diff options
| -rw-r--r-- | ALL_README.md | 1 | ||||
| -rw-r--r-- | README.md | 6 | ||||
| -rw-r--r-- | README_es.md | 6 | ||||
| -rw-r--r-- | README_eu.md | 6 | ||||
| -rw-r--r-- | README_fr.md | 6 | ||||
| -rw-r--r-- | README_gl.md | 6 | ||||
| -rw-r--r-- | README_id.md | 6 | ||||
| -rw-r--r-- | README_nl.md | 6 | ||||
| -rw-r--r-- | README_pl.md | 53 | ||||
| -rw-r--r-- | README_ru.md | 6 | ||||
| -rw-r--r-- | README_zh_Hans.md | 6 | ||||
| -rw-r--r-- | conf/.env.production.sample | 21 | ||||
| -rw-r--r-- | conf/mastodon-sidekiq.service | 36 | ||||
| -rw-r--r-- | conf/mastodon-streaming.service | 36 | ||||
| -rw-r--r-- | conf/mastodon-web.service | 36 | ||||
| -rw-r--r-- | manifest.toml | 13 | ||||
| -rw-r--r-- | scripts/_common.sh | 43 | ||||
| -rw-r--r-- | scripts/install | 53 | ||||
| -rw-r--r-- | scripts/upgrade | 29 | ||||
| -rw-r--r-- | tests.toml | 4 |
20 files changed, 246 insertions, 133 deletions
diff --git a/ALL_README.md b/ALL_README.md index df3708b..c93d620 100644 --- a/ALL_README.md +++ b/ALL_README.md @@ -7,5 +7,6 @@ - [Le o README en galego](README_gl.md) - [Baca README dalam bahasa bahasa Indonesia](README_id.md) - [Lees de README in het Nederlands](README_nl.md) +- [Przeczytaj README w języku polski](README_pl.md) - [Прочитать README на русский](README_ru.md) - [阅读中文（简体）的 README](README_zh_Hans.md) @@ -5,7 +5,9 @@ It shall NOT be edited by hand. # Mastodon for YunoHost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Shipped version:** 4.2.13~ynh1 +**Shipped version:** 4.3.2~ynh1 **Demo:** <https://joinmastodon.org/> diff --git a/README_es.md b/README_es.md index 54ccf3c..dc43ee9 100644 --- a/README_es.md +++ b/README_es.md @@ -5,7 +5,9 @@ No se debe editar a mano. # Mastodon para Yunohost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Versión actual:** 4.2.13~ynh1 +**Versión actual:** 4.3.2~ynh1 **Demo:** <https://joinmastodon.org/> diff --git a/README_eu.md b/README_eu.md index c478d4a..aa24037 100644 --- a/README_eu.md +++ b/README_eu.md @@ -5,7 +5,9 @@ EZ editatu eskuz. # Mastodon YunoHost-erako -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Paketatutako bertsioa:** 4.2.13~ynh1 +**Paketatutako bertsioa:** 4.3.2~ynh1 **Demoa:** <https://joinmastodon.org/> diff --git a/README_fr.md b/README_fr.md index 8cd7ffd..507032a 100644 --- a/README_fr.md +++ b/README_fr.md @@ -5,7 +5,9 @@ Il NE doit PAS être modifié à la main. # Mastodon pour YunoHost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -21,7 +23,7 @@ C'est une alternative décentralisée aux plates-formes commerciales comme Twitt Mastodon évite ainsi les risques qu'une seule société monopolise votre communication à des fins commerciales. -**Version incluse :** 4.2.13~ynh1 +**Version incluse :** 4.3.2~ynh1 **Démo :** <https://joinmastodon.org/> diff --git a/README_gl.md b/README_gl.md index b0d4b60..57994fa 100644 --- a/README_gl.md +++ b/README_gl.md @@ -5,7 +5,9 @@ NON debe editarse manualmente. # Mastodon para YunoHost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Versión proporcionada:** 4.2.13~ynh1 +**Versión proporcionada:** 4.3.2~ynh1 **Demo:** <https://joinmastodon.org/> diff --git a/README_id.md b/README_id.md index 3ecefa5..5b134f5 100644 --- a/README_id.md +++ b/README_id.md @@ -5,7 +5,9 @@ Ini TIDAK boleh diedit dengan tangan. # Mastodon untuk YunoHost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Versi terkirim:** 4.2.13~ynh1 +**Versi terkirim:** 4.3.2~ynh1 **Demo:** <https://joinmastodon.org/> diff --git a/README_nl.md b/README_nl.md index 2b97a1b..c5439b8 100644 --- a/README_nl.md +++ b/README_nl.md @@ -5,7 +5,9 @@ Hij mag NIET handmatig aangepast worden. # Mastodon voor Yunohost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Geleverde versie:** 4.2.13~ynh1 +**Geleverde versie:** 4.3.2~ynh1 **Demo:** <https://joinmastodon.org/> diff --git a/README_pl.md b/README_pl.md new file mode 100644 index 0000000..b876f93 --- /dev/null +++ b/README_pl.md @@ -0,0 +1,53 @@ +<!