Merge branch 'stretch' of https://github.com/bashrc/freedombone

doc/EN/armbian.org

@@ -62,6 +62,7 @@ sudo su
 Then clone the Freedombone repository and checkout the stretch development branch.
 
 #+begin_src bash
+apt-get -y install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch

doc/EN/beaglebone.org

@@ -38,7 +38,7 @@ You may need to obtain a domain name and set up a dynamic DNS account for your n
 On your laptop or desktop prepare a microSD card image as follows. To create an image on a Debian based system:
 
 #+begin_src bash
-sudo apt-get install git
+sudo apt-get install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch
@@ -49,7 +49,7 @@ freedombone-image --setup debian
 Or on Arch/Parabola:
 
 #+begin_src bash
-sudo pacman -S git
+sudo pacman -S git dialog
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch

doc/EN/homeserver.org

@@ -20,7 +20,7 @@ The quickest way to get started is as follows. You will need to be running a Deb
 First install freedombone onto your local system (not the target hardware that you want to run Freedombone on). On a debian based distro:
 
 #+begin_src bash
-sudo apt-get install git
+sudo apt-get install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch
@@ -32,7 +32,7 @@ freedombone-image -t i386 --onion-addresses-only yes
 Or on Arch/Parabola:
 
 #+begin_src bash
-sudo pacman -S git
+sudo pacman -S git dialog
 git clone https://github.com/bashrc/freedombone
 cd freedombone
 git checkout stretch

