vpn.desktop + echo 'Comment=Connect to another mesh network via the internet' >> /home/$MY_USERNAME/Desktop/vpn.desktop + echo 'Exec=mate-terminal -e /usr/local/bin/${PROJECT_NAME}-mesh-connect' >> /home/$MY_USERNAME/Desktop/vpn.desktop + echo 'Icon=/usr/share/${PROJECT_NAME}/avatars/connect.jpg' >> /home/$MY_USERNAME/Desktop/vpn.desktop + echo 'StartupNotify=false' >> /home/$MY_USERNAME/Desktop/vpn.desktop + chmod +x /home/$MY_USERNAME/Desktop/vpn.desktop + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/Desktop/vpn.desktop + fi + if [ -f /tmp/.ipfs-users ]; then echo '[Desktop Entry]' > /home/$MY_USERNAME/Desktop/sites.desktop echo 'Type=Application' >> /home/$MY_USERNAME/Desktop/sites.desktop diff --git a/src/freedombone-image-makefile b/src/freedombone-image-makefile index a8cbe02b..59729f4e 100755 --- a/src/freedombone-image-makefile +++ b/src/freedombone-image-makefile @@ -64,8 +64,8 @@ NAMESERVER1 ?= '213.73.91.35' NAMESERVER2 ?= '85.214.20.141' NAMESERVER3 ?= '213.73.91.35' NAMESERVER4 ?= '85.214.73.63' -NAMESERVER5 ?= '8.8.8.8' -NAMESERVER6 ?= '4.4.4.4' +NAMESERVER5 ?= '84.200.69.80' +NAMESERVER6 ?= '84.200.70.40' # Using taskset to pin build process to single core. This is a # workaround for a qemu-user-static issue that causes builds to diff --git a/src/freedombone-image-mesh b/src/freedombone-image-mesh index a9699a34..7148304a 100755 --- a/src/freedombone-image-mesh +++ b/src/freedombone-image-mesh @@ -85,6 +85,29 @@ VPN_MESH_TLS_PORT=653 SCUTTLEBOT_PORT=8010 +CRYPTPAD_PORT=9003 +CRYPTPAD_DIR=/etc/cryptpad + +function enable_cryptpad { + if [ ! -d $CRYPTPAD_DIR ]; then + return + fi + + # Set up the web server + ln -s /etc/nginx/sites-available/cryptpad /etc/nginx/sites-enabled/cryptpad + rm /etc/nginx/sites-enabled/default + + if [ ! -d $CRYPTPAD_DIR/customize/api ]; then + mkdir -p $CRYPTPAD_DIR/customize/api + fi + wget 127.0.0.1:$CRYPTPAD_PORT/api/config -O $CRYPTPAD_DIR/customize/api/config + if [ ! -f $CRYPTPAD_DIR/customize/api/config ]; then + echo $'Unable to wget api/config' + exit 89252 + fi + chown -R cryptpad:cryptpad $CRYPTPAD_DIR +} + # Debian stretch has a problem where the formerly predictable wlan0 and eth0 # device names get assigned random names. This is a hacky workaround. # Also adding net.ifnames=0 to kernel options on bootloader may work. @@ -761,7 +784,7 @@ function generate_stunnel_keys { cp /etc/stunnel/stunnel.pem /home/$MY_USERNAME/stunnel.pem cp /etc/stunnel/stunnel.p12 /home/$MY_USERNAME/stunnel.p12 - chown $MY_USERNAME:$MY_USERNAME $prefix$userhome/stunnel* + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel* echo "stunnel keys created" >> /var/log/${PROJECT_NAME}.log } @@ -774,6 +797,13 @@ function mesh_setup_vpn { generate_stunnel_keys sed -i 's|tun-mtu .*|tun-mtu 1532|g' /home/$MY_USERNAME/client.ovpn + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/client.ovpn + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel* + + # create an archive of the vpn client files + cd /home/$MY_USERNAME + tar -czvf vpn.tar.gz stunnel* client.ovpn + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/vpn.tar.gz systemctl restart openvpn } @@ -873,12 +903,16 @@ if [ -f $MESH_INSTALL_SETUP ]; then #create_ram_disk 1 #setup_amnesic_data change_avahi_name + if [ -d $CRYPTPAD_DIR ]; then + systemctl start cryptpad + fi configure_toxcore create_tox_user #setup_tahoelafs mesh_setup_vpn initialise_scuttlebot_pub setup_ipfs + enable_cryptpad mesh_amnesic make_root_read_only diff --git a/src/freedombone-mesh-connect b/src/freedombone-mesh-connect new file mode 100755 index 00000000..ab38bccb --- /dev/null +++ b/src/freedombone-mesh-connect @@ -0,0 +1,229 @@ +#!/bin/bash +# +# .---. . . +# | | | +# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-. +# | | (.-' (.-' ( | ( )| | | | )( )| | (.