245 lines
8.5 KiB
Bash
Executable File
245 lines
8.5 KiB
Bash
Executable File
#!/bin/sh -eu
|
|
|
|
#
|
|
# This runs as www-data
|
|
#
|
|
|
|
occupgrade() {
|
|
# Maintenance mode must be off
|
|
./occ maintenance:mode --off
|
|
# Sometimes this has to happen twice
|
|
./occ upgrade
|
|
./occ upgrade
|
|
}
|
|
|
|
plugin_status() {
|
|
plugin="$1"
|
|
plugins_state="$(./occ app:list --output=json_pretty)"
|
|
version="$(echo "${plugins_state}" | jq -r ".enabled.${plugin}")"
|
|
if [ "${version}" != "null" ]; then
|
|
printf "%s\t%s" "enabled" "${version}"
|
|
else
|
|
version="$(echo "${plugins_state}" | jq -r ".disabled.${plugin}")"
|
|
is_available="$(echo "${plugins_state}" | jq -r \
|
|
--arg plugin "${plugin}" \
|
|
'.disabled | to_entries[] | select(.key == $plugin) | .key')"
|
|
if [ "${is_available}" = "${plugin}" ]; then
|
|
printf "%s\t%s" "disabled" "${version}"
|
|
else
|
|
printf "%s\t%s" "n/a" "n/a"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
|
|
cat <<EOF
|
|
**************************************
|
|
Performing DD-specific Nextcloud setup
|
|
**************************************
|
|
|
|
EOF
|
|
|
|
# Install static settings
|
|
echo "--> Setting up static DD config"
|
|
STATIC_CFG=/var/www/html/config/zzz_dd.config.php
|
|
cat > "${STATIC_CFG}" <<EOF
|
|
<?php
|
|
/** DD-customised static settings
|
|
*/
|
|
\$CONFIG = array(
|
|
'default_language' => 'ca',
|
|
'skeletondirectory' => '',
|
|
'theme' => 'dd',
|
|
'allow_local_remote_servers' => true,
|
|
);
|
|
EOF
|
|
|
|
occupgrade
|
|
|
|
# These cannot be edited from outside of the DD project
|
|
# Operators should instead rely on the environment variables to ease deployment
|
|
# EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
|
|
CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,onlyoffice"
|
|
CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,ownpad"
|
|
|
|
if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
|
|
CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
|
|
USING_CLAMAV="YES"
|
|
else
|
|
CORE_PLUGINS_DISABLE="${CORE_PLUGINS_DISABLE},files_antivirus"
|
|
fi
|
|
|
|
# Take care of installing core plugins and extra requested plugins
|
|
PLUGINS="${CORE_PLUGINS_ENABLE},${CORE_PLUGINS_DISABLE},${EXTRA_PLUGINS_ENABLE:-},${EXTRA_PLUGINS_DISABLE:-}"
|
|
|
|
# Install all plugins
|
|
# shellcheck disable=SC2086 # We do want multiple arguments
|
|
for plugin in $(echo "${PLUGINS}" | tr ',' '\n'); do
|
|
if plugin_status "${plugin}" | grep -qE "^n/a"; then
|
|
echo "--> Installing ${plugin}"
|
|
./occ --no-warnings app:install "${plugin}"
|
|
fi
|
|
done
|
|
|
|
# Enable core plugins
|
|
# shellcheck disable=SC2086 # We do want multiple arguments
|
|
for plugin in $(echo "${CORE_PLUGINS_ENABLE}" | tr ',' '\n'); do
|
|
if plugin_status "${plugin}" | grep -qE "^disabled"; then
|
|
echo "--> Enabling core ${plugin}"
|
|
./occ --no-warnings app:enable "${plugin}"
|
|
fi
|
|
done
|
|
|
|
# Disable core plugins
|
|
# shellcheck disable=SC2086 # We do want multiple arguments
|
|
for plugin in $(echo "${CORE_PLUGINS_DISABLE}" | tr ',' '\n'); do
|
|
if plugin_status "${plugin}" | grep -qE "^enabled"; then
|
|
echo "--> Disabling core ${plugin}"
|
|
