mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-07-11 19:22:37 +02:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 MickLesk
|
167635f04b |
@@ -499,19 +499,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
|
||||
|
||||
</details>
|
||||
|
||||
## 2026-07-10
|
||||
|
||||
### 🆕 New Scripts
|
||||
|
||||
- Squid ([#15605](https://github.com/community-scripts/ProxmoxVE/pull/15605))
|
||||
|
||||
### 🚀 Updated Scripts
|
||||
|
||||
- #### 🐞 Bug Fixes
|
||||
|
||||
- Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
|
||||
- Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
|
||||
|
||||
## 2026-07-09
|
||||
|
||||
### 🚀 Updated Scripts
|
||||
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
|
||||
# Copyright (c) 2021-2026 community-scripts ORG
|
||||
# Author: MickLesk (CanbiZ)
|
||||
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
||||
# Source: https://github.com/toeverything/AFFiNE
|
||||
|
||||
APP="AFFiNE"
|
||||
var_tags="${var_tags:-knowledge;notes;workspace}"
|
||||
var_cpu="${var_cpu:-4}"
|
||||
var_ram="${var_ram:-8192}"
|
||||
var_disk="${var_disk:-20}"
|
||||
var_os="${var_os:-debian}"
|
||||
var_version="${var_version:-13}"
|
||||
var_arm64="${var_arm64:-no}"
|
||||
var_unprivileged="${var_unprivileged:-1}"
|
||||
|
||||
header_info "$APP"
|
||||
variables
|
||||
color
|
||||
catch_errors
|
||||
|
||||
function update_script() {
|
||||
header_info
|
||||
check_container_storage
|
||||
check_container_resources
|
||||
|
||||
if [[ ! -d /opt/affine ]]; then
|
||||
msg_error "No ${APP} Installation Found!"
|
||||
exit
|
||||
fi
|
||||
|
||||
if check_for_gh_release "affine_app" "toeverything/AFFiNE"; then
|
||||
msg_info "Stopping Services"
|
||||
systemctl stop affine-web affine-worker
|
||||
msg_ok "Stopped Services"
|
||||
|
||||
create_backup /root/.affine/config /root/.affine/storage
|
||||
|
||||
CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
|
||||
|
||||
msg_info "Rebuilding Application (Patience)"
|
||||
cd /opt/affine
|
||||
source /root/.profile
|
||||
export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
|
||||
|
||||
set -a && source /opt/affine/.env && set +a
|
||||
|
||||
export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
|
||||
export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
|
||||
|
||||
# Initialize git repo (required for build process)
|
||||
$STD git init -q
|
||||
$STD git config user.email "build@local"
|
||||
$STD git config user.name "Build"
|
||||
$STD git add -A
|
||||
$STD git commit -q -m "update"
|
||||
|
||||
# Force Turbo to run sequentially
|
||||
mkdir -p /opt/affine/.turbo
|
||||
cat <<TURBO >/opt/affine/.turbo/config.json
|
||||
{
|
||||
"concurrency": 1
|
||||
}
|
||||
TURBO
|
||||
|
||||
$STD corepack enable
|
||||
$STD corepack prepare yarn@4.12.0 --activate
|
||||
$STD yarn config set enableTelemetry 0
|
||||
|
||||
export NODE_OPTIONS="--max-old-space-size=2048"
|
||||
$STD yarn install
|
||||
$STD npm install -g typescript
|
||||
|
||||
$STD yarn affine @affine/native build
|
||||
$STD yarn affine @affine/server-native build
|
||||
|
||||
# Create architecture-specific symlinks
|
||||
ln -sf /opt/affine/packages/backend/native/server-native.node \
|
||||
/opt/affine/packages/backend/native/server-native.x64.node
|
||||
ln -sf /opt/affine/packages/backend/native/server-native.node \
|
||||
/opt/affine/packages/backend/native/server-native.arm64.node
|
||||
ln -sf /opt/affine/packages/backend/native/server-native.node \
|
||||
/opt/affine/packages/backend/native/server-native.armv7.node
|
||||
|
||||
$STD yarn affine init
|
||||
$STD yarn affine build -p @affine/reader
|
||||
$STD yarn affine build -p @affine/server
|
||||
|
||||
export NODE_OPTIONS="--max-old-space-size=4096"
|
||||
$STD yarn affine build -p @affine/web
|
||||
$STD yarn affine build -p @affine/admin
|
||||
|
||||
# Copy web assets
|
||||
mkdir -p /opt/affine/packages/backend/server/static
|
||||
cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
|
||||
mkdir -p /opt/affine/packages/backend/server/static/admin
|
||||
cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
|
||||
|
||||
# Mobile manifest placeholder
|
||||
mkdir -p /opt/affine/packages/backend/server/static/mobile
|
||||
echo '{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}' \
|
||||
>/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
|
||||
|
||||
# Run migrations
|
||||
cd /opt/affine/packages/backend/server
|
||||
set -a && source /opt/affine/.env && set +a
|
||||
$STD node ./scripts/self-host-predeploy.js
|
||||
|
||||
restore_backup
|
||||
|
||||
msg_info "Starting Services"
|
||||
systemctl start affine-web affine-worker
|
||||
msg_ok "Started Services"
|
||||
msg_ok "Updated Successfully!"
