Permalink
Branch: master
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 401 lines (314 sloc) 11.9 KB
#!/bin/bash
dummy_pwd=neutrinet
clear
cat <<EOF
********************************************************************************
You are about to configure an Internet Cube for Neutrinet.
All the passwords; yunohost admin account, openvpn password and the password
for the AP, will be: '$dummy_pwd'. Consider changing them after installation.
/!\\ This script has to be run as root *on* the Cube itself, on a
labriqueinternet_A20LIME_2015-11-09.img SD card (or newer)
/!\\ If you run into trouble, please refer to the original
documentation page: https://yunohost.org/installation_brique_fr
/!\\ Be aware that as soon as the vpn goes live the root user can log in over
the vpn with the chosen password! You might consider revising the root
password before continuing. Choosing a dictionary word or 12345678 is
not the best thing to do here, instead have a look at
https://ssd.eff.org/en/module/creating-strong-passwords for advice on
creating a strong password.
Press any key to continue or CTRL-C to abort
EOF
read
# Exit if any of the following command fails
set -e
get_variables() {
if [ -f neutrinet.variables ]; then
source neutrinet.variables
echo "********************************************************************************"
echo The following settings will apply
echo ""
echo domain = $domain
echo username = $username
echo firstname = $firstname
echo lastgname = $lastname
echo email = $email
echo vpn_username = $vpn_username
echo "vpn_pwd = **********"
echo ip6_net = $ip6_net
echo wifi_ssid = $wifi_ssid
echo vpn_ca_crt = ${vpn_ca_crt:0:46}...
echo vpn_client_key = ${vpn_client_key:0:46}...
echo vpn_client_crt = ${vpn_client_crt:0:46}...
echo ""
echo "********************************************************************************"
echo Press any key to continue or CTRL-C to abort
read
else
echo
echo "Main domain name (will be used to host your email and services)"
echo "i.e.: example.com"
read domain
echo
echo "Username (used to connect to the user interface and access your apps, must be composed of lowercase letters and numbers only)"
echo "i.e.: jonsnow"
read username
echo
echo "Firstname (mandatory, used as your firstname when you send emails)"
echo "i.e.: Jon"
read firstname
echo
echo "Lastname (mandatory, used as your lastname when you send emails)"
echo "i.e. Snow"
read lastname
echo
echo "Email (must contain one of the domain previously entered as second part)"
echo "i.e. jon@example.com"
read email
echo
echo "VPN client certificate (paste all the content of client.crt below and end with a blank line): "
vpn_client_crt=$(sed '/^$/q' | sed 's/-----BEGIN CERTIFICATE-----//' | sed 's/-----END CERTIFICATE-----//' | sed '/^$/d')
echo
echo "VPN client key (paste all the content of client.key below and end with a blank line): "
vpn_client_key=$(sed '/^$/q' | sed 's/-----BEGIN PRIVATE KEY-----//' | sed 's/-----END PRIVATE KEY-----//' | sed '/^$/d')
echo
echo "CA server certificate (paste all the content of ca.crt below and end with a blank line): "
vpn_ca_crt=$(sed '/^$/q' | sed 's/-----BEGIN CERTIFICATE-----//' | sed 's/-----END CERTIFICATE-----//' | sed '/^$/d')
echo
echo "VPN username (first line of the 'auth' file): "
read vpn_username
echo
echo "VPN password (second line of the 'auth' file): "
read vpn_pwd
echo
echo "IPv6 delegated prefix (without trailing /56, to be found in the neutrinet MGMT interface)"
echo "i.e.: 2001:913:1000:300::"
read ip6_net
echo
echo "WiFi AP SSID (that will appear right after this configuration script ending)"
echo "i.e.: MyWunderbarNeutralNetwork"
read wifi_ssid
echo
echo
echo "The installation will proceed, please verify the parameters above one last time."
read -rsp $'Press any key to continue...\n' -n1 yolo
echo
# Store all the variables into a file
for var in domain username firstname lastname email vpn_username vpn_pwd ip6_net wifi_ssid; do
declare -p $var | cut -d ' ' -f 3- >> neutrinet.variables
done
echo "vpn_client_crt=\"$vpn_client_crt\"" >> neutrinet.variables
echo "vpn_client_key=\"$vpn_client_key\"" >> neutrinet.variables
echo "vpn_ca_crt=\"$vpn_ca_crt\"" >> neutrinet.variables
fi
}
modify_hosts() {
# to resolve the domain properly
echo "Modifying hosts..."
