Restore v0.15 install.sh to avoid breaking installs
This commit is contained in:
Maurus Decimus
@@ -10,12 +10,12 @@ If any step below raises questions, a dedicated discussion thread for the `v0.16
|
|||||||
|
|
||||||
Email is a critical service, and we understand that a forced maintenance window is disruptive: in some environments it is simply not an option. The breaking changes in `v0.16` are not cosmetic. Stalwart has been under continuous development for close to five years; in that time the feature set and the user base have both grown well beyond what the original configuration and management layer was designed for. The gap between what users need and what the old architecture can cleanly support has widened to the point where a redesign was unavoidable: and the redesign itself unlocks a long list of frequently-requested features that were simply not implementable under the previous model. The storage layer is untouched by all of this: emails, calendars, contacts, files, and every other piece of user data stay exactly where they are. The migration is about configuration, not about data.
|
Email is a critical service, and we understand that a forced maintenance window is disruptive: in some environments it is simply not an option. The breaking changes in `v0.16` are not cosmetic. Stalwart has been under continuous development for close to five years; in that time the feature set and the user base have both grown well beyond what the original configuration and management layer was designed for. The gap between what users need and what the old architecture can cleanly support has widened to the point where a redesign was unavoidable: and the redesign itself unlocks a long list of frequently-requested features that were simply not implementable under the previous model. The storage layer is untouched by all of this: emails, calendars, contacts, files, and every other piece of user data stay exactly where they are. The migration is about configuration, not about data.
|
||||||
|
|
||||||
Operators who cannot accept downtime should **wait**. In the next two to three weeks we plan to release:
|
Operators who cannot accept downtime should **wait**. In the next two to three weeks we plan to release two tools that work together:
|
||||||
|
|
||||||
- A **zero-downtime migration utility**, and
|
- A **zero-downtime migration utility** that moves data (accounts, mailboxes, calendars, contacts, files) from an existing (`v0.15.x` or below) deployment to a freshly-installed `v0.16.x` deployment one account at a time, while both servers are running.
|
||||||
- A **proxy** that sits in front of a running cluster and redirects users to the right node.
|
- A **proxy** that sits in front of both deployments and routes each incoming connection to the server that currently owns that account. As accounts are migrated one by one, the proxy transparently shifts their traffic from the old deployment to the new one, so end users never notice a cutover.
|
||||||
|
|
||||||
When those tools are available, the instructions in this document will be superseded for most deployments. Everyone else can follow the manual steps below during a scheduled maintenance window.
|
Together, these let operators migrate a live production deployment on an account-by-account basis with no scheduled maintenance window. When those tools are available, the instructions in this document will be superseded for most deployments. Everyone else can follow the manual steps below during a scheduled maintenance window.
|
||||||
|
|
||||||
## What has changed
|
## What has changed
|
||||||
|
|
||||||
@@ -37,6 +37,8 @@ Every user and group principal now has a **local part** (the name) and an associ
|
|||||||
|
|
||||||
To avoid locking existing users out of their mail clients on the first login after the upgrade, `v0.16` **automatically appends the default domain** when a client authenticates with a bare username. Administrators running an **external directory** (LDAP, SQL, etc.), however, do need to update their directory filters to query by full email address rather than by bare account name; the old filters will no longer match.
|
To avoid locking existing users out of their mail clients on the first login after the upgrade, `v0.16` **automatically appends the default domain** when a client authenticates with a bare username. Administrators running an **external directory** (LDAP, SQL, etc.), however, do need to update their directory filters to query by full email address rather than by bare account name; the old filters will no longer match.
|
||||||
|
|
||||||
|
**CalDAV, CardDAV, and WebDAV clients need one manual adjustment.** These protocols use the account name as part of the URL path (for example `/dav/cal/alice`), and because the account name is now a full email address, that path changes. The `@` character is reserved in URLs and must be encoded as `%40`, so the equivalent path in `v0.16` becomes `/dav/cal/alice%40example.com`. Authentication itself still works (the server accepts the bare username and appends the default domain, as described above), but calendar, contact, and file sync will stop working until each client is reconfigured to point at the new path. It is a good idea to notify users before the upgrade so that they can update their calendar and contacts accounts in Apple Calendar, Thunderbird, DAVx⁵, and similar clients.
|
||||||
|
|
||||||
Two reasons drove this requirement. The first is **support for multiple external directories simultaneously**: when account names are bare strings there is no reliable way to tell which directory owns a given username, whereas email addresses are naturally namespaced by domain and make that mapping unambiguous. The second, and more consequential, reason is the **PACC specification** ([draft-ietf-mailmaint-pacc](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-pacc/)): the IETF's replacement for the fragmented collection of autoconfig / autodiscover / SRV-record mechanisms that mail clients use today to discover server settings. PACC expects login names shaped like email addresses; when they are not, the server has to reveal whether a given account exists just to disambiguate the login, which is exactly the privacy leak the spec is designed to prevent. Aligning account names with email addresses is what lets Stalwart implement PACC correctly.
|
Two reasons drove this requirement. The first is **support for multiple external directories simultaneously**: when account names are bare strings there is no reliable way to tell which directory owns a given username, whereas email addresses are naturally namespaced by domain and make that mapping unambiguous. The second, and more consequential, reason is the **PACC specification** ([draft-ietf-mailmaint-pacc](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-pacc/)): the IETF's replacement for the fragmented collection of autoconfig / autodiscover / SRV-record mechanisms that mail clients use today to discover server settings. PACC expects login names shaped like email addresses; when they are not, the server has to reveal whether a given account exists just to disambiguate the login, which is exactly the privacy leak the spec is designed to prevent. Aligning account names with email addresses is what lets Stalwart implement PACC correctly.
|
||||||
|
|
||||||
PACC also brings OAuth into the autodiscovery flow, and because the draft originates from Apple, a correct PACC implementation is the path to supporting Apple Mail clients with OIDC and MFA: a long-standing user request that only becomes possible once this groundwork is in place.
|
PACC also brings OAuth into the autodiscovery flow, and because the draft originates from Apple, a correct PACC implementation is the path to supporting Apple Mail clients with OIDC and MFA: a long-standing user request that only becomes possible once this groundwork is in place.
|
||||||
@@ -45,7 +47,7 @@ PACC also brings OAuth into the autodiscovery flow, and because the draft origin
|
|||||||
|
|
||||||
- **A brand-new WebUI**, rewritten from scratch on top of the new JMAP-based management API.
|
- **A brand-new WebUI**, rewritten from scratch on top of the new JMAP-based management API.
|
||||||
- **A brand-new CLI** (`stalwart-cli`) that also uses the JMAP API and can be used for day-to-day administration, scripted deployments, and infrastructure-as-code workflows. Full documentation is available at https://stalw.art/docs/management/cli.
|
- **A brand-new CLI** (`stalwart-cli`) that also uses the JMAP API and can be used for day-to-day administration, scripted deployments, and infrastructure-as-code workflows. Full documentation is available at https://stalw.art/docs/management/cli.
|
||||||
- **Over one hundred feature requests and bug fixes** across every subsystem.
|
- **[Over one hundred feature requests and bug fixes](https://github.com/stalwartlabs/stalwart/blob/main/CHANGELOG.md#0160---2026-xx-xx)** across every subsystem.
|
||||||
|
|
||||||
## Evaluate `v0.16` before migrating
|
## Evaluate `v0.16` before migrating
|
||||||
|
|
||||||
|
|||||||
431
install.sh
431
install.sh
@@ -19,256 +19,136 @@ main() {
|
|||||||
need_cmd uname
|
need_cmd uname
|
||||||
need_cmd mktemp
|
need_cmd mktemp
|
||||||
need_cmd chmod
|
need_cmd chmod
|
||||||
need_cmd chown
|
|
||||||
need_cmd mkdir
|
need_cmd mkdir
|
||||||
need_cmd rm
|
need_cmd rm
|
||||||
|
need_cmd rmdir
|
||||||
need_cmd tar
|
need_cmd tar
|
||||||
need_cmd cp
|
|
||||||
need_cmd hostname
|
|
||||||
|
|
||||||
# Require root
|
# Make sure we are running as root
|
||||||
if [ "$(id -u)" -ne 0 ]; then
|
if [ "$(id -u)" -ne 0 ] ; then
|
||||||
err "❌ Install failed: This program needs to run as root."
|
err "❌ Install failed: This program needs to run as root."