|
||||
fi
|
||||
exit
|
||||
}
|
||||
|
||||
start
|
||||
build_container
|
||||
description
|
||||
|
||||
msg_ok "Completed Successfully!\n"
|
||||
echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
|
||||
echo -e "${INFO}${YW}Access it using the following URL:${CL}"
|
||||
echo -e "${GATEWAY}${BGN}http://${IP}:3010/sign-in${CL}"
|
||||
+13
-4
@@ -34,22 +34,31 @@ function update_script() {
|
||||
systemctl stop endurain
|
||||
msg_ok "Stopped Service"
|
||||
|
||||
create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
|
||||
msg_info "Creating Backup"
|
||||
cp /opt/endurain/.env /opt/endurain.env
|
||||
cp /opt/endurain/frontend/dist/env.js /opt/endurain.env.js
|
||||
msg_ok "Created Backup"
|
||||
|
||||
CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
|
||||
|
||||
msg_info "Preparing Update"
|
||||
cd /opt/endurain
|
||||
rm -rf /opt/endurain/{docs,example.env,screenshot_01.png} /opt/endurain/docker* /opt/endurain/*.yml
|
||||
rm -rf \
|
||||
/opt/endurain/{docs,example.env,screenshot_01.png} \
|
||||
/opt/endurain/docker* \
|
||||
/opt/endurain/*.yml
|
||||
cp /opt/endurain.env /opt/endurain/.env
|
||||
rm /opt/endurain.env
|
||||
msg_ok "Prepared Update"
|
||||
|
||||
msg_info "Updating Frontend"
|
||||
cd /opt/endurain/frontend
|
||||
$STD npm ci
|
||||
$STD npm run build
|
||||
cp /opt/endurain.env.js /opt/endurain/frontend/dist/env.js
|
||||
rm /opt/endurain.env.js
|
||||
msg_ok "Updated Frontend"
|
||||
|
||||
restore_backup
|
||||
|
||||
msg_info "Updating Backend"
|
||||
cd /opt/endurain/backend
|
||||
UV_VERSION=$(grep -Po 'required-version\s*=\s*"\K[^"]+' pyproject.toml 2>/dev/null || echo "0.11.18")
|
||||
|
||||
+7
-14
@@ -35,22 +35,12 @@ function update_script() {
|
||||
systemctl stop fireshare
|
||||
msg_ok "Stopped Service"
|
||||
|
||||
create_backup /opt/fireshare/fireshare.env
|
||||
mv /opt/fireshare/fireshare.env /opt
|
||||
CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
|
||||
restore_backup
|
||||
mv /opt/fireshare.env /opt/fireshare
|
||||
rm -f /usr/local/bin/fireshare
|
||||
|
||||
if ! grep -q "__FIRESHARE_PORT__" /etc/nginx/nginx.conf; then
|
||||
cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
|
||||
sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
|
||||
sed -i 's/^user[[:space:]]\+nginx;/user root;/' /etc/nginx/nginx.conf
|
||||
sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
|
||||
sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
|
||||
cp /opt/fireshare/app/nginx/error.html /etc/nginx/
|
||||
cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
|
||||
fi
|
||||
msg_info "Configuring Fireshare"
|
||||
|
||||
msg_info "Updating Fireshare"
|
||||
cd /opt/fireshare
|
||||
$STD uv venv --clear
|
||||
$STD .venv/bin/python -m ensurepip --upgrade
|
||||
@@ -63,10 +53,13 @@ function update_script() {
|
||||
export VIDEO_DIRECTORY=/opt/fireshare-videos
|
||||
export PROCESSED_DIRECTORY=/opt/fireshare-processed
|
||||
$STD uv run flask db upgrade
|
||||
|
||||
msg_info "Building Fireshare Client"
|
||||
cd /opt/fireshare/app/client
|
||||
$STD npm install
|
||||
$STD npm run build
|
||||
msg_ok "Configured Fireshare"
|
||||
msg_ok "Built Fireshare Client"
|
||||
msg_ok "Updated Fireshare"
|
||||
|
||||
msg_info "Starting Service"
|
||||
systemctl start fireshare
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
___ _____________ _ ________
|
||||
/ | / ____/ ____(_) | / / ____/
|
||||
/ /| | / /_ / /_ / / |/ / __/
|
||||
/ ___ |/ __/ / __/ / / /| / /___
|
||||
/_/ |_/_/ /_/ /_/_/ |_/_____/
