Closes: #2490
Tests:
- Unit tests works.
- On a fresh stable container, enable auto updates. Run 'apt install
mumble-server' and kill the apt process when it is unpacking. After this any apt
install command will ask for running dpkg --configure -a. At this time, run the
Testing dist upgrade. Dist upgrade starts successfully and then shows the
message 'Fixing any broken apt/dpkg states...'. It also shows that packages that
were not setup have been setup. Dist upgrades proceeds after that.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Save changes to /etc/apt/sources.list as a different file.
- When launching the dist upgrade process via systemd-run, use bind mounting to
ensure that the newly created sources file is treated as the original
/etc/apt/sources.list.
- If the process completes successfully, rename the new file to the original
sources.list. If the process terminates abruptly or machine reboots,
sources.list will remain unchanged. This will also the dist upgrade process to
be restarted (and hopefully continued).
Tests:
- On a fresh stable container, running dist-upgrade succeeds.
- While dist-upgrade is running, /etc/apt/sources.list is unmodified. After the
operation is successfully completed, /etc/apt/sources.list has been updates
successfully. If the operation fails, /etc/apt/sources.list remains unmodified.
- During the run the following are run:
- apt update
- package holds
- debconf selections
- full-upgrade
- autoremove
- unattended-upgrades
- restarting freedombox service
- waiting 10 minutes
- apt update
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- When an action is invoked, it configured to handle console and journal
handlers. Console logger (StreamHandler) flushes after each event. Journal event
is sent immediately after the event. So, we are not losing the immediate flush
advantage by switching to logging framework.
- Since console logging is present (and the output is not captured away), using
journal handler also will double log each event. Remove the journal handler.
Console is where the output of various commands is logged. So, keep that.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- A service with the same name can't be started again.
- Transient service goes away as soon as the process ends. This is like
automatically removing the flag. This ensures that stale file does not cause an
issue.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: #2493.
Tests:
- For each of the packages in the list, download the Bookworm version and Trixie
version of the packages. See if the files in /etc/ that were modified were also
files we also modify. If so, keep it in the list. Otherwise, remove it from the
list.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Helps: #2493.
- searx will not be part of Trixie.
- This special upgrade code is not required for Bookworm -> Trixie upgrade.
- This code is not be invoked for Bullseye -> Bookworm upgrade as this removal
will not reach Bullseye.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Adding a new domain works. Adding a new domain with old name results in error
message.
- Editing a old domain works. Updating the domain name works. Updating
configuration parameters without domain name change works.
- Adding a domain with capital letters results in domain with lower cased
letters.
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Adding an new unique domain works.
- Adding an existing domain results in an error.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
unattended-upgrade will take a very long time to run, and won't be able
to upgrade most of the packages. There is not much benefit to running it
here.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Tests:
- Start a dist-upgrade from stable to testing. Dist upgrade is completed
as expected. "The system will reboot" message appears only after
freedombox-dist-upgrade.service has completed.
Helps: #2090
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- The get_domain_name() has some problem. It returns only static domain names
but not a dynamic domain name. It may not always return the same domain when
multiple static domains are configured. It may return return an empty string.
Tests:
- JSXC page shows the alphabetically first static domain. If no static domain is
configured, first dynamic domain is shown, next pagekite domain, next pagekite
domain, next tor onion domain, and finally .local domain.
- Downloading profile from OpenVPN will set the first domain in it.
- When ejabberd is installed, the first domain is configured by default.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- First of the list is the most important one and may be used as "primary"
domain in apps.
- Change the return type of DomainName.list() from set to list so that order can
be preserved. Update all users of the API accordingly. Add type hints to all the
methods using this API to catch any errors.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This can be used to ensure that apps that can deal with only a single domain
auto-configure the best domain by default.
Tests:
- Unit tests run.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Instead of just configure button, show edit/delete. And configure separately.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Change the mechanism for storing domain names in /etc/hosts. Don't write
hostname to /etc/hosts. Don't prepend hostname to domain name. This means that
when hostname changes, set_domain_name need not be called.
- This means that domain names such as example.fbx.one were not resolvable using
/etc/hosts but these will now resolve to 127.0.1.1. This is a minor concern to
becoming a breaking change.
- Don't use socket.getfqdn() for finding the domain name of the machine. Instead
read from /etc/hosts. There does not seem to a glibc/python API for querying
domain names from /etc/hosts with all variations it allows. Forward resolution
properly works no matter the library.
