vpnclient_ynh/scripts/config

#!/bin/bash

#=================================================
# GENERIC STARTING
#=================================================
# IMPORT GENERIC HELPERS
#=================================================

source _common.sh
source /usr/share/yunohost/helpers

#=================================================
# MANAGE SCRIPT FAILURE
#=================================================

# Exit if an error occurs during the execution of the script
ynh_abort_if_errors

#=================================================
# RETRIEVE ARGUMENTS
#=================================================

set_permissions() {
    local file="$1"
    if [ -f $file ]
    then
        chown $app:$app $file
        chmod go=--- $file
    fi
}

#=================================================
# SPECIFIC GETTERS FOR TOML SHORT KEY
#=================================================

BACKTICK='`'
TRIPLEBACKTICKS='```'

get__status() {
    local service_enabled=$(ynh_app_setting_get $app service_enabled)

    ipv4=$(ping -w3 -c1 ip.yunohost.org  >/dev/null 2>&1 && curl --max-time 5 https://ip.yunohost.org --silent)
    ipv6=$(ping -w3 -c1 ip6.yunohost.org >/dev/null 2>&1 && curl --max-time 5 https://ip6.yunohost.org --silent)

    if ip route get 1.2.3.4 | grep -q tun0 && [[ -n "$ipv4" ]]
    then
        if [ $service_enabled -eq 1 ]
        then
            cat << EOF
style: success
ask:
  en: |-
    The VPN is enabled and running ! :)

    **IPv4:** $BACKTICK$ipv4$BACKTICK

    **IPv6:** $BACKTICK$ipv6$BACKTICK
EOF

        else
            cat << EOF
style: warning
ask:
  en: The VPN is running, but it shouldn't !?
EOF
        fi
    elif [ $service_enabled -eq 1 ]
    then
        cat << EOF
style: danger
ask:
  en: |-
    The VPN is down ! Here are errors logged in the last few minutes
    $TRIPLEBACKTICKS
$(journalctl -u ynh-vpnclient -o cat | sed 's/^/    /g' | tail -n 15)
    $TRIPLEBACKTICKS
EOF
    else
        cat << EOF
style: info
ask:
  en: The VPN is not enabled
EOF

    fi
}

get__login_user() {
    if [ -s /etc/openvpn/keys/credentials ]
    then
        echo "$(sed -n 1p /etc/openvpn/keys/credentials)"
    else
        echo ""
    fi
}

get__login_passphrase() {
    if [ -s /etc/openvpn/keys/credentials ]
    then
        echo "$(sed -n 2p /etc/openvpn/keys/credentials)"
    else
        echo ""
    fi
}

#=================================================
# SPECIFIC VALIDATORS FOR TOML SHORT KEYS
#=================================================

validate__login_user() {

    if grep -q '^\s*auth-user-pass' ${config_file}
    then
        if [[ -z "${login_user}" ]]
        then
            echo 'A Username is needed with this configuration file'
        fi
    fi
}

validate__login_passphrase() {
    if grep -q '^\s*auth-user-pass' ${config_file}
    then
        if [[ -z "${login_passphrase}" ]]
        then
            echo 'A Password is needed with this configuration file'
        fi
    fi
}

validate__crt_server_ca() {
    if grep -q '^\s*ca\s' ${config_file}
    then
        if [[ ! -e "${crt_server_ca}" ]]
        then
            echo "A server CA certificate is needed"
        fi
    fi
}

validate__crt_client() {
    if grep -q '^\s*cert\s' ${config_file}
    then
        if [[ ! -e "${crt_client}" ]]
        then
            echo "A Client certificate is needed with this configuration file"
        fi
    fi
}

validate__crt_client_key() {
    if grep -q '^\s*key\s' ${config_file}
    then
        if [[ ! -e "${crt_client_key}" ]]
        then
            echo "A client private key is needed with this configuration file"
        fi
    fi
}

validate__crt_client_ta() {
    if grep -q '^\s*tls-auth\s' ${config_file}
    then
        if [[ ! -e "${crt_client_ta}" ]]
        then
            echo "A TLS auth shared secret is needed with this configuration file"
        fi
    fi
}

validate__nameservers() {
    if [[ "$dns_method" == "custom" ]] && [[ -z "$nameservers" ]]
    then
        echo "You need to choose DNS resolvers or select an other method to provide DNS resolvers"
    fi
}

