From 13bfcad30d20aee6f327b5df2a9f4554727e9387 Mon Sep 17 00:00:00 2001 From: ericgaspar Date: Sat, 6 Mar 2021 00:07:47 +0100 Subject: [PATCH] Fix --- check_process | 12 ----- conf/.env | 2 +- conf/nginx.conf | 2 +- conf/php-fpm.conf | 104 +++++++++++++++++++++++++++------------- conf/systemd.service | 13 ++--- manifest.json | 4 +- scripts/_common.sh | 7 ++- scripts/install | 112 +++++++++++++++++++------------------------ scripts/upgrade | 24 +--------- 9 files changed, 136 insertions(+), 144 deletions(-) diff --git a/check_process b/check_process index d51244e..fa58fc1 100644 --- a/check_process +++ b/check_process @@ -21,20 +21,8 @@ upgrade=1 backup_restore=1 multi_instance=1 - incorrect_path=1 port_already_use=0 change_url=0 -;;; Levels - Level 1=auto - Level 2=auto - Level 3=auto - Level 4=auto - Level 5=auto - Level 6=auto - Level 7=auto - Level 8=0 - Level 9=0 - Level 10=0 ;;; Options Email= Notification=none diff --git a/conf/.env b/conf/.env index 7e9724a..e52cef6 100644 --- a/conf/.env +++ b/conf/.env @@ -13,7 +13,7 @@ DB_HOST=127.0.0.1 DB_PORT=3306 DB_DATABASE=__DB_NAME__ DB_USERNAME=__DB_USER__ -DB_PASSWORD=__DB_PASS__ +DB_PASSWORD=__DB_PWD__ HASHIDS_SALT= HASHIDS_LENGTH=8 diff --git a/conf/nginx.conf b/conf/nginx.conf index 9d3fc7f..cbf06bf 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -30,7 +30,7 @@ location __PATH__ { location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; - fastcgi_pass unix:/run/php/php7.2-fpm.sock; + fastcgi_pass unix:/run/php/php__PHPVERSION__-fpm-__NAME__.sock; fastcgi_index index.php; include fastcgi_params; fastcgi_param PHP_VALUE "upload_max_filesize = 100M \n post_max_size=100M"; diff --git a/conf/php-fpm.conf b/conf/php-fpm.conf index e051293..ab1a471 100644 --- a/conf/php-fpm.conf +++ b/conf/php-fpm.conf @@ -1,10 +1,11 @@ ; Start a new pool named 'www'. -; the variable $pool can we used in any directive and will be replaced by the +; the variable $pool can be used in any directive and will be replaced by the ; pool name ('www' here) [__NAMETOCHANGE__] ; Per pool prefix ; It only applies on the following directives: +; - 'access.log' ; - 'slowlog' ; - 'listen' (unixsocket) ; - 'chroot' @@ -24,28 +25,35 @@ group = __USER__ ; The address on which to accept FastCGI requests. ; Valid syntaxes are: -; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific address on +; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on ; a specific port; -; 'port' - to listen on a TCP socket to all addresses on a -; specific port; +; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on +; a specific port; +; 'port' - to listen on a TCP socket to all addresses +; (IPv6 and IPv4-mapped) on a specific port; ; '/path/to/unix/socket' - to listen on a unix socket. ; Note: This value is mandatory. -listen = /var/run/php7.2-fpm-__NAMETOCHANGE__.sock +listen = /var/run/php/php__PHPVERSION__-fpm-__NAMETOCHANGE__.sock -; Set listen(2) backlog. A value of '-1' means unlimited. -; Default Value: 128 (-1 on FreeBSD and OpenBSD) -;listen.backlog = 128 +; Set listen(2) backlog. +; Default Value: 511 (-1 on FreeBSD and OpenBSD) +;listen.backlog = 511 ; Set permissions for unix socket, if one is used. In Linux, read/write ; permissions must be set in order to allow connections from a web server. Many -; BSD-derived systems allow connections regardless of permissions. +; BSD-derived systems allow connections regardless of permissions. ; Default Values: user and group are set as the running user ; mode is set to 0660 listen.owner = www-data listen.group = www-data ;listen.mode = 0660 - -; List of ipv4 addresses of FastCGI clients which are allowed to connect. +; When POSIX Access Control Lists are supported you can set them using +; these options, value is a comma separated list of user/group names. +; When set, listen.owner and listen.group are ignored +;listen.acl_users = +;listen.acl_groups = + +; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect. ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original ; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address ; must be separated by a comma. If this value is left blank, connections will be @@ -59,7 +67,13 @@ listen.group = www-data ; - The pool processes will inherit the master process priority ; unless it specified otherwise ; Default Value: no set -; priority = -19 +; process.priority = -19 + +; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user +; or group is differrent than the master process user. It allows to create process +; core dump and ptrace the process for the pool user. +; Default Value: no +; process.dumpable = yes ; Choose how the process manager will control the number of child processes. ; Possible Values: @@ -96,7 +110,7 @@ pm = dynamic ; forget to tweak pm.