- Create new policy that allows forwarding between zones.
See: https://bugzilla.redhat.com/show_bug.cgi?id=2016864#c8
- Increment version to perform setup on upgrade.
Closes: #2355
Tests:
- Build freedombox package, and install on top of Bookworm VM The
firewall setup is performed. firewall-cmd lists the fbx_int_to_ext_fwd
policy, masquerade on external zone, and forward on internal zone.
Not tested:
- I did not test forwarding traffic from external to internal zone.
However, several users have reported following these instructions on
the forum, and that it solved the issue for them.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Minor refactors for readability]
[sunil: Ensure that operation is idempotent]
[sunil: Reload instead of restarting firewalld]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
If the GRUB install device has not been selected, then grub package
configuration will fail during upgrades.
Tests:
- Install freedombox package with this change in a VM. Check that the
diagnostic is passed.
- Re-install the grub-pc package with DEBIAN_FRONTEND set to
noninteractive, so that it fails to be configured. Check that the
diagnostic is failed.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged (except initializing init/info a new SSH repository).
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged (except deleting the last admin user).
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Fixes: #2435
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Run affected privileged actions through UI and notice that secret strings are
not logged.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Perform effected actions and ensure that secrets are not logged on the
console.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
TiddlyWiki uses almost the same Apache configuration as Feather Wiki,
with one difference - disabling gzip for the `HEAD` request.
The FreedomBox app for TiddlyWiki is identical to Feather Wiki in
every other aspect.
- Proxy download through freedombox.org. This serves two purposes:
1. Upstream's website cannot track the IP addresses of FreedomBox users.
2. We can update the versions of the empty quine files without making
code changes in FreedomBox.
[sunil]
- Update description to correct the list of users who can access the app.
- Update logo to adhere to the logo guidelines.
- Minor styling fix.
- Update the copyright on the logo based on information from upstream git
repository.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
This serves two purposes:
1. Upstream's website cannot track the IP addresses of FreedomBox users.
2. We can update the versions of the empty quine files without making
code changes in FreedomBox.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
[sunil: Update description to reflect the change in upstream URL]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.or>g
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- Uninstall deletes wikis & extensions
- Use Skylark (v1.8.0)
- Add option to upload existing wiki
- Open wiki links in new tab. Since Feather Wiki modifies browser history, it
takes several clicks to go back and reach the FreedomBox app for Feather Wiki if
the user wants to switch to another wiki file. Opening in a new tab also makes
it easy for the user to move text between wikis (i.e. the Refile use case).
- Improve HTML file path handling. Extract only the HTML file name from the URL.
Return a 404 status if the file cannot be found
- Place featherwiki_nest.cgi file in /usr/lib/cgi-bin. The file is installed as
part of the FreedomBox package, rather than a step in the installation of
Feather Wiki.
[sunil]
- Reorganized description to complete the introduction before talking about
FreedomBox implementation.
- Update description to say that only users of 'wiki' group can access.
- Update description to talk about where the wiki is downloaded from how to
upgrade it.
- Update short description to 'Personal Notebooks'.
- Add UsersAndGroups component and to reuse 'wiki' group properly.
- Reorder component to resemble other apps (could prove useful in future).
- Restrict frontpage shortcut to 'wiki' group users.
- Minor styling updates. Run isort.
- Use pathlib.Path object where possible instead of os.path.
- Perform sanitization in privileged methods instead of callers. This leads
better security if the service is compromised.
- Perform duplicate checking in privileged methods instead of callers.
- Check in privileged action that uploaded file originates from temporary
directory. Otherwise, arbitrary files can moved into DAV directory.
- Switch storage path to /var/lib/ which is an application data folder from
/var/www which is a user data folder.
- Add extra security to the DAV folder by explicitly rejecting .htaccess
directives, forcing mime type and removing all options.
- Update SVG/PNG logo icons to adhere to our guidelines.
- Minor template updates. Add required attributes. Improve i18n. Avoid <p>
inside <p>.
- Refactor tests for more code reuse and fewer globals.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- DAV can simplify hosting the Feather Wiki app.
- It can also potentially be used to share folders over HTTP to clients such a
GNOME/KDE file mangers.
- Enabling the modules by default should have few disadvantages other than
slight increase in memory. It needs to be enabled with 'DAV on' directive on the
specific directories.
Tests:
- Running the service after patch run apache setup and the modules are enabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Tests:
- Without the changes, typing https://<domain>/nextcloud does not work. With the
changes it redirects to https://<domain>/nextcloud/.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- /etc/gitweb-freedombox.conf is a drop-in configuration file. It is provide in
/usr and linked into /etc/. It is overwritten when freedombox package is
upgraded. So, it is incorrect to backup/restore the file.
Tests:
- Run functional tests that include backup/restore.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Tests:
- Run functional tests on miniflux app.
- Run backup and restore on ttrss app manually and notice that data is restored
and there are no errors.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
- When the password is changed during the reset-password test, running other
tests in a different test run fails the tests.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
- Check the exitstatus and signalstatus as seen from the ptyprocess module.
- Avoid accessing 'log' before is it initialized.
- When creating admin user, don't expect JSON message for all other types of
errors. They are simple strings.
Tests:
- Try to modify the password of a non-existent account. Notice the error message
is shown. Modify the password of an existing account and it succeeds.