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Detect OS
|
# Detect OS
|
||||||
local _os _uname _account
|
local _os="unknown"
|
||||||
_uname="$(uname)"
|
local _uname="$(uname)"
|
||||||
_account="stalwart"
|
_account="stalwart"
|
||||||
case "$_uname" in
|
if [ "${_uname}" = "Linux" ]; then
|
||||||
Linux) _os="linux" ;;
|
_os="linux"
|
||||||
Darwin) _os="macos"; _account="_stalwart" ;;
|
elif [ "${_uname}" = "Darwin" ]; then
|
||||||
*) err "❌ Install failed: Unsupported OS: $_uname" ;;
|
_os="macos"
|
||||||
esac
|
_account="_stalwart"
|
||||||
|
fi
|
||||||
|
|
||||||
# Parse arguments
|
# Read arguments
|
||||||
|
local _dir="/opt/stalwart"
|
||||||
|
|
||||||
|
# Default component setting
|
||||||
local _component="stalwart"
|
local _component="stalwart"
|
||||||
local _prefix=""
|
|
||||||
while [ $# -gt 0 ]; do
|
# Loop through the arguments
|
||||||
case "$1" in
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
--fdb)
|
--fdb)
|
||||||
_component="stalwart-foundationdb"
|
_component="stalwart-foundationdb"
|
||||||
;;
|
;;
|
||||||
-h|--help)
|
|
||||||
print_usage
|
|
||||||
exit 0
|
|
||||||
;;
|
|
||||||
--*|-*)
|
|
||||||
err "❌ Unknown flag: $1 (try --help)"
|
|
||||||
;;
|
|
||||||
*)
|
*)
|
||||||
if [ -n "$_prefix" ]; then
|
if [ -n "$arg" ]; then
|
||||||
err "❌ Only one prefix argument is allowed, got: $_prefix $1"
|
_dir=$arg
|
||||||
fi
|
fi
|
||||||
_prefix="$1"
|
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
shift
|
|
||||||
done
|
done
|
||||||
|
|
||||||
# Derive install paths — FHS by default, self-contained under a custom prefix
|
# Detect platform architecture
|
||||||
local _bin_dir _bin_file _conf_dir _log_dir _data_dir _env_file _config_file
|
|
||||||
if [ -z "$_prefix" ]; then
|
|
||||||
_bin_dir="/usr/local/bin"
|
|
||||||
_conf_dir="/etc/stalwart"
|
|
||||||
_log_dir="/var/log/stalwart"
|
|
||||||
_data_dir="/var/lib/stalwart"
|
|
||||||
else
|
|
||||||
_bin_dir="${_prefix}/bin"
|
|
||||||
_conf_dir="${_prefix}/etc"
|
|
||||||
_log_dir="${_prefix}/logs"
|
|
||||||
_data_dir="${_prefix}/data"
|
|
||||||
fi
|
|
||||||
_bin_file="${_bin_dir}/stalwart"
|
|
||||||
_config_file="${_conf_dir}/config.json"
|
|
||||||
_env_file="${_conf_dir}/stalwart.env"
|
|
||||||
|
|
||||||
# Detect architecture
|
|
||||||
get_architecture || return 1
|
get_architecture || return 1
|
||||||
local _arch="$RETVAL"
|
local _arch="$RETVAL"
|
||||||
assert_nz "$_arch" "arch"
|
assert_nz "$_arch" "arch"
|
||||||
|
|
||||||
# Create service account
|
|
||||||
create_account "$_os" "$_account"
|
|
||||||
|
|
||||||
# Create directories
|
# Create directories
|
||||||
ensure mkdir -p "$_bin_dir" "$_conf_dir" "$_log_dir" "$_data_dir"
|
ensure mkdir -p "$_dir" "$_dir/bin" "$_dir/etc" "$_dir/logs"
|
||||||
|
|
||||||
# Download and install the binary
|
# Download latest binary
|
||||||
say "⏳ Downloading ${_component} for ${_arch}..."
|
say "⏳ Downloading ${_component} for ${_arch}..."
|
||||||
local _tmp _tar _src_name
|
local _file="${_dir}/bin/stalwart.tar.gz"
|
||||||
_tmp="$(mktemp -d)"
|
local _url="${BASE_URL}/${_component}-${_arch}.tar.gz"
|
||||||
_tar="${_tmp}/stalwart.tar.gz"
|
ensure mkdir -p "$_dir"
|
||||||
ensure downloader "${BASE_URL}/${_component}-${_arch}.tar.gz" "$_tar" "$_arch"
|
ensure downloader "$_url" "$_file" "$_arch"
|
||||||
ensure tar zxf "$_tar" -C "$_tmp"
|
ensure tar zxvf "$_file" -C "$_dir/bin"
|
||||||
_src_name="stalwart"
|
|
||||||
if [ "$_component" = "stalwart-foundationdb" ]; then
|
if [ "$_component" = "stalwart-foundationdb" ]; then
|
||||||
_src_name="stalwart-foundationdb"
|
ignore mv "$_dir/bin/stalwart-foundationdb" "$_dir/bin/stalwart"
|
||||||
fi
|
fi
|
||||||
ensure cp "${_tmp}/${_src_name}" "$_bin_file"
|
ignore chmod +x "$_dir/bin/stalwart"
|
||||||
ensure chmod 0755 "$_bin_file"
|
ignore rm "$_file"
|
||||||
ensure rm -rf "$_tmp"
|
|
||||||
|
|
||||||
# Create env file if absent (preserve user edits on reinstall)
|
# Create system account
|
||||||
if [ ! -e "$_env_file" ]; then
|
if ! id -u ${_account} > /dev/null 2>&1; then
|
||||||
say "📝 Writing env file at ${_env_file}..."
|
say "🖥️ Creating '${_account}' account..."
|
||||||
write_env_file "$_env_file"
|
if [ "${_os}" = "macos" ]; then
|
||||||
|
local _last_uid="$(dscacheutil -q user | grep uid | awk '{print $2}' | sort -n | tail -n 1)"
|
||||||
|
local _last_gid="$(dscacheutil -q group | grep gid | awk '{print $2}' | sort -n | tail -n 1)"
|
||||||
|
local _uid="$((_last_uid+1))"
|
||||||
|
local _gid="$((_last_gid+1))"
|
||||||
|
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart Password \*
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart PrimaryGroupID $_gid
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart RealName "Stalwart service"
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart RecordName _stalwart stalwart
|
||||||
|
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart NFSHomeDirectory /Users/_stalwart
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart Password \*
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart PrimaryGroupID $_gid
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart RealName "Stalwart service"
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart RecordName _stalwart stalwart
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart UniqueID $_uid
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart UserShell /bin/bash
|
||||||
|
|
||||||
|
ensure dscl /Local/Default -delete /Users/_stalwart AuthenticationAuthority
|
||||||
|
ensure dscl /Local/Default -delete /Users/_stalwart PasswordPolicyOptions
|
||||||
|
else
|
||||||
|
ensure useradd ${_account} -s /usr/sbin/nologin -M -r -U
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Ownership and permissions
|
# Run init
|
||||||
|
ignore $_dir/bin/stalwart --init "$_dir"
|
||||||
|
|
||||||
|
# Set permissions
|
||||||
say "🔐 Setting permissions..."
|
say "🔐 Setting permissions..."
|
||||||
ensure chown "${_account}:${_account}" "$_conf_dir" "$_log_dir" "$_data_dir"
|
ensure chown -R ${_account}:${_account} "$_dir"
|
||||||
ensure chmod 0750 "$_conf_dir" "$_log_dir" "$_data_dir"
|
ensure chmod -R 755 "$_dir"
|
||||||
ensure chown "root:${_account}" "$_env_file"
|
ensure chmod 700 "$_dir/etc/config.toml"
|
||||||
ensure chmod 0640 "$_env_file"
|
|
||||||
|
|
||||||
# Install and start the service
|
# Create service file
|
||||||
say "🚀 Starting service..."
|
say "🚀 Starting service..."
|
||||||
local _service_type=""
|
if [ "${_os}" = "linux" ]; then
|
||||||
case "$_os" in
|
local _issystemdlinux=$(command -v systemctl)
|
||||||
linux)
|
if [ -n "$_issystemdlinux" ]; then
|
||||||
if check_cmd systemctl; then
|
create_service_linux_systemd "$_dir"
|
||||||
create_service_linux_systemd "$_bin_file" "$_config_file" "$_env_file" "$_account"
|
else
|
||||||
_service_type="systemd"
|
create_service_linux_initd "$_dir"
|
||||||
else
|
fi
|
||||||
create_service_linux_initd "$_bin_file" "$_config_file" "$_env_file" "$_account"
|
elif [ "${_os}" = "macos" ]; then
|
||||||
_service_type="initd"
|
create_service_macos "$_dir"
|
||||||
fi
|
fi
|
||||||
;;
|
|
||||||
macos)
|
|
||||||
create_service_macos "$_bin_file" "$_config_file" "$_env_file" "$_account"
|
|
||||||
_service_type="launchd"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# Completion message
|
# Installation complete
|
||||||
local _host
|
local _host=$(hostname -f)
|
||||||
_host="$(hostname -f 2>/dev/null || hostname)"
|
say "🎉 Installation complete! Continue the setup at http://$_host:8080/login"
|
||||||
say ""
|
|
||||||
say "🎉 Installation complete!"
|
|
||||||
say ""
|
|
||||||
say "Stalwart is running in bootstrap mode. A temporary administrator"
|
|
||||||
say "password was generated at startup and printed to the service logs."
|
|
||||||
say ""
|
|
||||||
say "👉 To find the password, inspect the service logs:"
|
|
||||||
case "$_service_type" in
|
|
||||||
systemd)
|
|
||||||
say " journalctl -u stalwart -n 200 | grep -A8 'bootstrap mode'"
|
|
||||||
;;
|
|
||||||
initd)
|
|
||||||
say " grep -A8 'bootstrap mode' /var/log/syslog 2>/dev/null \\"
|
|
||||||
say " || grep -A8 'bootstrap mode' /var/log/messages"
|
|
||||||
;;
|
|
||||||
launchd)
|
|
||||||
say " sudo log show --predicate 'process == \"stalwart\"' --last 5m"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
say ""
|
|
||||||
say " Or set STALWART_RECOVERY_ADMIN=admin:<password> in"
|
|
||||||
say " ${_env_file} and restart the service to pin a credential."
|
|
||||||
say ""
|
|
||||||
say " Finish setup at: http://${_host}:8080/admin"
|
|
||||||
say ""
|
|
||||||
|
|
||||||
return 0
|
return 0
|
||||||
}
|
}
|
||||||
|
|
||||||
print_usage() {
|
# Functions to create service files
|
||||||
cat <<'EOF'
|
|
||||||
Usage: install.sh [--fdb] [PREFIX]
|
|
||||||
|
|
||||||
Install Stalwart into standard FHS paths or under a custom prefix.
|
|
||||||
|
|
||||||
Options:
|
|
||||||
--fdb Install the FoundationDB build.
|
|
||||||
-h, --help Show this help.
