sks keyserver app

This commit is contained in:
Bob Mottram 2017-07-27 21:51:12 +01:00
parent f0998ddcbc
commit d9d93b18a7
3 changed files with 439 additions and 2 deletions

435
src/freedombone-app-keyserver Executable file
View File

@ -0,0 +1,435 @@
#!/bin/bash
#
# .---. . .
# | | |
# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
# | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
# ' ' --' --' -' - -' ' ' -' -' -' ' - --'
#
# Freedom in the Cloud
#
# SKS Keyserver
#
# License
# =======
#
# Copyright (C) 2017 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
VARIANTS='full full-vim'
IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=1
KEYSERVER_SKS_REPO="https://bitbucket.org/skskeyserver/sks-keyserver"
KEYSERVER_SKS_COMMIT='0106ba2'
KEYSERVER_WEB_REPO="https://github.com/mattrude/pgpkeyserver-lite"
KEYSERVER_WEB_COMMIT='a038cb79b927c99bf7da62f20d2c6a2f20374339'
KEYSERVER_PORT=11371
KEYSERVER_ONION_PORT=8122
KEYSERVER_DOMAIN_NAME=
KEYSERVER_CODE=
KEYSERVER_DUMP_URL="https://keyserver.mattrude.com/dump/current/"
vim_variables=(MY_USERNAME
KEYSERVER_DOMAIN_NAME
KEYSERVER_CODE)
function logging_on_keyserver {
echo -n ''
}
function logging_off_keyserver {
echo -n ''
}
function reconfigure_keyserver {
echo -n ''
}
function upgrade_keyserver_sks {
CURR_KEYSERVER_SKS_COMMIT=$(get_completion_param "keyserver commit")
if [[ "$CURR_KEYSERVER_SKS_COMMIT" == "$KEYSERVER_SKS_COMMIT" ]]; then
return
fi
if grep -q "keyserver domain" $COMPLETION_FILE; then
KEYSERVER_DOMAIN_NAME=$(get_completion_param "keyserver domain")
fi
# update to the next commit
function_check set_repo_commit
set_repo_commit $INSTALL_DIR/keyserver "keyserver commit" "$KEYSERVER_SKS_COMMIT" $KEYSERVER_SKS_REPO
cd $INSTALL_DIR/keyserver
make dep
make all
if [ ! "$?" = "0" ]; then
echo $'Unable to build sks-keyserver'
exit 836252
fi
make install
chown -R keyserver:keyserver /var/lib/sks
}
function upgrade_keyserver_web {
CURR_KEYSERVER_WEB_COMMIT=$(get_completion_param "keyserver web commit")
if [[ "$CURR_KEYSERVER_WEB_COMMIT" == "$KEYSERVER_WEB_COMMIT" ]]; then
return
fi
if grep -q "keyserver domain" $COMPLETION_FILE; then
KEYSERVER_DOMAIN_NAME=$(get_completion_param "keyserver domain")
fi
# update to the next commit
function_check set_repo_commit
set_repo_commit /var/www/$KEYSERVER_DOMAIN_NAME/htdocs "keyserver web commit" "$KEYSERVER_WEB_COMMIT" $KEYSERVER_WEB_REPO
chown -R www-data:www-data /var/www/$KEYSERVER_DOMAIN_NAME/htdocs
}
function upgrade_keyserver {
upgrade_keyserver_sks
upgrade_keyserver_web
}
function backup_local_keyserver {
echo -n ''
}
function restore_local_vim {
echo -n ''
}
function backup_remote_keyserver {
echo -n ''
}
function restore_remote_keyserver {
echo -n ''
}
function remove_keyserver {
systemctl stop keyserver
systemctl disable keyserver
rm /etc/systemd/system/keyserver.service
systemctl daemon-reload
read_config_param "KEYSERVER_DOMAIN_NAME"
nginx_dissite $KEYSERVER_DOMAIN_NAME
remove_certs ${KEYSERVER_DOMAIN_NAME}
if [ -f /etc/nginx/sites-available/$KEYSERVER_DOMAIN_NAME ]; then
rm -f /etc/nginx/sites-available/$KEYSERVER_DOMAIN_NAME
