Skip to content

Commit 2e223bf

Browse files
jchiarullijchiarulli
authored
feat: set ownership and perms for files, directories, binaries etc. #53 (#70)
1 parent 47b43bc commit 2e223bf

37 files changed

+320
-118
lines changed

‎cmd/install.go

+40-37
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,10 @@ var installCmd = &cobra.Command{
9494
// Step 3: Configure the intrusion detection system
9595
network.ConfigureIntrusionDetection()
9696

97-
// Setp 4: Create relay user
97+
// Step 4: Configure Nginx
98+
network.ConfigureNginx()
99+
100+
// Setp 5: Create relay user
98101
spinner, _ := pterm.DefaultSpinner.Start(fmt.Sprintf("Checking if '%s' user exists...", relays.User))
99102
if !users.UserExists(relays.User) {
100103
spinner.UpdateText(fmt.Sprintf("Creating '%s' user...", relays.User))
@@ -105,118 +108,118 @@ var installCmd = &cobra.Command{
105108
}
106109

107110
if selectedRelayOption == khatru_pyramid.RelayName {
108-
// Step 5: Configure Nginx for HTTP
111+
// Step 6: Configure Nginx for HTTP
109112
khatru_pyramid.ConfigureNginxHttp(relayDomain)
110113

111-
// Step 6: Get SSL/TLS certificates
114+
// Step 7: Get SSL/TLS certificates
112115
httpsEnabled := network.GetCertificates(relayDomain)
113116
if httpsEnabled {
114-
// Step 7: Configure Nginx for HTTPS
117+
// Step 8: Configure Nginx for HTTPS
115118
khatru_pyramid.ConfigureNginxHttps(relayDomain)
116119
}
117120

118-
// Step 8: Download and install the relay binary
121+
// Step 9: Download and install the relay binary
119122
khatru_pyramid.InstallRelayBinary(pubKey)
120123

121-
// Step 9: Set up the relay service
124+
// Step 10: Set up the relay service
122125
khatru_pyramid.SetupRelayService(relayDomain, pubKey, relayContact)
123126

124-
// Step 10: Show success messages
127+
// Step 11: Show success messages
125128
khatru_pyramid.SuccessMessages(relayDomain, httpsEnabled)
126129
} else if selectedRelayOption == nostr_rs_relay.RelayName {
127-
// Step 5: Configure Nginx for HTTP
130+
// Step 6: Configure Nginx for HTTP
128131
nostr_rs_relay.ConfigureNginxHttp(relayDomain)
129132

130-
// Step 6: Get SSL/TLS certificates
133+
// Step 7: Get SSL/TLS certificates
131134
httpsEnabled := network.GetCertificates(relayDomain)
132135
if httpsEnabled {
133-
// Step 7: Configure Nginx for HTTPS
136+
// Step 8: Configure Nginx for HTTPS
134137
nostr_rs_relay.ConfigureNginxHttps(relayDomain)
135138
}
136139

137-
// Step 8: Download and install the relay binary
140+
// Step 9: Download and install the relay binary
138141
nostr_rs_relay.InstallRelayBinary()
139142

140-
// Step 9: Set up the relay service
143+
// Step 10: Set up the relay service
141144
nostr_rs_relay.SetupRelayService(relayDomain, pubKey, relayContact, httpsEnabled)
142145

143-
// Step 10: Show success messages
146+
// Step 11: Show success messages
144147
nostr_rs_relay.SuccessMessages(relayDomain, httpsEnabled)
145148
} else if selectedRelayOption == strfry.RelayName {
146-
// Step 5: Configure Nginx for HTTP
149+
// Step 6: Configure Nginx for HTTP
147150
strfry.ConfigureNginxHttp(relayDomain)
148151

149-
// Step 6: Get SSL/TLS certificates
152+
// Step 7: Get SSL/TLS certificates
150153
httpsEnabled := network.GetCertificates(relayDomain)
151154
if httpsEnabled {
152-
// Step 7: Configure Nginx for HTTPS
155+
// Step 8: Configure Nginx for HTTPS
153156
strfry.ConfigureNginxHttps(relayDomain)
154157
}
155158

156-
// Step 8: Download and install the relay binary
159+
// Step 9: Download and install the relay binary
157160
strfry.InstallRelayBinary()
158161

159-
// Step 9: Set up the relay service
162+
// Step 10: Set up the relay service
160163
strfry.SetupRelayService(relayDomain, relayContact)
161164

162-
// Step 10: Show success messages
165+
// Step 11: Show success messages
163166
strfry.SuccessMessages(relayDomain, httpsEnabled)
164167
} else if selectedRelayOption == wot_relay.RelayName {
165-
// Step 5: Configure Nginx for HTTP
168+
// Step 6: Configure Nginx for HTTP
166169
wot_relay.ConfigureNginxHttp(relayDomain)
167170