src/freedombone-app-bdsmail

@@ -0,0 +1,447 @@
+#!/bin/bash
+#
+# .---.                  .              .
+# |                      |              |
+# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
+# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
+# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
+#
+#                    Freedom in the Cloud
+#
+# Brain Dead Simple Mail Server for i2p
+#
+# License
+# =======
+#
+# Copyright (C) 2018 Bob Mottram <bob@freedombone.net>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+VARIANTS='full full-vim'
+
+IN_DEFAULT_INSTALL=0
+SHOW_ON_ABOUT=1
+
+BDSMAIL_REPO="https://github.com/majestrate/bdsmail"
+BDSMAIL_COMMIT='8fb00a725edea59b31b8d23eb32e0c21972bb723'
+BDSMAIL_DIR=/etc/bdsmail
+I2P_SAM_PORT=7656
+I2P_SMTP_PORT=2525
+
+bdsmail=(MY_USERNAME)
+
+function bdsmail_configure_users {
+    for d in /home/*/ ; do
+        USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
+        if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
+
+            # Add the user to the i2p group
+            usermod -a -G i2psvc $USERNAME
+
+            if [ -f /home/$USERNAME/.muttrc ]; then
+                # Create a mutt i2p folder
+                if ! grep -q ' =i2p' /home/$USERNAME/.muttrc; then
+                    MUTT_MAILBOXES=$(grep "mailboxes =" /home/$USERNAME/.muttrc)
+                    sed -i "s|$MUTT_MAILBOXES|$MUTT_MAILBOXES =i2p|g" /home/$USERNAME/.muttrc
+                fi
+
+                # Create a mutt folder hook to the i2p config
+                if ! grep -q 'folder-hook !i2p' /home/$USERNAME/.muttrc; then
+                    echo 'folder-hook !i2p/*     source ~/.muttrc' >> /home/$USERNAME/.muttrc
+                fi
+                if ! grep -q 'folder-hook i2p' /home/$USERNAME/.muttrc; then
+                    echo 'folder-hook i2p/*     source ~/.mutt/bdsmail' >> /home/$USERNAME/.muttrc
+                fi
+            fi
+
+            # Create a directory where i2p mail will be stored
+            if [ ! -d /home/$USERNAME/Maildir/i2p/new ]; then
+                mkdir -p /home/$USERNAME/Maildir/i2p/cur
+                mkdir -p /home/$USERNAME/Maildir/i2p/new
+                chown -R $USERNAME:$USERNAME /home/$USERNAME/Maildir/i2p
+            fi
+        fi
+    done
+}
+
+function logging_on_bdsmail {
+    echo -n ''
+}
+
+function logging_off_bdsmail {
+    echo -n ''
+}
+
+function remove_user_bdsmail {
+    remove_username="$1"
+}
+
+function add_user_bdsmail {
+    new_username="$1"
+    new_user_password="$2"
+
+    if [ ! -d /home/$new_username/.mutt ]; then
+        mkdir /home/$new_username/.mutt
+        cp /etc/skel/.mutt/bdsmail /home/$new_username/.mutt
+    fi
+    sed -i "s|username|$new_username|g" /home/$new_username/.mutt/bdsmail
+    bdsmail_configure_users
+    $BDSMAIL_DIR/bin/mailtool $BDSMAIL_DIR/config.ini $new_username /home/$new_username/Maildir/i2p
+    chown -R $new_username:$new_username /home/$new_username/.mutt
+    echo '0'
+}
+
+function install_interactive_bdsmail {
+    echo -n ''
+    APP_INSTALLED=1
+}
+
+function change_password_bdsmail {
+    curr_username="$1"
+    new_user_password="$2"
+}
+
+function bdsmail_update_domain {
+    sed -i "s|set from=.*|set from=username@$(bdsmail_domain)|g" /etc/skel/.mutt/bdsmail
+    for d in /home/*/ ; do
+        USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
+        if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
+            cp /etc/skel/.mutt/bdsmail /home/${USERNAME}/.mutt/bdsmail
+            sed -i "s|set from=.*|set from=${USERNAME}@$(bdsmail_domain)|g" /home/${USERNAME}/.mutt/bdsmail
+            chown ${USERNAME}:${USERNAME} /home/${USERNAME}/.mutt/bdsmail
+        fi
+    done
+}
+
+function bdsmail_wait_for_key_generation {
+    # wait for domain to be generated by the daemon
+    # This can take a while, probably because i2p is connecting
+    bds_domain=
+    sleep_ctr=0
+    while [ ! $bds_domain ]; do
+        echo $"Waiting for i2p domain to be generated ${sleep_ctr}/100"
+        systemctl restart bdsmail
+        sleep 30
+        bds_domain=$(bdsmail_domain)
+        sleep_ctr=$((sleep_ctr + 1))
+        if [ $sleep_ctr -gt 100 ]; then
+            break
+        fi
+    done
+}
+
+function reconfigure_bdsmail {
+    systemctl stop bdsmail
+    rm $BDSMAIL_DIR/*.dat
+    rm $BDSMAIL_DIR/*.pem
+    bdsmail_wait_for_key_generation
+    if [ ! -f $BDSMAIL_DIR/bdsmail-privkey.dat ]; then
+        return
+    fi
+    bdsmail_update_domain
+}
+
+function upgrade_bdsmail {
+    CURR_BDSMAIL_COMMIT=$(get_completion_param "bdsmail commit")
+    if [[ "$CURR_BDSMAIL_COMMIT" == "$BDSMAIL_COMMIT" ]]; then
+        return
+    fi
+
+    # update to the next commit
+    set_repo_commit $BDSMAIL_DIR "bdsmail commit" "$BDSMAIL_COMMIT" $BDSMAIL_REPO
+    cd $BDSMAIL_DIR
+    make GOROOT=/home/go/go${GO_VERSION}
+    chown -R i2psvc:i2psvc $BDSMAIL_DIR
+    systemctl restart bdsmail
+
+    if ! grep -q "$(bdsmail_domain)" /etc/skel/.mutt/bdsmail; then
+        bdsmail_update_domain
+    fi
+}
+
+function backup_local_bdsmail {
+    systemctl stop bdsmail
+
+    source_directory=$BDSMAIL_DIR
+
+    function_check backup_directory_to_usb
+    dest_directory=bdsmail