|
|
||||||
|
|
||||||
With no PREFIX, Stalwart is installed under standard FHS paths:
|
|
||||||
binary /usr/local/bin/stalwart
|
|
||||||
config /etc/stalwart/config.json (created by the daemon on first run)
|
|
||||||
env /etc/stalwart/stalwart.env
|
|
||||||
logs /var/log/stalwart/
|
|
||||||
data /var/lib/stalwart/
|
|
||||||
|
|
||||||
When PREFIX is provided, a self-contained layout is used instead:
|
|
||||||
binary $PREFIX/bin/stalwart
|
|
||||||
config $PREFIX/etc/config.json
|
|
||||||
env $PREFIX/etc/stalwart.env
|
|
||||||
logs $PREFIX/logs/
|
|
||||||
data $PREFIX/data/
|
|
||||||
EOF
|
|
||||||
}
|
|
||||||
|
|
||||||
write_env_file() {
|
|
||||||
cat > "$1" <<'EOF'
|
|
||||||
# Environment variables for the Stalwart service.
|
|
||||||
# Uncomment and edit an entry to override its default.
|
|
||||||
|
|
||||||
# Enable bootstrap / recovery mode on startup. Accepted: 1, true. Default: false.
|
|
||||||
#STALWART_RECOVERY_MODE=true
|
|
||||||
|
|
||||||
# Log level while in recovery mode. Default: info.
|
|
||||||
#STALWART_RECOVERY_MODE_LOG_LEVEL=debug
|
|
||||||
|
|
||||||
# HTTP port used in recovery mode. Default: 8080.
|
|
||||||
#STALWART_RECOVERY_MODE_PORT=9090
|
|
||||||
|
|
||||||
# Fixed administrator credentials — format: username:password
|
|
||||||
# Default: a temporary random password is generated and printed to the logs.
|
|
||||||
#STALWART_RECOVERY_ADMIN=admin:changeme
|
|
||||||
|
|
||||||
# Cluster role assigned to this node. Must match a role name defined in the
|
|
||||||
# cluster registry. Leave unset for a standalone (non-clustered) deployment.
|
|
||||||
#STALWART_ROLE=primary
|
|
||||||
|
|
||||||
# Push-notification shard this node is responsible for, when running in a
|
|
||||||
# cluster.
|
|
||||||
#STALWART_PUSH_SHARD=1
|
|
||||||
EOF
|
|
||||||
}
|
|
||||||
|
|
||||||
create_account() {
|
|
||||||
local _os="$1"
|
|
||||||
local _account="$2"
|
|
||||||
if id -u "$_account" > /dev/null 2>&1; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
say "🖥️ Creating '${_account}' account..."
|
|
||||||
if [ "$_os" = "macos" ]; then
|
|
||||||
local _last_uid _last_gid _uid _gid
|
|
||||||
_last_uid="$(dscacheutil -q user | grep uid | awk '{print $2}' | sort -n | tail -n 1)"
|
|
||||||
_last_gid="$(dscacheutil -q group | grep gid | awk '{print $2}' | sort -n | tail -n 1)"
|
|
||||||
_uid="$((_last_uid+1))"
|
|
||||||
_gid="$((_last_gid+1))"
|
|
||||||
|
|
||||||
ensure dscl /Local/Default -create Groups/_stalwart
|
|
||||||
ensure dscl /Local/Default -create Groups/_stalwart Password \*
|
|
||||||
ensure dscl /Local/Default -create Groups/_stalwart PrimaryGroupID $_gid
|
|
||||||
ensure dscl /Local/Default -create Groups/_stalwart RealName "Stalwart service"
|
|
||||||
ensure dscl /Local/Default -create Groups/_stalwart RecordName _stalwart stalwart
|
|
||||||
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart NFSHomeDirectory /var/empty
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart Password \*
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart PrimaryGroupID $_gid
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart RealName "Stalwart service"
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart RecordName _stalwart stalwart
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart UniqueID $_uid
|
|
||||||
ensure dscl /Local/Default -create Users/_stalwart UserShell /usr/bin/false
|
|
||||||
|
|
||||||
ensure dscl /Local/Default -delete /Users/_stalwart AuthenticationAuthority
|
|
||||||
ensure dscl /Local/Default -delete /Users/_stalwart PasswordPolicyOptions
|
|
||||||
else
|
|
||||||
ensure useradd "$_account" -s /usr/sbin/nologin -M -r -U
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
create_service_linux_systemd() {
|
create_service_linux_systemd() {
|
||||||
local _bin="$1" _config="$2" _env="$3" _user="$4"
|
local _dir="$1"
|
||||||
cat > /etc/systemd/system/stalwart.service <<EOF
|
cat <<EOF | sed "s|__PATH__|$_dir|g" > /etc/systemd/system/stalwart.service
|
||||||
[Unit]
|
[Unit]
|
||||||
Description=Stalwart
|
Description=Stalwart
|
||||||
Conflicts=postfix.service sendmail.service exim4.service
|
Conflicts=postfix.service sendmail.service exim4.service
|
||||||
|
ConditionPathExists=__PATH__/etc/config.toml
|
||||||
After=network-online.target
|
After=network-online.target
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
@@ -278,11 +158,10 @@ KillMode=process
|
|||||||
KillSignal=SIGINT
|
KillSignal=SIGINT
|
||||||
Restart=on-failure
|
Restart=on-failure
|
||||||
RestartSec=5
|
RestartSec=5
|
||||||
EnvironmentFile=-${_env}
|
ExecStart=__PATH__/bin/stalwart --config=__PATH__/etc/config.toml
|
||||||
ExecStart=${_bin} --config=${_config}
|
|
||||||
SyslogIdentifier=stalwart
|
SyslogIdentifier=stalwart
|
||||||
User=${_user}
|
User=stalwart
|
||||||
Group=${_user}
|
Group=stalwart
|
||||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
@@ -294,13 +173,13 @@ EOF
|
|||||||
}
|
}
|
||||||
|
|
||||||
create_service_linux_initd() {
|
create_service_linux_initd() {
|
||||||
local _bin="$1" _config="$2" _env="$3" _user="$4"
|
local _dir="$1"
|
||||||
cat > /etc/init.d/stalwart <<EOF
|
cat <<"EOF" | sed "s|__PATH__|$_dir|g" > /etc/init.d/stalwart
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
### BEGIN INIT INFO
|
### BEGIN INIT INFO
|
||||||
# Provides: stalwart
|
# Provides: stalwart
|
||||||
# Required-Start: \$network
|
# Required-Start: $network
|
||||||
# Required-Stop: \$network
|
# Required-Stop: $network
|
||||||
# Default-Start: 2 3 4 5
|
# Default-Start: 2 3 4 5
|
||||||
# Default-Stop: 0 1 6
|
# Default-Stop: 0 1 6
|
||||||
# Short-Description: Stalwart Server
|
# Short-Description: Stalwart Server
|
||||||
@@ -313,75 +192,91 @@ PATH=/sbin:/usr/sbin:/bin:/usr/bin
|
|||||||
. /lib/init/vars.sh
|
. /lib/init/vars.sh
|
||||||
. /lib/lsb/init-functions
|
. /lib/lsb/init-functions
|
||||||
|
|
||||||
DAEMON=${_bin}
|
# Service Config
|
||||||
DAEMON_ARGS="--config=${_config}"
|
DAEMON=__PATH__/bin/stalwart
|
||||||
ENV_FILE=${_env}
|
DAEMON_ARGS="--config=__PATH__/etc/config.toml"
|
||||||
PIDFILE=/var/run/stalwart.pid
|
PIDFILE=/var/run/stalwart.pid
|
||||||
ULIMIT_NOFILE=65536
|
ULIMIT_NOFILE=65536
|
||||||
|
|
||||||
[ -x "\$DAEMON" ] || exit 0
|
# Exit if the package is not installed
|
||||||
|
[ -x "$DAEMON" ] || exit 0
|
||||||
|
|
||||||
if [ -r "\$ENV_FILE" ]; then
|
# Exit if config file doesn't exist
|
||||||
set -a
|
[ -f "__PATH__/etc/config.toml" ] || exit 0
|
||||||
. "\$ENV_FILE"
|
|
||||||
set +a
|
|
||||||
fi
|
|
||||||
|
|
||||||
ulimit -n \$ULIMIT_NOFILE
|
# Read configuration variable file if it is present
|
||||||
|
[ -r /etc/default/stalwart ] && . /etc/default/stalwart
|
||||||
|
|
||||||
|
# Increase file descriptor limit
|
||||||
|
ulimit -n $ULIMIT_NOFILE
|
||||||
|
|
||||||
do_start()
|
do_start()
|
||||||
{
|
{
|
||||||
start-stop-daemon --start --quiet --pidfile \$PIDFILE --exec \$DAEMON --test > /dev/null \\
|
# Return
|
||||||
|
# 0 if daemon has been started
|
||||||
|
# 1 if daemon was already running
|
||||||
|
# 2 if daemon could not be started
|
||||||
|
start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|
||||||
|| return 1
|
|| return 1
|
||||||
start-stop-daemon --start --quiet --pidfile \$PIDFILE --exec \$DAEMON \\
|
start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON \
|
||||||
--background --make-pidfile --chuid ${_user}:${_user} \\
|
--background --make-pidfile --chuid stalwart:stalwart \
|
||||||
-- \$DAEMON_ARGS \\
|
-- $DAEMON_ARGS \
|
||||||
|| return 2
|
|| return 2
|
||||||
}
|
}
|
||||||
|
|
||||||
do_stop()
|
do_stop()
|
||||||
{
|
{
|
||||||
start-stop-daemon --stop --quiet --retry=INT/30/KILL/5 --pidfile \$PIDFILE --name stalwart
|
# Return
|
||||||
RETVAL="\$?"
