mirror of
https://github.com/nextcloud/nextcloudpi.git
synced 2026-01-09 06:32:00 -03:30
131 lines
3.6 KiB
Bash
131 lines
3.6 KiB
Bash
#!/bin/bash
|
|
|
|
# Data at rest encryption for NextcloudPi
|
|
#
|
|
# Copyleft 2021 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
|
|
# GPL licensed (see end of file) * Use at your own risk!
|
|
#
|
|
# More at: nextcloudpi.com
|
|
#
|
|
|
|
is_active()
|
|
{
|
|
mount | grep ncdata_enc | grep -q gocryptfs
|
|
}
|
|
|
|
install()
|
|
{
|
|
apt_install gocryptfs
|
|
}
|
|
|
|
configure()
|
|
{
|
|
|
|
set -e -o pipefail
|
|
local datadir parentdir encdir tmpdir
|
|
datadir="$(get_ncpcfg datadir)"
|
|
[[ "${datadir?}" == "null" ]] && datadir=/var/www/nextcloud/data
|
|
parentdir="$(dirname "${datadir}")"
|
|
encdir="${parentdir?}/ncdata_enc"
|
|
tmpdir="$(mktemp -u -p "${parentdir}" -t nc-data-crypt.XXXXXX)"
|
|
|
|
[[ "${ACTIVE?}" != "yes" ]] && {
|
|
if ! is_active; then
|
|
echo "Data not currently encrypted"
|
|
return 0
|
|
fi
|
|
save_maintenance_mode
|
|
trap restore_maintenance_mode EXIT
|
|
echo "Decrypting data..."
|
|
mkdir "${tmpdir?}"
|
|
chown www-data: "${tmpdir}"
|
|
pkill tail # prevents from umounting in docker
|
|
mv "${datadir?}"/* "${datadir}"/.[!.]* "${tmpdir}"
|
|
fusermount -u "${datadir}"
|
|
rmdir "${datadir}"
|
|
mv "${tmpdir}" "${datadir}"
|
|
rm "${encdir?}"/gocryptfs.*
|
|
rmdir "${encdir}"
|
|
echo "Data no longer encrypted"
|
|
return
|
|
}
|
|
|
|
if is_active; then
|
|
echo "Encrypted data already in use"
|
|
return
|
|
fi
|
|
|
|
export PASSWORD
|
|
# Just mount already encrypted data
|
|
if [[ -f "${encdir?}"/gocryptfs.conf ]]; then
|
|
systemctl reset-failed ncp-encrypt ||:
|
|
systemd-run -u ncp-encrypt -E PASSWORD bash -c "gocryptfs -fg -allow_other -q '${encdir}' '${datadir}' <<<\"\${PASSWORD}\" 2>&1 | sed /^Switch/d |& tee /var/log/ncp-encrypt.log"
|
|
|
|
# switch to the regular virtual hosts after we decrypt, so we can access NC and ncp-web
|
|
a2ensite ncp 001-nextcloud
|
|
a2dissite ncp-activation
|
|
apache2ctl -k graceful
|
|
|
|
echo "Encrypted data now accessible"
|
|
return
|
|
fi
|
|
mkdir -p "${encdir?}"
|
|
echo "${PASSWORD?}" | gocryptfs -init -q "${encdir}"
|
|
save_maintenance_mode
|
|
cleanup() {
|
|
umount "${datadir}" ||:
|
|
[[ -f "${tmpdir}" ]] && {
|
|
rm -rf "${datadir?}" ||:
|
|
mv "${tmpdir}" "${datadir}"
|
|
|
|
chown -R www-data:www-data "${datadir}"
|
|
}
|
|
}
|
|
|
|
trap cleanup 1
|
|
trap restore_maintenance_mode EXIT
|
|
|
|
mv "${datadir?}" "${tmpdir?}"
|
|
|
|
mkdir "${datadir}"
|
|
systemctl reset-failed ncp-encrypt ||:
|
|
systemd-run -u ncp-encrypt -E PASSWORD bash -c "gocryptfs -fg -allow_other -q '${encdir}' '${datadir}' <<<\"\${PASSWORD}\" 2>&1 | sed /^Switch/d |& tee /var/log/ncp-encrypt.log"
|
|
|
|
maxtries=5
|
|
while [[ "$(systemctl is-active ncp-encrypt)" != "active" ]] || ! mount | grep -1 "${datadir}"
|
|
do
|
|
echo "Wating for encryption process to start... (${maxtries})"
|
|
sleep 3
|
|
maxtries=$((maxtries - 1))
|
|
[[ $maxtries -gt 0 ]] || return 1
|
|
done
|
|
|
|
echo "Encrypting data..."
|
|
mv "${tmpdir}"/* "${tmpdir}"/.[!.]* "${datadir}"
|
|
chown -R www-data: "${datadir}"
|
|
rmdir "${tmpdir}"
|
|
|
|
set_ncpcfg datadir "${datadir}"
|
|
|
|
echo "Data is now encrypted"
|
|
|
|
}
|
|
|
|
# License
|
|
#
|
|
# This script is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This script is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this script; if not, write to the
|
|
# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
|
|
# Boston, MA 02111-1307 USA
|
|
|