#=================================================
# SPECIFIC SETTERS FOR TOML SHORT KEYS
#=================================================

set__login_user() {
    if [ -n "${login_user}" ]
    then
        echo "${login_user}" > /etc/openvpn/keys/credentials
        echo "${login_passphrase}" >> /etc/openvpn/keys/credentials
        set_permissions /etc/openvpn/keys/credentials
    else
        echo "" > /etc/openvpn/keys/credentials
    fi
}

set__login_passphrase() {
    :
}

#=================================================
# OVERWRITING VALIDATE STEP
#=================================================

ynh_app_config_validate() {
    # At this moment this var is not already set with the old value
    if [[ -n "${config_file:-}" ]]; then
        # Overwrite form response with cube files data before validation process

        # We don't have the extension, so we use this ugly hack to check that this is a json-like
        # (i.e. it starts with { ..)
        if [[ -f "${config_file}" ]]; then
            if [[ "$(cat ${config_file} | tr -d ' ' | grep -v "^$" | head -c1)" == "{" ]]; then
                local tmp_dir=$(dirname "$config_file")

                cube_file="$tmp_dir/client.cube"
                cp -f "$config_file" "$cube_file"

                convert_cube_file "$config_file"
            # Othewise, assume that it's a .ovpn / .conf
            else
                local tmp_dir=$(dirname "$config_file")

                ovpn_file="$tmp_dir/client.ovpn"
                cp -f "$config_file" "$ovpn_file"

                convert_ovpn_file "$config_file"
            fi
        fi
    fi

    _ynh_app_config_validate
}

#=================================================
# OVERWRITING APPLY STEP
#=================================================

ynh_app_config_apply() {

    # Stop vpn client
    ynh_print_info --message="Stopping vpnclient in order to edit files"
    ynh_systemd_action --service_name="ynh-vpnclient-checker.timer" --action="stop"
    ynh_systemd_action --service_name="ynh-vpnclient" --action="stop"

    chown $app:$app /etc/openvpn/keys
    chmod go=--- /etc/openvpn/keys

    _ynh_app_config_apply

    # If we are uploading a cube file, then the file would be in a temporary folder
    # Otherwise, we aren't uploading a cube file, then the path is either empty 
    # or takes the value of the previous upload, that is, the target path for the cube file.
    if [[ -n "${cube_file:-}" && "$cube_file" != "/etc/openvpn/client.cube" ]]; then
      ynh_app_setting_set $app ip6_addr "$ip6_addr"
      ynh_app_setting_set $app ip6_net "$ip6_net"
      ynh_app_setting_set $app ip6_send_over_tun_enabled "$ip6_send_over_tun_enabled"
    fi

    if [[ ${ip6_send_over_tun_enabled} -eq 1 ]]; then
        install -b -o root -g root -m 0755 ../conf/optional-scripts/route-up.d/50-vpnclient-set-ipv6-send-over-tun /etc/openvpn/scripts/route-up.d/
        install -b -o root -g root -m 0755 ../conf/optional-scripts/route-down.d/50-vpnclient-unset-ipv6-send-over-tun /etc/openvpn/scripts/route-down.d/
    else
        ynh_secure_remove /etc/openvpn/scripts/route-up.d/50-vpnclient-set-ipv6-send-over-tun
        ynh_secure_remove /etc/openvpn/scripts/route-down.d/50-vpnclient-unset-ipv6-send-over-tun
    fi

    set_permissions /etc/openvpn/client.conf
    set_permissions /etc/openvpn/keys/ca-server.crt
    set_permissions /etc/openvpn/keys/user.crt
    set_permissions /etc/openvpn/keys/user.key
    set_permissions /etc/openvpn/keys/user_ta.key

    # Cleanup previously uploaded config file
    [[ -n "${cube_file:-}" && "$cube_file" == "/etc/openvpn/client.cube" ]] && rm -f "$cube_file"
    [[ -n "${ovpn_file:-}" && "$ovpn_file" == "/etc/openvpn/client.ovpn" ]] && rm -f "$ovpn_file"

    # Start vpn client
    ynh_print_info --message="Starting vpnclient service if needed"
    ynh_systemd_action --service_name="ynh-vpnclient" --action="start"
    ynh_systemd_action --service_name="ynh-vpnclient-checker.timer" --action="start"
}

ynh_app_config_run $1