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
_____ _ __
|
||||
/ ___/____ ___ __(_)___/ /
|
||||
\__ \/ __ `/ / / / / __ /
|
||||
___/ / /_/ / /_/ / / /_/ /
|
||||
/____/\__, /\__,_/_/\__,_/
|
||||
/_/
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
|
||||
# Copyright (c) 2021-2026 community-scripts ORG
|
||||
# Author: 007hacky007
|
||||
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
||||
# Source: https://www.squid-cache.org/
|
||||
|
||||
APP="Squid"
|
||||
var_tags="${var_tags:-proxy}"
|
||||
var_cpu="${var_cpu:-1}"
|
||||
var_ram="${var_ram:-512}"
|
||||
var_disk="${var_disk:-4}"
|
||||
var_os="${var_os:-debian}"
|
||||
var_version="${var_version:-13}"
|
||||
var_arm64="${var_arm64:-yes}"
|
||||
var_unprivileged="${var_unprivileged:-1}"
|
||||
|
||||
header_info "$APP"
|
||||
variables
|
||||
color
|
||||
catch_errors
|
||||
|
||||
function update_script() {
|
||||
header_info
|
||||
check_container_storage
|
||||
check_container_resources
|
||||
if [[ ! -f /etc/squid/squid.conf ]]; then
|
||||
msg_error "No ${APP} Installation Found!"
|
||||
exit
|
||||
fi
|
||||
msg_info "Updating Squid"
|
||||
$STD apt update
|
||||
$STD apt upgrade -y
|
||||
msg_ok "Updated Squid"
|
||||
|
||||
msg_info "Validating Squid Configuration"
|
||||
$STD squid -k parse
|
||||
msg_ok "Validated Squid Configuration"
|
||||
|
||||
msg_info "Restarting Squid"
|
||||
systemctl restart squid
|
||||
msg_ok "Restarted Squid"
|
||||
exit
|
||||
}
|
||||
|
||||
start
|
||||
build_container
|
||||
description
|
||||
|
||||
msg_ok "Completed successfully!\n"
|
||||
echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
|
||||
echo -e "${INFO}${YW} Proxy endpoint:${CL}"
|
||||
echo -e "${TAB}${GATEWAY}${BGN}${IP}:3128${CL}"
|
||||
@@ -1,215 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright (c) 2021-2026 community-scripts ORG
|
||||
# Author: MickLesk (CanbiZ)
|
||||
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
||||
# Source: https://github.com/toeverything/AFFiNE
|
||||
|
||||
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
||||
color
|
||||
verb_ip6
|
||||
catch_errors
|
||||
setting_up_container
|
||||
network_check
|
||||
update_os
|
||||
|
||||
msg_info "Installing Dependencies"
|
||||
$STD apt install -y \
|
||||
build-essential \
|
||||
git \
|
||||
pkg-config \
|
||||
openssl \
|
||||
libssl-dev \
|
||||
libjemalloc2 \
|
||||
redis-server \
|
||||
nginx
|
||||
msg_ok "Installed Dependencies"
|
||||
|
||||
PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
|
||||
PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
|
||||
NODE_VERSION="22" setup_nodejs
|
||||
setup_rust
|
||||
|
||||
fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
|
||||
|
||||
msg_info "Setting up Directories"
|
||||
rm -rf /root/.affine
|
||||
mkdir -p /root/.affine/{storage,config}
|
||||
msg_ok "Set up Directories"
|
||||
|
||||
msg_info "Configuring Environment"
|
||||
SECRET_KEY=$(openssl rand -hex 32)
|
||||
cat <<EOF >/opt/affine/.env
|
||||
NODE_ENV=production
|
||||
AFFINE_SERVER_PORT=3010
|
||||
AFFINE_SERVER_HOST=${LOCAL_IP}
|
||||
AFFINE_SERVER_EXTERNAL_URL=http://${LOCAL_IP}
|
||||
DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
|
||||
REDIS_SERVER_HOST=localhost
|
||||
REDIS_SERVER_PORT=6379
|
||||
AFFINE_INDEXER_ENABLED=false
|
||||
SECRET_KEY=${SECRET_KEY}
|
||||
EOF
|
||||
msg_ok "Configured Environment"
|
||||
|
||||
msg_info "Building AFFiNE (Patience)"
|
||||
cd /opt/affine
|
||||
source /root/.profile
|
||||
export PATH="/root/.cargo/bin:$PATH"
|
||||