./occ --no-warnings app:disable "${plugin}"
|
|
fi
|
|
done
|
|
|
|
|
|
# Enable extra plugins
|
|
# shellcheck disable=SC2086 # We do want multiple arguments
|
|
for plugin in $(echo "${EXTRA_PLUGINS_ENABLE:-}" | tr ',' '\n'); do
|
|
if plugin_status "${plugin}" | grep -qE "^disabled"; then
|
|
echo "--> Enabling extra ${plugin}"
|
|
./occ --no-warnings app:enable "${plugin}"
|
|
fi
|
|
done
|
|
|
|
# Disable extra plugins
|
|
# shellcheck disable=SC2086 # We do want multiple arguments
|
|
for plugin in $(echo "${EXTRA_PLUGINS_DISABLE:-}" | tr ',' '\n'); do
|
|
if plugin_status "${plugin}" | grep -qE "^enabled"; then
|
|
echo "--> Disabling extra ${plugin}"
|
|
./occ --no-warnings app:disable "${plugin}"
|
|
fi
|
|
done
|
|
|
|
occupgrade
|
|
|
|
|
|
## Forms
|
|
## This should be upstreamed, see:
|
|
## https://github.com/juanan3ip/form/issues/76
|
|
## This is what is being used: https://github.com/3iPunt/nextcloud_forms
|
|
FORMS_EXPECTED_HASH="$(cat /forms.hash)"
|
|
FORMS_DIR="/var/www/html/custom_apps/forms"
|
|
FORMS_HASH=""
|
|
if [ -f "${FORMS_DIR}.hash" ]; then
|
|
FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
|
|
fi
|
|
if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
|
|
# Remove old plugin
|
|
rm -rf "${FORMS_DIR}"
|
|
# Install new one
|
|
unzip -o /forms.zip -d /tmp
|
|
mv "/tmp/nextcloud_forms-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
|
|
# Perform config / install
|
|
npm --prefix "${FORMS_DIR}" install
|
|
composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
|
|
# Place hash marker
|
|
cp /forms.hash "${FORMS_DIR}.hash"
|
|
fi
|
|
if plugin_status "${plugin}" | grep -qE "^disabled"; then
|
|
./occ app:enable forms
|
|
fi
|
|
#
|
|
#occupgrade
|
|
|
|
#
|
|
# Apply app-specific configurations
|
|
#
|
|
echo "--> Configuring BBB"
|
|
# Host
|
|
./occ config:app:set -n bbb api.url --value="${BBB_HOST:-}"
|
|
# API Secret
|
|
./occ config:app:set -n -q bbb api.secret --value="${BBB_API_SECRET:-}"
|
|
# Disable Big Blue Button media check by default
|
|
./occ config:app:set -n bbb join.mediaCheck --value="false"
|
|
# Disable Big Blue Button listen only mode by default
|
|
# And enable option to join muted to Big Blue Button room by default
|
|
## TODO: Upstream these as toggeable settings
|
|
# shellcheck disable=SC2016 # We want these literal strings
|
|
sed -i.orig \
|
|
-e 's/^\(\s*$room->setListenOnly(\)true\();\)$/\1false\2/' \
|
|
-e 's/^\(\s*$room->setJoinMuted(\)false\();\)$/\1true\2/' \
|
|
/var/www/html/custom_apps/bbb/lib/Service/RoomService.php
|
|
# Remove meeting join nextcloud bbb app dialog exclamation marks
|
|
sed -i.orig \
|
|
-e 's/\(^\s*"Please enter your name!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
|
|
-e 's/\(^\s*"Let.s go!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
|
|
/var/www/html/custom_apps/bbb/l10n/*.json
|
|
|
|
# Settings
|
|
echo "--> Applying custom settings"
|
|
|
|
./occ --no-warnings config:app:set -n onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN"
|
|
./occ --no-warnings config:app:set -n onlyoffice jwt_secret --value="secret"
|
|
./occ --no-warnings config:app:set -n onlyoffice jwt_header --value="Authorization"
|
|