- Drop a pre-Python 3 conversion from unicode to ascii string for hostname. This
is no longer relevant.
- Domain name form is now domain add form. Passing domain name is mandatory.
Domain delete form and view have been introduced.
- Use augeas to edit hosts file. Add privileged methods to add/delete/get
domains. Add method to migration from old format to new. Support reading old
format too in get_domains.
Tests:
- Without hostname written in /etc/hosts, 'resolvectl query <hostname>' and
'ping <hostname>' work.
- With old /etc/hosts format apply patches and restart service. It will be
converted to new format.
- Adding a domain adds a new line to /etc/hosts file. The domain is shown in
domains list in Names app. Applications get reconfigured with the new domain
name.
- Deleting a domain adds a new line to /etc/hosts file. The domain is shown in
domains list in Names app. Applications get reconfigured with the new domain
name.
- Restarting app triggers domain added signal for all domains and all the
domains are shown in the Names app.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- In the main domains list, only show currently configured domains. Allow
operations such as edit/delete/configure on them. Actions are determined by the
domain type.
- Show domain types that can be added in a separate table. If an domain is
present and only of that type can exist, it will not be shown in this table.
Show add/configure action based on whether multiple domains can exist.
Tests:
- Configuring a singleton domain type puts it in the domains tables and removes
it from the add domains table. De-configuring it or disabling it does the
opposite.
- For domain types with multiple domains (static/dynamic), entries are shown in
domains if such domains exist. Entry in add domains tables always shows up.
- All action buttons for all five domain types work.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- To be used to present better interface for domain types that have multiple
domains.
Tests:
- Unit tests pass.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This can happen if a domain is added while the app is disabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This seems to be the most useful function for enabling/disabling dynamic DNS.
This is also what users are likely to expect.
Tests:
- Disable app. The domains will be removed from list of domains in Names app.
Installed applications will be reconfigured.
- Enable app. The domains will be added to list of domains in Names app.
Installed applications will be reconfigured.
- When app is disabled. Adding/removing domain does not trigger app
configuration apps. Domains are not added to Names app.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- In preparation for changes to domain type component.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This would mean consistent interfacing with systemd instead of a split
approach.
Tests:
- Edit hostname page shows the current value of hostname correctly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
The changes introduced in https://salsa.debian.org/freedombox-team/freedombox/-/merge_requests/2616
make the email app installation fail if it's installed for the first
time.
This patch ensures that 95-freedombox-sieve.conf is present and that
dovecot is restarted before privileged.setup_spam() is run. This way,
the sievec command can run.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
SOGo is an open source webmail client and groupware available in Debian.
Make a new FreedomBox app for it to be used with the local
Postfix/Dovecot email server.
SOGo requires a database to store events/tasks as well as user settings. Memcached
is also required for caching.
Users log in with their username (as opposed to username + domain on
Roundcube). The host header seen from the first login will be
associated with the user profile. So, if a user logs into SOGo from
freedombox.local and later configures the email server to use
example.com, they will manually have to edit their account(s) to show
the updated domain.
Authentication is done via openldap. It is possible to authenticate with
apache, however it is limited to http basic auth, so mod_auth_tkt cannot
be used. See: b40d777a86/SoObjects/SOGo/SOGoProxyAuthenticator.m (L137)
Configuring http basic auth in my opinion wouldn't add much to
the user experience. It would actually take away the usage of SOGO's built
in TOTP feature.
SOGo only accepts configurations from /etc/sogo/sogo.conf, other configs
from sogo.d don't get recognised.
Use the sogo icon from upstream source. Update sogo.png and sogo.svg to be the
same image (but resized) that is provided in the upstream source. The previous
image was download from Wikimedia Commons.
Update smtp settings so that messages can be sent
Test result for mail deliverability sent with SOGo: https://www.mail-tester.com/test-pdf2yzy6n
The result shows that the message is not DKIM signed. This seems to be
an issue not specific to SOGo. Mails sent from Thunderbird don't get
signed either.
Tests:
- Install app and log in with a FreedomBox user. Create a new event
titled "Lunch with 🍕 and fries". Confirm the pizza character displays properly.
- Backup the app and uninstall it.
- Restore from the backup, log in and confirm the event gets restored.