fi
if [ -d /var/www/$KEYSERVER_DOMAIN_NAME ]; then
rm -rf /var/www/$KEYSERVER_DOMAIN_NAME
fi
function_check remove_ddns_domain
remove_ddns_domain $KEYSERVER_DOMAIN_NAME
groupdel -f keyserver
userdel -r keyserver
remove_config_param KEYSERVER_DOMAIN_NAME
remove_config_param KEYSERVER_CODE
function_check remove_onion_service
remove_onion_service keyserver ${KEYSERVER_ONION_PORT}
remove_completion_param "install_keyserver"
sed -i '/keyserver/d' $COMPLETION_FILE
if [ -f /usr/bin/keyserver-start ]; then
rm /usr/bin/keyserver-start
fi
if [ -f /usr/bin/keyserver-stop ]; then
rm /usr/bin/keyserver-stop
fi
groupdel -f keyserver
userdel -r keyserver
}
function install_interactive_keyserver {
if [ ! $ONION_ONLY ]; then
ONION_ONLY='no'
fi
if [[ $ONION_ONLY != "no" ]]; then
KEYSERVER_DOMAIN_NAME='keyserver.local'
write_config_param "KEYSERVER_DOMAIN_NAME" "$KEYSERVER_DOMAIN_NAME"
else
function_check interactive_site_details
interactive_site_details "keyserver" "KEYSERVER_DOMAIN_NAME" "KEYSERVER_CODE"
fi
APP_INSTALLED=1
}
function install_keyserver {
apt-get -qy install build-essential gcc ocaml libdb-dev wget
if [ ! -d /var/www/$KEYSERVER_DOMAIN_NAME ]; then
mkdir /var/www/$KEYSERVER_DOMAIN_NAME
fi
if [ ! -d $INSTALL_DIR ]; then
mkdir -p $INSTALL_DIR
fi
cd $INSTALL_DIR
if [ -d /repos/keyserver ]; then
mkdir $INSTALL_DIR/keyserver
cp -r -p /repos/keyserver/. $INSTALL_DIR/keyserver
cd $INSTALL_DIR/keyserver
git pull
else
if [ -d $INSTALL_DIR/keyserver ]; then
cd $INSTALL_DIR/keyserver
pull
else
git_clone $KEYSERVER_SKS_REPO $INSTALL_DIR/keyserver
fi
fi
cd $INSTALL_DIR/keyserver
git checkout $KEYSERVER_SKS_COMMIT -b $KEYSERVER_SKS_COMMIT
set_completion_param "keyserver commit" "$KEYSERVER_SKS_COMMIT"
cd /var/www/$KEYSERVER_DOMAIN_NAME
if [ -d /var/www/$KEYSERVER_DOMAIN_NAME/htdocs ]; then
rm -rf /var/www/$KEYSERVER_DOMAIN_NAME/htdocs
fi
if [ -d /repos/keyserverweb ]; then
mkdir htdocs
cp -r -p /repos/keyserverweb/. htdocs
cd htdocs
git pull
else
git_clone $KEYSERVER_WEB_REPO htdocs
fi
cd /var/www/$KEYSERVER_DOMAIN_NAME/htdocs
git checkout $KEYSERVER_WEB_COMMIT -b $KEYSERVER_WEB_COMMIT
set_completion_param "keyserver web commit" "$KEYSERVER_WEB_COMMIT"
cd $INSTALL_DIR/keyserver
if [ ! -f Makefile.local.unused ]; then
echo $'Unused makefile not found'
exit 72398
fi
cp Makefile.local.unused Makefile.local
sed -i 's|LIBDB=.*|LIBDB=-ldb-5.3.1|g' Makefile.local
make dep
make all
if [ ! "$?" = "0" ]; then
echo $'Unable to build sks-keyserver'
exit 8356328
fi
make install
if [ ! -f /usr/local/bin/sks_build.sh ]; then
echo $'/usr/local/bin/sks_build.sh not found'
exit 238460
fi
USER_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
GPG_ID=$(su -m root -c "gpg --list-keys $USER_EMAIL_ADDRESS | sed -n '2p' | sed 's/^[ \t]*//'" - $MY_USERNAME)
if [ ! $GPG_ID ]; then
echo $'No GPG ID for admin user'
exit 846336
fi
if [ ${#GPG_ID} -lt 5 ]; then
echo $'GPG ID not retrieved for admin user'
exit 835292
fi
if [[ "$GPG_ID" == *"error"* ]]; then
echo $'GPG ID not retrieved for admin user due to error'
exit 74825
fi
sksconf_file=/var/lib/sks/sksconf