export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
|
||||
export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
|
||||
# # Initialize git repo (required for build process)
|
||||
$STD git init -q
|
||||
$STD git config user.email "build@local"
|
||||
$STD git config user.name "Build"
|
||||
$STD git add -A
|
||||
$STD git commit -q -m "initial"
|
||||
mkdir -p /opt/affine/.turbo
|
||||
cat <<TURBO >/opt/affine/.turbo/config.json
|
||||
{
|
||||
"concurrency": 1
|
||||
}
|
||||
TURBO
|
||||
$STD corepack enable
|
||||
$STD corepack prepare yarn@4.12.0 --activate
|
||||
$STD yarn config set enableTelemetry 0
|
||||
export NODE_OPTIONS="--max-old-space-size=4096"
|
||||
export TSC_COMPILE_ON_ERROR=true
|
||||
$STD yarn install
|
||||
$STD npm install -g typescript
|
||||
$STD yarn affine @affine/native build
|
||||
$STD yarn affine @affine/server-native build
|
||||
|
||||
# Create architecture-specific symlinks for server-native
|
||||
ln -sf /opt/affine/packages/backend/native/server-native.node \
|
||||
/opt/affine/packages/backend/native/server-native.x64.node
|
||||
ln -sf /opt/affine/packages/backend/native/server-native.node \
|
||||
/opt/affine/packages/backend/native/server-native.arm64.node
|
||||
ln -sf /opt/affine/packages/backend/native/server-native.node \
|
||||
/opt/affine/packages/backend/native/server-native.armv7.node
|
||||
|
||||
$STD yarn affine init
|
||||
$STD yarn affine build -p @affine/reader
|
||||
$STD yarn affine build -p @affine/server
|
||||
export NODE_OPTIONS="--max-old-space-size=4096"
|
||||
$STD yarn affine build -p @affine/web
|
||||
$STD yarn affine build -p @affine/admin
|
||||
mkdir -p /opt/affine/packages/backend/server/static
|
||||
cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
|
||||
mkdir -p /opt/affine/packages/backend/server/static/admin
|
||||
cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
|
||||
# Create empty mobile manifest (server expects it but we don't build mobile)
|
||||
mkdir -p /opt/affine/packages/backend/server/static/mobile
|
||||
cat <<'MANIFEST' >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
|
||||
{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}
|
||||
MANIFEST
|
||||
msg_ok "Built AFFiNE"
|
||||
|
||||
msg_info "Running Initial Migration"
|
||||
cd /opt/affine/packages/backend/server
|
||||
set -a && source /opt/affine/.env && set +a
|
||||
$STD node ./scripts/self-host-predeploy.js
|
||||
msg_ok "Ran Initial Migration"
|
||||
|
||||
msg_info "Creating Services"
|
||||
cat <<EOF >/etc/systemd/system/affine-web.service
|
||||
[Unit]
|
||||
Description=AFFiNE Web Server
|
||||
After=network.target postgresql.service redis-server.service
|
||||
Requires=postgresql.service redis-server.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=/opt/affine/packages/backend/server
|
||||
EnvironmentFile=/opt/affine/.env
|
||||
Environment=LD_PRELOAD=libjemalloc.so.2
|
||||
Environment=NODE_OPTIONS=--max-old-space-size=1024
|
||||
ExecStart=/usr/bin/node ./dist/main.js
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
cat <<EOF >/etc/systemd/system/affine-worker.service
|
||||
[Unit]
|
||||
Description=AFFiNE Background Worker
|
||||
After=network.target postgresql.service redis-server.service
|
||||
Requires=postgresql.service redis-server.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=/opt/affine/packages/backend/server
|
||||
EnvironmentFile=/opt/affine/.env
|
||||
Environment=LD_PRELOAD=libjemalloc.so.2
|
||||
Environment=NODE_OPTIONS=--max-old-space-size=1024
|
||||