-' +# ' ' --' --' -' - -' ' ' -' -' -' ' - --' +# +# Freedom in the Cloud +# +# Blogging functions for mesh clients +# +# License +# ======= +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +PROJECT_NAME='freedombone' + +export TEXTDOMAIN=${PROJECT_NAME}-mesh-blog +export TEXTDOMAINDIR="/usr/share/locale" + +MY_USERNAME='fbone' + +OPENVPN_SERVER_NAME="server" +OPENVPN_KEY_FILENAME='client.ovpn' +VPN_COUNTRY_CODE="US" +VPN_AREA="Apparent Free Speech Zone" +VPN_LOCATION="Freedomville" +VPN_ORGANISATION="Freedombone" +VPN_UNIT="Freedombone Unit" +STUNNEL_PORT=3439 +VPN_MESH_TLS_PORT=653 + +function vpn_generate_keys { + # generate host keys + if [ ! -f /etc/openvpn/dh2048.pem ]; then + ${PROJECT_NAME}-dhparam -o /etc/openvpn/dh2048.pem + fi + if [ ! -f /etc/openvpn/dh2048.pem ]; then + echo $'vpn dhparams were not generated' >> /var/log/${PROJECT_NAME}.log + exit 73724523 + fi + cp /etc/openvpn/dh2048.pem /etc/openvpn/easy-rsa/keys/dh2048.pem + + cd /etc/openvpn/easy-rsa + . ./vars + ./clean-all + vpn_openssl_version='1.0.0' + if [ ! -f openssl-${vpn_openssl_version}.cnf ]; then + echo $"openssl-${vpn_openssl_version}.cnf was not found" >> /var/log/${PROJECT_NAME}.log + exit 7392353 + fi + cp openssl-${vpn_openssl_version}.cnf openssl.cnf + + if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then + rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt + fi + if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then + rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key + fi + if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr ]; then + rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr + fi + sed -i 's| --interact||g' build-key-server + sed -i 's| --interact||g' build-ca + ./build-ca + ./build-key-server ${OPENVPN_SERVER_NAME} + if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then + echo $'OpenVPN crt not found' >> /var/log/${PROJECT_NAME}.log + exit 7823352 + fi + server_cert=$(cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt) + if [ ${#server_cert} -lt 10 ]; then + cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt + echo $'Server cert generation failed' >> /var/log/${PROJECT_NAME}.log + exit 3284682 + fi + + if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then + echo $'OpenVPN key not found' >> /var/log/${PROJECT_NAME}.log + exit 6839436 + fi + if [ ! -f /etc/openvpn/easy-rsa/keys/ca.key ]; then + echo $'OpenVPN ca not found' >> /var/log/${PROJECT_NAME}.log + exit 7935203 + fi + cp /etc/openvpn/easy-rsa/keys/{$OPENVPN_SERVER_NAME.crt,$OPENVPN_SERVER_NAME.key,ca.crt} /etc/openvpn + + create_user_vpn_key ${MY_USERNAME} +} + +function generate_stunnel_keys { + echo "Creating stunnel keys" >> /var/log/${PROJECT_NAME}.log + openssl req -x509 -nodes -days 3650 -sha256 \ + -subj "/O=$VPN_ORGANISATION/OU=$VPN_UNIT/C=$VPN_COUNTRY_CODE/ST=$VPN_AREA/L=$VPN_LOCATION/CN=$HOSTNAME" \ + -newkey rsa:2048 -keyout /etc/stunnel/key.pem \ + -out /etc/stunnel/cert.pem + if [ ! -f /etc/stunnel/key.pem ]; then + echo $'stunnel key not created' >> /var/log/${PROJECT_NAME}.log + exit 793530 + fi + if [ ! -f /etc/stunnel/cert.pem ]; then + echo $'stunnel cert not created' >> /var/log/${PROJECT_NAME}.log + exit 204587 + fi + chmod 400 /etc/stunnel/key.pem + chmod 640 /etc/stunnel/cert.pem + + cat /etc/stunnel/key.pem /etc/stunnel/cert.pem >> /etc/stunnel/stunnel.pem + chmod 640 /etc/stunnel/stunnel.pem + + openssl pkcs12 -export -out /etc/stunnel/stunnel.p12 -inkey /etc/stunnel/key.pem -in /etc/stunnel/cert.pem -passout pass: + if [ ! -f /etc/stunnel/stunnel.p12 ]; then + echo $'stunnel pkcs12 not created' >> /var/log/${PROJECT_NAME}.log + exit 639353 + fi + chmod 640 /etc/stunnel/stunnel.p12 + + cp /etc/stunnel/stunnel.pem /home/$MY_USERNAME/stunnel.pem + cp /etc/stunnel/stunnel.p12 /home/$MY_USERNAME/stunnel.p12 + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel* + echo "stunnel keys created" >> /var/log/${PROJECT_NAME}.log +} + +function mesh_setup_vpn { + vpn_generate_keys + + cp /etc/stunnel/stunnel-client.conf /home/$MY_USERNAME/stunnel-client.conf + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel* + + generate_stunnel_keys + + sed -i 's|tun-mtu .