168-
// Step 6: Get SSL/TLS certificates
171+
// Step 7: Get SSL/TLS certificates
169172
httpsEnabled := network.GetCertificates(relayDomain)
170173
if httpsEnabled {
171-
// Step 7: Configure Nginx for HTTPS
174+
// Step 8: Configure Nginx for HTTPS
172175
wot_relay.ConfigureNginxHttps(relayDomain)
173176
}
174177

175-
// Step 8: Download and install the relay binary
178+
// Step 9: Download and install the relay binary
176179
wot_relay.InstallRelayBinary(pubKey)
177180

178-
// Step 9: Set up the relay service
181+
// Step 10: Set up the relay service
179182
wot_relay.SetupRelayService(relayDomain, pubKey, relayContact, httpsEnabled)
180183

181-
// Step 10: Show success messages
184+
// Step 11: Show success messages
182185
wot_relay.SuccessMessages(relayDomain, httpsEnabled)
183186
} else if selectedRelayOption == khatru29.RelayName {
184-
// Step 5: Configure Nginx for HTTP
187+
// Step 6: Configure Nginx for HTTP
185188
khatru29.ConfigureNginxHttp(relayDomain)
186189

187-
// Step 6: Get SSL/TLS certificates
190+
// Step 7: Get SSL/TLS certificates
188191
httpsEnabled := network.GetCertificates(relayDomain)
189192
if httpsEnabled {
190-
// Step 7: Configure Nginx for HTTPS
193+
// Step 8: Configure Nginx for HTTPS
191194
khatru29.ConfigureNginxHttps(relayDomain)
192195
}
193196

194-
// Step 8: Download and install the relay binary
197+
// Step 9: Download and install the relay binary
195198
khatru29.InstallRelayBinary()
196199

197-
// Step 9: Set up the relay service
200+
// Step 10: Set up the relay service
198201
khatru29.SetupRelayService(relayDomain, privKey, relayContact)
199202

200-
// Step 10: Show success messages
203+
// Step 11: Show success messages
201204
khatru29.SuccessMessages(relayDomain, httpsEnabled)
202205
} else if selectedRelayOption == strfry29.RelayName {
203-
// Step 5: Configure Nginx for HTTP
206+
// Step 6: Configure Nginx for HTTP
204207
strfry29.ConfigureNginxHttp(relayDomain)
205208

206-
// Step 6: Get SSL/TLS certificates
209+
// Step 7: Get SSL/TLS certificates
207210
httpsEnabled := network.GetCertificates(relayDomain)
208211
if httpsEnabled {
209-
// Step 7: Configure Nginx for HTTPS
212+
// Step 8: Configure Nginx for HTTPS
210213
strfry29.ConfigureNginxHttps(relayDomain)
211214
}
212215

213-
// Step 8: Download and install the relay binary
216+
// Step 9: Download and install the relay binary
214217
strfry29.InstallRelayBinary()
215218

216-
// Step 9: Set up the relay service
219+
// Step 10: Set up the relay service
217220
strfry29.SetupRelayService(relayDomain, privKey, relayContact)
218221

219-
// Step 10: Show success messages
222+
// Step 11: Show success messages
220223
strfry29.SuccessMessages(relayDomain, httpsEnabled)
221224
}
222225

‎pkg/manager/apt.go

+5-3
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@ package manager
22

33
import (
44
"fmt"
5+
"os"
6+
"os/exec"
7+
58
"github.com/nodetec/rwz/pkg/relays/nostr_rs_relay"
69
"github.com/nodetec/rwz/pkg/relays/strfry"
710
"github.com/nodetec/rwz/pkg/relays/strfry29"
11+
"github.com/nodetec/rwz/pkg/relays/wot_relay"
812
"github.com/pterm/pterm"
9-
"os"
10-
"os/exec"
1113
)
1214

1315
// Function to check if a package is installed
@@ -46,7 +48,7 @@ func AptInstallPackages(selectedRelayOption string) {
4648

4749
packages := []string{"nginx", "certbot", "python3-certbot-nginx", "ufw", "fail2ban"}
4850

49-
if selectedRelayOption == nostr_rs_relay.RelayName || selectedRelayOption == strfry.RelayName || selectedRelayOption == strfry29.RelayName {
51+
if selectedRelayOption == nostr_rs_relay.RelayName || selectedRelayOption == strfry.RelayName || selectedRelayOption == wot_relay.RelayName || selectedRelayOption == strfry29.RelayName {
5052
packages = append(packages, "git")
5153
}
5254

‎pkg/network/certbot.go

+51-2
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,54 @@ package network
22