|
# 0 if daemon has been stopped
|
||||||
[ "\$RETVAL" = 2 ] && return 2
|
# 1 if daemon was already stopped
|
||||||
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec \$DAEMON
|
# 2 if daemon could not be stopped
|
||||||
[ "\$?" = 2 ] && return 2
|
# other if a failure occurred
|
||||||
rm -f \$PIDFILE
|
start-stop-daemon --stop --quiet --retry=INT/30/KILL/5 --pidfile $PIDFILE --name stalwart
|
||||||
return "\$RETVAL"
|
RETVAL="$?"
|
||||||
|
[ "$RETVAL" = 2 ] && return 2
|
||||||
|
# Wait for children to finish too if this is a daemon that forks
|
||||||
|
# and if the daemon is only ever run from this initscript.
|
||||||
|
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
|
||||||
|
[ "$?" = 2 ] && return 2
|
||||||
|
# Many daemons don't delete their pidfiles when they exit.
|
||||||
|
rm -f $PIDFILE
|
||||||
|
return "$RETVAL"
|
||||||
}
|
}
|
||||||
|
|
||||||
case "\$1" in
|
case "$1" in
|
||||||
start)
|
start)
|
||||||
[ "\$VERBOSE" != no ] && log_daemon_msg "Starting Stalwart Server" "stalwart"
|
[ "$VERBOSE" != no ] && log_daemon_msg "Starting Stalwart Server" "stalwart"
|
||||||
do_start
|
do_start
|
||||||
case "\$?" in
|
case "$?" in
|
||||||
0|1) [ "\$VERBOSE" != no ] && log_end_msg 0 ;;
|
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
||||||
2) [ "\$VERBOSE" != no ] && log_end_msg 1 ;;
|
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
||||||
esac
|
esac
|
||||||
;;
|
;;
|
||||||
stop)
|
stop)
|
||||||
[ "\$VERBOSE" != no ] && log_daemon_msg "Stopping Stalwart Server" "stalwart"
|
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping Stalwart Server" "stalwart"
|
||||||
do_stop
|
do_stop
|
||||||
case "\$?" in
|
case "$?" in
|
||||||
0|1) [ "\$VERBOSE" != no ] && log_end_msg 0 ;;
|
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
||||||
2) [ "\$VERBOSE" != no ] && log_end_msg 1 ;;
|
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
||||||
esac
|
esac
|
||||||
;;
|
;;
|
||||||
status)
|
status)
|
||||||
status_of_proc "\$DAEMON" "stalwart" && exit 0 || exit \$?
|
status_of_proc "$DAEMON" "stalwart" && exit 0 || exit $?
|
||||||
;;
|
;;
|
||||||
restart)
|
restart)
|
||||||
log_daemon_msg "Restarting Stalwart Server" "stalwart"
|
log_daemon_msg "Restarting Stalwart Server" "stalwart"
|
||||||
do_stop
|
do_stop
|
||||||
case "\$?" in
|
case "$?" in
|
||||||
0|1)
|
0|1)
|
||||||
do_start
|
do_start
|
||||||
case "\$?" in
|
case "$?" in
|
||||||
0) log_end_msg 0 ;;
|
0) log_end_msg 0 ;;
|
||||||
*) log_end_msg 1 ;;
|
1) log_end_msg 1 ;; # Old process is still running
|
||||||
|
*) log_end_msg 1 ;; # Failed to start
|
||||||
esac
|
esac
|
||||||
;;
|
;;
|
||||||
*)
|
*)
|
||||||
|
# Failed to stop
|
||||||
log_end_msg 1
|
log_end_msg 1
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
@@ -395,40 +290,34 @@ esac
|
|||||||
exit 0
|
exit 0
|
||||||
EOF
|
EOF
|
||||||
chmod +x /etc/init.d/stalwart
|
chmod +x /etc/init.d/stalwart
|
||||||
|
|
||||||
|
cat <<EOF > /etc/default/stalwart
|
||||||
|
# Configuration for Stalwart init script being run during
|
||||||
|
# the boot sequence
|
||||||
|
|
||||||
|
# Set to 'yes' to enable additional verbosity
|
||||||
|
#VERBOSE=no
|
||||||
|
EOF
|
||||||
update-rc.d stalwart defaults
|
update-rc.d stalwart defaults
|
||||||
service stalwart start
|
service stalwart start
|
||||||
}
|
}
|
||||||
|
|
||||||
create_service_macos() {
|
create_service_macos() {
|
||||||
local _bin="$1" _config="$2" _env="$3" _user="$4"
|
local _dir="$1"
|
||||||
local _plist="/Library/LaunchDaemons/stalwart.plist"
|
cat <<EOF | sed "s|__PATH__|$_dir|g" > /Library/LaunchAgents/stalwart.mail.plist
|
||||||
|
|
||||||
# Remove any legacy LaunchAgent from a prior install
|
|
||||||
if [ -f /Library/LaunchAgents/stalwart.mail.plist ]; then
|
|
||||||
launchctl unload /Library/LaunchAgents/stalwart.mail.plist 2>/dev/null || true
|
|
||||||
rm -f /Library/LaunchAgents/stalwart.mail.plist
|
|
||||||
fi
|
|
||||||
|
|
||||||
# launchd has no EnvironmentFile equivalent — wrap with sh to source the env file
|
|
||||||
cat > "$_plist" <<EOF
|
|
||||||
<?xml version="1.0" encoding="UTF-8"?>
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
|
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
|
||||||
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||||
<plist version="1.0">
|
<plist version="1.0">
|
||||||
<dict>
|
<dict>
|
||||||
<key>Label</key>
|
<key>Label</key>
|
||||||
<string>stalwart</string>
|
<string>stalwart.mail</string>
|
||||||
<key>ServiceDescription</key>
|
<key>ServiceDescription</key>
|
||||||
<string>Stalwart</string>
|
<string>Stalwart</string>
|
||||||
<key>UserName</key>
|
|
||||||
<string>${_user}</string>
|
|
||||||
<key>GroupName</key>
|
|
||||||
<string>${_user}</string>
|
|
||||||
<key>ProgramArguments</key>
|
<key>ProgramArguments</key>
|
||||||
<array>
|
<array>
|
||||||
<string>/bin/sh</string>
|
<string>__PATH__/bin/stalwart</string>
|
||||||
<string>-c</string>
|
<string>--config=__PATH__/etc/config.toml</string>
|
||||||
<string>set -a; if [ -r "${_env}" ]; then . "${_env}"; fi; set +a; exec "${_bin}" --config="${_config}"</string>
|
|
||||||
</array>
|
</array>
|
||||||
<key>RunAtLoad</key>
|
<key>RunAtLoad</key>
|
||||||
<true/>
|
<true/>
|
||||||
@@ -437,11 +326,9 @@ create_service_macos() {
|
|||||||
</dict>
|
</dict>
|
||||||
</plist>
|
</plist>
|
||||||
EOF
|
EOF
|
||||||
chmod 0644 "$_plist"
|
launchctl load /Library/LaunchAgents/stalwart.mail.plist
|
||||||
chown root:wheel "$_plist"
|
launchctl enable system/stalwart.mail
|
||||||
launchctl bootout system "$_plist" 2>/dev/null || true
|
launchctl start system/stalwart.mail
|
||||||
launchctl bootstrap system "$_plist"
|
|
||||||
launchctl enable system/stalwart
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
990
install.sh.new
Normal file
990
install.sh.new
Normal file
@@ -0,0 +1,990 @@
|
|||||||
|
#!/usr/bin/env sh
|
||||||
|
# shellcheck shell=dash
|
||||||
|
|
||||||
|
#
|
||||||
|
# SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
|
||||||
|
#
|
||||||
|
|
||||||
|
# Stalwart install script -- based on the rustup installation script.
|
||||||
|
|
||||||
|
set -e
|
||||||
|
set -u
|
||||||
|
|
||||||
|
readonly BASE_URL="https://github.com/stalwartlabs/stalwart/releases/latest/download"
|
||||||
|
|
||||||
|
main() {
|
||||||
|
downloader --check
|
||||||
|
need_cmd uname
|
||||||
|
need_cmd mktemp
|
||||||
|
need_cmd chmod
|
||||||
|
need_cmd chown
|
||||||
|
need_cmd mkdir
|
||||||
|
need_cmd rm
|
||||||
|
need_cmd tar
|
||||||
|
need_cmd cp
|
||||||
|
need_cmd hostname
|
||||||
|
|
||||||
|
# Require root
|
||||||
|
if [ "$(id -u)" -ne 0 ]; then
|
||||||
|
err "❌ Install failed: This program needs to run as root."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Detect OS
|
||||||
|
local _os _uname _account
|
||||||
|
_uname="$(uname)"
|
||||||
|
_account="stalwart"
|
||||||
|
case "$_uname" in
|
||||||
|
Linux) _os="linux" ;;
|
||||||
|
Darwin) _os="macos"; _account="_stalwart" ;;
|
||||||
|
*) err "❌ Install failed: Unsupported OS: $_uname" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Parse arguments
|
||||||
|
local _component="stalwart"
|
||||||
|
local _prefix=""
|
||||||
|
while [ $# -gt 0 ]; do
|
||||||
|
case "$1" in
|
||||||
|
--fdb)
|
||||||
|
_component="stalwart-foundationdb"
|
||||||
|
;;
|
||||||
|
-h|--help)
|
||||||
|
print_usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
--*|-*)
|
||||||
|
err "❌ Unknown flag: $1 (try --help)"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
if [ -n "$_prefix" ]; then
|
||||||
|
err "❌ Only one prefix argument is allowed, got: $_prefix $1"
|
||||||
|
fi
|
||||||
|
_prefix="$1"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
# Derive install paths — FHS by default, self-contained under a custom prefix
|
||||||
|
local _bin_dir _bin_file _conf_dir _log_dir _data_dir _env_file _config_file
|
||||||
|
if [ -z "$_prefix" ]; then
|
||||||
|
_bin_dir="/usr/local/bin"
|
||||||
|
_conf_dir="/etc/stalwart"
|
||||||
|
_log_dir="/var/log/stalwart"
|
||||||
|
_data_dir="/var/lib/stalwart"
|
||||||
|
else
|
||||||
|
_bin_dir="${_prefix}/bin"
|
||||||
|
_conf_dir="${_prefix}/etc"
|
||||||
|
_log_dir="${_prefix}/logs"
|
||||||
|
_data_dir="${_prefix}/data"
|
||||||
|
fi
|
||||||
|
_bin_file="${_bin_dir}/stalwart"
|
||||||
|
_config_file="${_conf_dir}/config.json"
|
||||||
|
_env_file="${_conf_dir}/stalwart.env"
|
||||||
|
|
||||||
|
# Detect architecture
|
||||||
|
get_architecture || return 1
|
||||||
|
local _arch="$RETVAL"
|
||||||
|
assert_nz "$_arch" "arch"
|
||||||
|
|
||||||
|
# Create service account
|
||||||
|
create_account "$_os" "$_account"
|
||||||
|
|
||||||
|
# Create directories
|
||||||
|
ensure mkdir -p "$_bin_dir" "$_conf_dir" "$_log_dir" "$_data_dir"
|
||||||
|
|
||||||
|
# Download and install the binary
|
||||||
|
say "⏳ Downloading ${_component} for ${_arch}..."