*|tun-mtu 1532|g' /home/$MY_USERNAME/client.ovpn + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/client.ovpn + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel* + + # create an archive of the vpn client files + cd /home/$MY_USERNAME + tar -czvf vpn.tar.gz stunnel* client.ovpn + chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/vpn.tar.gz + + if [ -f vpn.tar.gz ]; then + dialog --title $"Generate VPN client keys" \ + --msgbox $"\nNew VPN client keys have been generated in the /home/fbone directory.\n\nYou can find it by selecting \"Places\" then \"Home Directory\" on the top menu bar. Transmit the vpn.tar.gz file to whoever is running the other mesh network so that they can connect to yours.\n\nThey should uncompress vpn.tar.gz to their /home/fbone directory, forward port $VPN_MESH_TLS_PORT then connect using your IP address or domain name." 15 70 + fi +} + +function connect_to_vpn { + dialog --title $"VPN Connect to another mesh network" \ + --backtitle $"Freedombone Mesh" \ + --defaultno \ + --yesno $"\nHave you received the vpn.tar.gz file from the other mesh administrator, uncompressed it into the /home/fbone directory and also forwarded port $VPN_MESH_TLS_PORT from your internet router to this system?" 10 70 + sel=$? + case $sel in + 1) return;; + 255) return;; + esac + + data=$(tempfile 2>/dev/null) + trap "rm -f $data" 0 1 2 5 15 + dialog --title $"VPN Connect to another mesh network" \ + --backtitle $"Freedombone Mesh" \ + --inputbox $'Enter the IP address or domain name of the other mesh.' 10 60 2>$data + sel=$? + case $sel in + 0) + ip_or_domain=$(<$data) + if [ ${#ip_or_domain} -gt 1 ]; then + if [[ "$ip_or_domain" == *'.'* ]]; then + + if [ ! -f ~/client.ovpn ]; then + rm $data + exit 1 + fi + if [ ! -f ~/stunnel.pem ]; then + rm $data + exit 1 + fi + if [ ! -f ~/stunnel.p12 ]; then + rm $data + exit 1 + fi + + sed -i "s|route .*|route $ip_or_domain 255.255.255.255 net_gateway|g" ~/client.ovpn + + clear + cd ~/ + sudo stunnel stunnel-client.conf + sudo openvpn client.ovpn + fi + fi + ;; + esac + + rm $data +} + +data=$(tempfile 2>/dev/null) +trap "rm -f $data" 0 1 2 5 15 +dialog --backtitle $"Freedombone Mesh" \ + --title $"Connect to another mesh network" \ + --radiolist $"Choose an operation:" 10 75 2 \ + 1 $"Connect to another mesh network" on \ + 2 $"Generate VPN keys for another mesh network to connect to me" off 2> $data +sel=$? +case $sel in + 1) exit 1;; + 255) exit 1;; +esac +case $(cat $data) in + 1) rm $data + connect_to_vpn;; + 2) rm $data + mesh_setup_vpn;; +esac + +exit 0 diff --git a/src/freedombone-utils-dns b/src/freedombone-utils-dns index 31a30ab7..7c5c5b84 100755 --- a/src/freedombone-utils-dns +++ b/src/freedombone-utils-dns @@ -33,8 +33,8 @@ NAMESERVER1='213.73.91.35' NAMESERVER2='85.214.20.141' NAMESERVER3='213.73.91.35' NAMESERVER4='85.214.73.63' -NAMESERVER5='8.8.8.8' -NAMESERVER6='4.4.4.4' +NAMESERVER5='84.200.69.80' +NAMESERVER6='84.200.70.40' # parameters used when adding a new domain DDNS_PROVIDER="default@freedns.afraid.org" diff --git a/src/freedombone-utils-guile b/src/freedombone-utils-guile index 16e9756c..3f22334a 100755 --- a/src/freedombone-utils-guile +++ b/src/freedombone-utils-guile @@ -50,9 +50,11 @@ function install_8sync { export GUILE_CFLAGS="-I${GUILE_BASE_PATH}/include" export GUILE_LIBS="-L${GUILE_BASE_PATH}/lib -lguile -lqthreads -ldl -ltermcap -lsocket -lnsl -lm" ./bootstrap.sh + sed -i 's|PKG_CHECK_MODULES|##PKG_CHECK_MODULES|g' configure configure make make install + export GUILE_LOAD_COMPILED_PATH="$INSTALL_DIR/8sync" } function install_guile { diff --git a/website/EN/index.html b/website/EN/index.html index 4ad49b2e..b72e8704 100644 --- a/website/EN/index.html +++ b/website/EN/index.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + ‎ @@ -300,7 +300,7 @@ If you find bugs, or want to add a new app to this system see the available here.