+    backup_directory_to_usb $source_directory $dest_directory
+
+    systemctl start bdsmail
+}
+
+function restore_local_bdsmail {
+    systemctl stop bdsmail
+
+    temp_restore_dir=/root/tempbdsmail
+    bdsmail_dir=$BDSMAIL_DIR
+
+    function_check restore_directory_from_usb
+    restore_directory_from_usb $temp_restore_dir bdsmail
+    if [ -d $temp_restore_dir ]; then
+        if [ -d cp $temp_restore_dir$bdsmail_dir ]; then
+            cp -rp $temp_restore_dir$bdsmail_dir $bdsmail_dir/
+        else
+            if [ ! -d $bdsmail_dir ]; then
+                mkdir $bdsmail_dir
+            fi
+            cp -rp $temp_restore_dir/* $bdsmail_dir
+        fi
+        chown -R i2psvc:i2psvc $bdsmail_dir
+        rm -rf $temp_restore_dir
+    fi
+
+    systemctl start bdsmail
+}
+
+function backup_remote_bdsmail {
+    systemctl stop bdsmail
+
+    source_directory=$BDSMAIL_DIR
+
+    function_check backup_directory_to_friend
+    dest_directory=bdsmail
+    backup_directory_to_friend $source_directory $dest_directory
+
+    systemctl start bdsmail
+}
+
+function restore_remote_bdsmail {
+    systemctl stop bdsmail
+
+    temp_restore_dir=/root/tempbdsmail
+    bdsmail_dir=$BDSMAIL_DIR
+
+    function_check restore_directory_from_friend
+    restore_directory_from_friend $temp_restore_dir bdsmail
+    if [ -d $temp_restore_dir ]; then
+        if [ -d cp $temp_restore_dir$bdsmail_dir ]; then
+            cp -rp $temp_restore_dir$bdsmail_dir $bdsmail_dir/
+        else
+            if [ ! -d $bdsmail_dir ]; then
+                mkdir $bdsmail_dir
+            fi
+            cp -rp $temp_restore_dir/* $bdsmail_dir
+        fi
+        chown -R i2psvc:i2psvc $bdsmail_dir
+        rm -rf $temp_restore_dir
+    fi
+
+    systemctl start bdsmail
+}
+
+function remove_bdsmail {
+    if [ -f /etc/systemd/system/bdsmail.service ]; then
+        systemctl stop bdsmail
+        systemctl disable bdsmail
+        rm /etc/systemd/system/bdsmail.service
+    fi
+
+    for d in /home/*/ ; do
+        USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
+        if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
+            # remove the user from the i2p group
+            deluser $USERNAME i2psvc
+
+            # Remove mutt folder hook to the i2p config
+            if [ -f /home/$USERNAME/.muttrc ]; then
+                if grep -q 'folder-hook !i2p' /home/$USERNAME/.muttrc; then
+                    sed -i '/folder-hook !i2p/d' /home/$USERNAME/.muttrc
+                fi
+                if grep -q 'folder-hook i2p' /home/$USERNAME/.muttrc; then
+                    sed -i '/folder-hook i2p/d' /home/$USERNAME/.muttrc
+                fi
+            fi
+
+            # Remove folder
+            if grep -q ' =i2p' /home/$USERNAME/.muttrc; then
+                sed -i 's| =i2p||g' /home/$USERNAME/.muttrc
+            fi
+
+            # NOTE: leave Maildir/i2p/cur. We might want to archive that
+            # or just be reinstalling the system without losing mail
+            rm -rf /home/$USERNAME/Maildir/i2p/new
+        fi
+    done
+
+    remove_i2p
+    remove_app bdsmail
+    remove_completion_param install_bdsmail
+    sed -i '/bdsmail/d' $COMPLETION_FILE
+    rm -rf /etc/skel/.mutt
+    if [ -d $BDSMAIL_DIR ]; then
+        rm -rf $BDSMAIL_DIR
+    fi
+    rm /usr/bin/bdsmail_domain
+    sed -i '/bdsmail_distribute/d' /etc/crontab
+    rm /usr/bin/bdsmail_distribute
+    if [ -f /etc/skel/.mutt/bdsmail ]; then
+        rm /etc/skel/.mutt/bdsmail
+    fi
+}
+
+function install_bdsmail {
+    if [ -d $BDSMAIL_DIR ]; then
+        remove_bdsmail
+    fi
+
+    if [ -d /repos/bdsmail ]; then
+        mkdir $BDSMAIL_DIR
+        cp -r -p /repos/bdsmail/. $BDSMAIL_DIR
+        cd $BDSMAIL_DIR
+        git pull
+    else
+        git_clone $BDSMAIL_REPO $BDSMAIL_DIR
+    fi
+
+    if [ ! -d $BDSMAIL_DIR ]; then
+        echo $'Unable to clone bdsmail repo'
+        exit 5735735
+    fi
+
+    cd $BDSMAIL_DIR
+    git checkout $BDSMAIL_COMMIT -b $BDSMAIL_COMMIT
+    set_completion_param "bdsmail commit" "$BDSMAIL_COMMIT"
+
+    mkdir -p $BDSMAIL_DIR/Maildir/i2p
+    chmod -R 700 $BDSMAIL_DIR/Maildir
+
+    make GOROOT=/home/go/go${GO_VERSION}
+    if [ ! -f $BDSMAIL_DIR/bin/bdsconfig ]; then
+        echo $'Unable to make bdsmail'
+        exit 87923567842
+    fi
+
+    install_i2p
+    i2p_enable_sam
+
+    # create configuration file
+    $BDSMAIL_DIR/bin/bdsconfig > $BDSMAIL_DIR/config.ini
+    echo '[maild]' > $BDSMAIL_DIR/config.ini
+    echo "i2paddr = 127.0.0.1:$I2P_SAM_PORT" >> $BDSMAIL_DIR/config.ini
+    echo 'i2pkeyfile = bdsmail-privkey.dat' >> $BDSMAIL_DIR/config.ini
+    echo "bindmail = 127.0.0.1:$I2P_SMTP_PORT" >> $BDSMAIL_DIR/config.ini
+    echo 'bindweb = 127.0.0.1:8489' >> $BDSMAIL_DIR/config.ini
+    echo 'bindpop3 = 127.0.0.1:1110' >> $BDSMAIL_DIR/config.ini
+    echo 'domain = localhost' >> $BDSMAIL_DIR/config.ini
+    echo 'maildir = Maildir/i2p' >> $BDSMAIL_DIR/config.ini
+    echo 'database = localhost.sqlite' >> $BDSMAIL_DIR/config.ini
+    echo 'assets = contrib/assets/web' >> $BDSMAIL_DIR/config.ini
+
+    echo '[Unit]' > /etc/systemd/system/bdsmail.service
+    echo 'Description=bdsmail' >> /etc/systemd/system/bdsmail.service
