89607d2c64
it seems we decided that instead of a notification, we display a warning in the backups view itself (see #719).
425 lines
15 KiB
JavaScript
425 lines
15 KiB
JavaScript
'use strict';
|
|
|
|
exports = module.exports = {
|
|
initialize,
|
|
uninitialize,
|
|
getConfig,
|
|
getLogs,
|
|
|
|
reboot,
|
|
isRebootRequired,
|
|
|
|
onActivated,
|
|
|
|
setupDnsAndCert,
|
|
|
|
prepareDashboardDomain,
|
|
setDashboardDomain,
|
|
updateDashboardDomain,
|
|
renewCerts,
|
|
syncDnsRecords,
|
|
|
|
runSystemChecks
|
|
};
|
|
|
|
const apps = require('./apps.js'),
|
|
appstore = require('./appstore.js'),
|
|
assert = require('assert'),
|
|
async = require('async'),
|
|
auditSource = require('./auditsource.js'),
|
|
backups = require('./backups.js'),
|
|
BoxError = require('./boxerror.js'),
|
|
branding = require('./branding.js'),
|
|
constants = require('./constants.js'),
|
|
cron = require('./cron.js'),
|
|
debug = require('debug')('box:cloudron'),
|
|
domains = require('./domains.js'),
|
|
eventlog = require('./eventlog.js'),
|
|
fs = require('fs'),
|
|
mail = require('./mail.js'),
|
|
notifications = require('./notifications.js'),
|
|
path = require('path'),
|
|
paths = require('./paths.js'),
|
|
platform = require('./platform.js'),
|
|
reverseProxy = require('./reverseproxy.js'),
|
|
safe = require('safetydance'),
|
|
services = require('./services.js'),
|
|
settings = require('./settings.js'),
|
|
shell = require('./shell.js'),
|
|
spawn = require('child_process').spawn,
|
|
split = require('split'),
|
|
sysinfo = require('./sysinfo.js'),
|
|
tasks = require('./tasks.js'),
|
|
users = require('./users.js');
|
|
|
|
const REBOOT_CMD = path.join(__dirname, 'scripts/reboot.sh');
|
|
|
|
const NOOP_CALLBACK = function (error) { if (error) debug(error); };
|
|
|
|
async function initialize() {
|
|
runStartupTasks();
|
|
|
|
await notifyUpdate();
|
|
}
|
|
|
|
function uninitialize(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
async.series([
|
|
cron.stopJobs,
|
|
platform.stopAllTasks
|
|
], callback);
|
|
}
|
|
|
|
function onActivated(options, callback) {
|
|
assert.strictEqual(typeof options, 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
debug('onActivated: running post activation tasks');
|
|
|
|
// Starting the platform after a user is available means:
|
|
// 1. mail bounces can now be sent to the cloudron owner
|
|
// 2. the restore code path can run without sudo (since mail/ is non-root)
|
|
async.series([
|
|
platform.start.bind(null, options),
|
|
cron.startJobs,
|
|
// disable responding to api calls via IP to not leak domain info. this is carefully placed as the last item, so it buys
|
|
// the UI some time to query the dashboard domain in the restore code path
|
|
(done) => setTimeout(() => reverseProxy.writeDefaultConfig({ activated :true }, done), 30000)
|
|
], callback);
|
|
}
|
|
|
|
async function notifyUpdate() {
|
|
const version = safe.fs.readFileSync(paths.VERSION_FILE, 'utf8');
|
|
if (version === constants.VERSION) return;
|
|
|
|
await eventlog.add(eventlog.ACTION_UPDATE_FINISH, auditSource.CRON, { errorMessage: '', oldVersion: version || 'dev', newVersion: constants.VERSION });
|
|
|
|
return new Promise((resolve, reject) => {
|
|
tasks.setCompletedByType(tasks.TASK_UPDATE, { error: null }, function (error) {
|
|
if (error && error.reason !== BoxError.NOT_FOUND) return reject(error); // when hotfixing, task may not exist
|
|
|
|
safe.fs.writeFileSync(paths.VERSION_FILE, constants.VERSION, 'utf8');
|
|
|
|
resolve();
|
|
});
|
|
});
|
|
}
|
|
|
|
// each of these tasks can fail. we will add some routes to fix/re-run them
|
|
function runStartupTasks() {
|
|
const tasks = [
|
|
// stop all the systemd tasks
|
|
platform.stopAllTasks,
|
|
|
|