diff --git a/website/EN/mesh.html b/website/EN/mesh.html index 398838df..a3303e18 100644 --- a/website/EN/mesh.html +++ b/website/EN/mesh.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + ‎ @@ -274,13 +274,13 @@ for the JavaScript code in this tag. -What the system can do +What the system can do - -Disk Images +Disk Images - -Building Disk Images +Building Disk Images - -How to use it +How to use it @@ -324,15 +324,16 @@ The Freedombone mesh roughly follows MondoNet's ten social specifications:
  • Evolvable: The network should be built with future development in mind. The platform should be flexible enough to support technologies, protocols and modes of usage that have not yet been developed.
    • -
    -

    What the system can do

    -
    +
    +

    What the system can do

    +
    • Discovery of other users on the network
    • Text based chat, one-to-one and in groups
    • Voice chat (VoIP) and video calls
    • Private and public sharing of files
    • Blogging
      • +
    • Collaborative editing of documents and presentations
    • Creating and broadcasting audio media/podcasts
    • Social network stream. Follow/unfollow other peers
    • No network administration required
      • @@ -350,13 +351,13 @@ This system should be quite scalable. Both qTox and IPFS are based upon distribu
    -
    -

    Disk Images

    -
    +
    +

    Disk Images

    +
    -
    -

    Writing many images quickly

    -
    +
    +

    Writing many images quickly

    +

    There may be situations where you need to write the same disk image to multiple drives at the same time in order to maximize rate of deployment. In the instructions given below the dd command is used for writing to the target drive, but to write to multiple drives you can use a tool such as GNOME MultiWriter.

    @@ -384,9 +385,9 @@ The MultiWriter tool is also available within mesh client images, so that you ca

    -
    -

    Client images

    -
    +
    +

    Client images

    +
    @@ -435,16 +436,16 @@ sudo dd bs=1M -

    Router images

    -
    +
    +

    Router images

    +

    Routers are intended to build network coverage for an area using small and low cost hardware. You can bolt them to walls or leave them on window ledges. They don't have any user interface and their only job is to haul network traffic across the mesh and to enable peers to find each other via running bootstrap nodes for Tox and IPFS. Copy the image to a microSD card and insert it into the router, plug in an Atheros wifi dongle and power on. That should be all you need to do.