ExecStart=/usr/bin/node ./dist/main.js --worker
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl enable -q --now redis-server affine-web affine-worker
|
||||
msg_ok "Created Services"
|
||||
|
||||
msg_info "Creating Admin User"
|
||||
ADMIN_PASS=$(openssl rand -base64 12)
|
||||
for i in {1..30}; do
|
||||
if curl -s http://localhost:3010/info >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
# Create admin via API
|
||||
ADMIN_RESPONSE=$(curl -s -X POST http://localhost:3010/api/setup/create-admin-user \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"email\":\"admin@affine.local\",\"password\":\"${ADMIN_PASS}\"}")
|
||||
if echo "$ADMIN_RESPONSE" | grep -q '"id"'; then
|
||||
{
|
||||
echo "AFFiNE Credentials"
|
||||
echo "=================="
|
||||
echo "Email: admin@affine.local"
|
||||
echo "Password: ${ADMIN_PASS}"
|
||||
} >~/affine.creds
|
||||
msg_ok "Created Admin User"
|
||||
else
|
||||
msg_warn "Admin creation skipped (may already exist)"
|
||||
fi
|
||||
|
||||
msg_info "Configuring Nginx"
|
||||
cat <<EOF >/etc/nginx/sites-available/affine.conf
|
||||
upstream affine_backend {
|
||||
server 127.0.0.1:3010;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
|
||||
client_max_body_size 100M;
|
||||
|
||||
location / {
|
||||
proxy_pass http://affine_backend;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
ln -sf /etc/nginx/sites-available/affine.conf /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
systemctl enable -q --now nginx
|
||||
msg_ok "Configured Nginx"
|
||||
|
||||
motd_ssh
|
||||
customize
|
||||
cleanup_lxc
|
||||
@@ -141,9 +141,6 @@ cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
|
||||
sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
|
||||
sed -i 's/^user[[:space:]]\+nginx;/user root;/' /etc/nginx/nginx.conf
|
||||
sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
|
||||
sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
|
||||
cp /opt/fireshare/app/nginx/error.html /etc/nginx/
|
||||
cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
|
||||
systemctl start nginx
|
||||
|
||||
cat <<EOF >~/fireshare.creds
|
||||
|
||||
@@ -1,88 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright (c) 2021-2026 community-scripts ORG
|
||||
# Author: 007hacky007
|
||||
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
||||
# Source: https://www.squid-cache.org/
|
||||
|
||||
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
||||
color
|
||||
verb_ip6
|
||||
catch_errors
|
||||
setting_up_container
|
||||
network_check
|
||||
update_os
|
||||
|
||||
msg_info "Configuring Squid"
|
||||
mkdir -p /etc/squid
|
||||
cat <<EOF >/etc/squid/squid.conf
|
||||
acl localnet src 0.0.0.1-0.255.255.255
|
||||
acl localnet src 10.0.0.0/8
|
||||
acl localnet src 100.64.0.0/10
|
||||
acl localnet src 169.254.0.0/16
|
||||
acl localnet src 172.16.0.0/12
|
||||
acl localnet src 192.168.0.0/16
|
||||
acl localnet src fc00::/7
|
||||
acl localnet src fe80::/10
|
||||
|
||||
acl SSL_ports port 443
|
||||
acl Safe_ports port 80
|
||||
acl Safe_ports port 21
|
||||
acl Safe_ports port 443
|
||||
acl Safe_ports port 70
|
||||
acl Safe_ports port 210
|
||||
acl Safe_ports port 1025-65535
|
||||
acl Safe_ports port 280
|
||||
acl Safe_ports port 488
|
||||
acl Safe_ports port 591
|
||||
acl Safe_ports port 777
|
||||
acl CONNECT method CONNECT
|
||||
|
||||
http_access deny !Safe_ports
|
||||
http_access deny CONNECT !SSL_ports
|
||||
http_access allow localhost manager
|
||||
http_access deny manager
|
||||
|
||||
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