./occ --no-warnings config:app:set -n onlyoffice sameTab --value="false"
|
|
|
|
# Moodle nextcloud task needs forcesave onlyoffice option
|
|
./occ --no-warnings config:app:set -n onlyoffice customizationForcesave --value="true"
|
|
|
|
# Add allow list IPs
|
|
./occ --no-warnings config:app:set -n bruteForce whitelist_1 --value='172.16.0.0/12'
|
|
|
|
# OnlyOffice
|
|
./occ --no-warnings config:app:set -n onlyoffice preview --value="true"
|
|
./occ --no-warnings config:app:set -n onlyoffice defFormats --value='{"csv":"false","doc":"true","docm":"false","docx":"true","docxf":"true","oform":"true","dotx":"false","epub":"false","html":"false","odp":"true","ods":"true","odt":"true","otp":"true","ots":"true","ott":"true","pdf":"false","potm":"false","potx":"false","ppsm":"false","ppsx":"true","ppt":"true","pptm":"false","pptx":"true","rtf":"false","txt":"false","xls":"true","xlsm":"false","xlsx":"true","xltm":"false","xltx":"true"}'
|
|
./occ --no-warnings config:app:set -n onlyoffice editFormats --value='{"csv":"true","odp":"false","ods":"false","odt":"false","rtf":"false","txt":"true"}'
|
|
|
|
if [ -n "${USING_CLAMAV:-}" ]; then
|
|
echo "--> Configuring ClamAV"
|
|
./occ --no-warnings config:app:set -n files_antivirus av_mode --value="daemon"
|
|
./occ --no-warnings config:app:set -n files_antivirus av_host --value="dd-apps-clamav"
|
|
./occ --no-warnings config:app:set -n files_antivirus av_port --value="3310"
|
|
./occ --no-warnings config:app:set -n files_antivirus av_infected_action --value="only_log"
|
|
./occ --no-warnings config:app:set -n files_antivirus av_stream_max_length --value="26214400"
|
|
./occ --no-warnings config:app:set -n files_antivirus av_max_file_size --value="-1"
|
|
fi
|
|
|
|
# Allow nextcloud into other apps iframes
|
|
echo "--> Fixing CSP"
|
|
# TODO: this should be done in a different fashion
|
|
# Content-Security-Policy: frame-ancestors 'self' *.$DOMAIN;
|
|
# Content-Set-Policy: connect-src 'self -' *.$DOMAIN;
|
|
# Content-Set-Policy: img-src 'self' *. -$DOMAIN;
|
|
# Content-Set-Policy: style-src 'self' -*.$DOMAIN;
|
|
# Content-Set-Policy: font-src 'self' * -.$DOMAIN;
|
|
sed -i \
|
|
-E "s%'\\\\'self\\\\'',.*$%'\\\\'self\\\\'', '*.${DOMAIN}',%" \
|
|
/var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
|
|
|
|
# Add default file for moodle activities
|
|
TEMPLATEDOCX="/var/www/html/data/admin/files/template.docx"
|
|
if [ ! -f "${TEMPLATEDOCX}" ]; then
|
|
echo "--> Copying activity template for Moodle"
|
|
cp /template.docx "${TEMPLATEDOCX}"
|
|
# We have to tell NC about this change
|
|
./occ files:scan admin
|
|
fi
|
|
|
|
# Configure logo
|
|
echo "--> Configuring logo"
|
|
# TODO: This should be a tad more dynamic
|
|
cachebuster="0"
|
|
if ./occ config:app:get theming cachebuster; then
|
|
cachebuster="$(./occ config:app:get theming cachebuster)"
|
|
fi
|
|
./occ theming:config logo /custom/img/logo.png
|
|
./occ theming:config background /custom/img/background.png
|
|
./occ config:app:set theming cachebuster --value="$((cachebuster + 1 ))"
|
|
|
|
occupgrade
|
|
|
|
cat <<EOF
|
|
*************************************
|
|
Done with DD-specific Nextcloud setup
|
|
*************************************
|
|
|
|
EOF
|