    -
    -

    Beaglebone Black

    -
    +
    +

    Beaglebone Black

    +
    @@ -481,9 +482,9 @@ There is still a software freedom issue with the Beaglebone Black, but it doesn'
    -
    -

    Building Disk Images

    -
    +
    +

    Building Disk Images

    +

    It's better not to trust images downloaded from random places on the interwebs. Chances are that unless you are in the web of trust of the above GPG signatures then they don't mean very much to you. If you actually want something trustworthy then build the images from scratch. It will take some time. Here's how to do it.

    @@ -571,9 +572,9 @@ The resulting image can be copied to a microSD card, inserted into a Beaglebone
    -
    -

    Customisation

    -
    +
    +

    Customisation

    +

    If you want to make your own specially branded version, such as for a particular event, then to change the default desktop backgrounds edit the images within img/backgrounds and to change the available avatars and desktop icons edit the images within img/avatars. Re-create disk images using the instructions shown previously.

    @@ -583,9 +584,9 @@ If you need particular dconf commands to alter desktop appearance or beha

    -
    -

    How to use it

    -
    +
    +

    How to use it

    +

    When you first boot from the USB drive the system will create some encryption keys, assign a unique network address to the system and then reboot itself. When that's done you should see a prompt asking for a username. This username just makes it easy for others to initially find you on the mesh and will appear in the list of users.

    @@ -595,9 +596,9 @@ After a minute or two if you are within wifi range and there is at least one oth

    -
    -

    Boot trouble

    -
    +
    +

    Boot trouble

    +

    If the system doesn't boot and reports an error which includes /dev/mapper/loop0p1 then reboot with Ctrl-Alt-Del and when you see the grub menu press e and manually change /dev/mapper/loop0p1 to /dev/sdb1, then press Ctrl-x. If that doesn't work then reboot and try /dev/sdc1 instead.

    @@ -607,9 +608,9 @@ After the system has booted successfully the problem should resolve itself on su

    -
    -

    Set the Date

    -
    +
    +

    Set the Date

    +

    On the ordinary internet the date and time of your system would be set automatically via NTP. But this is not the internet and so you will need to manually ensure that your date and time settings are correct. You might need to periodically do this if your clock drifts. It's not essential that the time on your system be highly accurate, but if it drifts too far or goes back to epoch then things could become a little confusing in regard to the order of blog posts.

    @@ -619,9 +620,9 @@ On the ordinary internet the date and time of your system would be set automatic

    -
    -

    Check network status

    -
    +
    +

    Check network status

    +

    Unlike with ordinary wifi, on the mesh you don't get a signal strength icon and so it's not simple to see if you have a good connection.

    @@ -644,9 +645,9 @@ When you are finished close the window and then select the Network Restart
    -
    -

    Connecting to the internet

    -
    +
    +

    Connecting to the internet

    +

    If you need to be able to access the internet from the mesh then connect one of the peers to an internet router using an ethernet cable, then reboot it. Other peers in the mesh, including any attached mobile devices, will then be able to access the internet using the ethernet attached peer as a gateway. Freifunk works in a similar way.

    @@ -669,47 +670,38 @@ Where myclient.ovpn comes from your VPN provider and with the password "<

    -
    -

    Connecting two meshes over the internet via a VPN tunnel

    -
    +
    +

    Connecting two meshes over the internet via a VPN tunnel

    +

    -Maybe the internet exists, but you don't care about getting any content from it and just want to use it as a way to connect mesh networks from different geographical locations together. VPN configuration, pem and stunnel files exist within the home directory. Edit the configuration with: +Maybe the internet exists, but you don't care about getting any content from it and just want to use it as a way to connect mesh networks from different geographical locations together.

    -
    -
    nano ~/client.ovpn
-
    -
    -

    -Edit the IP address or domain for the mesh that you wish to connect to within the route command: +In your home directory on a system connected via ethernet to an internet router you'll find a file called vpn.tar.gz. If you want another mesh to be able to connect to yours then send them this file and get them to uncompress it into their home directory also on an internet gateway machine. If they have an external IP address or domain name for your router then they will be able to VPN connect using the Connect Meshes icon. They should also forward port 653 from their internet router to the mesh gateway machine.