-- +To README zostało automatycznie wygenerowane przez <https://github.com/YunoHost/apps/tree/master/tools/readme_generator> +Nie powinno być ono edytowane ręcznie. +--> + +# Mastodon dla YunoHost + +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + + +[](https://install-app.yunohost.org/?app=mastodon) + +*[Przeczytaj plik README w innym języku.](./ALL_README.md)* + +> *Ta aplikacja pozwala na szybką i prostą instalację Mastodon na serwerze YunoHost.* +> *Jeżeli nie masz YunoHost zapoznaj się z [poradnikiem](https://yunohost.org/install) instalacji.* + +## Przegląd + +Mastodon is a free, open-source microblogging social network. +It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. + + +**Dostarczona wersja:** 4.3.2~ynh1 + +**Demo:** <https://joinmastodon.org/> + +## Zrzuty ekranu + + + +## Dokumentacja i zasoby + +- Oficjalna strona aplikacji: <https://joinmastodon.org/> +- Oficjalna dokumentacja dla administratora: <https://docs.joinmastodon.org/> +- Repozytorium z kodem źródłowym: <https://github.com/mastodon/mastodon> +- Sklep YunoHost: <https://apps.yunohost.org/app/mastodon> +- Zgłaszanie błędów: <https://github.com/YunoHost-Apps/mastodon_ynh/issues> + +## Informacje od twórców + +Wyślij swój pull request do [gałęzi `testing`](https://github.com/YunoHost-Apps/mastodon_ynh/tree/testing). + +Aby wypróbować gałąź `testing` postępuj zgodnie z instrukcjami: + +```bash +sudo yunohost app install https://github.com/YunoHost-Apps/mastodon_ynh/tree/testing --debug +lub +sudo yunohost app upgrade mastodon -u https://github.com/YunoHost-Apps/mastodon_ynh/tree/testing --debug +``` + +**Więcej informacji o tworzeniu paczek aplikacji:** <https://yunohost.org/packaging_apps> diff --git a/README_ru.md b/README_ru.md index 00ab7c2..649ec1b 100644 --- a/README_ru.md +++ b/README_ru.md @@ -5,7 +5,9 @@ # Mastodon для YunoHost -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**Поставляемая версия:** 4.2.13~ynh1 +**Поставляемая версия:** 4.3.2~ynh1 **Демо-версия:** <https://joinmastodon.org/> diff --git a/README_zh_Hans.md b/README_zh_Hans.md index e9476cb..9b2aff4 100644 --- a/README_zh_Hans.md +++ b/README_zh_Hans.md @@ -5,7 +5,9 @@ # YunoHost 上的 Mastodon -[](https://ci-apps.yunohost.org/ci/apps/mastodon/)   +[](https://ci-apps.yunohost.org/ci/apps/mastodon/) + + [](https://install-app.yunohost.org/?app=mastodon) @@ -20,7 +22,7 @@ Mastodon is a free, open-source microblogging social network. It is a decentralized alternative to commercial platforms like Twitter and avoids the risks of a single company monopolizing your communication for commercial purposes. -**分发版本：** 4.2.13~ynh1 +**分发版本：** 4.3.2~ynh1 **演示：** <https://joinmastodon.org/> diff --git a/conf/.env.production.sample b/conf/.env.production.sample index 7005b5d..2abf6c5 100644 --- a/conf/.env.production.sample +++ b/conf/.env.production.sample @@ -1,5 +1,5 @@ # This is a sample configuration file. You can generate your configuration -# with the `rake mastodon:setup` interactive setup wizard, but to customize +# with the `bundle exec rails mastodon:setup` interactive setup wizard, but to customize # your setup even further, you'll need to edit it manually. This sample does # not demonstrate all available configuration options. Please look at # https://docs.joinmastodon.org/admin/config/ for the full documentation. @@ -41,14 +41,25 @@ ES_ENABLED=false # Secrets # ------- -# Make sure to use `rake secret` to generate secrets +# Make sure to use `bundle exec rails secret` to generate