+    echo 'After=syslog.target' >> /etc/systemd/system/bdsmail.service
+    echo 'After=network.target' >> /etc/systemd/system/bdsmail.service
+    echo '' >> /etc/systemd/system/bdsmail.service
+    echo '[Service]' >> /etc/systemd/system/bdsmail.service
+    echo 'Type=simple' >> /etc/systemd/system/bdsmail.service
+    echo 'User=i2psvc' >> /etc/systemd/system/bdsmail.service
+    echo 'Group=i2psvc' >> /etc/systemd/system/bdsmail.service
+    echo "WorkingDirectory=$BDSMAIL_DIR" >> /etc/systemd/system/bdsmail.service
+    echo "ExecStart=$BDSMAIL_DIR/bin/maild $BDSMAIL_DIR/config.ini" >> /etc/systemd/system/bdsmail.service
+    echo 'Restart=always' >> /etc/systemd/system/bdsmail.service
+    echo 'Environment="USER=i2psvc"' >> /etc/systemd/system/bdsmail.service
+    echo '' >> /etc/systemd/system/bdsmail.service
+    echo '[Install]' >> /etc/systemd/system/bdsmail.service
+    echo 'WantedBy=multi-user.target' >> /etc/systemd/system/bdsmail.service
+
+    echo '#!/usr/bin/env python2' > $BDSMAIL_DIR/get_address
+    echo 'import base64, hashlib, sys' >> $BDSMAIL_DIR/get_address
+    echo 'with open(sys.argv[1]) as f:' >> $BDSMAIL_DIR/get_address
+    echo "    print(base64.b32encode(hashlib.sha256(base64.b64decode(f.read(516), '-~')).digest()).strip('=')+\".b32.i2p\")" >> $BDSMAIL_DIR/get_address
+    chmod +x $BDSMAIL_DIR/get_address
+
+    chown -R i2psvc:i2psvc $BDSMAIL_DIR
+    systemctl enable bdsmail
+    systemctl start bdsmail
+
+    echo '#!/bin/bash' > /usr/bin/bdsmail_distribute
+    echo "BDSMAIL_DIR=$BDSMAIL_DIR" >> /usr/bin/bdsmail_distribute
+    echo "MAIL_DIR=\$BDSMAIL_DIR/\$(cat \$BDSMAIL_DIR/config.ini | grep 'maildir =' | awk -F ' ' '{print \$3}')" >> /usr/bin/bdsmail_distribute
+    echo 'if [ ! -d $MAIL_DIR/postmaster/new ]; then' >> /usr/bin/bdsmail_distribute
+    echo '    exit 0' >> /usr/bin/bdsmail_distribute
+    echo 'fi' >> /usr/bin/bdsmail_distribute
+    echo 'for filename in $MAIL_DIR/postmaster/new/*; do' >> /usr/bin/bdsmail_distribute
+    echo '    to_line=$(cat $filename | grep "To: " | head -n 1)' >> /usr/bin/bdsmail_distribute
+    echo "    to_username=\$(echo \"\$to_line\" | awk -F ' ' '{print \$2}' | awk -F '@' '{print \$1}')" >> /usr/bin/bdsmail_distribute
+    echo '    if [ -d /home/$to_username/Maildir/i2p/new ]; then' >> /usr/bin/bdsmail_distribute
+    echo '        chown $to_username:$to_username $filename' >> /usr/bin/bdsmail_distribute
+    echo '        chmod 600 $filename' >> /usr/bin/bdsmail_distribute
+    echo '        mv $filename /home/$to_username/Maildir/i2p/new' >> /usr/bin/bdsmail_distribute
+    echo '    fi' >> /usr/bin/bdsmail_distribute
+    echo 'done' >> /usr/bin/bdsmail_distribute
+    chmod +x /usr/bin/bdsmail_distribute
+
+    if ! grep -q 'bdsmail_distribute' /etc/crontab; then
+        echo '*/1            * *   *   *   root /usr/bin/bdsmail_distribute 2> /dev/null' >> /etc/crontab
+    fi
+
+    echo '#!/bin/bash' > /usr/bin/bdsmail_domain
+    echo "cd $BDSMAIL_DIR" >> /usr/bin/bdsmail_domain
+    echo 'if [ ! -f bdsmail-privkey.dat ]; then' >> /usr/bin/bdsmail_domain
+    echo '    exit 1' >> /usr/bin/bdsmail_domain
+    echo 'fi' >> /usr/bin/bdsmail_domain
+    echo "python2 get_address bdsmail-privkey.dat | tr '[:upper:]' '[:lower:]'" >> /usr/bin/bdsmail_domain
+    chmod +x /usr/bin/bdsmail_domain
+
+    echo ''
+    echo $'Now we will wait for i2p to connect and a private key to be generated'
+    echo $'This may take a while.'
+    echo ''
+
+    bdsmail_wait_for_key_generation
+
+    if [ ! $bds_domain ]; then
+        systemctl stop bdsmail
+        systemctl disable bdsmail
+        remove_i2p
+        echo $'Failed to get the bdsmail domain'
+        exit 8934638
+    fi
+
+    bdsmail_admin_password="$(create_password ${MINIMUM_PASSWORD_LENGTH})"
+    ${PROJECT_NAME}-pass -u $MY_USERNAME -a bdsmail -p "$bdsmail_admin_password"
+    $BDSMAIL_DIR/bin/mailtool $BDSMAIL_DIR/config.ini admin $BDSMAIL_DIR/Maildir/i2p/admin "$bdsmail_admin_password"
+
+    # Create mutt configuration
+    if [ ! -d /etc/skel/.mutt ]; then
+        mkdir /etc/skel/.mutt
+    fi
+    echo 'set mbox_type=Maildir' > /etc/skel/.mutt/bdsmail
+    echo "set smtp_url=smtp://admin:${bdsmail_admin_password}@127.0.0.1:$I2P_SMTP_PORT/" >> /etc/skel/.mutt/bdsmail
+    echo 'set use_from=yes' >> /etc/skel/.mutt/bdsmail
+    echo "set from=username@${bds_domain}" >> /etc/skel/.mutt/bdsmail
+    echo "set spoolfile=~/Maildir/i2p" >> /etc/skel/.mutt/bdsmail
+    echo 'set pgp_autoencrypt=no' >> /etc/skel/.mutt/bdsmail
+    echo 'set pgp_replyencrypt=no' >> /etc/skel/.mutt/bdsmail
+    echo 'set pgp_autosign=no' >> /etc/skel/.mutt/bdsmail
+    echo 'set pgp_replysign=no' >> /etc/skel/.mutt/bdsmail
+
+    # mutt configuration for the admin user
+    if [ ! -d /home/$MY_USERNAME/.mutt ]; then
+        mkdir /home/$MY_USERNAME/.mutt
+    fi
+    cp /etc/skel/.mutt/bdsmail /home/$MY_USERNAME/.mutt
+    sed -i "s|username|$MY_USERNAME|g" /home/$MY_USERNAME/.mutt/bdsmail
+    chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.mutt
+
+    bdsmail_configure_users
+
+    $BDSMAIL_DIR/bin/mailtool $BDSMAIL_DIR/config.ini $MY_USERNAME /home/$MY_USERNAME/Maildir/i2p
+
+    APP_INSTALLED=1
+}
+
+# NOTE: deliberately there is no "exit 0"