// this configures collectd to collect backup storage metrics if filesystem is used. This is also triggerd when the settings change with the rest api
|
|
function (callback) {
|
|
settings.getBackupConfig(function (error, backupConfig) {
|
|
if (error) return callback(error);
|
|
|
|
backups.configureCollectd(backupConfig, callback);
|
|
});
|
|
},
|
|
|
|
// always generate webadmin config since we have no versioning mechanism for the ejs
|
|
function (callback) {
|
|
if (!settings.dashboardDomain()) return callback();
|
|
|
|
reverseProxy.writeDashboardConfig(settings.dashboardDomain(), callback);
|
|
},
|
|
|
|
// check activation state and start the platform
|
|
function (callback) {
|
|
users.isActivated(function (error, activated) {
|
|
if (error) return callback(error);
|
|
|
|
// configure nginx to be reachable by IP when not activated. for the moment, the IP based redirect exists even after domain is setup
|
|
// just in case user forgot or some network error happenned in the middle (then browser refresh takes you to activation page)
|
|
// we remove the config as a simple security measure to not expose IP <-> domain
|
|
if (!activated) {
|
|
debug('runStartupTasks: not activated. generating IP based redirection config');
|
|
return reverseProxy.writeDefaultConfig({ activated: false }, callback);
|
|
}
|
|
|
|
onActivated({}, callback);
|
|
});
|
|
}
|
|
];
|
|
|
|
// we used to run tasks in parallel but simultaneous nginx reloads was causing issues
|
|
async.series(async.reflectAll(tasks), function (error, results) {
|
|
results.forEach((result, idx) => {
|
|
if (result.error) debug(`Startup task at index ${idx} failed: ${result.error.message}`);
|
|
});
|
|
});
|
|
}
|
|
|
|
function getConfig(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
const release = safe.fs.readFileSync('/etc/lsb-release', 'utf-8');
|
|
if (release === null) return callback(new BoxError(BoxError.FS_ERROR, safe.error.message));
|
|
const ubuntuVersion = release.match(/DISTRIB_DESCRIPTION="(.*)"/)[1];
|
|
|
|
settings.getAll(function (error, allSettings) {
|
|
if (error) return callback(error);
|
|
|
|
// be picky about what we send out here since this is sent for 'normal' users as well
|
|
callback(null, {
|
|
apiServerOrigin: settings.apiServerOrigin(),
|
|
webServerOrigin: settings.webServerOrigin(),
|
|
adminDomain: settings.dashboardDomain(),
|
|
adminFqdn: settings.dashboardFqdn(),
|
|
mailFqdn: settings.mailFqdn(),
|
|
version: constants.VERSION,
|
|
ubuntuVersion,
|
|
isDemo: settings.isDemo(),
|
|
cloudronName: allSettings[settings.CLOUDRON_NAME_KEY],
|
|
footer: branding.renderFooter(allSettings[settings.FOOTER_KEY] || constants.FOOTER),
|
|
features: appstore.getFeatures(),
|
|
profileLocked: allSettings[settings.DIRECTORY_CONFIG_KEY].lockUserProfiles,
|
|
mandatory2FA: allSettings[settings.DIRECTORY_CONFIG_KEY].mandatory2FA
|
|
});
|
|
});
|
|
}
|
|
|
|
function reboot(callback) {
|
|
notifications.alert(notifications.ALERT_REBOOT, 'Reboot Required', '', function (error) {
|
|
if (error) debug('reboot: failed to clear reboot notification.', error);
|
|
|
|
shell.sudo('reboot', [ REBOOT_CMD ], {}, callback);
|
|
});
|
|
}
|
|
|
|
function isRebootRequired(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
// https://serverfault.com/questions/92932/how-does-ubuntu-keep-track-of-the-system-restart-required-flag-in-motd
|
|
callback(null, fs.existsSync('/var/run/reboot-required'));
|
|
}
|
|
|
|
// called from cron.js
|
|
function runSystemChecks(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
debug('runSystemChecks: checking status');
|
|
|
|
async.parallel([
|
|
checkMailStatus,
|
|
checkRebootRequired,
|
|
checkUbuntuVersion
|
|
], callback);
|
|
}
|
|
|
|
function checkMailStatus(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
mail.checkConfiguration(function (error, message) {