set -x
grep -q "olinux" /etc/hosts \
|| echo "127.0.0.1 $domain olinux" >> /etc/hosts
}
set_locales() {
[ "$(grep LC_ALL /etc/environment)" ] || echo 'LC_ALL="en_US.UTF-8"' >> /etc/environment
source /etc/environment
export LC_ALL
}
upgrade_system() {
echo "Upgrading Debian packages..."
set -x
echo "deb http://repo.yunohost.org/debian jessie stable" > /etc/apt/sources.list.d/yunohost.list
apt-get update -qq
apt-get dist-upgrade -y
}
postinstall_yunohost() {
echo "Launching YunoHost post-installation..."
set -x
yunohost tools postinstall -d $domain -p $dummy_pwd
}
create_yunohost_user() {
echo "Creating the first YunoHost user..."
set -x
yunohost user create $username -f "$firstname" -l "$lastname" -m $email \
-q 0 -p $dummy_pwd
}
add_labriqueinternet_app_list() {
echo "Adding labriqueinternet official app list for updates in the future..."
yunohost app fetchlist -n labriqueinternet -u https://labriqueinter.net/apps/labriqueinternet.json
}
install_vpnclient() {
echo "Installing the VPN client application..."
set -x
yunohost app install vpnclient \
--args "domain=$domain&path=/vpnadmin&server_name=vpn.neutrinet.be"
}
configure_vpnclient() {
echo "Configuring the VPN connection..."
set -x
# Restrict user access to the app
yunohost app addaccess vpnclient -u $username
# Neutrinet related: add some VPN configuration directives
cat > /etc/openvpn/client.conf.tpl <<EOF
# [WARN] Edit this raw configuration ONLY IF YOU KNOW
# what you do!
# [WARN] Continue to use the placeholders <TPL:*> and
# keep update their value on the web admin (they
# are not only used for this file).
client
remote <TPL:SERVER_NAME>
proto <TPL:PROTO>
port <TPL:SERVER_PORT>
pull
nobind
dev tun
tun-ipv6
# keepalive 10 30
# neutrinet
keepalive 10 120
comp-lzo adaptive
resolv-retry infinite
# Authentication by login
<TPL:LOGIN_COMMENT>auth-user-pass /etc/openvpn/keys/credentials
# UDP only
<TPL:UDP_COMMENT>explicit-exit-notify
# TLS
tls-client
remote-cert-tls server
ns-cert-type server
ca /etc/openvpn/keys/ca-server.crt
<TPL:CERT_COMMENT>cert /etc/openvpn/keys/user.crt
<TPL:CERT_COMMENT>key /etc/openvpn/keys/user.key
# Logs
verb 3
mute 5
status /var/log/openvpn-client.status
log-append /var/log/openvpn-client.log
# Routing
route-ipv6 2000::/3
redirect-gateway def1 bypass-dhcp
# neutrinet
cipher AES-256-CBC
tls-version-min 1.2
auth SHA256
topology subnet
EOF
# Copy certificates and keys
mkdir -p /etc/openvpn/keys
echo '-----BEGIN CERTIFICATE-----' > /etc/openvpn/keys/user.crt
grep -Eo '"[^"]*"|[^" ]*' <<< $vpn_client_crt >> /etc/openvpn/keys/user.crt
echo '-----END CERTIFICATE-----' >> /etc/openvpn/keys/user.crt
echo '-----BEGIN PRIVATE KEY-----' > /etc/openvpn/keys/user.key
grep -Eo '"[^"]*"|[^" ]*' <<< $vpn_client_key >> /etc/openvpn/keys/user.key
echo '-----END PRIVATE KEY-----' >> /etc/openvpn/keys/user.key
echo '-----BEGIN CERTIFICATE-----' > /etc/openvpn/keys/ca-server.crt
grep -Eo '"[^"]*"|[^" ]*' <<< $vpn_ca_crt >> /etc/openvpn/keys/ca-server.crt
echo '-----END CERTIFICATE-----' >> /etc/openvpn/keys/ca-server.crt
# And credentials
echo -e "$vpn_username\n$vpn_pwd" > /etc/openvpn/keys/credentials
# Set rights
chown admin:admins -hR /etc/openvpn/keys
chmod 640 -R /etc/openvpn/keys
# Configure VPN client
yunohost app setting vpnclient server_name -v "vpn.neutrinet.be"
yunohost app setting vpnclient server_port -v "1195"
yunohost app setting vpnclient server_proto -v "udp"
yunohost app setting vpnclient service_enabled -v "1"
yunohost app setting vpnclient login_user -v "$vpn_username"
yunohost app setting vpnclient login_passphrase -v "$vpn_pwd"
yunohost app setting vpnclient ip6_net -v "$ip6_net"
# Add the service to YunoHost's monitored services
yunohost service add ynh-vpnclient -l /var/log/openvpn-client.log
echo "Restarting OpenVPN..."