src/freedombone-app-peertube

@@ -51,6 +51,7 @@ peertube_variables=(PEERTUBE_DOMAIN_NAME
                     ONION_ONLY
                     DDNS_PROVIDER
                     MY_USERNAME
+                    ARCHITECTURE
                     MY_EMAIL_ADDRESS)
 
 function peertube_create_database {
@@ -140,8 +141,8 @@ function peertube_disable_signups {
            --yesno $"\nDo you wish to disable further PeerTube signups?" 8 75
     sel=$?
     case $sel in
-        0) sed "0,/RE/s/enabled:.*/enabled: false/" $PEERTUBE_DIR/config/production.yaml;;
+        0) sed -i "0,/enabled:.*/s//enabled: false/" $PEERTUBE_DIR/config/production.yaml;;
-        1) sed "0,/RE/s/enabled:.*/enabled: true/" $PEERTUBE_DIR/config/production.yaml;;
+        1) sed -i "0,/enabled:.*/s//enabled: true/" $PEERTUBE_DIR/config/production.yaml;;
         255) return;;
     esac
 
@@ -341,9 +342,8 @@ function remove_peertube {
     sed -i '/peertube/d' $COMPLETION_FILE
 
     function_check drop_database_postgresql
-    drop_database_postgresql peertube
+    drop_database_postgresql peertube peertube
 
-    remove_postgresql_user peertube
     groupdel -f peertube
     userdel -r peertube
 
@@ -589,11 +589,12 @@ function peertube_create_config {
     echo '    size: 10 # Max number of previews you want to cache' >> $peertube_config_file
     echo '' >> $peertube_config_file
     echo 'admin:' >> $peertube_config_file
-    echo "  email: 'root@local'" >> $peertube_config_file
+    # This is deliberately a dummy email address
+    echo "  email: 'testuser@testdomain.net'" >> $peertube_config_file
     echo '' >> $peertube_config_file
     echo 'signup:' >> $peertube_config_file
     echo '  enabled: true' >> $peertube_config_file
-    echo '  limit: 2 # When the limit is reached, registrations are disabled. -1 == unlimited' >> $peertube_config_file
+    echo '  limit: 5 # When the limit is reached, registrations are disabled. -1 == unlimited' >> $peertube_config_file
     echo '' >> $peertube_config_file
     echo 'user:' >> $peertube_config_file
     echo '  # Default value of maximum video BYTES the user can upload (does not take into account transcoded files).' >> $peertube_config_file
@@ -829,6 +830,12 @@ function install_peertube {
     systemctl start peertube
     systemctl restart nginx
 
+    # wait for the database to get generated after initial peertube daemon start
+    sleep 10
+
+    # update the admin email address after creation of the database
+    sed -i "s|email: .*|email: '$MY_EMAIL_ADDRESS'|g" $PEERTUBE_DIR/config/production.yaml
+
     set_completion_param "peertube domain" "$PEERTUBE_DOMAIN_NAME"
     APP_INSTALLED=1
 }

src/freedombone-app-rss

@@ -428,7 +428,11 @@ function install_rss_main {
     echo '    deny all;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '  }' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
-    echo '  add_header X-Frame-Options DENY;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-XSS-Protection "1; mode=block";' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Robots-Tag none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Download-Options noopen;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Permitted-Cross-Domain-Policies none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Frame-Options SAMEORIGIN;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '  add_header X-Content-Type-Options nosniff;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '  client_max_body_size 15m;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '}' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
@@ -482,7 +486,11 @@ function install_rss_main {
     echo '    deny all;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '  }' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
-    echo '  add_header X-Frame-Options DENY;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-XSS-Protection "1; mode=block";' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Robots-Tag none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Download-Options noopen;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Permitted-Cross-Domain-Policies none;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
+    echo '  add_header X-Frame-Options SAMEORIGIN;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '  add_header X-Content-Type-Options nosniff;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '  client_max_body_size 15m;' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME
     echo '}' >> /etc/nginx/sites-available/$RSS_READER_DOMAIN_NAME

src/freedombone-backup-local

@@ -13,7 +13,7 @@
 # License
 # =======
 #
-# Copyright (C) 2015-2016 Bob Mottram <bob@freedombone.net>
+# Copyright (C) 2015-2018 Bob Mottram <bob@freedombone.net>
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -177,6 +177,10 @@ function backup_users {
                 fi
                 backup_directory_to_usb /home/$USERNAME/tempbackup mutt/$USERNAME
             fi
+            if [ -d /home/$USERNAME/.mutt ]; then
+                echo $"Backing up Mutt configurations for $USERNAME"
+                backup_directory_to_usb /home/$USERNAME/.mutt mutt/${USERNAME}configs
+            fi
 
             # Backup email
             if [ -d /home/$USERNAME/Maildir ]; then

src/freedombone-backup-remote

@@ -231,6 +231,10 @@ function backup_users {
                 fi
                 backup_directory_to_friend /home/$USERNAME/tempbackup mutt/$USERNAME
             fi
+            if [ -d /home/$USERNAME/.mutt ]; then
+                echo $"Backing up Mutt configurations for $USERNAME"
+                backup_directory_to_friend /home/$USERNAME/.mutt mutt/${USERNAME}configs
+            fi
 