|
|
if (error) return callback(error);
|
|
|
|
notifications.alert(notifications.ALERT_MAIL_STATUS, 'Email is not configured properly', message, callback);
|
|
});
|
|
}
|
|
|
|
function checkRebootRequired(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
isRebootRequired(function (error, rebootRequired) {
|
|
if (error) return callback(error);
|
|
|
|
notifications.alert(notifications.ALERT_REBOOT, 'Reboot Required', rebootRequired ? 'To finish ubuntu security updates, a reboot is necessary.' : '', callback);
|
|
});
|
|
}
|
|
|
|
function checkUbuntuVersion(callback) {
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
const isXenial = fs.readFileSync('/etc/lsb-release', 'utf-8').includes('16.04');
|
|
if (!isXenial) return callback();
|
|
|
|
notifications.alert(notifications.ALERT_UPDATE_UBUNTU, 'Ubuntu upgrade required', 'Ubuntu 16.04 has reached end of life and will not receive security and maintenance updates. Please follow https://docs.cloudron.io/guides/upgrade-ubuntu-18/ to upgrade to Ubuntu 18 at the earliest.', callback);
|
|
}
|
|
|
|
function getLogs(unit, options, callback) {
|
|
assert.strictEqual(typeof unit, 'string');
|
|
assert(options && typeof options === 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
assert.strictEqual(typeof options.lines, 'number');
|
|
assert.strictEqual(typeof options.format, 'string');
|
|
assert.strictEqual(typeof options.follow, 'boolean');
|
|
|
|
var lines = options.lines === -1 ? '+1' : options.lines,
|
|
format = options.format || 'json',
|
|
follow = options.follow;
|
|
|
|
debug('Getting logs for %s as %s', unit, format);
|
|
|
|
let args = [ '--lines=' + lines ];
|
|
if (follow) args.push('--follow');
|
|
|
|
// need to handle box.log without subdir
|
|
if (unit === 'box') args.push(path.join(paths.LOG_DIR, 'box.log'));
|
|
else if (unit.startsWith('crash-')) args.push(path.join(paths.CRASH_LOG_DIR, unit.slice(6) + '.log'));
|
|
else return callback(new BoxError(BoxError.BAD_FIELD, 'No such unit', { field: 'unit' }));
|
|
|
|
var cp = spawn('/usr/bin/tail', args);
|
|
|
|
var transformStream = split(function mapper(line) {
|
|
if (format !== 'json') return line + '\n';
|
|
|
|
var data = line.split(' '); // logs are <ISOtimestamp> <msg>
|
|
var timestamp = (new Date(data[0])).getTime();
|
|
if (isNaN(timestamp)) timestamp = 0;
|
|
|
|
return JSON.stringify({
|
|
realtimeTimestamp: timestamp * 1000,
|
|
message: line.slice(data[0].length+1),
|
|
source: unit
|
|
}) + '\n';
|
|
});
|
|
|
|
transformStream.close = cp.kill.bind(cp, 'SIGKILL'); // closing stream kills the child process
|
|
|
|
cp.stdout.pipe(transformStream);
|
|
|
|
return callback(null, transformStream);
|
|
}
|
|
|
|
function prepareDashboardDomain(domain, auditSource, callback) {
|
|
assert.strictEqual(typeof domain, 'string');
|
|
assert.strictEqual(typeof auditSource, 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
debug(`prepareDashboardDomain: ${domain}`);
|
|
|
|
if (settings.isDemo()) return callback(new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode'));
|
|
|
|
domains.get(domain, function (error, domainObject) {
|
|
if (error) return callback(error);
|
|
|
|
const fqdn = domains.fqdn(constants.DASHBOARD_LOCATION, domainObject);
|
|
|
|
apps.getAll(function (error, result) {
|
|
if (error) return callback(error);
|
|
|
|
const conflict = result.filter(app => app.fqdn === fqdn);
|
|
if (conflict.length) return callback(new BoxError(BoxError.BAD_STATE, 'Dashboard location conflicts with an existing app'));
|
|
|
|
tasks.add(tasks.TASK_SETUP_DNS_AND_CERT, [ constants.DASHBOARD_LOCATION, domain, auditSource ], function (error, taskId) {
|
|
if (error) return callback(error);
|
|
|
|
tasks.startTask(taskId, {}, NOOP_CALLBACK);
|
|
|
|
callback(null, taskId);