    -
    -
    route [mesh IP or domain] 255.255.255.255 net_gateway
-
    -
    +
    -

    -Then you can connect to the other mesh with: -

    - -
    -
    cd /home/fbone
-sudo stunnel stunnel-client.conf
-sudo openvpn client.ovpn
-
    -
    - -

    -Using the password "freedombone". From a deep packet inspection point of view the traffic going over the internet will just look like any other TLS connection to a server. +

    +

    mesh_connect.jpg

    -
    -

    Mobile devices (phones, etc)

    -
    +

    +You should create a new vpn.tar.gz file for every other mesh which wants to be able to connect to yours. If you are prompted for a password it is 'freedombone'. +

    + +

    +From a deep packet inspection point of view the traffic going over the internet between mesh gateways will just look like any other TLS connection to a server. +

    +
    +
    + +
    +

    Mobile devices (phones, etc)

    +

    To allow mobile devices to connect to the mesh you will need a second wifi adapter connected to your laptop/netbook/SBC. Plug in a second wifi adapter then reboot the system. The second adaptor will then create a wifi hotspot which mobile devices can connect to. The hotspot name also contains its local IP address (eg. "mesh-192.168.1.83").

    @@ -731,9 +723,9 @@ On some android devices you may need to move the downloaded APK file from the
    -
    -

    Chat System

    -
    +
    +

    Chat System

    +

    Ensure that you're within wifi range of at least one other mesh peer (could be a router or client) and then you should see that the Chat and Other Users icons appear. Select the users icon and you should see a list of users on the mesh. Select the Chat icon and once you are connected you should see the status light turn green. If after a few minutes you don't get the green status light then try closing and re-opening the Tox chat application. Select the plus button to add a friend and then copy and paste in a Tox ID from the users list.

    @@ -792,9 +784,42 @@ At present video doesn't work reliably, but text and voice chat do work well.
    -
    -

    Social Network

    -
    +
    +

    Collaborative document editing

    +
    +

    +The mesh system includes the ability to collaboratively edit various sorts of documents using CryptPad. CryptPad is an almost peer-to-peer system in that it is designed for a client/server environment but that the server aspect of it is very minimal and limited to orchestrating the connected clients. With CryptPad installed on each mesh peer it effectively enables peer-to-peer collaborative editing. Documents are ephemeral and forgotten unless they're exported or copy-pasted to permanent storage. +

    + +
    + +
    +

    mesh_cryptpad1.jpg +

    +
    +
    + +

    +To create a document click on the CryptPad icon. Depending upon the specifications of your system it may take a few seconds to load, so don't be too disturned if the browser contents look blank for a while. Select Rich Text Pad and give yourself a username. +

    + +
    + +
    +

    mesh_cryptpad2.jpg +

    +
    +
    + +

    +If you have the chat system running you can then copy and paste the URL for your pad into the chat, and the other user can then open the link and edit the document with you. You can repeat that for however many other users you wish to be able to edit. +

    +
    +
    + +
    +

    Social Network

    +

    Patchwork is available as a social networking system for the mesh. Like all social network systems it has a stream of posts and you can follow or unfollow other users. You can also send private messages to other users with end-to-end encryption.

    @@ -829,9 +854,9 @@ The Secure Scuttlebutt protocol which Patchwork is based upon is intended to be
    -
    -

    Sharing Files

    -
    +
    +

    Sharing Files

    +

    You can make files publicly available on the network simply by dragging and dropping them into the Public folder on the desktop. To view the files belonging to another user select the desktop icon called Visit a site and enter the username or Tox ID of the other user.

    @@ -846,9 +871,9 @@ You can make files publicly available on the network simply by dragging and drop
    -
    -

    Blogging

    -
    +
    +

    Blogging

    +

    To create a blog post select the Blog icon on the desktop and then use the up and down cursor keys, space bar and enter key to add a new entry. Edit the title of the entry and add your text. You can also include photos if you wish - just copy them to the CreateBlog/content/images directory and then link to them as shown.