             # procmail settings
             if [ -f /home/$USERNAME/.procmailrc ]; then

src/freedombone-controlpanel-user

@@ -882,6 +882,20 @@ function menu_run_client_app {
     fi
 }
 
+function show_your_email_address {
+    GPG_FINGERPRINT=$(gpg --fingerprint $GPG_ID | sed -n '2p' | sed 's/^[ \t]*//')
+    GPG_DATE=$(gpg --fingerprint $GPG_ID | grep -i "pub" | head -n 1 | awk -F ' ' '{print $3}')
+    if [ ! -d /etc/bdsmail ]; then
+        dialog --title $"Show your Email Address" \
+               --backtitle $"Freedombone User Control Panel" \
+               --msgbox $"Email Address: $MY_EMAIL_ADDRESS\n\nKey ID: $GPG_ID\n\nFingerprint: $GPG_FINGERPRINT\n\nCreated: $GPG_DATE" 12 70
+    else
+        dialog --title $"Show your Email Address" \
+               --backtitle $"Freedombone User Control Panel" \
+               --msgbox $"\nYou can press SHIFT and then drag the mouse and right click to copy.\n\nEmail Address: $MY_EMAIL_ADDRESS\n\nKey ID: $GPG_ID\n\nFingerprint: $GPG_FINGERPRINT\n\nCreated: $GPG_DATE\n\nI2P Address: ${USER}@$(bdsmail_domain)" 17 90
+    fi
+}
+
 function menu_top_level {
     while true
     do
@@ -889,16 +903,17 @@ function menu_top_level {
         trap "rm -f $data" 0 1 2 5 15
         dialog --backtitle $"Freedombone User Control Panel" \
                --title $"User Control Panel" \
-               --radiolist $"Choose an operation:" 19 50 12 \
+               --radiolist $"Choose an operation:" 20 60 13 \
                1 $"Use Email" off \
-               2 $"Change Email Filtering Rules" off \
+               2 $"Show your Email Address" off \
-               3 $"Run an App" off \
+               3 $"Change Email Filtering/Blocking Rules" off \
-               4 $"Browse the Web" off \
+               4 $"Run an App" off \
-               5 $"My Encryption Keys" off \
+               5 $"Browse the Web" off \
-               6 $"Set an outgoing email proxy" off \
+               6 $"My Encryption Keys" off \
-               7 $"Administrator controls" off \
+               7 $"Set an outgoing email proxy" off \
-               8 $"Exit to the command line" off \
+               8 $"Administrator controls" off \
-               9 $"Log out" on 2> $data
+               9 $"Exit to the command line" off \
+               10 $"Log out" on 2> $data
         sel=$?
         case $sel in
             1) rm $data
@@ -908,15 +923,16 @@ function menu_top_level {
         esac
         case $(cat $data) in
             1) mutt;;
-            2) menu_email;;
+            2) show_your_email_address;;
-            3) menu_run_client_app;;
+            3) menu_email;;
-            4) torify elinks -no-home;;
+            4) menu_run_client_app;;
-            5) menu_encryption_keys;;
+            5) torify elinks -no-home;;
-            6) smtp_proxy;;
+            6) menu_encryption_keys;;
-            7) menu_admin;;
+            7) smtp_proxy;;
-            8) rm $data
+            8) menu_admin;;
+            9) rm $data
                break;;
-            9) kill -HUP `pgrep -s 0 -o`;;
+            10) kill -HUP `pgrep -s 0 -o`;;
         esac
         rm $data
     done

src/freedombone-image-customise

@@ -1946,6 +1946,7 @@ function image_preinstall_repos {
     git clone $PEERTUBE_REPO $rootdir/repos/peertube
     git clone $PRIVATEBIN_REPO $rootdir/repos/privatebin
     git clone $EDITH_REPO $rootdir/repos/edith
+    git clone $BDSMAIL_REPO $rootdir/repos/bdsmail
     #git clone $WEKAN_REPO $rootdir/repos/wekan
     #git clone $FLOW_ROUTER_REPO $rootdir/repos/flowrouter
     #git clone $METEOR_USERACCOUNTS_REPO $rootdir/repos/meteoruseraccounts

src/freedombone-restore-local

@@ -404,10 +404,18 @@ function restore_mutt_settings {
     if [ -d $USB_MOUNT/backup/mutt ]; then
         for d in $USB_MOUNT/backup/mutt/*/ ; do
             USERNAME=$(echo "$d" | awk -F '/' '{print $6}')
+
+            # skip over configurations
+            if [[ "$USERNAME" == *'configs' ]]; then
+                continue
+            fi
+
             if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
                 if [ ! -d /home/$USERNAME ]; then
                     ${PROJECT_NAME}-adduser $USERNAME
                 fi
+                echo $"Restoring Mutt configurations for $USERNAME"
+                restore_directory_from_usb /home/$USERNAME/.mutt mutt/${USERNAME}configs
                 echo $"Restoring Mutt settings for $USERNAME"
                 temp_restore_dir=/root/tempmutt
                 restore_directory_from_usb $temp_restore_dir mutt/$USERNAME