|
||||||
|
local _tmp _tar _src_name
|
||||||
|
_tmp="$(mktemp -d)"
|
||||||
|
_tar="${_tmp}/stalwart.tar.gz"
|
||||||
|
ensure downloader "${BASE_URL}/${_component}-${_arch}.tar.gz" "$_tar" "$_arch"
|
||||||
|
ensure tar zxf "$_tar" -C "$_tmp"
|
||||||
|
_src_name="stalwart"
|
||||||
|
if [ "$_component" = "stalwart-foundationdb" ]; then
|
||||||
|
_src_name="stalwart-foundationdb"
|
||||||
|
fi
|
||||||
|
ensure cp "${_tmp}/${_src_name}" "$_bin_file"
|
||||||
|
ensure chmod 0755 "$_bin_file"
|
||||||
|
ensure rm -rf "$_tmp"
|
||||||
|
|
||||||
|
# Create env file if absent (preserve user edits on reinstall)
|
||||||
|
if [ ! -e "$_env_file" ]; then
|
||||||
|
say "📝 Writing env file at ${_env_file}..."
|
||||||
|
write_env_file "$_env_file"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Ownership and permissions
|
||||||
|
say "🔐 Setting permissions..."
|
||||||
|
ensure chown "${_account}:${_account}" "$_conf_dir" "$_log_dir" "$_data_dir"
|
||||||
|
ensure chmod 0750 "$_conf_dir" "$_log_dir" "$_data_dir"
|
||||||
|
ensure chown "root:${_account}" "$_env_file"
|
||||||
|
ensure chmod 0640 "$_env_file"
|
||||||
|
|
||||||
|
# Install and start the service
|
||||||
|
say "🚀 Starting service..."
|
||||||
|
local _service_type=""
|
||||||
|
case "$_os" in
|
||||||
|
linux)
|
||||||
|
if check_cmd systemctl; then
|
||||||
|
create_service_linux_systemd "$_bin_file" "$_config_file" "$_env_file" "$_account"
|
||||||
|
_service_type="systemd"
|
||||||
|
else
|
||||||
|
create_service_linux_initd "$_bin_file" "$_config_file" "$_env_file" "$_account"
|
||||||
|
_service_type="initd"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
macos)
|
||||||
|
create_service_macos "$_bin_file" "$_config_file" "$_env_file" "$_account"
|
||||||
|
_service_type="launchd"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Completion message
|
||||||
|
local _host
|
||||||
|
_host="$(hostname -f 2>/dev/null || hostname)"
|
||||||
|
say ""
|
||||||
|
say "🎉 Installation complete!"
|
||||||
|
say ""
|
||||||
|
say "Stalwart is running in bootstrap mode. A temporary administrator"
|
||||||
|
say "password was generated at startup and printed to the service logs."
|
||||||
|
say ""
|
||||||
|
say "👉 To find the password, inspect the service logs:"
|
||||||
|
case "$_service_type" in
|
||||||
|
systemd)
|
||||||
|
say " journalctl -u stalwart -n 200 | grep -A8 'bootstrap mode'"
|
||||||
|
;;
|
||||||
|
initd)
|
||||||
|
say " grep -A8 'bootstrap mode' /var/log/syslog 2>/dev/null \\"
|
||||||
|
say " || grep -A8 'bootstrap mode' /var/log/messages"
|
||||||
|
;;
|
||||||
|
launchd)
|
||||||
|
say " sudo log show --predicate 'process == \"stalwart\"' --last 5m"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
say ""
|
||||||
|
say " Or set STALWART_RECOVERY_ADMIN=admin:<password> in"
|
||||||
|
say " ${_env_file} and restart the service to pin a credential."
|
||||||
|
say ""
|
||||||
|
say " Finish setup at: http://${_host}:8080/admin"
|
||||||
|
say ""
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
print_usage() {
|
||||||
|
cat <<'EOF'
|
||||||
|
Usage: install.sh [--fdb] [PREFIX]
|
||||||
|
|
||||||
|
Install Stalwart into standard FHS paths or under a custom prefix.
|
||||||
|
|
||||||
|
Options:
|
||||||
|
--fdb Install the FoundationDB build.
|
||||||
|
-h, --help Show this help.
|
||||||
|
|
||||||
|
With no PREFIX, Stalwart is installed under standard FHS paths:
|
||||||
|
binary /usr/local/bin/stalwart
|
||||||
|
config /etc/stalwart/config.json (created by the daemon on first run)
|
||||||
|
env /etc/stalwart/stalwart.env
|
||||||
|
logs /var/log/stalwart/
|
||||||
|
data /var/lib/stalwart/
|
||||||
|
|
||||||
|
When PREFIX is provided, a self-contained layout is used instead:
|
||||||
|
binary $PREFIX/bin/stalwart
|
||||||
|
config $PREFIX/etc/config.json
|
||||||
|
env $PREFIX/etc/stalwart.env
|
||||||
|
logs $PREFIX/logs/
|
||||||
|
data $PREFIX/data/
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
write_env_file() {
|
||||||
|
cat > "$1" <<'EOF'
|
||||||
|
# Environment variables for the Stalwart service.
|
||||||
|
# Uncomment and edit an entry to override its default.
|
||||||
|
|
||||||
|
# Enable bootstrap / recovery mode on startup. Accepted: 1, true. Default: false.
|
||||||
|
#STALWART_RECOVERY_MODE=true
|
||||||
|
|
||||||
|
# Log level while in recovery mode. Default: info.
|
||||||
|
#STALWART_RECOVERY_MODE_LOG_LEVEL=debug
|
||||||
|
|
||||||
|
# HTTP port used in recovery mode. Default: 8080.
|
||||||
|
#STALWART_RECOVERY_MODE_PORT=9090
|
||||||
|
|
||||||
|
# Fixed administrator credentials — format: username:password
|
||||||
|
# Default: a temporary random password is generated and printed to the logs.
|
||||||
|
#STALWART_RECOVERY_ADMIN=admin:changeme
|
||||||
|
|
||||||
|
# Cluster role assigned to this node. Must match a role name defined in the
|
||||||
|
# cluster registry. Leave unset for a standalone (non-clustered) deployment.
|
||||||
|
#STALWART_ROLE=primary
|
||||||
|
|
||||||
|
# Push-notification shard this node is responsible for, when running in a
|
||||||
|
# cluster.
|
||||||
|
#STALWART_PUSH_SHARD=1
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
create_account() {
|
||||||
|
local _os="$1"
|
||||||
|
local _account="$2"
|
||||||
|
if id -u "$_account" > /dev/null 2>&1; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
say "🖥️ Creating '${_account}' account..."
