mirror of
https://github.com/ether/etherpad-lite.git
synced 2026-07-17 16:47:05 +00:00
6bb879ed03
* feat(packaging): add Debian (.deb) build via nfpm with systemd unit First-class Debian packaging for Etherpad, producing signed-ready etherpad-lite_<version>_<arch>.deb artefacts for amd64 and arm64 from a single nfpm manifest. Installing the package gives users: - /opt/etherpad-lite with a prebuilt, self-contained node_modules/ — no pnpm required at runtime, just `nodejs (>= 20)`. - etherpad system user/group, created via `adduser` in preinst. - /etc/etherpad-lite/settings.json seeded from the template on first install, preserved across upgrades, removed on `purge`. - /var/lib/etherpad-lite owned by etherpad:etherpad, with the default dirty-DB retargeted there so ProtectSystem=strict works. - /lib/systemd/system/etherpad-lite.service — hardened unit (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, RestrictAddressFamilies) with Restart=on-failure. - /usr/bin/etherpad-lite CLI wrapper running `node --import tsx/esm`. CI (.github/workflows/deb-package.yml) triggers on v* tags, builds both arches via native runners (ubuntu-latest + ubuntu-24.04-arm), smoke-tests the amd64 package end-to-end (install → systemctl start → curl /health → purge → confirm user removed), and attaches the artefacts to the GitHub Release. Publishing to an APT repo (Cloudsmith, Launchpad PPA, self-hosted reprepro) is intentionally out of scope — needs a governance decision on who holds the signing key. Recipes are documented in packaging/README.md. Refs #7529 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(deb): fail smoke test on /health timeout, tighten default-file perms, 2-space indent Addresses Qodo review feedback on #7559: 1. Smoke test false-positive: the `for` loop polling /health never failed the job if the endpoint stayed down — `curl && break || sleep 2` keeps returning 0 from the trailing `sleep`, so `set -e` never trips. CI could attach a broken .deb to a release. Fix: track success explicitly and exit 1 (plus dump journald logs for diagnostics) when the service never becomes healthy. 2. /etc/default/etherpad-lite was world-readable (0644). systemd loads it via `EnvironmentFile=…`, and Etherpad supports ${ENV_VAR}-substitution for secrets (DB_PASSWORD etc.), so any local user could read anything admins drop there. Fix: install the conffile as root:etherpad 0640 — only root and the service user can read it. 3. Indentation: reflow maintainer scripts from 4-space to 2-space to match the repo style rule. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
68 lines
2.1 KiB
Bash
Executable file
68 lines
2.1 KiB
Bash
Executable file
#!/bin/sh
|
|
# postinstall - runs after files have been unpacked.
|
|
# Debian actions: configure | abort-upgrade | abort-remove | abort-deconfigure
|
|
set -e
|
|
|
|
ETC_DIR=/etc/etherpad-lite
|
|
VAR_DIR=/var/lib/etherpad-lite
|
|
LOG_DIR=/var/log/etherpad-lite
|
|
APP_DIR=/opt/etherpad-lite
|
|
DIST_SETTINGS=/usr/share/etherpad-lite/settings.json.dist
|
|
ACTIVE_SETTINGS="${ETC_DIR}/settings.json"
|
|
|
|
case "$1" in
|
|
configure)
|
|
mkdir -p "${ETC_DIR}" "${VAR_DIR}" "${LOG_DIR}"
|
|
chown root:etherpad "${ETC_DIR}"
|
|
chmod 0750 "${ETC_DIR}"
|
|
chown etherpad:etherpad "${VAR_DIR}" "${LOG_DIR}"
|
|
chmod 0750 "${VAR_DIR}" "${LOG_DIR}"
|
|
|
|
if [ ! -e "${ACTIVE_SETTINGS}" ]; then
|
|
cp "${DIST_SETTINGS}" "${ACTIVE_SETTINGS}"
|
|
# Point the default dirty-DB at /var/lib so ProtectSystem=strict works.
|
|
sed -i \
|
|
's|"filename": "var/dirty.db"|"filename": "/var/lib/etherpad-lite/dirty.db"|' \
|
|
"${ACTIVE_SETTINGS}"
|
|
chown root:etherpad "${ACTIVE_SETTINGS}"
|
|
chmod 0640 "${ACTIVE_SETTINGS}"
|
|
fi
|
|
|
|
# Etherpad reads settings.json from CWD (/opt/etherpad-lite). Expose
|
|
# the /etc copy there via symlink.
|
|
ln -sfn "${ACTIVE_SETTINGS}" "${APP_DIR}/settings.json"
|
|
|
|
if [ -d "${APP_DIR}/var" ]; then
|
|
chown -R etherpad:etherpad "${APP_DIR}/var" || true
|
|
fi
|
|
|
|
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload || true
|
|
# Enable on first install; leave state alone on upgrade.
|
|
if [ -z "$2" ]; then
|
|
systemctl enable etherpad-lite.service >/dev/null 2>&1 || true
|
|
fi
|
|
# Restart on upgrade to pick up new code (skip on fresh install --
|
|
# admin may want to configure first).
|
|
if [ -n "$2" ]; then
|
|
systemctl try-restart etherpad-lite.service >/dev/null 2>&1 || true
|
|
fi
|
|
fi
|
|
|
|
cat <<EOF
|
|
Etherpad installed. Edit /etc/etherpad-lite/settings.json, then:
|
|
sudo systemctl start etherpad-lite
|
|
Default port 9001. Service logs: journalctl -u etherpad-lite -f
|
|
EOF
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinstall called with unknown argument: $1" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit 0
|