33
import (
44
"fmt"
5-
"github.com/nodetec/rwz/pkg/utils/files"
6-
"github.com/pterm/pterm"
75
"os"
86
"os/exec"
97
"strings"
8+
9+
"github.com/nodetec/rwz/pkg/utils/directories"
10+
"github.com/nodetec/rwz/pkg/utils/files"
11+
"github.com/pterm/pterm"
1012
)
1113

14+
func setDomainCertDirPerms(domainName string) {
15+
DomainCertificateDirPath := fmt.Sprintf("%s/%s", CertificateDirPath, domainName)
16+
17+
if directories.DirExists(DomainCertificateDirPath) {
18+
directories.SetPermissions(DomainCertificateDirPath, 0700)
19+
}
20+
}
21+
22+
func setDomainCertArchiveDirPerms(domainName string) {
23+
DomainCertificateArchiveDirPath := fmt.Sprintf("%s/%s", CertificateArchiveDirPath, domainName)
24+
25+
if directories.DirExists(DomainCertificateArchiveDirPath) {
26+
directories.SetPermissions(DomainCertificateArchiveDirPath, 0700)
27+
}
28+
}
29+
30+
func setDomainCertArchiveFilePerms(domainName string) {
31+
FullchainArchiveFilePath := fmt.Sprintf("%s/%s/%s", CertificateArchiveDirPath, domainName, FullchainArchiveFile)
32+
PrivkeyArchiveFilePath := fmt.Sprintf("%s/%s/%s", CertificateArchiveDirPath, domainName, PrivkeyArchiveFile)
33+
ChainArchiveFilePath := fmt.Sprintf("%s/%s/%s", CertificateArchiveDirPath, domainName, ChainArchiveFile)
34+
CertArchiveFilePath := fmt.Sprintf("%s/%s/%s", CertificateArchiveDirPath, domainName, CertArchiveFile)
35+
36+
if files.FileExists(FullchainArchiveFilePath) {
37+
files.SetPermissions(FullchainArchiveFilePath, 0600)
38+
}
39+
40+
if files.FileExists(PrivkeyArchiveFilePath) {
41+
files.SetPermissions(PrivkeyArchiveFilePath, 0600)
42+
}
43+
44+
if files.FileExists(ChainArchiveFilePath) {
45+
files.SetPermissions(ChainArchiveFilePath, 0600)
46+
}
47+
48+
if files.FileExists(CertArchiveFilePath) {
49+
files.SetPermissions(CertArchiveFilePath, 0600)
50+
}
51+
}
52+
1253
// Function to get SSL/TLS certificates using Certbot
1354
func GetCertificates(domainName string) bool {
1455
ThemeDefault := pterm.ThemeDefault
@@ -112,6 +153,10 @@ func GetCertificates(domainName string) bool {
112153
if files.FileExists(fmt.Sprintf("%s/%s/%s", CertificateDirPath, domainName, FullchainFile)) &&
113154
files.FileExists(fmt.Sprintf("%s/%s/%s", CertificateDirPath, domainName, PrivkeyFile)) &&
114155
files.FileExists(fmt.Sprintf("%s/%s/%s", CertificateDirPath, domainName, ChainFile)) {
156+
setDomainCertDirPerms(domainName)
157+
setDomainCertArchiveDirPerms(domainName)
158+
setDomainCertArchiveFilePerms(domainName)
159+
115160
certificateSpinner.Info("SSL/TLS certificates already exist.")
116161
pterm.Println()
117162
return true
@@ -134,6 +179,10 @@ func GetCertificates(domainName string) bool {
134179
}
135180
}
136181

182+
setDomainCertDirPerms(domainName)
183+
setDomainCertArchiveDirPerms(domainName)
184+
setDomainCertArchiveFilePerms(domainName)
185+
137186
certificateSpinner.Success("SSL/TLS certificates obtained successfully.")
138187
return true
139188
}

‎pkg/network/constants.go

+6
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,11 @@ const CertificateDirPath = "/etc/letsencrypt/live"
1414
const FullchainFile = "fullchain.pem"
1515
const PrivkeyFile = "privkey.pem"
1616
const ChainFile = "chain.pem"
17+
const CertificateArchiveDirPath = "/etc/letsencrypt/archive"
18+
const FullchainArchiveFile = "fullchain1.pem"
19+
const PrivkeyArchiveFile = "privkey1.pem"
20+
const ChainArchiveFile = "chain1.pem"
21+
const CertArchiveFile = "cert1.pem"
22+
const NginxConfDirPath = "/etc/nginx/conf.d"
1723
const WWWDirPath = "/var/www"
1824
const AcmeChallengeDirPath = ".well-known/acme-challenge"