|
||||||
|
if [ "$_os" = "macos" ]; then
|
||||||
|
local _last_uid _last_gid _uid _gid
|
||||||
|
_last_uid="$(dscacheutil -q user | grep uid | awk '{print $2}' | sort -n | tail -n 1)"
|
||||||
|
_last_gid="$(dscacheutil -q group | grep gid | awk '{print $2}' | sort -n | tail -n 1)"
|
||||||
|
_uid="$((_last_uid+1))"
|
||||||
|
_gid="$((_last_gid+1))"
|
||||||
|
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart Password \*
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart PrimaryGroupID $_gid
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart RealName "Stalwart service"
|
||||||
|
ensure dscl /Local/Default -create Groups/_stalwart RecordName _stalwart stalwart
|
||||||
|
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart NFSHomeDirectory /var/empty
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart Password \*
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart PrimaryGroupID $_gid
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart RealName "Stalwart service"
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart RecordName _stalwart stalwart
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart UniqueID $_uid
|
||||||
|
ensure dscl /Local/Default -create Users/_stalwart UserShell /usr/bin/false
|
||||||
|
|
||||||
|
ensure dscl /Local/Default -delete /Users/_stalwart AuthenticationAuthority
|
||||||
|
ensure dscl /Local/Default -delete /Users/_stalwart PasswordPolicyOptions
|
||||||
|
else
|
||||||
|
ensure useradd "$_account" -s /usr/sbin/nologin -M -r -U
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
create_service_linux_systemd() {
|
||||||
|
local _bin="$1" _config="$2" _env="$3" _user="$4"
|
||||||
|
cat > /etc/systemd/system/stalwart.service <<EOF
|
||||||
|
[Unit]
|
||||||
|
Description=Stalwart
|
||||||
|
Conflicts=postfix.service sendmail.service exim4.service
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
LimitNOFILE=65536
|
||||||
|
KillMode=process
|
||||||
|
KillSignal=SIGINT
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=5
|
||||||
|
EnvironmentFile=-${_env}
|
||||||
|
ExecStart=${_bin} --config=${_config}
|
||||||
|
SyslogIdentifier=stalwart
|
||||||
|
User=${_user}
|
||||||
|
Group=${_user}
|
||||||
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable stalwart.service
|
||||||
|
systemctl restart stalwart.service
|
||||||
|
}
|
||||||
|
|
||||||
|
create_service_linux_initd() {
|
||||||
|
local _bin="$1" _config="$2" _env="$3" _user="$4"
|
||||||
|
cat > /etc/init.d/stalwart <<EOF
|
||||||
|
#!/bin/sh
|
||||||
|
### BEGIN INIT INFO
|
||||||
|
# Provides: stalwart
|
||||||
|
# Required-Start: \$network
|
||||||
|
# Required-Stop: \$network
|
||||||
|
# Default-Start: 2 3 4 5
|
||||||
|
# Default-Stop: 0 1 6
|
||||||
|
# Short-Description: Stalwart Server
|
||||||
|
# Description: Starts and stops the Stalwart Server
|
||||||
|
# Conflicts: postfix sendmail
|
||||||
|
### END INIT INFO
|
||||||
|
|
||||||
|
PATH=/sbin:/usr/sbin:/bin:/usr/bin
|
||||||
|
|
||||||
|
. /lib/init/vars.sh
|
||||||
|
. /lib/lsb/init-functions
|
||||||
|
|
||||||
|
DAEMON=${_bin}
|
||||||
|
DAEMON_ARGS="--config=${_config}"
|
||||||
|
ENV_FILE=${_env}
|
||||||
|
PIDFILE=/var/run/stalwart.pid
|
||||||
|
ULIMIT_NOFILE=65536
|
||||||
|
|
||||||
|
[ -x "\$DAEMON" ] || exit 0
|
||||||
|
|
||||||
|
if [ -r "\$ENV_FILE" ]; then
|
||||||
|
set -a
|
||||||
|
. "\$ENV_FILE"
|
||||||
|
set +a
|
||||||
|
fi
|
||||||
|
|
||||||
|
ulimit -n \$ULIMIT_NOFILE
|
||||||
|
|
||||||
|
do_start()
|
||||||
|
{
|
||||||
|
start-stop-daemon --start --quiet --pidfile \$PIDFILE --exec \$DAEMON --test > /dev/null \\
|
||||||
|
|| return 1
|
||||||
|
start-stop-daemon --start --quiet --pidfile \$PIDFILE --exec \$DAEMON \\
|
||||||
|
--background --make-pidfile --chuid ${_user}:${_user} \\
|
||||||
|
-- \$DAEMON_ARGS \\
|
||||||
|
|| return 2
|
||||||
|
}
|
||||||
|
|
||||||
|
do_stop()
|
||||||
|
{
|
||||||
|
start-stop-daemon --stop --quiet --retry=INT/30/KILL/5 --pidfile \$PIDFILE --name stalwart
|
||||||
|
RETVAL="\$?"
|
||||||
|
[ "\$RETVAL" = 2 ] && return 2
|
||||||
|
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec \$DAEMON
|
||||||
|
[ "\$?" = 2 ] && return 2
|
||||||
|
rm -f \$PIDFILE
|
||||||
|
return "\$RETVAL"
|
||||||
|
}
|
||||||
|
|
||||||
|
case "\$1" in
|
||||||
|
start)
|
||||||
|
[ "\$VERBOSE" != no ] && log_daemon_msg "Starting Stalwart Server" "stalwart"
|
||||||
|
do_start
|
||||||
|
case "\$?" in
|
||||||
|
0|1) [ "\$VERBOSE" != no ] && log_end_msg 0 ;;
|
||||||
|
2) [ "\$VERBOSE" != no ] && log_end_msg 1 ;;
|
||||||
|
esac
|
||||||
|
;;
|
||||||
|
stop)
|
||||||
|
[ "\$VERBOSE" != no ] && log_daemon_msg "Stopping Stalwart Server" "stalwart"
|
||||||
|
do_stop
|
||||||
|
case "\$?" in
|
||||||
|
0|1) [ "\$VERBOSE" != no ] && log_end_msg 0 ;;
|
||||||
|
2) [ "\$VERBOSE" != no ] && log_end_msg 1 ;;
|
||||||
|
esac
|
||||||
|
;;
|
||||||
|
status)
|
||||||
|
status_of_proc "\$DAEMON" "stalwart" && exit 0 || exit \$?
|
||||||
|
;;
|
||||||
|
restart)
|
||||||
|
log_daemon_msg "Restarting Stalwart Server" "stalwart"
|
||||||
|
do_stop
|
||||||
|
case "\$?" in
|
||||||
|
0|1)
|
||||||
|
do_start
|
||||||
|
case "\$?" in
|
||||||
|
0) log_end_msg 0 ;;
|
||||||
|
*) log_end_msg 1 ;;
|
||||||
|
esac
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
log_end_msg 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Usage: /etc/init.d/stalwart {start|stop|status|restart}" >&2
|
||||||
|
exit 3
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
exit 0
|
||||||
|
EOF
|
||||||
|
chmod +x /etc/init.d/stalwart
|
||||||
|
update-rc.d stalwart defaults
|
||||||
|
service stalwart start
|
||||||
|
}
|
||||||
|
|
||||||
|
create_service_macos() {
|
||||||
|
local _bin="$1" _config="$2" _env="$3" _user="$4"
|
||||||
|
local _plist="/Library/LaunchDaemons/stalwart.plist"
|
||||||
|
|
||||||
|
# Remove any legacy LaunchAgent from a prior install
|
||||||
|
if [ -f /Library/LaunchAgents/stalwart.mail.plist ]; then
|
||||||
|
launchctl unload /Library/LaunchAgents/stalwart.mail.plist 2>/dev/null || true
|
||||||
|
rm -f /Library/LaunchAgents/stalwart.mail.plist
|
||||||
|
fi
|
||||||
|
|
||||||
|
# launchd has no EnvironmentFile equivalent — wrap with sh to source the env file
|
||||||
|
cat > "$_plist" <<EOF
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
|
||||||
|
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||||
|
<plist version="1.0">
|
||||||
|
<dict>
|
||||||
|
<key>Label</key>
|
||||||
|
<string>stalwart</string>
|
||||||
|
<key>ServiceDescription</key>
|
||||||
|
<string>Stalwart</string>
|
||||||
|
<key>UserName</key>
|
||||||
|
<string>${_user}</string>
|
||||||
|
<key>GroupName</key>
|
||||||
|
<string>${_user}</string>
|
||||||
|
<key>ProgramArguments</key>
|
||||||
|
<array>
|
||||||
|
<string>/bin/sh</string>
|
||||||
|
<string>-c</string>
|
||||||
|
<string>set -a; if [ -r "${_env}" ]; then . "${_env}"; fi; set +a; exec "${_bin}" --config="${_config}"</string>
|
||||||
|
</array>
|
||||||
|
<key>RunAtLoad</key>
|
||||||
|
<true/>
|
||||||
|
<key>KeepAlive</key>
|
||||||
|
<true/>
|
||||||
|
</dict>
|
||||||
|
</plist>
|
||||||
|
EOF
|
||||||
|
chmod 0644 "$_plist"
|
||||||
|
chown root:wheel "$_plist"
|
||||||
|
launchctl bootout system "$_plist" 2>/dev/null || true
|
||||||
|
launchctl bootstrap system "$_plist"
|
||||||
|
launchctl enable system/stalwart
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
get_architecture() {
|
||||||
|
local _ostype _cputype _bitness _arch _clibtype
|
||||||
|
_ostype="$(uname -s)"
|
||||||
|
_cputype="$(uname -m)"
|
||||||
|
_clibtype="gnu"
|
||||||
|
|
||||||
|
if [ "$_ostype" = Linux ]; then
|
||||||
|
if [ "$(uname -o)" = Android ]; then
|
||||||
|
_ostype=Android
|
||||||
|
fi
|
||||||
|
if ldd --version 2>&1 | grep -q 'musl'; then
|
||||||
|
_clibtype="musl"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$_ostype" = Darwin ] && [ "$_cputype" = i386 ]; then