|
|
});
|
|
});
|
|
});
|
|
}
|
|
|
|
// call this only pre activation since it won't start mail server
|
|
function setDashboardDomain(domain, auditSource, callback) {
|
|
assert.strictEqual(typeof domain, 'string');
|
|
assert.strictEqual(typeof auditSource, 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
debug(`setDashboardDomain: ${domain}`);
|
|
|
|
domains.get(domain, function (error, domainObject) {
|
|
if (error) return callback(error);
|
|
|
|
reverseProxy.writeDashboardConfig(domain, function (error) {
|
|
if (error) return callback(error);
|
|
|
|
const fqdn = domains.fqdn(constants.DASHBOARD_LOCATION, domainObject);
|
|
|
|
settings.setDashboardLocation(domain, fqdn, function (error) {
|
|
if (error) return callback(error);
|
|
|
|
appstore.updateCloudron({ domain }, NOOP_CALLBACK);
|
|
|
|
eventlog.add(eventlog.ACTION_DASHBOARD_DOMAIN_UPDATE, auditSource, { domain, fqdn });
|
|
|
|
callback(null);
|
|
});
|
|
});
|
|
});
|
|
}
|
|
|
|
// call this only post activation because it will restart mail server
|
|
function updateDashboardDomain(domain, auditSource, callback) {
|
|
assert.strictEqual(typeof domain, 'string');
|
|
assert.strictEqual(typeof auditSource, 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
debug(`updateDashboardDomain: ${domain}`);
|
|
|
|
if (settings.isDemo()) return callback(new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode'));
|
|
|
|
setDashboardDomain(domain, auditSource, function (error) {
|
|
if (error) return callback(error);
|
|
|
|
services.rebuildService('turn', NOOP_CALLBACK); // to update the realm variable
|
|
|
|
callback(null);
|
|
});
|
|
}
|
|
|
|
function renewCerts(options, auditSource, callback) {
|
|
assert.strictEqual(typeof options, 'object');
|
|
assert.strictEqual(typeof auditSource, 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
tasks.add(tasks.TASK_CHECK_CERTS, [ options, auditSource ], function (error, taskId) {
|
|
if (error) return callback(error);
|
|
|
|
tasks.startTask(taskId, {}, NOOP_CALLBACK);
|
|
|
|
callback(null, taskId);
|
|
});
|
|
}
|
|
|
|
function setupDnsAndCert(subdomain, domain, auditSource, progressCallback, callback) {
|
|
assert.strictEqual(typeof subdomain, 'string');
|
|
assert.strictEqual(typeof domain, 'string');
|
|
assert.strictEqual(typeof auditSource, 'object');
|
|
assert.strictEqual(typeof progressCallback, 'function');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
domains.get(domain, function (error, domainObject) {
|
|
if (error) return callback(error);
|
|
|
|
const dashboardFqdn = domains.fqdn(subdomain, domainObject);
|
|
|
|
sysinfo.getServerIp(function (error, ip) {
|
|
if (error) return callback(error);
|
|
|
|
async.series([
|
|
(done) => { progressCallback({ message: `Updating DNS of ${dashboardFqdn}` }); done(); },
|
|
domains.upsertDnsRecords.bind(null, subdomain, domain, 'A', [ ip ]),
|
|
(done) => { progressCallback({ message: `Waiting for DNS of ${dashboardFqdn}` }); done(); },
|
|
domains.waitForDnsRecord.bind(null, subdomain, domain, 'A', ip, { interval: 30000, times: 50000 }),
|
|
(done) => { progressCallback({ message: `Getting certificate of ${dashboardFqdn}` }); done(); },
|
|
reverseProxy.ensureCertificate.bind(null, domains.fqdn(subdomain, domainObject), domain, auditSource)
|
|
], function (error) {
|
|
if (error) return callback(error);
|
|
|
|
callback(null);
|
|
});
|
|
});
|
|
});
|
|
}
|
|
|
|
function syncDnsRecords(options, callback) {
|
|
assert.strictEqual(typeof options, 'object');
|
|
assert.strictEqual(typeof callback, 'function');
|
|
|
|
tasks.add(tasks.TASK_SYNC_DNS_RECORDS, [ options ], function (error, taskId) {
|
|
if (error) return callback(error);
|
|
|
|
tasks.startTask(taskId, {}, NOOP_CALLBACK);
|
|
|
|
callback(null, taskId);
|
|
});
|
|
}
|