src/freedombone-restore-remote

@@ -360,11 +360,19 @@ function restore_mutt_settings {
     fi
     for d in $SERVER_DIRECTORY/backup/mutt/*/ ; do
         USERNAME=$(echo "$d" | awk -F '/' '{print $6}')
+
+        # skip over configurations
+        if [[ "$USERNAME" == *'configs' ]]; then
+            continue
+        fi
+
         if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
             if [ -d $SERVER_DIRECTORY/backup/mutt/$USERNAME ]; then
                 if [ ! -d /home/$USERNAME ]; then
                     ${PROJECT_NAME}-adduser $USERNAME
                 fi
+                echo $"Restoring Mutt configurations for $USERNAME"
+                restore_directory_from_friend /home/$USERNAME/.mutt mutt/${USERNAME}configs
                 echo $"Restoring Mutt settings for $USERNAME"
                 temp_restore_dir=/root/tempmutt
                 restore_directory_from_friend ${temp_restore_dir} mutt/$USERNAME

src/freedombone-tests

@@ -892,6 +892,12 @@ function test_stig {
     output "SV-86927r2_rule" $? ${SETLANG}
     ################
 
+    ##Check that pam_python is not installed
+    bash $STIG_TESTS_DIR/check-ssh.sh pam_python >/dev/null 2>&1 &
+    stig_spinner $!
+    output "SV-86724r2_rule" $? ${SETLANG}
+    ################
+
     ##RHEL-06-000247
     ##The system clock must be synchronized continuously, or at least daily.
 

src/freedombone-utils-firewall

@@ -265,7 +265,7 @@ function configure_internet_protocol {
     if ! grep -q "ignore pings" /etc/sysctl.conf; then
         echo '# ignore pings' >> /etc/sysctl.conf
         echo 'net.ipv4.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
-        echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
+        #echo 'net.ipv6.icmp_echo_ignore_all = 1' >> /etc/sysctl.conf
     fi
     if ! grep -q "disable ipv6" /etc/sysctl.conf; then
         echo '# disable ipv6' >> /etc/sysctl.conf

src/freedombone-utils-go

@@ -32,7 +32,7 @@
 # before getting to the version we want
 GO_INTERMEDIATE_VERSION=1.4.2
 
-GO_VERSION=1.9
+GO_VERSION=1.9.4
 
 GO_REPO="https://go.googlesource.com/go"
 GO_PACKAGE_MANAGER_REPO="https://github.com/gpmgo/gopm"

src/freedombone-utils-i2p

@@ -0,0 +1,101 @@
+#!/bin/bash
+#
+# .---.                  .              .
+# |                      |              |
+# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
+# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
+# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
+#
+#                    Freedom in the Cloud
+#
+# i2p functions
+#
+# There's a problem with installing this onto mesh images, which is
+# that qemu appears to run out of RAM when using yarn to add webpack.
+#
+# License
+# =======
+#
+# Copyright (C) 2017-2018 Bob Mottram <bob@freedombone.net>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+I2P_DOMAIN='deb.i2p2.de'
+
+function install_i2p {
+    if [ ! -d $INSTALL_DIR ]; then
+       mkdir -p $INSTALL_DIR
+    fi
+
+    # install the gpg key
+    cd $INSTALL_DIR
+    if [ -f i2p-debian-repo.key.asc ]; then
+        rm i2p-debian-repo.key.asc
+    fi
+    wget https://geti2p.net/_static/i2p-debian-repo.key.asc
+    if [ ! -f i2p-debian-repo.key.asc ]; then
+        echo $'failed to ontain i2p repo gpg key'
+        exit 7834627345
+    fi
+    apt-key add i2p-debian-repo.key.asc
+
+    echo "deb https://${I2P_DOMAIN}/ stretch main" > /etc/apt/sources.list.d/i2p.list
+    echo "deb-src https://${I2P_DOMAIN}/ stretch main" >> /etc/apt/sources.list.d/i2p.list
+
+    # i2p needs ipv6 to be enabled
+    sed -i 's|net.ipv6.conf.all.disable_ipv6.*|net.ipv6.conf.all.disable_ipv6 = 0|g' /etc/sysctl.conf
+    /sbin/sysctl -p -q
+
+    apt-get update
+    apt-get -yq install i2p i2p-keyring
+    systemctl restart i2p
+}
+
+function remove_i2p {
+    apt-get -yq remove i2p-router --purge
+    apt-get -yq remove i2p --purge
+    apt-get -yq remove i2p-keyring --purge
+    apt-get -yq autoremove
+
+    # It's assumed here that ipv6 is only needed for i2p
+    # This might not be true in future
+    sed -i 's|net.ipv6.conf.all.disable_ipv6.*|net.ipv6.conf.all.disable_ipv6 = 1|g' /etc/sysctl.conf
+    /sbin/sysctl -p -q
+
+    if [ -d /var/lib/i2p ]; then
+        rm -rf /var/lib/i2p
+    fi
+    if [ -d /etc/i2p ]; then
+        rm -rf /etc/i2p
+    fi
+    if [ -d /usr/share/i2p ]; then
+        rm -rf /usr/share/i2p
+    fi
+}
+
+function i2p_enable_sam {
+    if [ ! -f /var/lib/i2p/i2p-config/clients.config ]; then
+        apt-get -yq remove i2p --purge
+        apt-get -yq remove i2p-router --purge
+        apt-get -yq install i2p
+        apt-get -yq install i2p-router
+        sleep 2
+    fi
+    if [ ! -f /var/lib/i2p/i2p-config/clients.config ]; then
+        echo $'File not found /var/lib/i2p/i2p-config/clients.config'
+        exit 483648364834
+    fi
+    sed -i 's|clientApp.1.startOnLoad=.*|clientApp.1.startOnLoad=true|g' /var/lib/i2p/i2p-config/clients.config
+    systemctl restart i2p
+}

