clear messages

install.sh

@@ -9,8 +9,8 @@
 #
 # Overridable: MOVIM_USER (default movim, created if missing), PREFIX
 # (default /opt/movim), DATA_DIR (default /var/lib/movim), CONF_DIR
-# (default /etc/movim), XMPP_DOMAIN and WEB_HOST (asked when run in a
-# terminal and the configuration does not exist yet).
+# (default /etc/movim), XMPP_DOMAIN, WEB_HOST and MOVIM_PORT (asked when run
+# in a terminal and the configuration does not exist yet).
 set -eu
 
 MOVIM_USER=${MOVIM_USER:-movim}
@@ -19,19 +19,47 @@ DATA_DIR=${DATA_DIR:-/var/lib/movim}
 CONF_DIR=${CONF_DIR:-/etc/movim}
 XMPP_DOMAIN=${XMPP_DOMAIN:-}
 WEB_HOST=${WEB_HOST:-}
+MOVIM_PORT=${MOVIM_PORT:-}
 UNIT=/etc/systemd/system/movim.service
 MIN_RUSTC=1.94
 
 die() { echo "error: $*" >&2; exit 1; }
 
+# Validators print why a value is refused.
 valid_host() {
-    printf '%s' "$1" | grep -Eq '^([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\.)+[A-Za-z]{2,}$'
+    printf '%s' "$1" | grep -Eq '^([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\.)+[A-Za-z]{2,}$' && return 0
+    echo "    not a valid domain name: $1"
+    return 1
 }
 
-# ask VAR "question" default: prompt on the terminal until a valid hostname.
+port_in_use() {
+    command -v ss >/dev/null && [ -n "$(ss -Htln "sport = :$1")" ]
+}
+
+# The service has no capabilities, so no privileged ports.
+valid_port() {
+    case $1 in ''|*[!0-9]*) echo "    not a port number: $1"; return 1 ;; esac
+    if [ "$1" -lt 1024 ] || [ "$1" -gt 65535 ]; then
+        echo "    port must be between 1024 and 65535"
+        return 1
+    fi
+    if port_in_use "$1"; then
+        echo "    port $1 is already used by another service (ss -tlnp)"
+        return 1
+    fi
+}
+
+free_port() {
+    p=$1
+    while port_in_use "$p"; do p=$((p + 1)); done
+    echo "$p"
+}
+
+# ask VAR "question" default [validator]: prompt on the terminal until valid.
 ask() {
+    check=${4:-valid_host}
     eval "current=\${$1}"
-    [ -z "$current" ] || { valid_host "$current" || die "$1=$current is not a valid domain name"; return 0; }
+    [ -z "$current" ] || { "$check" "$current" >&2 || die "invalid $1"; return 0; }
     if [ ! -t 0 ]; then
         echo "    no terminal, $1 defaults to $3 (set $1=... to choose)"
         eval "$1=\$3"
@@ -41,11 +69,10 @@ ask() {
         printf '%s [%s]: ' "$2" "$3"
         read -r answer || die "aborted"
         answer=${answer:-$3}
-        if valid_host "$answer"; then
+        if "$check" "$answer"; then
             eval "$1=\$answer"
             return 0
         fi
-        echo "    not a valid domain name: $answer"
     done
 }
 
@@ -71,6 +98,7 @@ fi
 # --- Questions (before the build, so nobody has to wait for it) -----------
 if [ ! -e "$CONF_DIR/movim.env" ]; then
     ask XMPP_DOMAIN "XMPP domain users log in with (MOVIM_DOMAIN)" example.org
+    ask MOVIM_PORT "Local port for Movim (behind nginx)" "$(free_port 8080)" valid_port
 fi
 if [ -d /etc/nginx/sites-available ] && [ ! -e /etc/nginx/sites-available/movim ]; then
     default_web=movim.${XMPP_DOMAIN:-example.org}
@@ -147,7 +175,7 @@ if [ ! -e "$CONF_DIR/movim.env" ]; then
 MOVIM_ROOT=$PREFIX
 MOVIM_DATA_DIR=$DATA_DIR
 # Listen on localhost only, behind a TLS reverse proxy (WebSocket on /ws/).
-MOVIM_BIND=127.0.0.1:8080
+MOVIM_BIND=127.0.0.1:$MOVIM_PORT
 # XMPP domain proposed on the login page.
 MOVIM_DOMAIN=$XMPP_DOMAIN
 # Comma separated XMPP domains allowed to log in (empty: all).
@@ -176,9 +204,7 @@ if [ -d /etc/nginx/sites-available ]; then
     if [ ! -e "$nginx_site" ]; then
         echo "    writing $nginx_site"
         sudo tee "$nginx_site" >/dev/null <<EOF
-# Movim behind nginx. Get the certificate first, e.g.
-#   sudo certbot certonly --nginx -d $WEB_HOST
-# or point ssl_certificate* to your own.
+# Movim behind nginx. Add your HTTPS settings (certificates, headers) below.
 server {
     listen 80;
     listen [::]:80;
@@ -192,8 +218,11 @@ server {
     http2 on;
     server_name $WEB_HOST;
 
-    ssl_certificate /etc/letsencrypt/live/$WEB_HOST/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/$WEB_HOST/privkey.pem;
+    # TODO: your HTTPS settings, e.g. include snippets/ssl.conf;
+    # Movim already sends X-Content-Type-Options, X-Frame-Options and
+    # Referrer-Policy on pages; if your file adds them too, hide Movim's to
+    # avoid duplicates (proxy_hide_header X-Frame-Options; ... in both
+    # locations below).
 
     # HTTP file uploads go through Movim, match your XMPP upload limit.
     client_max_body_size 100m;
@@ -274,7 +303,7 @@ echo "Installed. Not enabled or started; as admin:"
 echo "  1. check $CONF_DIR/movim.env"
 echo "  2. sudo systemctl enable --now movim"
 if [ -n "$nginx_site" ]; then
-    echo "  3. get a certificate for the nginx site ($nginx_site), then:"
+    echo "  3. add your HTTPS settings to $nginx_site (see the TODO), then:"
     echo "     sudo ln -s $nginx_site /etc/nginx/sites-enabled/movim"
     echo "     sudo nginx -t && sudo systemctl reload nginx"
 else