|
||||
auth_param basic realm proxy
|
||||
acl authenticated proxy_auth REQUIRED
|
||||
http_access allow authenticated
|
||||
http_access deny all
|
||||
|
||||
http_port 3128
|
||||
|
||||
coredump_dir /var/spool/squid
|
||||
|
||||
refresh_pattern ^ftp: 1440 20% 10080
|
||||
refresh_pattern ^gopher: 1440 0% 1440
|
||||
refresh_pattern -i (/cgi-bin/|\\?) 0 0% 0
|
||||
refresh_pattern . 0 20% 4320
|
||||
|
||||
# Privacy / hardening
|
||||
httpd_suppress_version_string on
|
||||
visible_hostname $(hostname)
|
||||
forwarded_for delete
|
||||
request_header_access X-Forwarded-For deny all
|
||||
EOF
|
||||
msg_ok "Configured Squid"
|
||||
|
||||
msg_info "Installing Dependencies"
|
||||
$STD apt install -y \
|
||||
squid \
|
||||
apache2-utils
|
||||
msg_ok "Installed Dependencies"
|
||||
|
||||
msg_info "Configuring Squid Authentication"
|
||||
touch /etc/squid/passwords
|
||||
chown proxy:proxy /etc/squid/passwords
|
||||
chmod 640 /etc/squid/passwords
|
||||
$STD squid -k parse
|
||||
msg_ok "Configured Squid Authentication"
|
||||
|
||||
msg_info "Starting Service"
|
||||
systemctl enable -q --now squid
|
||||
msg_ok "Started Service"
|
||||
|
||||
motd_ssh
|
||||
customize
|
||||
cleanup_lxc
|
||||
+39
-19
@@ -36,6 +36,10 @@
|
||||
#
|
||||
# ==============================================================================
|
||||
|
||||
# Guard against double-sourcing (core.func uses the same pattern)
|
||||
[[ -n "${_TOOLS_FUNC_LOADED:-}" ]] && return 0
|
||||
_TOOLS_FUNC_LOADED=1
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Debug helper - outputs to stderr when TOOLS_DEBUG is enabled
|
||||
# Usage: debug_log "message"
|
||||
@@ -91,16 +95,17 @@ curl_with_retry() {
|
||||
while [[ $attempt -le $retries ]]; do
|
||||
debug_log "curl attempt $attempt/$retries: $url"
|
||||
|
||||
local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout"
|
||||
[[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
|
||||
# Build curl command as array to avoid command injection via extra_opts
|
||||
local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout")
|
||||
[[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
|
||||
|
||||
if [[ "$output" == "-" ]]; then
|
||||
if $curl_cmd "$url"; then
|
||||
if "${curl_args[@]}" "$url"; then
|
||||
success=true
|
||||
break
|
||||
fi
|
||||
else
|
||||
if $curl_cmd -o "$output" "$url"; then
|
||||
if "${curl_args[@]}" -o "$output" "$url"; then
|
||||
success=true
|
||||
break
|
||||
fi
|
||||
@@ -153,15 +158,16 @@ curl_api_with_retry() {
|
||||
while [[ $attempt -le $retries ]]; do
|
||||
debug_log "curl API attempt $attempt/$retries: $url"
|
||||
|
||||
local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout -w '%{http_code}'"
|
||||
[[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
|
||||
# Build curl command as array to avoid command injection via extra_opts
|
||||
local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout" -w '%{http_code}')
|
||||
[[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
|
||||
|
||||
if [[ -n "$body_file" ]]; then
|
||||
http_code=$($curl_cmd -o "$body_file" "$url" 2>/dev/null) || true
|
||||
http_code=$("${curl_args[@]}" -o "$body_file" "$url" 2>/dev/null) || true
|
||||
else
|
||||
# Capture body and http_code separately
|
||||
local tmp_body="/tmp/curl_api_body_$$"
|
||||
http_code=$($curl_cmd -o "$tmp_body" "$url" 2>/dev/null) || true
|
||||
http_code=$("${curl_args[@]}" -o "$tmp_body" "$url" 2>/dev/null) || true
|
||||
if [[ -f "$tmp_body" ]]; then
|
||||
cat "$tmp_body"