|
||||||
|
# Darwin `uname -m` lies
|
||||||
|
if sysctl hw.optional.x86_64 | grep -q ': 1'; then
|
||||||
|
_cputype=x86_64
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$_ostype" = SunOS ]; then
|
||||||
|
# Both Solaris and illumos presently announce as "SunOS" in "uname -s"
|
||||||
|
# so use "uname -o" to disambiguate. We use the full path to the
|
||||||
|
# system uname in case the user has coreutils uname first in PATH,
|
||||||
|
# which has historically sometimes printed the wrong value here.
|
||||||
|
if [ "$(/usr/bin/uname -o)" = illumos ]; then
|
||||||
|
_ostype=illumos
|
||||||
|
fi
|
||||||
|
|
||||||
|
# illumos systems have multi-arch userlands, and "uname -m" reports the
|
||||||
|
# machine hardware name; e.g., "i86pc" on both 32- and 64-bit x86
|
||||||
|
# systems. Check for the native (widest) instruction set on the
|
||||||
|
# running kernel:
|
||||||
|
if [ "$_cputype" = i86pc ]; then
|
||||||
|
_cputype="$(isainfo -n)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
case "$_ostype" in
|
||||||
|
|
||||||
|
Android)
|
||||||
|
_ostype=linux-android
|
||||||
|
;;
|
||||||
|
|
||||||
|
Linux)
|
||||||
|
check_proc
|
||||||
|
_ostype=unknown-linux-$_clibtype
|
||||||
|
_bitness=$(get_bitness)
|
||||||
|
;;
|
||||||
|
|
||||||
|
FreeBSD)
|
||||||
|
_ostype=unknown-freebsd
|
||||||
|
;;
|
||||||
|
|
||||||
|
NetBSD)
|
||||||
|
_ostype=unknown-netbsd
|
||||||
|
;;
|
||||||
|
|
||||||
|
DragonFly)
|
||||||
|
_ostype=unknown-dragonfly
|
||||||
|
;;
|
||||||
|
|
||||||
|
Darwin)
|
||||||
|
_ostype=apple-darwin
|
||||||
|
;;
|
||||||
|
|
||||||
|
illumos)
|
||||||
|
_ostype=unknown-illumos
|
||||||
|
;;
|
||||||
|
|
||||||
|
MINGW* | MSYS* | CYGWIN* | Windows_NT)
|
||||||
|
_ostype=pc-windows-gnu
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
err "unrecognized OS type: $_ostype"
|
||||||
|
;;
|
||||||
|
|
||||||
|
esac
|
||||||
|
|
||||||
|
case "$_cputype" in
|
||||||
|
|
||||||
|
i386 | i486 | i686 | i786 | x86)
|
||||||
|
_cputype=i686
|
||||||
|
;;
|
||||||
|
|
||||||
|
xscale | arm)
|
||||||
|
_cputype=arm
|
||||||
|
if [ "$_ostype" = "linux-android" ]; then
|
||||||
|
_ostype=linux-androideabi
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
armv6l)
|
||||||
|
_cputype=arm
|
||||||
|
if [ "$_ostype" = "linux-android" ]; then
|
||||||
|
_ostype=linux-androideabi
|
||||||
|
else
|
||||||
|
_ostype="${_ostype}eabihf"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
armv7l | armv8l)
|
||||||
|
_cputype=armv7
|
||||||
|
if [ "$_ostype" = "linux-android" ]; then
|
||||||
|
_ostype=linux-androideabi
|
||||||
|
else
|
||||||
|
_ostype="${_ostype}eabihf"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
aarch64 | arm64)
|
||||||
|
_cputype=aarch64
|
||||||
|
;;
|
||||||
|
|
||||||
|
x86_64 | x86-64 | x64 | amd64)
|
||||||
|
_cputype=x86_64
|
||||||
|
;;
|
||||||
|
|
||||||
|
mips)
|
||||||
|
_cputype=$(get_endianness mips '' el)
|
||||||
|
;;
|
||||||
|
|
||||||
|
mips64)
|
||||||
|
if [ "$_bitness" -eq 64 ]; then
|
||||||
|
# only n64 ABI is supported for now
|
||||||
|
_ostype="${_ostype}abi64"
|
||||||
|
_cputype=$(get_endianness mips64 '' el)
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
ppc)
|
||||||
|
_cputype=powerpc
|
||||||
|
;;
|
||||||
|
|
||||||
|
ppc64)
|
||||||
|
_cputype=powerpc64
|
||||||
|
;;
|
||||||
|
|
||||||
|
ppc64le)
|
||||||
|
_cputype=powerpc64le
|
||||||
|
;;
|
||||||
|
|
||||||
|
s390x)
|
||||||
|
_cputype=s390x
|
||||||
|
;;
|
||||||
|
riscv64)
|
||||||
|
_cputype=riscv64gc
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
err "unknown CPU type: $_cputype"
|
||||||
|
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Detect 64-bit linux with 32-bit userland
|
||||||
|
if [ "${_ostype}" = unknown-linux-gnu ] && [ "${_bitness}" -eq 32 ]; then
|
||||||
|
case $_cputype in
|
||||||
|
x86_64)
|
||||||
|
if [ -n "${RUSTUP_CPUTYPE:-}" ]; then
|
||||||
|
_cputype="$RUSTUP_CPUTYPE"
|
||||||
|
else {
|
||||||
|
# 32-bit executable for amd64 = x32
|
||||||
|
if is_host_amd64_elf; then {
|
||||||
|
echo "This host is running an x32 userland; as it stands, x32 support is poor," 1>&2
|
||||||
|
echo "and there isn't a native toolchain -- you will have to install" 1>&2
|
||||||
|
echo "multiarch compatibility with i686 and/or amd64, then select one" 1>&2
|
||||||
|
echo "by re-running this script with the RUSTUP_CPUTYPE environment variable" 1>&2
|
||||||
|
echo "set to i686 or x86_64, respectively." 1>&2
|
||||||
|
echo 1>&2
|
||||||
|
echo "You will be able to add an x32 target after installation by running" 1>&2
|
||||||
|
echo " rustup target add x86_64-unknown-linux-gnux32" 1>&2
|
||||||
|
exit 1
|
||||||
|
}; else
|
||||||
|
_cputype=i686
|
||||||
|
fi
|
||||||
|
}; fi
|
||||||
|
;;
|
||||||
|
mips64)
|
||||||
|
_cputype=$(get_endianness mips '' el)
|
||||||
|
;;
|
||||||
|
powerpc64)
|
||||||
|
_cputype=powerpc
|
||||||
|
;;
|
||||||
|
aarch64)
|
||||||
|
_cputype=armv7
|
||||||
|
if [ "$_ostype" = "linux-android" ]; then
|
||||||
|
_ostype=linux-androideabi
|
||||||
|
else
|
||||||
|
_ostype="${_ostype}eabihf"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
riscv64gc)
|
||||||
|
err "riscv64 with 32-bit userland unsupported"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Detect armv7 but without the CPU features Rust needs in that build,
|
||||||
|
# and fall back to arm.
|
||||||
|
# See https://github.com/rust-lang/rustup.rs/issues/587.
|
||||||
|
if [ "$_ostype" = "unknown-linux-gnueabihf" ] && [ "$_cputype" = armv7 ]; then
|
||||||
|
if ensure grep '^Features' /proc/cpuinfo | grep -q -v neon; then
|
||||||
|
# At least one processor does not have NEON.
|
||||||
|
_cputype=arm
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
_arch="${_cputype}-${_ostype}"
|
||||||
|
|
||||||
|
RETVAL="$_arch"
|
||||||
|
}
|
||||||
|
|
||||||
|
check_proc() {
|
||||||
|
# Check for /proc by looking for the /proc/self/exe link
|
||||||
|
# This is only run on Linux
|
||||||
|
if ! test -L /proc/self/exe ; then
|
||||||
|
err "fatal: Unable to find /proc/self/exe. Is /proc mounted? Installation cannot proceed without /proc."
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
get_bitness() {
|
||||||
|
need_cmd head
|
||||||
|
# Architecture detection without dependencies beyond coreutils.
|
||||||
|
# ELF files start out "\x7fELF", and the following byte is
|
||||||
|
# 0x01 for 32-bit and
|
||||||
|
# 0x02 for 64-bit.
|
||||||
|
# The printf builtin on some shells like dash only supports octal
|
||||||
|
# escape sequences, so we use those.
|
||||||
|
local _current_exe_head
|
||||||
|
_current_exe_head=$(head -c 5 /proc/self/exe )
|
||||||
|
if [ "$_current_exe_head" = "$(printf '\177ELF\001')" ]; then
|
||||||
|
echo 32
|
||||||
|
elif [ "$_current_exe_head" = "$(printf '\177ELF\002')" ]; then
|
||||||
|
echo 64
|
||||||
|
else
|
||||||
|
err "unknown platform bitness"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
is_host_amd64_elf() {
|
||||||
|
need_cmd head
|
||||||
|
need_cmd tail
|
||||||
|
# ELF e_machine detection without dependencies beyond coreutils.
|
||||||
|
# Two-byte field at offset 0x12 indicates the CPU,
|
||||||
|
# but we're interested in it being 0x3E to indicate amd64, or not that.
|
||||||
|
local _current_exe_machine
|
||||||
|
_current_exe_machine=$(head -c 19 /proc/self/exe | tail -c 1)
|
||||||
|
[ "$_current_exe_machine" = "$(printf '\076')" ]
|
||||||
|
}
|
||||||
|
|
||||||
|
get_endianness() {
|
||||||
|
local cputype=$1
|
||||||
|
local suffix_eb=$2
|
||||||
|
local suffix_el=$3
|
||||||
|
|
||||||
|
# detect endianness without od/hexdump, like get_bitness() does.
|
||||||
|
need_cmd head
|
||||||
|
need_cmd tail
|
||||||
|
|
||||||
|
local _current_exe_endianness
|
||||||
|
_current_exe_endianness="$(head -c 6 /proc/self/exe | tail -c 1)"
|
||||||
|
if [ "$_current_exe_endianness" = "$(printf '\001')" ]; then
|
||||||
|
echo "${cputype}${suffix_el}"
|
||||||
|
elif [ "$_current_exe_endianness" = "$(printf '\002')" ]; then
|
||||||
|
echo "${cputype}${suffix_eb}"
|
||||||
|
else
|
||||||
|
err "unknown platform endianness"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
say() {
|
||||||
|
printf '%s\n' "$1"
|
||||||
|
}
|
||||||
|
|
||||||
|
err() {
|
||||||
|
say "$1" >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
need_cmd() {
|
||||||
|
if ! check_cmd "$1"; then
|
||||||
|
err "need '$1' (command not found)"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
check_cmd() {
|
||||||
|
command -v "$1" > /dev/null 2>&1
|
||||||
|
}
|
||||||
|
|
||||||
|
assert_nz() {
|
||||||
|
if [ -z "$1" ]; then err "assert_nz $2"; fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Run a command that should never fail. If the command fails execution
|
||||||
|
# will immediately terminate with an error showing the failing
|
||||||
|
# command.
|
||||||
|
ensure() {
|
||||||
|
if ! "$@"; then err "command failed: $*"; fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# This wraps curl or wget. Try curl first, if not installed,