* to fit your needs. ; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand' ; Note: This value is mandatory. -pm.max_children = 10 +pm.max_children = 5 ; The number of child processes created on startup. ; Note: Used only when pm is set to 'dynamic' @@ -117,12 +131,12 @@ pm.max_spare_servers = 3 ; Note: Used only when pm is set to 'ondemand' ; Default Value: 10s ;pm.process_idle_timeout = 10s; - + ; The number of requests each child process should execute before respawning. ; This can be useful to work around memory leaks in 3rd party libraries. For ; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. ; Default Value: 0 -pm.max_requests = 500 +;pm.max_requests = 500 ; The URI to view the FPM status page. If this value is not set, no URI will be ; recognized as a status page. It shows the following informations: @@ -170,7 +184,7 @@ pm.max_requests = 500 ; ; By default the status page only outputs short status. Passing 'full' in the ; query string will also return status for each pool process. -; Example: +; Example: ; http://www.foo.bar/status?full ; http://www.foo.bar/status?json&full ; http://www.foo.bar/status?html&full @@ -215,7 +229,7 @@ pm.max_requests = 500 ; last request memory: 0 ; ; Note: There is a real-time FPM status monitoring sample web page available -; It's available in: ${prefix}/share/fpm/status.html +; It's available in: /usr/share/php/7.0/fpm/status.html ; ; Note: The value must start with a leading slash (/). The value can be ; anything, but it may not be a good idea to use the .php extension or it @@ -275,7 +289,7 @@ pm.max_requests = 500 ; - %{megabytes}M ; - %{mega}M ; %n: pool name -; %o: ouput header +; %o: output header ; it must be associated with embraces to specify the name of the header: ; - %{Content-Type}o ; - %{X-Powered-By}o @@ -283,7 +297,7 @@ pm.max_requests = 500 ; - .... ; %p: PID of the child that serviced the request ; %P: PID of the parent of the child that serviced the request -; %q: the query string +; %q: the query string ; %Q: the '?' character if query string exists ; %r: the request URI (without the query string, see %q and %Q) ; %R: remote IP address @@ -291,47 +305,51 @@ pm.max_requests = 500 ; %t: server time the request was received ; it can accept a strftime(3) format: ; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsuled in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t ; %T: time the log has been written (the request has finished) ; it can accept a strftime(3) format: ; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsuled in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t ; %u: remote user ; ; Default: "%R - %u %t \"%m %r\" %s" ;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%" - + ; The log file for slow requests ; Default Value: not set ; Note: slowlog is mandatory if request_slowlog_timeout is set -slowlog = /var/log/nginx/__NAMETOCHANGE__.slow.log - +;slowlog = log/$pool.log.slow + ; The timeout for serving a single request after which a PHP backtrace will be ; dumped to the 'slowlog' file. A value of '0s' means 'off'. ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) ; Default Value: 0 -request_slowlog_timeout = 5s - +;request_slowlog_timeout = 0 + ; The timeout for serving a single request after which the worker process will ; be killed. This option should be used when the 'max_execution_time' ini option ; does not stop script execution for some reason. A value of '0' means 'off'. ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) ; Default Value: 0 request_terminate_timeout = 1d - + ; Set open file descriptor rlimit. ; Default Value: system defined value ;rlimit_files = 1024 - + ; Set max core size rlimit. ; Possible Values: 'unlimited' or an integer greater or equal to 0 ; Default Value: system defined value ;rlimit_core = 0 - + ; Chroot to this directory at the start. This value must be defined as an ; absolute path. When this value is not set, chroot is not used. ; Note: you can prefix with '$prefix' to chroot to the pool prefix or one ; of its subdirectories. If the pool prefix is not set, the global prefix ; will be used instead. -; Note: chrooting is a great security feature and should be used whenever +; Note: chrooting is a great security feature and should be used whenever ; possible. However, all PHP paths will be relative to the chroot ; (error_log, sessions.save_path, ...). ; Default Value: not set @@ -347,16 +365,25 @@ chdir = __FINALPATH__ ; Note: on highloaded environement, this can cause some delay in the page ; process time (several ms). ; Default Value: no -catch_workers_output = yes +;catch_workers_output = yes + +; Clear environment in FPM workers +; Prevents arbitrary environment variables from reaching FPM worker processes +; by clearing the environment in workers before env vars specified in this +; pool configuration are added. +; Setting to "no" will make all environment variables available to PHP code +; via getenv(), $_ENV and $_SERVER. +; Default Value: yes +;clear_env = no ; Limits the extensions of the main script FPM will allow to parse. This can ; prevent configuration mistakes on the web server side. You should only limit ; FPM to .php extensions to prevent malicious users to use other extensions to -; exectute php code. +; execute php code. ; Note: set an empty value to allow all extensions. ; Default Value: .php -;security.limit_extensions = .php .php3 .php4 .php5 - +;security.limit_extensions = .php .php3 .php4 .php5 .php7 + ; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from ; the current environment. ; Default Value: clean env @@ -370,7 +397,7 @@ catch_workers_output = yes ; overwrite the values previously defined in the php.ini. The directives are the ; same as the PHP SAPI: ; php_value/php_flag - you can set classic ini defines which can -; be overwritten from PHP call 'ini_set'. +; be overwritten from PHP call 'ini_set'. ; php_admin_value/php_admin_flag - these directives won't be overwritten by ; PHP call 'ini_set' ; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. @@ -390,3 +417,14 @@ catch_workers_output = yes ;php_admin_value[error_log] = /var/log/fpm-php.www.log ;php_admin_flag[log_errors] = on ;php_admin_value[memory_limit] = 32M + +; Common values to change to increase file upload limit +; php_admin_value[upload_max_filesize] = 50M +; php_admin_value[post_max_size] = 50M +; php_admin_flag[mail.add_x_header] = Off + +; Other common parameters +; php_admin_value[max_execution_time] = 600 +; php_admin_value[max_input_time] = 300 +; php_admin_value[memory_limit] = 256M +; php_admin_flag[short_open_tag] = On diff --git a/conf/systemd.service b/conf/systemd.service index 04c85c8..c1a678c 100644 --- a/conf/systemd.service +++ b/conf/systemd.service @@ -1,17 +1,12 @@ -# Pterodactyl Queue Worker File -# ---------------------------------- - [Unit] Description=Pterodactyl Queue Worker After=redis-server.service [Service] -# On some systems the user and group might be different. -# Some systems use `apache` as the user and group. -User=www-data -Group=www-data +User=__APP__ +Group=__APP__ Restart=always -ExecStart=/usr/bin/php /var/www/pterodactyl/artisan queue:work --queue=high,standard,low --sleep=3 --tries=3 +ExecStart=/usr/bin/php __FINALPATH__/artisan queue:work --queue=high,standard,low --sleep=3 --tries=3 [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target diff --git a/manifest.json b/manifest.json index ab11c60..a3bd3ea 100644 --- a/manifest.json +++ b/manifest.json @@ -14,12 +14,12 @@ "email": "aeris@e.email" }, "requirements": { - "yunohost": ">= 3.8.1" + "yunohost": ">= 4.1.7" }, "multi_instance": true, "services": [ "nginx", - "php7-fpm", + "php7.3-fpm", "mysql" ], "arguments": { diff --git a/scripts/_common.sh b/scripts/_common.sh index b8a81bf..b601d52 100644 --- a/scripts/_common.sh +++ b/scripts/_common.sh @@ -4,7 +4,12 @@ # COMMON VARIABLES #================================================= -YNH_PHP_VERSION=7.2 +YNH_PHP_VERSION=7.3 + +extra_php_dependencies="php${YNH_PHP_VERSION}-igbinary php${YNH_PHP_VERSION}-memcached php${YNH_PHP_VERSION}-msgpack php${YNH_PHP_VERSION}-xdebug php${YNH_PHP_VERSION}-bcmath php7.2-cli php${YNH_PHP_VERSION}-common php${YNH_PHP_VERSION}-curl php${YNH_PHP_VERSION}-fpm php${YNH_PHP_VERSION}-gd php${YNH_PHP_VERSION}-json php${YNH_PHP_VERSION}-mbstring php${YNH_PHP_VERSION}-mysql php${YNH_PHP_VERSION}-opcache php${YNH_PHP_VERSION}-readline php${YNH_PHP_VERSION}-xml php${YNH_PHP_VERSION}-zip" + +pkg_dependencies="libargon2-1 libsodium23 libzip5 memcached" + #================================================= # EXPERIMENTAL HELPERS diff --git a/scripts/install b/scripts/install index 403ca3f..59397f9 100644 --- a/scripts/install +++ b/scripts/install @@ -30,102 +30,87 @@ path_url=$YNH_APP_ARG_PATH admin=$YNH_APP_ARG_ADMIN is_public=$YNH_APP_ARG_IS_PUBLIC password=$YNH_APP_ARG_PASSWORD +email=$(ynh_user_get_info --username=$admin --key=mail) app=$YNH_APP_INSTANCE_NAME #================================================= # CHECK IF THE APP CAN BE INSTALLED WITH THESE ARGS #================================================= - -ynh_script_progression --message="Validating installation parameters..." --weight=1 +ynh_script_progression --message="Validating installation parameters..." --time --weight=1 final_path=/var/www/$app -test ! -e "$final_path" || ynh_die "Seems like $final_path already exist. Aborting." +test ! -e "$final_path" || ynh_die --message="This path already contains a folder" -# Normalize the url path syntax -path_url=$(ynh_normalize_url_path $path_url) - -# Check web path availability -ynh_webpath_available $domain $path_url # Register (book) web path -ynh_webpath_register $app $domain $path_url +ynh_webpath_register --app=$app --domain=$domain --path_url=$path_url #================================================= # STORE SETTINGS FROM MANIFEST #================================================= -ynh_app_setting_set $app domain $domain -ynh_app_setting_set $app path $path_url -ynh_app_setting_set $app admin $admin -ynh_app_setting_set $app is_public $is_public +ynh_app_setting_set --app=$app --key=domain --value=$domain +ynh_app_setting_set --app=$app --key=path --value=$path_url +ynh_app_setting_set --app=$app --key=admin --value=$admin #================================================= # FIND AND OPEN A PORT #================================================= +ynh_script_progression --message="Finding an available port..." --weight=1 -# Find a free port -port=$(ynh_find_port 8080) -# Open this port -yunohost firewall allow --no-upnp TCP $port 2>&1 -ynh_app_setting_set $app port $port +# Find an available port +port=$(ynh_find_port --port=8080) +ynh_app_setting_set --app=$app --key=port --value=$port -#============================================== -# INSTALL DEPS -#============================================== +#================================================= +# INSTALL DEPENDENCIES +#================================================= +ynh_script_progression --message="Installing dependencies..." --weight=1 -## Install PHP 7.2 -ynh_install_php --phpversion=7.2 - -## Get apt updates -ynh_package_update -ynh_package_install libargon2-1 libsodium23 libzip5 memcached php-igbinary php-memcached php-msgpack php-xdebug php7.2 php7.2-bcmath php7.2-cli php7.2-common php7.2-curl php7.2-fpm php7.2-gd php7.2-json php7.2-mbstring php7.2-mysql php7.2-opcache php7.2-readline php7.2-xml php7.2-zip - - -## Start php7.2 -systemctl enable php7.2-fpm -systemctl start php7.2-fpm +ynh_install_app_dependencies $pkg_dependencies #================================================= # CREATE A MYSQL DATABASE #================================================= -# If your app uses a MySQL database, you can use these lines to bootstrap -# a database, an associated user and save the password in app settings +ynh_script_progression --message="Creating a MySQL database..." --weight=1 -db_name=$(ynh_sanitize_dbid $app) -ynh_app_setting_set $app db_name $db_name -ynh_mysql_setup_db $db_name $db_name +db_name=$(ynh_sanitize_dbid --db_name=$app) +db_user=$db_name +ynh_app_setting_set --app=$app --key=db_name --value=$db_name +ynh_mysql_setup_db --db_user=$db_user --db_name=$db_name #================================================= # DOWNLOAD, CHECK AND UNPACK SOURCE #================================================= +ynh_script_progression --message="Setting up source files..." --weight=1 -ynh_app_setting_set $app final_path $final_path +ynh_app_setting_set --app=$app --key=final_path --value=$final_path # Download, check integrity, uncompress and patch the source from app.src -ynh_setup_source "$final_path" +ynh_setup_source --dest_dir="$final_path" #================================================= # NGINX CONFIGURATION #================================================= +ynh_script_progression --message="Configuring NGINX web server..." --time --weight=1 -# Create a dedicated nginx config +# Create a dedicated NGINX config ynh_add_nginx_config #================================================= # CREATE DEDICATED USER #================================================= +ynh_script_progression --message="Configuring system user..." --time --weight=1 # Create a system user -ynh_system_user_create $app +ynh_system_user_create --username=$app #================================================= # SPECIFIC SETUP #================================================= -# create a user -email=$(ynh_user_get_info $admin 'mail') - # setup application config cp -a ../conf/.env $final_path/.env + cp -a ../conf/wings.service /etc/systemd/system/wings.service #================================================= @@ -145,27 +130,19 @@ ynh_replace_string "__DB_NAME__" "$db_name" "$final_path/.env" ynh_install_composer -#================================================= -# DOWNLOAD, CHECK AND UNPACK SOURCE -#================================================= - -ynh_app_setting_set $app final_path $final_path -# Download, check integrity, uncompress and patch