fix nextcloud

.drone.yml

@@ -0,0 +1,143 @@
+kind: pipeline
+type: exec
+name: default
+
+steps:
+- name: deploy
+  environment:
+    PASSWORD:
+      from_secret: HETZNER_TOKEN
+    DOMAIN:
+      from_secret: DOMAIN
+    CLOUDFLARE_TOKEN:
+      from_secret: CLOUDFLARE_TOKEN
+    USER_PASS:
+      from_secret: USER_PASS
+
+  commands:
+  # Create infect user script and then export it to a remote machine on server creation.
+  - echo '#!/bin/sh' > infect.sh
+  - echo "curl https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-infect/raw/branch/development/nixos-infect | PROVIDER=hetzner NIX_CHANNEL=nixos-21.11 DOMAIN=$DOMAIN LUSER=cicdcicd ENCODED_PASSWORD=$(printf $USER_PASS | base64) WORD=PASSWORD=$USER_PASS CF_TOKEN=$CLOUDFLARE_TOKEN DB_PASSWORD=$USER_PASS API_TOKEN=$USER_PASS HOSTNAME=selfprivacy-ci-test bash 2>&1 | tee /root/infect.log" >> infect.sh
+  - http -v --check-status --ignore-stdin POST https://api.hetzner.cloud/v1/servers Authorization:"Bearer $PASSWORD" name=ci-sibling server_type=cx11 start_after_create:=true image=ubuntu-20.04 user_data=@infect.sh automount:=false location=fsn1
+
+- name: dns
+  environment:
+    PASSWORD:
+      from_secret: HETZNER_TOKEN
+    CLOUDFLARE_TOKEN:
+      from_secret: CLOUDFLARE_TOKEN
+    DOMAIN:
+      from_secret: DOMAIN
+    ZONE_ID:
+      from_secret: ZONE_ID
+
+  commands:
+  # Read all available machines and export IP of 'ci-sibling' 
+  # Create DNS entires for main domain and subdomains
+  - >
+    curl -s -H "Authorization: Bearer $PASSWORD" 'https://api.hetzner.cloud/v1/servers' > .machine.json
+  - >
+    export machineip=$( for i in {0..24}; do jq 'if .servers['$i'].name == "ci-sibling" then .servers['$i'].public_net.ipv4.ip else null end' .machine.json; done | grep -v null | sed 's/"//' | sed 's/"//' )
+  - echo $machineip
+  - >
+    curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN"
+    -H "Authorization: Bearer $CLOUDFLARE_TOKEN"
+    -H "Content-Type: application/json" 
+  - >
+    curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
+    -H "Authorization: Bearer $CLOUDFLARE_TOKEN"
+    -H "Content-Type: application/json"
+    --data '{"type":"A","name":"@","content":"'"$$machineip"'","ttl":3600,"priority":10,"proxied":false}'
+  - >
+    http --check-status --ignore-stdin POST https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records Authorization:"Bearer $CLOUDFLARE_TOKEN" type=A name=api content=$machineip ttl:=3600 priority:=10 proxied:=false
+  - >
+    http --check-status --ignore-stdin POST https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records Authorization:"Bearer $CLOUDFLARE_TOKEN" type=A name=cloud content=$machineip ttl:=3600 priority:=10 proxied:=false
+  - >
+    http --check-status --ignore-stdin POST https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records Authorization:"Bearer $CLOUDFLARE_TOKEN" type=A name=password content=$machineip ttl:=3600 priority:=10 proxied:=false
+  - >
+    curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
+    -H "Authorization: Bearer $CLOUDFLARE_TOKEN"
+    -H "Content-Type: application/json"
+    --data '{"type":"MX","name":"@","content":"'"$$DOMAIN"'","ttl":3600,"priority":10,"proxied":false}'
+  - >
+    curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
+    -H "Authorization: Bearer $CLOUDFLARE_TOKEN"
+    -H "Content-Type: application/json"
+    --data '{"type":"TXT","name":"_dmarc","content":"v=DMARC1; p=none","ttl":18000,"priority":10,"proxied":false}'
+  - >
+    curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
+    -H "Authorization: Bearer $CLOUDFLARE_TOKEN"
+    -H "Content-Type: application/json"
+    --data '{"type":"TXT","name":"'"$$DOMAIN"'","content":"v=spf1 a mx ip4:$machineip -all","ttl":18000,"priority":10,"proxied":false}'
+
+- name: sleep
+  commands:
+    - echo "You better make some tea, it's going to take a while :("
+    - sleep 1000
+
+- name: test
+  environment:
+    DOMAIN:
+      from_secret: DOMAIN
+    USER_PASS:
+      from_secret: USER_PASS
+    TEST_EMAIL_PASS:
+      from_secret: TEST_EMAIL_PASS
+  commands:
+  - >
+    dig api.$DOMAIN
+  - >
+    http -v --verify=false --check-status --ignore-stdin GET https://api.$DOMAIN/services/status Authorization:"Bearer $USER_PASS"
+  - >
+    swaks --to ci@$DOMAIN -s selfprivacy.org -tls -au test@selfprivacy.org -ap $TEST_EMAIL_PASS
+  - >
+    http -v --verify=false --check-status --ignore-stdin GET https://cloud.$DOMAIN/ocs/v2.php/apps/serverinfo/api/v1/info?format=json -a admin:$USER_PASS
+  - >
+    echo "File to test nextcloud upload" > file
+  - >
+    http -v --verify=false --check-status --ignore-stdin PUT https://cloud.$DOMAIN/remote.php/dav/files/admin/file @file -a admin:$USER_PASS
+  - >
+    http -v --verify=false --check-status --ignore-stdin GET https://cloud.$DOMAIN/remote.php/dav/files/admin/file -a admin:$USER_PASS
+  #- >
+    #http -v --verify=false --check-status --ignore-stdin GET https://password.$DOMAIN/admin/diagnostics
+
+- name: teardown
+  environment:
+    PASSWORD:
+      from_secret: HETZNER_TOKEN
+    CLOUDFLARE_TOKEN:
+      from_secret: CLOUDFLARE_TOKEN
+    DOMAIN:
+      from_secret: DOMAIN
+    ZONE_ID:
+      from_secret: ZONE_ID
+  commands:
+  # Delete our machine called 'ci-sibling' and all the found DNS records on it.
+  - >
+    curl -s "https://api.hetzner.cloud/v1/servers" -H "Authorization: Bearer $PASSWORD" > .hetzner_servers.json
+  - >
+    export machineid=$( for i in {0..24}; do jq 'if .servers['$i'].name == "ci-sibling" then .servers['$i'].id else null end' .hetzner_servers.json; done | grep -v null | sed 's/"//g')
+  - >
+    curl -s -X DELETE "https://api.hetzner.cloud/v1/servers/$machineid" -H "Authorization: Bearer $PASSWORD"
+  - >
+    json=$(curl -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" -H "Authorization: Bearer $CLOUDFLARE_TOKEN" -H "Content-Type: application/json")
+  - >
+    echo "$json" > .dns-records.json
+  - >
+    result=$(jq -r ".result" <<< "$json")
+  - >
+    echo "$ZONE_ID"
+  - >
+    echo "$result" | jq '.[] | "\(.id)"' | while read id ; do echo "Deleting $id"; http -v --check-status --ignore-stdin DELETE https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$(echo $id | cut -f 2 -d '"') Authorization:"Bearer $CLOUDFLARE_TOKEN"; done
+  when:
+    status:
+    - failure
+    - success
+
+- name: switch-channel
+  environment:
+    CHANNEL_SWITCHER_KEY:
+      from_secret: CHANNEL_SWITCHER_KEY
+  commands:
+    - >
+      curl -X POST -H "Authorization: $CHANNEL_SWITCHER_KEY" 'https://channel.selfprivacy.org/nixos-selfpricacy/upgrade'