echo 'debuglevel: 3' > $sksconf_file
echo '' >> $sksconf_file
echo "hostname: $KEYSERVER_DOMAIN_NAME" >> $sksconf_file
echo '' >> $sksconf_file
echo 'hkp_address: 127.0.0.1' >> $sksconf_file
echo "hkp_port: $KEYSERVER_PORT" >> $sksconf_file
echo 'recon_port: 11370' >> $sksconf_file
echo '' >> $sksconf_file
echo "server_contact: $GPG_ID" >> $sksconf_file
echo '' >> $sksconf_file
echo 'initial_stat:' >> $sksconf_file
echo 'disable_mailsync:' >> $sksconf_file
echo 'membership_reload_interval: 1' >> $sksconf_file
echo 'stat_hour: 12' >> $sksconf_file
echo '' >> $sksconf_file
echo 'max_matches: 500' >> $sksconf_file
if [ ! -d /var/lib/sks/dump ]; then
mkdir -p /var/lib/sks/dump
fi
cd /var/lib/sks/dump
echo $'Getting keyserver dump. This may take a few hours, so be patient.'
wget -crp -e robots=off --level=1 --cut-dirs=3 -nH \
-A pgp,txt $KEYSERVER_DUMP_URL
cd /var/lib/sks
echo $'Building the keyserver database from the downloaded dump'
echo '2' | /usr/local/bin/sks_build.sh
KEYSERVER_ONION_HOSTNAME=$(add_onion_service keyserver 80 ${KEYSERVER_ONION_PORT})
echo '#!/bin/sh' > /usr/bin/keyserver-start
echo 'cd /var/lib/sks' >> /usr/bin/keyserver-start
echo 'echo -n \ sks_db' >> /usr/bin/keyserver-start
echo '$DAEMON db &' >> /usr/bin/keyserver-start
echo 'echo -n \ sks_recon' >> /usr/bin/keyserver-start
echo '$DAEMON recon &' >> /usr/bin/keyserver-start
chmod +x /usr/bin/keyserver-start
echo '#!/bin/sh' > /usr/bin/keyserver-stop
echo 'killall sks' >> /usr/bin/keyserver-stop
echo 'sleep 5' >> /usr/bin/keyserver-stop
chmod +x /usr/bin/keyserver-stop
echo '[Unit]' > /etc/systemd/system/keyserver.service
echo 'Description=SKS Keyserver' >> /etc/systemd/system/keyserver.service
echo 'After=syslog.target network.target nginx.target' >> /etc/systemd/system/keyserver.service
echo '' >> /etc/systemd/system/keyserver.service
echo '[Service]' >> /etc/systemd/system/keyserver.service
echo 'User=keyserver' >> /etc/systemd/system/keyserver.service
echo 'Group=keyserver' >> /etc/systemd/system/keyserver.service
echo "WorkingDirectory=/var/lib/sks" >> /etc/systemd/system/keyserver.service
echo "ExecStart=/usr/bin/keyserver-start" >> /etc/systemd/system/keyserver.service
echo "ExecStop=/usr/bin/keyserver-stop" >> /etc/systemd/system/keyserver.service
echo 'Restart=always' >> /etc/systemd/system/keyserver.service
echo 'RestartSec=10' >> /etc/systemd/system/keyserver.service
echo '' >> /etc/systemd/system/keyserver.service
echo '[Install]' >> /etc/systemd/system/keyserver.service
echo 'WantedBy=multi-user.target' >> /etc/systemd/system/keyserver.service
chmod +x /etc/systemd/system/keyserver.service
keyserver_nginx_site=/etc/nginx/sites-available/$KEYSERVER_DOMAIN_NAME
if [[ $ONION_ONLY == "no" ]]; then
function_check nginx_http_redirect
nginx_http_redirect $KEYSERVER_DOMAIN_NAME
echo 'server {' >> $keyserver_nginx_site
echo ' listen 443 ssl;' >> $keyserver_nginx_site
echo ' listen [::]:443 ssl;' >> $keyserver_nginx_site
echo " server_name $KEYSERVER_DOMAIN_NAME;" >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' # Security' >> $keyserver_nginx_site