|
||||
rm -f "$tmp_body"
|
||||
@@ -304,7 +310,10 @@ edit_yaml_config() {
|
||||
return 1
|
||||
fi
|
||||
|
||||
sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${value}|" "$file"
|
||||
# Escape sed metacharacters in value (| and &) to prevent injection
|
||||
local escaped_value="${value//|/\\|}"
|
||||
escaped_value="${escaped_value//&/\\&}"
|
||||
sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${escaped_value}|" "$file"
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
@@ -1687,10 +1696,6 @@ is_ubuntu() {
|
||||
[[ "$(get_os_info id)" == "ubuntu" ]]
|
||||
}
|
||||
|
||||
is_alpine() {
|
||||
[[ "$(get_os_info id)" == "alpine" ]]
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Get Debian/Ubuntu major version
|
||||
# ------------------------------------------------------------------------------
|
||||
@@ -2454,8 +2459,10 @@ start_timer() {
|
||||
end_timer() {
|
||||
local start_time="$1"
|
||||
local label="${2:-Operation}"
|
||||
local end_time=$(date +%s)
|
||||
local end_time
|
||||
end_time=$(date +%s)
|
||||
local duration=$((end_time - start_time))
|
||||
echo "${label} took ${duration}s"
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
@@ -6746,9 +6753,16 @@ setup_mariadb_db() {
|
||||
|
||||
msg_info "Setting up MariaDB Database"
|
||||
|
||||
$STD mariadb -u root -e "CREATE DATABASE \`$MARIADB_DB_NAME\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
|
||||
$STD mariadb -u root -e "CREATE USER '$MARIADB_DB_USER'@'localhost' IDENTIFIED BY '$MARIADB_DB_PASS';"
|
||||
$STD mariadb -u root -e "GRANT ALL ON \`$MARIADB_DB_NAME\`.* TO '$MARIADB_DB_USER'@'localhost';"
|
||||
# Use --defaults-extra-file to pass credentials safely and escape identifiers
|
||||
# to prevent SQL injection via DB name / user / password
|
||||
local _db_escaped _user_escaped _pass_escaped
|
||||
_db_escaped="${MARIADB_DB_NAME//\'/\'\'}"
|
||||
_user_escaped="${MARIADB_DB_USER//\'/\'\'}"
|
||||
_pass_escaped="${MARIADB_DB_PASS//\'/\'\'}"
|
||||
|
||||
$STD mariadb -u root -e "CREATE DATABASE \`$_db_escaped\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
|
||||
$STD mariadb -u root -e "CREATE USER '$_user_escaped'@'localhost' IDENTIFIED BY '$_pass_escaped';"
|
||||
$STD mariadb -u root -e "GRANT ALL ON \`$_db_escaped\`.* TO '$_user_escaped'@'localhost';"
|
||||
|
||||
# Optional extra grants
|
||||
if [[ -n "${MARIADB_DB_EXTRA_GRANTS:-}" ]]; then
|
||||
@@ -8378,8 +8392,14 @@ setup_postgresql_db() {
|
||||
fi
|
||||
|
||||
msg_info "Setting up PostgreSQL Database"
|
||||
$STD sudo -u postgres psql -c "CREATE ROLE $PG_DB_USER WITH LOGIN PASSWORD '$PG_DB_PASS';"
|
||||
$STD sudo -u postgres psql -c "CREATE DATABASE $PG_DB_NAME WITH OWNER $PG_DB_USER ENCODING 'UTF8' TEMPLATE template0;"
|
||||
# Escape single quotes in identifiers to prevent SQL injection
|
||||
local _pg_user_escaped _pg_pass_escaped _pg_db_escaped
|
||||
_pg_user_escaped="${PG_DB_USER//\'/\'\'}"
|
||||
_pg_pass_escaped="${PG_DB_PASS//\'/\'\'}"
|
||||
_pg_db_escaped="${PG_DB_NAME//\'/\'\'}"
|
||||
|
||||
$STD sudo -u postgres psql -c "CREATE ROLE $_pg_user_escaped WITH LOGIN PASSWORD '$_pg_pass_escaped';"
|
||||
$STD sudo -u postgres psql -c "CREATE DATABASE $_pg_db_escaped WITH OWNER $_pg_user_escaped ENCODING 'UTF8' TEMPLATE template0;"
|
||||
|
||||
# Configure pg_cron database BEFORE creating the extension (must be set before pg_cron loads)
|
||||
if [[ -n "${PG_DB_EXTENSIONS:-}" ]] && [[ ",${PG_DB_EXTENSIONS//[[:space:]]/}," == *",pg_cron,"* ]]; then
|
||||
|
||||
Reference in New Issue
Block a user