To-do:
- test ActiveSync
- create a fail2ban jail
- include the icons in the copyright file
- test sending email in a production setup
- test sieve filters
- write tests
https://salsa.debian.org/freedombox-team/freedombox/-/issues/56
[Sunil]
- App:
- Update icons to be uniform size as all other apps and copyright information.
- Since SOGo is not configured to trust the authentication from Apache, it
does not require FirewallLocalProtection. Remove it.
- Expand app description. Talk about Email Server app.
- Update to match recent tags related changes.
- Make memcached a shared daemon as other processes might use it.
- Added shared daemon for PostgreSQL.
- Don't start services when rerunning setup if the app is currently disabled.
- Don't restart memcached during a restore operation.
- Security:
- Add system security restrictions to the daemon.
- Don't use fail2ban jail. SOGo has a mechanism to lock users for a few
minutes. Use that instead.
- Apache:
- Make /.well-known URLs work by moving their definitions to global section.
- Remove old (<2.4) Apache authorization keywords.
- Simplify, indentation, new line at EOF.
- Manifest:
- Add more tags.
- Add SOGo connector, DAVx5, and GNOME Calendar to list of clients.
- Add 'sogo' to list of service to bring down during backup/restore.
- Privileged:
- Switch from MySQL to PostgreSQL as it is recommended by SOGo.
- Use existing utility to generate database password.
- Use plget and plmerge utilities from gnustep-common package to parse/edit
the configuration instead of augeas which don't have a dedicated lens.
- Don't reset the domain when rerunning setup.
- Ensure that the configuration file has proper ownership and permissions even
when it did not exist previously.
- Add typing information for most methods.
- Remove configuration file after uninstall.
- Configuration:
- Define database URLs for all seven database tables.
- Set calendar default roles as suggested in the installation guide.
- Refresh view automatically every minute to check for new mail.
- Use the mechanism to lock account after failed login attempts.
- Add folder name for Junk folder too explicitly.
- Tests: Add basic functional tests.
Tests:
- Functional tests work.
- Rerunning setup does not change the domain back to the primary domain of the
email server.
- Login works. Sending mail and reading mail works. Creating calendar events and
contact works.
- Changing the domain sets the domain value properly in the configuration file.
Configured domain is shown properly on the form.
- Backup and restore work as expected.
- When configuration file is removed and setup is re-run, then the file is
created with proper ownership and permissions.
- 'systemd-analyze security sogo.service' shows a good score.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Can be used to set the 'Expires:' header to cache static files for a long
time.
Tests:
- Without the patch 'a2query -m expires' shows that the module is not installed.
Applying the patches and restarting services shows that Apache app's setup is
run and 'a2query -m expires' shows that module is enabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Without the patch, uninstall and reinstall will fail. With patch it passes.
- Rerunning setup does not destroy the contents of the database.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Add methods for creating/dropping user/database.
Tests:
- ttrss and miniflux functional tests work which check for backup/restore.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Enabling/disabling app results in daemons enabling/disabling in correct order.
MySQL first and timer next when enabling. Reverse when disabling.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This allows ttrss to disabled postgresql if it is not needed by any other app
and enable postgresql if it is disabled and ttrss is being enabled.
Tests:
- When disabling ttrss and it is the last app using postgresql, it will be
disabled too.
- When disabling ttrss and it is not the last app using postgresql, it will not
be disabled too.
- When enabling ttrss if postgresql is disabled, it will be enabled too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This allows miniflux to disabled postgresql if it is not needed by any other
app and enable postgresql if it is disabled and miniflux is being enabled.
Tests:
- When disabling miniflux and it is the last app using postgresql, it will be
disabled too.
- When disabling miniflux and it is not the last app using postgresql, it will
not be disabled too.
- When enabling miniflux if postgresql is disabled, it will be enabled too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Thunderbird Mobile has been built on K-9 mail and is the future of the app[1].
Links:
1)
https://blog.thunderbird.net/2022/06/revealed-thunderbird-on-android-plans-k9/
Tests:
- Go to email app and expand the clients information. Verify the app store links
for Thunderbird Mobile.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: Debian bug #1093065.
These files were only present to serve polkit = 105 in Debian bullseye.
Alternate files .rules already being shipped for polkit > 105.
Tests:
- Install infinoted and enable/disable firewalld. infinoted ports have been
enabled/disabled in the firewall as noticed using firewall-cmd.
- Creating/deleting network manager connections works well. nmcli shows the
updates.
- Add backup location page shows list of disks properly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