function_check nginx_ssl
nginx_ssl $KEYSERVER_DOMAIN_NAME
function_check nginx_disable_sniffing
nginx_disable_sniffing $KEYSERVER_DOMAIN_NAME
echo ' add_header Strict-Transport-Security max-age=15768000;' >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' # Logs' >> $keyserver_nginx_site
echo ' access_log /dev/null;' >> $keyserver_nginx_site
echo ' error_log /dev/null;' >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' # Root' >> $keyserver_nginx_site
echo " root /var/www/$KEYSERVER_DOMAIN_NAME/htdocs;" >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' rewrite ^/stats /pks/lookup?op=stats;' >> $keyserver_nginx_site
echo ' rewrite ^/s/(.*) /pks/lookup?search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/search/(.*) /pks/lookup?search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/g/(.*) /pks/lookup?op=get&search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/get/(.*) /pks/lookup?op=get&search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/d/(.*) /pks/lookup?op=get&options=mr&search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/download/(.*) /pks/lookup?op=get&options=mr&search=$1;' >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' location /pks {' >> $keyserver_nginx_site
echo " proxy_pass http://127.0.0.1:$KEYSERVER_PORT;" >> $keyserver_nginx_site
echo ' proxy_pass_header Server;' >> $keyserver_nginx_site
echo " add_header Via \"1.1 $KEYSERVER_DOMAIN_NAME:$KEYSERVER_PORT (nginx)\";" >> $keyserver_nginx_site
echo ' proxy_ignore_client_abort on;' >> $keyserver_nginx_site
echo ' client_max_body_size 8m;' >> $keyserver_nginx_site
echo ' }' >> $keyserver_nginx_site
echo '}' >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
else
echo -n '' > $keyserver_nginx_site
fi
echo 'server {' >> $keyserver_nginx_site
echo " listen 127.0.0.1:$KEYSERVER_ONION_PORT default_server;" >> $keyserver_nginx_site
echo " server_name $KEYSERVER_ONION_HOSTNAME;" >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
function_check nginx_disable_sniffing
nginx_disable_sniffing $KEYSERVER_DOMAIN_NAME
echo '' >> $keyserver_nginx_site
echo ' # Logs' >> $keyserver_nginx_site
echo ' access_log /dev/null;' >> $keyserver_nginx_site
echo ' error_log /dev/null;' >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' # Root' >> $keyserver_nginx_site
echo " root /var/www/$KEYSERVER_DOMAIN_NAME/mail;" >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' rewrite ^/stats /pks/lookup?op=stats;' >> $keyserver_nginx_site
echo ' rewrite ^/s/(.*) /pks/lookup?search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/search/(.*) /pks/lookup?search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/g/(.*) /pks/lookup?op=get&search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/get/(.*) /pks/lookup?op=get&search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/d/(.*) /pks/lookup?op=get&options=mr&search=$1;' >> $keyserver_nginx_site
echo ' rewrite ^/download/(.*) /pks/lookup?op=get&options=mr&search=$1;' >> $keyserver_nginx_site
echo '' >> $keyserver_nginx_site
echo ' location /pks {' >> $keyserver_nginx_site