- Create an account with username that already exists. Notice that error is
shown. Otherwise, it succeeds.
- Allow the UI to enter short passwords and notice that error is shown properly
during user creation and reset password.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
Tests:
- Reset the password of an account successfully. No error is shown.
- Reset the password of a non-existent account. Error is shown.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
Both postgres and postgres-contrib package seem to pull the postgres-16 package
ultimately.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
[sunil's changes]
- Add copyright information the logo.
- Deluge: undo an unintended change.
- Drop wrapper calls over privileged methods. The new privileged method
decorators make is easy to avoid these.
- Styling updates: docstrings, single quotes for strings, casing for UI strings.
- Drop "DO NOT EDIT" comment for files located in /usr as they are not expected
to be editable by the user.
- Fix 'miniflux' to 'Miniflux' in web client name.
- Overwrite FreedomBox settings onto the existing configuration file when setup
is re-run. This is to ensure that FreedomBox settings take priority.
- Use return value of the miniflux command to raise errors.
- Use pathlib module where possible.
- Move message parsing into the privileged module from views module.
- Resize SVG and PNG logo files for consistency with icon styling.
- Use hypens instead of underscores in URLs and Django URL names.
- Rename miniflux_configure.html to miniflux.html.
- Use base method for minor simplification in backup functional test. Ensure
that the test can be run independently when other tests are not run.
- Update tests to reflect code changes.
- Avoid concatenating internationalized strings so that they can be translated
properly.
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- Not enabled by default currently. This can be changed after further
testing.
- Re-use existing operation from diagnostics run. However, this requires
changing the app_id of the operation for each app.
Tests:
- Enable automatic repair, and run diagnostics. See that repairs are
run.
- Enable automatic repair, and wait for daily diagnostics run. See that
repairs are run.
Closes: #2399.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- Rename 'domain' to 'override domain'. See below.
- If override domain is not set and trusted domains list is properly maintained,
then Nextcloud can be accessed using a domain from list of trusted domains. This
is ideal as accessing from .onion domain and a regular domain will
simultaneously without forcing a single domain. However, non-localhost IP
addresses will not work with this approach and 'override domain' will be needed.
- When override domain is set to an IP address or a domain, then that domain
will forced. Also hostname are accepted on a request but after the first page
load, access will be forcefully redirected to the configured override domain.
Multiple domains, even trusted domains, will thus not work. This option should
be used as a last resort.
- All un-setting the override domain to an empty value so that trusted domains
can be used again.
- Update diagnostic checks to ensure that above logic is used with checking
domains.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Enable the redis drop-in configurations before redis-server is started so that
the configuration is effective.
- When app is disabled and re-running setup, disable it after running setup
because setup() enables it.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Retrieve a database password from configuration if one is set instead of
generating new one.
- Create database after starting the container. This is okay as database
configuration is not set until maintenance:install operation is run.
- Minor change to setting administrator password during install.
Tests:
- Update profile in Nextcloud and re-run setup. The updated settings are still
available.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This is required because when services are restarted, their Unix domain sockets
are removed and new ones are created. The container will still be using the old
sockets and will fail to connect to the service.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- First wait until the files are copied into /var/www/html from
/usr/src/nextcloud.
- Then wait until init-sync lock is released.
- This allows for re-running setup as CAN_INSTALL file is removed after install
process in completed.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Configuring just php-fpm is easier compared to configuring Apache + mod_php.
There is no need to configure trusted proxies as the requests are made using the
FastCGI protocol.
- There is no need for a full web server as we already run Apache.
- Place nextcloud data in /var/lib/container so that non-PHP files can be served
directly without php-fpm involved. This location is more suitable for switching
to nextcloud based on a .deb file (if ever). This is done by configuring the
volume to serve a bind mounted directory of our choice.
- Update Apache configuration to proxy to php-fpm instead of another web server.
Include the changes needed for Apache configuration to serve non-php files
directly.
- Managed the volume using quadlet podman systemd generator.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This is not ideal and reduces security. However it simplifies quite a bit of
setup.
- Services on the host network are already exposed to the container (however,
they could easily be protected with firewall rules).
- Container has full access to external networks already. So this part does not
change.
- This setup would be at par with how other services run on FreedomBox right
now. We can think of generalized solution for all the apps later.
- FirewallLocalProtection for the single service the runs in the container works
as usual without change.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- See quadlet(5).
- Using 'podman generate systemd' is deprecated. Quadlets are recommended.
- When using the systemd generator, enable/disable is not possible. The
container is automatically started when system is booted or systemd is reloaded
after .container file changes.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tested when minidlna app is running - after upgrade the ssdp
port is open.
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Minidlna interface is still available to everybody in internal networks
at http://<ip-address>:8200. (Note that using mDNS name like
freedombox.local doesn't work here).
Remove 'minidlna' group and apache minidlna site configuration as
those are not useful any more.
Reconfigure minidlna front page shortcut to link to the app
description page.
Tests performed with stable and testing containers:
Create a user that belongs to minidlna group. Apply changes, after
minidlna app upgrade:
- the user is not in minidlna group any more.
- the users configuration page doesn't show minidlna group.
- Apache site /_minidlna is disabled.
Closes#2012, #2013, #2416.
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
[sunil: Minor formatting, use single quotes for strings for consistency]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