‎pkg/network/nginx.go

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package network
2+
3+
import (
4+
"github.com/nodetec/rwz/pkg/relays"
5+
"github.com/nodetec/rwz/pkg/utils/directories"
6+
)
7+
8+
// Function to configure Nginx
9+
func ConfigureNginx() {
10+
if directories.DirExists(NginxConfDirPath) {
11+
directories.SetPermissions(NginxConfDirPath, 0755)
12+
directories.SetOwnerAndGroup(relays.NginxUser, relays.NginxUser, NginxConfDirPath)
13+
}
14+
15+
if directories.DirExists(WWWDirPath) {
16+
directories.SetPermissions(WWWDirPath, 0755)
17+
directories.SetOwnerAndGroup(relays.NginxUser, relays.NginxUser, WWWDirPath)
18+
}
19+
}

‎pkg/relays/constants.go

+1
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ package relays
33
const BinaryDestDir = "/usr/local/bin"
44
const TmpDirPath = "/tmp"
55
const User = "nostr"
6+
const NginxUser = "www-data"

‎pkg/relays/khatru29/constants.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,20 @@ const BinaryName = "khatru29"
55
const BinaryFilePath = "/usr/local/bin/khatru29"
66
const NginxConfigFilePath = "/etc/nginx/conf.d/khatru29.conf"
77
const DataDirPath = "/var/lib/khatru29"
8+
const ConfigDirPath = "/etc/khatru29"
89
const ServiceName = "khatru29"
9-
const EnvFilePath = "/etc/systemd/system/khatru29.env"
10+
const EnvFilePath = "/etc/khatru29/khatru29.env"
1011
const EnvFileTemplate = `PORT="5577"
1112
DOMAIN="{{.Domain}}"
1213
RELAY_NAME="Khatru29"
1314
RELAY_PRIVKEY="{{.PrivKey}}"
14-
RELAY_DESCRIPTION="Khatru29 Nostr Relay"
15+
RELAY_DESCRIPTION="Khatru29 Relay"
1516
RELAY_CONTACT="{{.RelayContact}}"
1617
DATABASE_PATH="/var/lib/khatru29/db"
1718
`
1819
const ServiceFilePath = "/etc/systemd/system/khatru29.service"
1920
const ServiceFileTemplate = `[Unit]
20-
Description=Khatru29 Nostr Relay Service
21+
Description=Khatru29 Relay Service
2122
After=network.target
2223
2324
[Service]

‎pkg/relays/khatru29/nginx_http.go

+4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package khatru29
33
import (
44
"fmt"
55
"github.com/nodetec/rwz/pkg/network"
6+
"github.com/nodetec/rwz/pkg/relays"
67
"github.com/nodetec/rwz/pkg/utils/directories"
78
"github.com/nodetec/rwz/pkg/utils/files"
89
"github.com/nodetec/rwz/pkg/utils/systemd"
@@ -15,7 +16,9 @@ func ConfigureNginxHttp(domainName string) {
1516

1617
files.RemoveFile(NginxConfigFilePath)
1718

19+
directories.CreateDirectory(fmt.Sprintf("%s/%s", network.WWWDirPath, domainName), 0755)
1820
directories.CreateDirectory(fmt.Sprintf("%s/%s/%s/", network.WWWDirPath, domainName, network.AcmeChallengeDirPath), 0755)
21+
directories.SetOwnerAndGroup(relays.NginxUser, relays.NginxUser, fmt.Sprintf("%s/%s", network.WWWDirPath, domainName))
1922

2023
configContent := fmt.Sprintf(`map $http_upgrade $connection_upgrade {
2124
default upgrade;
@@ -84,6 +87,7 @@ server {
8487
`, domainName, network.AcmeChallengeDirPath, network.WWWDirPath, domainName, domainName, domainName)
8588

8689
files.WriteFile(NginxConfigFilePath, configContent, 0644)
90+
files.SetOwnerAndGroup(relays.NginxUser, relays.NginxUser, NginxConfigFilePath)
8791

8892
systemd.RestartService("nginx")
8993

‎pkg/relays/khatru29/nginx_https.go

+2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package khatru29
33
import (
44
"fmt"
55
"github.com/nodetec/rwz/pkg/network"
6+
"github.com/nodetec/rwz/pkg/relays"
67
"github.com/nodetec/rwz/pkg/utils/files"
78
"github.com/nodetec/rwz/pkg/utils/systemd"
89
"github.com/pterm/pterm"
@@ -122,6 +123,7 @@ server {
122123
`, domainName, network.CertificateDirPath, domainName, network.FullchainFile, network.CertificateDirPath, domainName, network.PrivkeyFile, network.CertificateDirPath, domainName, network.ChainFile, domainName, network.AcmeChallengeDirPath, network.WWWDirPath, domainName, domainName)
123124

124125
files.WriteFile(NginxConfigFilePath, configContent, 0644)
126+
files.SetOwnerAndGroup(relays.NginxUser, relays.NginxUser, NginxConfigFilePath)
125127

126128
systemd.ReloadService("nginx")
127129

0 commit comments

Comments
 (0)