the source from app.src -ynh_setup_source "$final_path" - #============================================== # Install Pterodactyl #============================================== pushd $final_path -chmod -R 755 storage/* bootstrap/cache -composer install --no-progress -php artisan key:generate --force -php artisan migrate --force -php artisan db:seed --force -php artisan p:user:make --name-first $admin --name-last $admin --username $admin --email $email --password $password --admin 1 -php artisan p:environment:setup --author=$email --url=https://$domain --timezone=America/New_York --cache=redis --session=database --queue=redis --disable-settings-ui --redis-host=127.0.0.1 --redis-pass= --redis-port=6379 -php artisan migrate --seed --force + chmod -R 755 storage/* bootstrap/cache + composer install --no-progress + php artisan key:generate --force + php artisan migrate --force + php artisan db:seed --force + php artisan p:user:make --name-first $admin --name-last $admin --username $admin --email $email --password $password --admin 1 + php artisan p:environment:setup --author=$email --url=https://$domain --timezone=America/New_York --cache=redis --session=database --queue=redis --disable-settings-ui --redis-host=127.0.0.1 --redis-pass= --redis-port=6379 + php artisan migrate --seed --force popd #============================================== @@ -237,16 +214,25 @@ chown -R www-data:www-data $final_path #================================================= # SETUP SSOWAT #================================================= +ynh_script_progression --message="Configuring permissions..." --time --weight=1 # Make app public if necessary if [ $is_public -eq 1 ] then - # unprotected_uris allows SSO credentials to be passed anyway. - ynh_app_setting_set $app unprotected_uris "/" + # Everyone can access the app. + # The "main" permission is automatically created before the install script. + ynh_permission_update --permission="main" --add="visitors" fi #================================================= # RELOAD NGINX #================================================= +ynh_script_progression --message="Reloading NGINX web server..." --time --weight=1 -systemctl reload nginx +ynh_systemd_action --service_name=nginx --action=reload + +#================================================= +# END OF SCRIPT +#================================================= + +ynh_script_progression --message="Installation of $app completed" --time --last diff --git a/scripts/upgrade b/scripts/upgrade index 74a2690..3359992 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -28,12 +28,6 @@ db_name=$(ynh_app_setting_get --app=$app --key=db_name) # CHECK VERSION #================================================= -### This helper will compare the version of the currently installed app and the version of the upstream package. -### $upgrade_type can have 2 different values -### - UPGRADE_APP if the upstream app version has changed -### - UPGRADE_PACKAGE if only the YunoHost package has changed -### ynh_check_app_version_changed will stop the upgrade if the app is up to date. -### UPGRADE_APP should be used to upgrade the core app only if there's an upgrade to do. upgrade_type=$(ynh_check_app_version_changed) #================================================= @@ -161,7 +155,6 @@ ynh_add_systemd_config # Set permissions on app files chown -R root: $final_path - #================================================= # INTEGRATE SERVICE IN YUNOHOST #================================================= @@ -174,20 +167,7 @@ yunohost service add $app --description "Pterodactyl Queue Worker" --log "/var/l #================================================= ynh_script_progression --message="Starting a systemd service..." --time --weight=1 -ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log" - - -#================================================= -# SETUP SSOWAT -#================================================= -ynh_script_progression --message="Upgrading SSOwat configuration..." --time --weight=1 - -# Make app public if necessary -if [ $is_public -eq 1 ] -then - # unprotected_uris allows SSO credentials to be passed anyway - ynh_app_setting_set --app=$app --key=unprotected_uris --value="/" -fi +ynh_systemd_action --service_name=$app --action=start --log_path="/var/log/$app/$app.log" #================================================= # RELOAD NGINX @@ -200,4 +180,4 @@ ynh_systemd_action --service_name=nginx --action=reload # END OF SCRIPT #================================================= -ynh_script_progression --message="Upgrade of $app completed" --time --last \ No newline at end of file +ynh_script_progression --message="Upgrade of $app completed" --last