echo " proxy_pass http://127.0.0.1:$KEYSERVER_PORT;" >> $keyserver_nginx_site
echo ' proxy_pass_header Server;' >> $keyserver_nginx_site
echo " add_header Via \"1.1 $KEYSERVER_DOMAIN_NAME:$KEYSERVER_PORT (nginx)\";" >> $keyserver_nginx_site
echo ' proxy_ignore_client_abort on;' >> $keyserver_nginx_site
echo ' client_max_body_size 8m;' >> $keyserver_nginx_site
echo ' }' >> $keyserver_nginx_site
echo '}' >> $keyserver_nginx_site
function_check create_site_certificate
if [ ! -f /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem ]; then
create_site_certificate $KEYSERVER_DOMAIN_NAME 'yes'
fi
if [ -f /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.crt ]; then
mv /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.crt /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem
fi
if [ -f /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem ]; then
chown root:root /etc/ssl/certs/${KEYSERVER_DOMAIN_NAME}.pem
sed -i "s|.crt|.pem|g" /etc/nginx/sites-available/${KEYSERVER_DOMAIN_NAME}
fi
if [ -f /etc/ssl/private/${KEYSERVER_DOMAIN_NAME}.key ]; then
chown root:root /etc/ssl/private/${KEYSERVER_DOMAIN_NAME}.key
fi
groupadd keyserver
useradd -c "SKS Keyserver system account" -d /var/lib/sks -m -r -g keyserver keyserver
chown -R keyserver:keyserver /var/lib/sks
chown -R www-data:www-data /var/www/$KEYSERVER_DOMAIN_NAME/htdocs
function_check nginx_ensite
nginx_ensite $KEYSERVER_DOMAIN_NAME
systemctl enable keyserver
systemctl daemon-reload
systemctl start keyserver
systemctl restart nginx
set_completion_param "keyserver domain" "$KEYSERVER_DOMAIN_NAME"
APP_INSTALLED=1
}
# NOTE: deliberately no exit 0

View File

@ -210,7 +210,7 @@ function remove_wekan {
remove_completion_param install_wekan remove_completion_param install_wekan
sed -i '/wekan/d' $COMPLETION_FILE sed -i '/wekan/d' $COMPLETION_FILE
groupdel -f gogs groupdel -f wekan
userdel -r wekan userdel -r wekan
remove_meteor remove_meteor
} }
@ -259,8 +259,8 @@ function install_wekan_main {
fi fi
# an unprivileged user to run as # an unprivileged user to run as
useradd -d $WEKAN_DIR/ wekan
groupadd wekan groupadd wekan
useradd -c "Wekan account" -d $WEKAN_DIR/ -m -r -g wekan wekan
cd $WEKAN_DIR cd $WEKAN_DIR
git checkout $WEKAN_COMMIT -b $WEKAN_COMMIT git checkout $WEKAN_COMMIT -b $WEKAN_COMMIT

View File

@ -1275,6 +1275,8 @@ function image_preinstall_repos {
git clone $TOXIC_REPO $rootdir/repos/toxic git clone $TOXIC_REPO $rootdir/repos/toxic
git clone $TURTL_REPO $rootdir/repos/turtl git clone $TURTL_REPO $rootdir/repos/turtl
git clone $KANBOARD_REPO $rootdir/repos/kanboard git clone $KANBOARD_REPO $rootdir/repos/kanboard
git clone $KEYSERVER_SKS_REPO $rootdir/repos/keyserver
git clone $KEYSERVER_WEB_REPO $rootdir/repos/keyserverweb
#git clone $WEKAN_REPO $rootdir/repos/wekan #git clone $WEKAN_REPO $rootdir/repos/wekan
#git clone $FLOW_ROUTER_REPO $rootdir/repos/flowrouter #git clone $FLOW_ROUTER_REPO $rootdir/repos/flowrouter
#git clone $METEOR_USERACCOUNTS_REPO $rootdir/repos/meteoruseraccounts #git clone $METEOR_USERACCOUNTS_REPO $rootdir/repos/meteoruseraccounts