secrets # ------- SECRET_KEY_BASE=__SECRET_KEY_BASE__ OTP_SECRET=__OTP_SECRET__ +# Encryption secrets +# ------------------ +# Must be available (and set to same values) for all server processes +# These are private/secret values, do not share outside hosting environment +# Use `bin/rails db:encryption:init` to generate fresh secrets +# Do not change these secrets once in use, as this would cause data loss and other issues +# ------------------ +ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=__ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY__ +ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=__ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT__ +ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=__ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY__ + # Web Push # -------- -# Generate with `rake mastodon:webpush:generate_vapid_key` +# Generate with `bundle exec rails mastodon:webpush:generate_vapid_key` # -------- VAPID_PRIVATE_KEY=__VAPID_PRIVATE_KEY__ VAPID_PUBLIC_KEY=__VAPID_PUBLIC_KEY__ @@ -104,5 +115,5 @@ LDAP_TLS_NO_VERIFY=true # Make sure to modify the scheduling of ip_cleanup_scheduler in config/sidekiq.yml # to be less than daily if you lower IP_RETENTION_PERIOD below two days (172800). # ----------------------- -IP_RETENTION_PERIOD=1209600 -SESSION_RETENTION_PERIOD=1209600 +IP_RETENTION_PERIOD=31556952 +SESSION_RETENTION_PERIOD=31556952 diff --git a/conf/mastodon-sidekiq.service b/conf/mastodon-sidekiq.service index 14bd592..ad5a6a0 100644 --- a/conf/mastodon-sidekiq.service +++ b/conf/mastodon-sidekiq.service @@ -6,10 +6,10 @@ After=network.target Type=simple User=__APP__ WorkingDirectory=__INSTALL_DIR__/live -Environment="__LD_PRELOAD__" Environment="RAILS_ENV=production" Environment="DB_POOL=25" Environment="MALLOC_ARENA_MAX=2" +Environment="__LD_PRELOAD__" Environment="__YNH_RUBY_LOAD_PATH__" ExecStart=__INSTALL_DIR__/live/bin/bundle exec sidekiq -c 25 TimeoutSec=15 @@ -17,22 +17,26 @@ Restart=always StandardOutput=append:/var/log/__APP__/__APP__-sidekiq.log StandardError=inherit -# Sandboxing options to harden security -# Depending on specificities of your service/app, you may need to tweak these -# .. but this should be a good baseline -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=no -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed +# Proc filesystem +# Capabilities +# Security +NoNewPrivileges=true +# Sandboxing ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes +PrivateTmp=true +PrivateDevices=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectControlGroups=true +RestrictAddressFamilies=AF_INET +RestrictAddressFamilies=AF_INET6 +RestrictAddressFamilies=AF_NETLINK +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=true +LockPersonality=true +RestrictRealtime=true +DevicePolicy=closed +# System Call Filtering SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps diff --git a/conf/mastodon-streaming.service b/conf/mastodon-streaming.service index f63945e..963a316 100644 --- a/conf/mastodon-streaming.service +++ b/conf/mastodon-streaming.service @@ -1,5 +1,5 @@ [Unit] -Description=__APP__-streaming +Description=__APP__-streaming on port __PORT_STREAM__ After=network.target [Service] @@ -16,22 +16,26 @@ Restart=always StandardOutput=append:/var/log/__APP__/__APP__-streaming.log StandardError=inherit -# Sandboxing options to harden security -# Depending on specificities of your service/app, you may need to tweak these -# .. but this should be a good baseline -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=yes -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed +# Proc filesystem +# Capabilities +# Security +NoNewPrivileges=true +# Sandboxing ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes +PrivateTmp=true +PrivateDevices=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectControlGroups=true +RestrictAddressFamilies=AF_INET +RestrictAddressFamilies=AF_INET6 +RestrictAddressFamilies=AF_NETLINK +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=true +LockPersonality=true +RestrictRealtime=true +DevicePolicy=closed +# System Call Filtering SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps diff --git a/conf/mastodon-web.service b/conf/mastodon-web.service index 133fc3b..4804b16 100644 --- a/conf/mastodon-web.service +++ b/conf/mastodon-web.service @@ -6,9 +6,9 @@ After=network.target Type=simple User=__APP__ WorkingDirectory=__INSTALL_DIR__/live -Environment="__LD_PRELOAD__" Environment="RAILS_ENV=production" Environment="PORT=__PORT_WEB__" +Environment="__LD_PRELOAD__" Environment="__YNH_RUBY_LOAD_PATH__" ExecStart=__INSTALL_DIR__/live/bin/bundle exec puma -C config/puma.rb ExecReload=/bin/kill -SIGUSR1 $MAINPID @@ -17,22 +17,26 @@ Restart=always StandardOutput=append:/var/log/__APP__/__APP__-web.log StandardError=inherit -# Sandboxing options to harden security -# Depending on specificities of your service/app, you may need to tweak these -# .. but this should be a good baseline -# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html -NoNewPrivileges=yes -PrivateTmp=yes -PrivateDevices=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -DevicePolicy=closed +# Proc filesystem +# Capabilities +# Security +NoNewPrivileges=true +# Sandboxing ProtectSystem=full -ProtectControlGroups=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -LockPersonality=yes +PrivateTmp=true +PrivateDevices=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectControlGroups=true +RestrictAddressFamilies=AF_INET +RestrictAddressFamilies=AF_INET6 +RestrictAddressFamilies=AF_NETLINK +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=true +LockPersonality=true +RestrictRealtime=true +DevicePolicy=closed +# System Call Filtering SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap # Denying access to capabilities that should not be relevant for webapps diff --git a/manifest.toml b/manifest.toml index d41094e..1c4aefd 100644 --- a/manifest.toml +++ b/manifest.toml @@ -5,7 +5,7 @@ name = "Mastodon" description.en = "Libre and federated social network" description.fr = "Réseau social libre et fédéré" -version = "4.2.13~ynh1" +version = "4.3.2~ynh1" maintainers = ["Tagada"] @@ -52,8 +52,8 @@ ram.runtime = "500M" [resources] [resources.sources] [resources.sources.main] - url = "https://github.com/mastodon/mastodon/archive/refs/tags/v4.2.13.tar.gz" - sha256 = "a8f2576ac97bc8ab39e952408f5fcdb11aa8b15f0b988dab6147a8e5aa8b112d" + url = "https://github.com/mastodon/mastodon/archive/refs/tags/v4.3.2.tar.gz" + sha256 = "d4ad908ad4793c6df761438cf6ee51d08a28cd74a1554bcc0f71718f88cce0ac" autoupdate.strategy = "latest_github_release" [resources.system_user] @@ -75,12 +75,7 @@ ram.runtime = "500M" stream.default = 4000 [resources.apt] - packages = "imagemagick, ffmpeg, libpq-dev, libxml2-dev, libxslt1-dev, file, git, git-core, g++, libprotobuf-dev, protobuf-compiler, pkg-config, gcc, autoconf, bison, build-essential, libssl-dev, libyaml-dev, libreadline6-dev, zlib1g-dev, libncurses5-dev, libffi-dev, libgdbm6, libgdbm-dev, redis-tools, redis-server, rsync, postgresql, postgresql-contrib, libidn11-dev, libicu-dev, libjemalloc-dev, curl, apt-transport-https" - - [resources.apt.extras.yarn] - repo = "deb https://dl.yarnpkg.com/debian/ stable main" - key = "https://dl.yarnpkg.com/debian/pubkey.gpg" - packages = "yarn" + packages = "imagemagick, ffmpeg, libvips-tools, libpq-dev, libxml2-dev, libxslt1-dev, file, git, git-core, g++, libprotobuf-dev, protobuf-compiler, pkg-config, gcc, autoconf, bison, build-essential, libssl-dev, libyaml-dev, libreadline6-dev, zlib1g-dev, libncurses5-dev, libffi-dev, libgdbm6, libgdbm-dev, redis-tools, redis-server, rsync, postgresql, postgresql-contrib, libidn11-dev, libicu-dev, libjemalloc-dev, curl, apt-transport-https" [resources.database] type = "postgresql" diff --git a/scripts/_common.sh b/scripts/_common.sh index a2ba0b8..0dbcc15 100644 --- a/scripts/_common.sh +++ b/scripts/_common.sh @@ -5,33 +5,26 @@ #================================================= memory_needed="2560" -ruby_version=3.2.3 +ruby_version=3.3.5 nodejs_version=20 -# Workaround for Mastodon on Bullseye -# See https://github.com/mastodon/mastodon/issues/15751#issuecomment-873594463 -if [ "$(lsb_release --codename --short)" = "bullseye" ]; -then - case $YNH_ARCH in - amd64) - ld_preload="LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so" - ;; - arm64) - ld_preload="LD_PRELOAD=/usr/lib/aarch64-linux-gnu/libjemalloc.so" - ;; - armhf) - ld_preload="LD_PRELOAD=/usr/lib/arm-linux-gnueabihf/libjemalloc.so" - ;; - armel) - ld_preload="LD_PRELOAD=/usr/lib/arm-linux-gnueabi/libjemalloc.so" - ;; - i386) - ld_preload="LD_PRELOAD=/usr/lib/i386-linux-gnu/libjemalloc.so" - ;; - esac -else - ld_preload="" -fi +case $YNH_ARCH in + amd64) + ld_preload="LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so" + ;; + arm64) + ld_preload="LD_PRELOAD=/usr/lib/aarch64-linux-gnu/libjemalloc.so" + ;; + armhf) + ld_preload="LD_PRELOAD=/usr/lib/arm-linux-gnueabihf/libjemalloc.so" + ;; + armel) + ld_preload="LD_PRELOAD=/usr/lib/arm-linux-gnueabi/libjemalloc.so" + ;; + i386) + ld_preload="LD_PRELOAD=/usr/lib/i386-linux-gnu/libjemalloc.so" + ;; +esac #================================================= # PERSONAL HELPERS diff --git a/scripts/install b/scripts/install index 1385a30..dfcbb27 100644 --- a/scripts/install +++ b/scripts/install @@ -69,22 +69,19 @@ ynh_app_setting_set --app="$app" --key=secret_key_base --value="$secret_key_base otp_secret=$(ynh_string_random --length=128) ynh_app_setting_set --app="$app" --key=otp_secret --value="$otp_secret" -# We need rake to build vapid keys, we generate them later once the app is installed +# We need bundle exec rails to build vapid keys, we generate them later once the app is installed vapid_private_key="" vapid_public_key="" +# We need `bin/rails db:encryption:init` to generate fresh secrets, we generate them later once the app is installed +active_record_encryption_deterministic_key="" +active_record_encryption_key_derivation_salt="" +active_record_encryption_primary_key="" + ynh_add_config --template=".env.production.sample" --destination="$config" chmod 400 "$config" chown $app:$app "$config" -ynh_replace_string --match_string="registrations_mode: 'open'" --replace_string="registrations_mode: 'none'" --target_file="$install_dir/live/config/settings.yml" -ynh_replace_string --match_string="min_invite_role: 'admin'" --replace_string="min_invite_role: 'none'" --target_file="$install_dir/live/config/settings.yml" - -ynh_store_file_checksum --file="$install_dir/live/config/settings.yml" - -chmod 400 "$install_dir/live/config/settings.yml" -chown $app:$app "$install_dir/live/config/settings.yml" - #================================================= # BUILD APP #================================================= @@ -97,31 +94,45 @@ pushd "$install_dir/live" ynh_gem install bundler --no-document ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config deployment 'true' ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config without 'development test' - ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config set force_ruby_platform true + ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config set force_ruby_platform true --quiet ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle install -j$(getconf _NPROCESSORS_ONLN) - # Building assets ynh_use_nodejs - ynh_exec_warn_less ynh_exec_as $app $ynh_node_load_PATH yarn install --pure-lockfile --production --network-timeout 600000 + env $ynh_node_load_PATH corepack enable + echo Y | ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn workspaces focus --production + ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn install --immutable echo "SAFETY_ASSURED=1">> $config - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate --quiet - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile --quiet # Generate vapid keys - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rake mastodon:webpush:generate_vapid_key > key.txt - # Create the first admin user - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl accounts create "$admin" --email="$admin_mail" --confirmed --role=Owner > /dev/null + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails mastodon:webpush:generate_vapid_key > vapid_key.txt + # Generate active record encryption + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:encryption:init > active_record_encryption.txt popd -# Re-generate config with vapid keys -vapid_private_key=$(grep -oP "VAPID_PRIVATE_KEY=\K.+" "$install_dir/live/key.txt") +# Re-generate config with vapid keys and active record encryption +vapid_private_key=$(grep -oP "VAPID_PRIVATE_KEY=\K.+" "$install_dir/live/vapid_key.txt") ynh_app_setting_set --app="$app" --key=vapid_private_key --value="$vapid_private_key" -vapid_public_key=$(grep -oP "VAPID_PUBLIC_KEY=\K.+" "$install_dir/live/key.txt") +vapid_public_key=$(grep -oP "VAPID_PUBLIC_KEY=\K.+" "$install_dir/live/vapid_key.txt") ynh_app_setting_set --app="$app" --key=vapid_public_key --value="$vapid_public_key" -ynh_secure_remove --file="$install_dir/live/key.txt" +ynh_secure_remove --file="$install_dir/live/vapid_key.txt" +active_record_encryption_deterministic_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=\K.+" "$install_dir/live/active_record_encryption.txt") +ynh_app_setting_set --app="$app" --key=active_record_encryption_deterministic_key --value="$active_record_encryption_deterministic_key" +active_record_encryption_key_derivation_salt=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=\K.+" "$install_dir/live/active_record_encryption.txt") +ynh_app_setting_set --app="$app" --key=active_record_encryption_key_derivation_salt --value="$active_record_encryption_key_derivation_salt" +active_record_encryption_primary_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=\K.+" "$install_dir/live/active_record_encryption.txt") +ynh_app_setting_set --app="$app" --key=active_record_encryption_primary_key --value="$active_record_encryption_primary_key" +ynh_secure_remove --file="$install_dir/live/active_record_encryption.txt" ynh_delete_file_checksum --file="$config" ynh_add_config --template=".env.production.sample" --destination="$config" chmod 400 "$config" chown $app:$app "$config" +pushd "$install_dir/live" + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate --quiet + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile --quiet + # Create the first admin user + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl accounts create "$admin" --email="$admin_mail" --confirmed --role=Owner > /dev/null + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl accounts approve "$admin" > /dev/null +popd + #================================================= # SYSTEM CONFIGURATION #================================================= diff --git a/scripts/upgrade b/scripts/upgrade index c889e65..f7a3573 