|
||||||
|
# use wget instead.
|
||||||
|
downloader() {
|
||||||
|
local _dld
|
||||||
|
local _ciphersuites
|
||||||
|
local _err
|
||||||
|
local _status
|
||||||
|
local _retry
|
||||||
|
if check_cmd curl; then
|
||||||
|
_dld=curl
|
||||||
|
elif check_cmd wget; then
|
||||||
|
_dld=wget
|
||||||
|
else
|
||||||
|
_dld='curl or wget' # to be used in error message of need_cmd
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$1" = --check ]; then
|
||||||
|
need_cmd "$_dld"
|
||||||
|
elif [ "$_dld" = curl ]; then
|
||||||
|
check_curl_for_retry_support
|
||||||
|
_retry="$RETVAL"
|
||||||
|
get_ciphersuites_for_curl
|
||||||
|
_ciphersuites="$RETVAL"
|
||||||
|
if [ -n "$_ciphersuites" ]; then
|
||||||
|
_err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
else
|
||||||
|
echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
|
||||||
|
if ! check_help_for "$3" curl --proto --tlsv1.2; then
|
||||||
|
echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
|
||||||
|
_err=$(curl $_retry --silent --show-error --fail --location "$1" --output "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
else
|
||||||
|
_err=$(curl $_retry --proto '=https' --tlsv1.2 --silent --show-error --fail --location "$1" --output "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -n "$_err" ]; then
|
||||||
|
if echo "$_err" | grep -q 404; then
|
||||||
|
err "❌ Binary for platform '$3' not found, this platform may be unsupported."
|
||||||
|
else
|
||||||
|
echo "$_err" >&2
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
return $_status
|
||||||
|
elif [ "$_dld" = wget ]; then
|
||||||
|
if [ "$(wget -V 2>&1|head -2|tail -1|cut -f1 -d" ")" = "BusyBox" ]; then
|
||||||
|
echo "Warning: using the BusyBox version of wget. Not enforcing strong cipher suites for TLS or TLS v1.2, this is potentially less secure"
|
||||||
|
_err=$(wget "$1" -O "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
else
|
||||||
|
get_ciphersuites_for_wget
|
||||||
|
_ciphersuites="$RETVAL"
|
||||||
|
if [ -n "$_ciphersuites" ]; then
|
||||||
|
_err=$(wget --https-only --secure-protocol=TLSv1_2 --ciphers "$_ciphersuites" "$1" -O "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
else
|
||||||
|
echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
|
||||||
|
if ! check_help_for "$3" wget --https-only --secure-protocol; then
|
||||||
|
echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
|
||||||
|
_err=$(wget "$1" -O "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
else
|
||||||
|
_err=$(wget --https-only --secure-protocol=TLSv1_2 "$1" -O "$2" 2>&1)
|
||||||
|
_status=$?
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -n "$_err" ]; then
|
||||||
|
if echo "$_err" | grep -q ' 404 Not Found'; then
|
||||||
|
err "❌ Binary for platform '$3' not found, this platform may be unsupported."
|
||||||
|
else
|
||||||
|
echo "$_err" >&2
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
return $_status
|
||||||
|
else
|
||||||
|
err "Unknown downloader" # should not reach here
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check if curl supports the --retry flag, then pass it to the curl invocation.
|
||||||
|
check_curl_for_retry_support() {
|
||||||
|
local _retry_supported=""
|
||||||
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
|
||||||
|
if check_help_for "notspecified" "curl" "--retry"; then
|
||||||
|
_retry_supported="--retry 3"
|
||||||
|
fi
|
||||||
|
|
||||||
|
RETVAL="$_retry_supported"
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
check_help_for() {
|
||||||
|
local _arch
|
||||||
|
local _cmd
|
||||||
|
local _arg
|
||||||
|
_arch="$1"
|
||||||
|
shift
|
||||||
|
_cmd="$1"
|
||||||
|
shift
|
||||||
|
|
||||||
|
local _category
|
||||||
|
if "$_cmd" --help | grep -q 'For all options use the manual or "--help all".'; then
|
||||||
|
_category="all"
|
||||||
|
else
|
||||||
|
_category=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
case "$_arch" in
|
||||||
|
|
||||||
|
*darwin*)
|
||||||
|
if check_cmd sw_vers; then
|
||||||
|
case $(sw_vers -productVersion) in
|
||||||
|
10.*)
|
||||||
|
# If we're running on macOS, older than 10.13, then we always
|
||||||
|
# fail to find these options to force fallback
|
||||||
|
if [ "$(sw_vers -productVersion | cut -d. -f2)" -lt 13 ]; then
|
||||||
|
# Older than 10.13
|
||||||
|
echo "Warning: Detected macOS platform older than 10.13"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
11.*)
|
||||||
|
# We assume Big Sur will be OK for now
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
# Unknown product version, warn and continue
|
||||||
|
echo "Warning: Detected unknown macOS major version: $(sw_vers -productVersion)"
|
||||||
|
echo "Warning TLS capabilities detection may fail"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
esac
|
||||||
|
|
||||||
|
for _arg in "$@"; do
|
||||||
|
if ! "$_cmd" --help $_category | grep -q -- "$_arg"; then
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
true # not strictly needed
|
||||||
|
}
|
||||||
|
|
||||||
|
# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
|
||||||
|
# if support by local tools is detected. Detection currently supports these curl backends:
|
||||||
|
# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
|
||||||
|
get_ciphersuites_for_curl() {
|
||||||
|
if [ -n "${RUSTUP_TLS_CIPHERSUITES-}" ]; then
|
||||||
|
# user specified custom cipher suites, assume they know what they're doing
|
||||||
|
RETVAL="$RUSTUP_TLS_CIPHERSUITES"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
local _openssl_syntax="no"
|
||||||
|
local _gnutls_syntax="no"
|
||||||
|
local _backend_supported="yes"
|
||||||
|
if curl -V | grep -q ' OpenSSL/'; then
|
||||||
|
_openssl_syntax="yes"
|
||||||
|
elif curl -V | grep -iq ' LibreSSL/'; then
|
||||||
|
_openssl_syntax="yes"
|
||||||
|
elif curl -V | grep -iq ' BoringSSL/'; then
|
||||||
|
_openssl_syntax="yes"
|
||||||
|
elif curl -V | grep -iq ' GnuTLS/'; then
|
||||||
|
_gnutls_syntax="yes"
|
||||||
|
else
|
||||||
|
_backend_supported="no"
|
||||||
|
fi
|
||||||
|
|
||||||
|
local _args_supported="no"
|
||||||
|
if [ "$_backend_supported" = "yes" ]; then
|
||||||
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
|
||||||
|
if check_help_for "notspecified" "curl" "--tlsv1.2" "--ciphers" "--proto"; then
|
||||||
|
_args_supported="yes"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
local _cs=""
|
||||||
|
if [ "$_args_supported" = "yes" ]; then
|
||||||
|
if [ "$_openssl_syntax" = "yes" ]; then
|
||||||
|
_cs=$(get_strong_ciphersuites_for "openssl")
|
||||||
|
elif [ "$_gnutls_syntax" = "yes" ]; then
|
||||||
|
_cs=$(get_strong_ciphersuites_for "gnutls")
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
RETVAL="$_cs"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
|
||||||
|
# if support by local tools is detected. Detection currently supports these wget backends:
|
||||||
|
# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
|
||||||
|
get_ciphersuites_for_wget() {
|
||||||
|
if [ -n "${RUSTUP_TLS_CIPHERSUITES-}" ]; then
|
||||||
|
# user specified custom cipher suites, assume they know what they're doing
|
||||||
|
RETVAL="$RUSTUP_TLS_CIPHERSUITES"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
local _cs=""
|
||||||
|
if wget -V | grep -q '\-DHAVE_LIBSSL'; then
|
||||||
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
|
||||||
|
if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then
|
||||||
|
_cs=$(get_strong_ciphersuites_for "openssl")
|
||||||
|
fi
|
||||||
|
elif wget -V | grep -q '\-DHAVE_LIBGNUTLS'; then
|
||||||
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
|
||||||
|
if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then
|
||||||
|
_cs=$(get_strong_ciphersuites_for "gnutls")
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
RETVAL="$_cs"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Return strong TLS 1.2-1.3 cipher suites in OpenSSL or GnuTLS syntax. TLS 1.2
|
||||||
|
# excludes non-ECDHE and non-AEAD cipher suites. DHE is excluded due to bad
|
||||||
|
# DH params often found on servers (see RFC 7919). Sequence matches or is
|
||||||
|
# similar to Firefox 68 ESR with weak cipher suites disabled via about:config.
|
||||||
|
# $1 must be openssl or gnutls.
|
||||||
|
get_strong_ciphersuites_for() {
|
||||||
|
if [ "$1" = "openssl" ]; then
|
||||||
|
# OpenSSL is forgiving of unknown values, no problems with TLS 1.3 values on versions that don't support it yet.
|
||||||
|
echo "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
|
||||||
|
elif [ "$1" = "gnutls" ]; then
|
||||||
|
# GnuTLS isn't forgiving of unknown values, so this may require a GnuTLS version that supports TLS 1.3 even if wget doesn't.
|
||||||
|
# Begin with SECURE128 (and higher) then remove/add to build cipher suites. Produces same 9 cipher suites as OpenSSL but in slightly different order.
|
||||||
|
echo "SECURE128:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS-ALL:-CIPHER-ALL:-MAC-ALL:-KX-ALL:+AEAD:+ECDHE-ECDSA:+ECDHE-RSA:+AES-128-GCM:+CHACHA20-POLY1305:+AES-256-GCM"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# This is just for indicating that commands' results are being
|
||||||
|
# intentionally ignored. Usually, because it's being executed
|
||||||
|
# as part of error handling.
|
||||||
|
ignore() {
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
main "$@" || exit 1
|
||||||
Reference in New Issue
Block a user