systemctl restart ynh-vpnclient \
|| (echo "Logs:" && cat /var/log/openvpn-client.log && exit 1)
sleep 5
}
install_hotspot() {
echo "Installing the Hotspot application..."
set -x
yunohost app install hotspot --verbose \
--args "domain=$domain&path=/wifiadmin&wifi_ssid=$wifi_ssid&wifi_passphrase=$dummy_pwd&firmware_nonfree=yes"
}
configure_hostpot() {
echo "Configuring the hotspot..."
set -x
# Removing the persistent Net rules to keep the Wifi device to wlan0
rm -f /etc/udev/rules.d/70-persistent-net.rules
# Restrict user access to the app
yunohost app addaccess hotspot -u $username
# Ensure that the hotspot is activated and that the IPv6 prefix is set
yunohost app setting hotspot service_enabled -v "1"
yunohost app setting hotspot ip6_net -v "$ip6_net"
yunohost app setting hotspot ip6_addr -v "${ip6_net}42"
# Add the service to YunoHost's monitored services
yunohost service add ynh-hotspot -l /var/log/syslog
echo "Restarting the hotspot..."
systemctl restart ynh-hotspot
}
install_doctorcube() {
set -x
echo "Installing doctorcube (this shouldn't do anything)..."
yunohost app install doctorcube --verbose
}
install_neutrinet_ynh() {
set -x
echo "Installing neutrinet_ynh..."
yunohost app install https://github.com/Neutrinet/neutrinet_ynh --verbose --args "domain=$domain&path=/neutrinet"
}
# ----------------------------------
# Optional steps
# ----------------------------------
remove_dyndns_cron() {
set -x
yunohost dyndns update > /dev/null 2>&1 \
&& echo "Removing the DynDNS cronjob..." \
|| echo "No DynDNS to remove"
rm -f /etc/cron.d/yunohost-dyndns
}
restart_api() {
set -x
systemctl restart yunohost-api
}
display_win_message() {
ip6=$(ip -6 addr show tun0 | awk -F'[/ ]' '/inet/{print $6}' || echo 'ERROR')
ip4=$(ip -4 addr show tun0 | awk -F'[/ ]' '/inet/{print $6}' || echo 'ERROR')
cat <<EOF
VICTOIRE !
Your Cube has been configured properly. Please set your DNS records as below:
@ 14400 IN A $ip4
* 14400 IN A $ip4
@ 14400 IN AAAA $ip6
* 14400 IN AAAA $ip6
_xmpp-client._tcp 14400 IN SRV 0 5 5222 $domain.
_xmpp-server._tcp 14400 IN SRV 0 5 5269 $domain.
@ 14400 IN MX 5 $domain.
@ 14400 IN TXT "v=spf1 a mx ip4:$ip4 ip6:$ip6 -all"
$(cat /etc/dkim/$domain.mail.txt > /dev/null 2>&1 || echo '')
EOF
cat <<EOF
/!\\ Do not forget to change:
* The root password on the OS-level: # passwd
* The administration password in yunohost
* The regular user password in yunohost
* The VPN client password administered in yunohost
* The Wifi AP password administered in yunohost
EOF
}
# ----------------------------------
# Operation order (you can deactivate some if your script has failed in the middle)
# ----------------------------------
get_variables
modify_hosts
set_locales
upgrade_system
postinstall_yunohost
create_yunohost_user
add_labriqueinternet_app_list
install_vpnclient
configure_vpnclient
install_hotspot
configure_hostpot
install_doctorcube
install_neutrinet_ynh
remove_dyndns_cron
restart_api
display_win_message