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -102,8 +102,8 @@ if [ "$upgrade_type" == "UPGRADE_APP" ] then ynh_script_progression --message="Upgrading source files..." --weight=1 - # Download Mastodon - ynh_setup_source --dest_dir="$install_dir/live" --keep="public/system/" + # Download, check integrity, uncompress and patch the source from manifest.toml + ynh_setup_source --dest_dir="$install_dir/live" --full_replace=1 --keep="public/system .env.production" chmod 750 "$install_dir" chmod -R o-rwx "$install_dir" @@ -124,9 +124,9 @@ pushd "$install_dir/live" ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle config set force_ruby_platform true --quiet ynh_exec_as $app $ynh_ruby_load_path $ld_preload bin/bundle install -j$(getconf _NPROCESSORS_ONLN) ynh_use_nodejs - ynh_exec_as $app $ynh_node_load_PATH yarn install --pure-lockfile --production --network-timeout 600000 - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:clean - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile + env $ynh_node_load_PATH corepack enable + echo Y | ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn workspaces focus --production + ynh_exec_warn_less ynh_exec_as $app env $ynh_node_load_PATH yarn install --immutable popd chown "$app:www-data" "$install_dir" @@ -163,6 +163,21 @@ ynh_use_logrotate --non-append #================================================= ynh_script_progression --message="Updating a config file..." --weight=1 +if ynh_compare_current_package_version --comparison lt --version "4.3.2~ynh1"; then + pushd "$install_dir/live" + ynh_use_ruby + # Generate active record encryption + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:encryption:init > active_record_encryption.txt + active_record_encryption_deterministic_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=\K.+" "$install_dir/live/active_record_encryption.txt") + ynh_app_setting_set --app="$app" --key=active_record_encryption_deterministic_key --value="$active_record_encryption_deterministic_key" + active_record_encryption_key_derivation_salt=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=\K.+" "$install_dir/live/active_record_encryption.txt") + ynh_app_setting_set --app="$app" --key=active_record_encryption_key_derivation_salt --value="$active_record_encryption_key_derivation_salt" + active_record_encryption_primary_key=$(grep -oP "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=\K.+" "$install_dir/live/active_record_encryption.txt") + ynh_app_setting_set --app="$app" --key=active_record_encryption_primary_key --value="$active_record_encryption_primary_key" + ynh_secure_remove --file="$install_dir/live/active_record_encryption.txt" + popd +fi + language="$(echo $language | head -c 2)" ynh_add_config --template=".env.production.sample" --destination="$config" @@ -177,8 +192,8 @@ ynh_script_progression --message="Applying migrations..." --weight=1 pushd "$install_dir/live" ynh_use_ruby - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate - ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/tootctl cache clear + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails db:migrate --quiet + ynh_exec_warn_less ynh_exec_as $app RAILS_ENV=production $ynh_ruby_load_path $ld_preload bin/bundle exec rails assets:precompile --quiet popd #================================================= @@ -1,3 +1,5 @@ +#:schema https://raw.githubusercontent.com/YunoHost/apps/master/schemas/tests.v1.schema.json + test_format = 1.0 [default] @@ -24,3 +26,5 @@ test_format = 1.0 test_upgrade_from.43504e6.args.is_public=1 test_upgrade_from.43504e6.args.admin="john" test_upgrade_from.43504e6.args.language="fr_FR" + + test_upgrade_from.8102fffa52a4e3279bba9fbdafb3a0e5b1fe3e17.name = "Upgrade from 4.2.13~ynh1" |