nixos-infect

@@ -5,9 +5,15 @@
 set -e -o pipefail
 
 makeConf() {
-  export HASHED_PASSWORD=$( mkpasswd -m sha-512 "$PASSWORD" )
   # Skip everything if main config already present
   [[ -e /etc/nixos/configuration.nix ]] && return 0
+  if [[ $PASSWORD == null ]]; then
+      export PASSWORD=$(printf $ENCODED_PASSWORD | base64 --decode)
+  fi
+    
+  export ESCAPED_PASSWORD=$(printf $ENCODED_PASSWORD | base64 --decode | jq -Rs .)
+  export HASHED_PASSWORD=$( mkpasswd -m sha-512 "$PASSWORD" )
+
   # NB <<"EOF" quotes / $ ` in heredocs, <<EOF does not
   mkdir -p /etc/nixos
 
@@ -44,8 +50,8 @@ makeConf() {
     "hostname": "$HOSTNAME",
     "nextcloud": {
         "enable": true,
-        "adminPassword": "$PASSWORD",
-        "databasePassword": "$PASSWORD"
+        "adminPassword": $ESCAPED_PASSWORD,
+        "databasePassword": $ESCAPED_PASSWORD
     },
     "gitea": {
         "enable": true
@@ -57,10 +63,10 @@ makeConf() {
         "enable": true
     },
     "pleroma": {
-        "enable": true
+        "enable": false
     },
     "timezone": "Europe/Uzhgorod",
-    "resticPassword": "$PASSWORD",
+    "resticPassword": $ESCAPED_PASSWORD,
     "username": "$LUSER"
 }
 EOF
@@ -298,9 +304,8 @@ infect() {
   # shellcheck disable=SC1090
   source ~/.nix-profile/etc/profile.d/nix.sh
 
-  [[ -z "$NIX_CHANNEL" ]] && NIX_CHANNEL="nixos-21.05"
   nix-channel --remove nixpkgs
-  nix-channel --add "https://nixos.org/channels/$NIX_CHANNEL" nixos
+  nix-channel --add "https://channel.selfprivacy.org/nixos-selfpricacy" nixos
   nix-channel --update
 
   export NIXOS_CONFIG=/etc/nixos/configuration.nix
@@ -338,7 +343,7 @@ infect() {
 [ "$PROVIDER" = "digitalocean" ] && doNetConf=y # digitalocean requires detailed network config to be generated
 
 apt update
-apt install git tar wget curl whois
+apt install -y git tar wget curl whois jq
 checkEnv
 prepareEnv
 makeSwap # smallest (512MB) droplet needs extra memory!