src/freedombone-utils-nodejs

@@ -205,7 +205,7 @@ function upgrade_nodejs {
         npm upgrade -g n@${NODEJS_N_VERSION} --save
     fi
     if [[ "$CURR_NODE_VERSION" != "v${NODEJS_VERSION}" ]]; then
-        n {NODEJS_VERSION}
+        n ${NODEJS_VERSION}
     fi
     cp /usr/local/bin/n /usr/bin/n
     if [ -f /usr/local/bin/npm ]; then

src/freedombone-utils-postgresql

@@ -124,8 +124,12 @@ function remove_postgresql_user {
 
 function drop_database_postgresql {
     database_name="$1"
+    database_owner_name="$2"
     cd /etc/postgresql
     sudo -u postgres psql -c "drop database $database_name"
+    if [ ${#database_owner_name} -gt 0 ]; then
+        sudo -u postgres psql -c "drop user $database_owner_name"
+    fi
 }
 
 function run_system_query_postgresql {

tests/check-ssh.sh

@@ -194,4 +194,9 @@ case $1 in
             exit 1
         fi
         ;;
+    pam_python)
+        if grep -q 'pam_python' /etc/pam.d/sshd; then
+            exit 1
+        fi
+        ;;
 esac

tests/output.sh

@@ -119,6 +119,11 @@ Check_content: Verify the SSH private host key files have mode "0600" or less pe
                   printf '\n######################\n\nThis system is not intended to support graphical output\n\n######################\n\n' >> $LOG
               fi
               ;;
+    SV-86724r2_rule) log_msg $2 'Dont allow pam_python.'
+              if [ $2 -ne 0 ];then
+                  printf '\n######################\n\npam_python within /etc/pam.d/sshd could indicate a possible attack on ssh logins.\n\n######################\n\n' >> $LOG
+              fi
+              ;;
     V-38455)  if [ "$3" = "en" ]; then
                   log_msg $2 'The system must use a separate file system for /tmp.'
               else

website/EN/armbian.html

@@ -3,7 +3,7 @@
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 <head>
-<!-- 2017-11-28 Tue 17:02 -->
+<!-- 2018-02-12 Mon 20:13 -->
 <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <title>&lrm;</title>
@@ -326,7 +326,8 @@ Then clone the Freedombone repository and checkout the stretch development branc
 </p>
 
 <div class="org-src-container">
-<pre class="src src-bash">git clone https://github.com/bashrc/freedombone
+<pre class="src src-bash">apt-get -y install git dialog build-essential
+git clone https://github.com/bashrc/freedombone
 <span class="org-builtin">cd</span> freedombone
 git checkout stretch
 </pre>

website/EN/beaglebone.html

@@ -3,10 +3,10 @@
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 <head>
-<!-- 2017-09-12 Tue 09:56 -->
+<!-- 2018-02-12 Mon 20:12 -->
 <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
-<title></title>
+<title>&lrm;</title>
 <meta name="generator" content="Org mode" />
 <meta name="author" content="Bob Mottram" />
 <meta name="description" content="How to install Freedombone onto a Beaglebone Black"
@@ -286,13 +286,13 @@ On your laptop or desktop prepare a microSD card image as follows. To create an
 </p>
 
 <div class="org-src-container">
-<pre><code class="src src-bash">sudo apt-get install git
+<pre class="src src-bash">sudo apt-get install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 <span class="org-builtin">cd</span> freedombone
 git checkout stretch
 sudo make install
 freedombone-image --setup debian
-</code></pre>
+</pre>
 </div>
 
 <p>
@@ -300,13 +300,13 @@ Or on Arch/Parabola:
 </p>
 
 <div class="org-src-container">
-<pre><code class="src src-bash">sudo pacman -S git
+<pre class="src src-bash">sudo pacman -S git dialog
 git clone https://github.com/bashrc/freedombone
 <span class="org-builtin">cd</span> freedombone
 git checkout stretch
 sudo make install
 freedombone-image --setup parabola
-</code></pre>
+</pre>
 </div>
 
 <div class="org-center">

website/EN/homeserver.html

@@ -3,7 +3,7 @@
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 <head>
-<!-- 2018-01-29 Mon 10:19 -->
+<!-- 2018-02-12 Mon 20:11 -->
 <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <title>&lrm;</title>
@@ -256,7 +256,7 @@ First install freedombone onto your local system (not the target hardware that y
 </p>
 
 <div class="org-src-container">
-<pre class="src src-bash">sudo apt-get install git
+<pre class="src src-bash">sudo apt-get install git dialog build-essential
 git clone https://github.com/bashrc/freedombone
 <span class="org-builtin">cd</span> freedombone
 git checkout stretch
@@ -271,7 +271,7 @@ Or on Arch/Parabola:
 </p>
 
 <div class="org-src-container">
-<pre class="src src-bash">sudo pacman -S git
+<pre class="src src-bash">sudo pacman -S git dialog
 git clone https://github.com/bashrc/freedombone
 <span class="org-builtin">cd</span> freedombone
 git checkout stretch