Marek Miklewicz
705 lines
22 KiB
Bash
Executable File
705 lines
22 KiB
Bash
Executable File
#!/bin/bash
|
||
# =============================================================================
|
||
# adminer_install.sh
|
||
# Instalacja i integracja Adminera z pluginem da-postgresql (DirectAdmin)
|
||
#
|
||
# Założenia bezpieczeństwa:
|
||
# - Adminer dostępny przez alias /adminer
|
||
# - Tryb public/private odczytywany runtime z /var/www/html/adminer/runtime/config.json
|
||
# - Tryb publiczny (ADMINER_PUBLIC=true) pozwala na ręczne logowanie do PostgreSQL
|
||
# - Tryb prywatny (ADMINER_PUBLIC=false) wymaga ticketu SSO z pluginu
|
||
# - Ticket SSO ma krótki TTL i jest przypięty do User-Agent
|
||
# - Logowanie odbywa się tymczasową rolą PostgreSQL tworzoną przez plugin
|
||
# =============================================================================
|
||
|
||
set -euo pipefail
|
||
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
CYAN='\033[0;36m'
|
||
BOLD='\033[1m'
|
||
NC='\033[0m'
|
||
|
||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||
sekcja() { echo -e "\n${BOLD}${CYAN}=== $* ===${NC}\n"; }
|
||
die() { echo -e "${RED}[BŁĄD]${NC} $*" >&2; exit 1; }
|
||
|
||
[[ $EUID -eq 0 ]] || die "Skrypt musi być uruchomiony jako root."
|
||
|
||
LOGFILE="/var/log/adminer_install_$(date +%Y%m%d_%H%M%S).log"
|
||
exec 1> >(tee >(sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' >> "$LOGFILE")) 2>&1
|
||
info "Pełny log zapisany w: $LOGFILE"
|
||
|
||
ADMINER_URL_PATH="/adminer"
|
||
ADMINER_VERSION="5.4.2"
|
||
ADMINER_FLAVOR="pgsql"
|
||
ADMINER_INSTALL_DIR="/var/www/html/adminer"
|
||
ADMINER_RUNTIME_DIR="${ADMINER_INSTALL_DIR}/runtime"
|
||
ADMINER_TICKETS_DIR="${ADMINER_RUNTIME_DIR}/tickets"
|
||
ADMINER_RUNTIME_CONFIG_FILE="${ADMINER_RUNTIME_DIR}/config.json"
|
||
ADMINER_CORE_FILE="${ADMINER_INSTALL_DIR}/adminer-core.php"
|
||
ADMINER_EXTENSION_FILE="${ADMINER_INSTALL_DIR}/adminer-extension.php"
|
||
ADMINER_INDEX_FILE="${ADMINER_INSTALL_DIR}/index.php"
|
||
PLUGIN_BUNDLED_ADMINER="/usr/local/directadmin/plugins/da-postgresql/assets/adminer/adminer-${ADMINER_VERSION}-${ADMINER_FLAVOR}.php"
|
||
PLUGIN_BUNDLED_ADMINER_SHA256="059505abc2b56487d78bbfbeb9485ed8c6a10fe357f4ddec9fc69b1043bff4af"
|
||
PLUGIN_BUNDLED_EXTENSION="/usr/local/directadmin/plugins/da-postgresql/assets/adminer/adminer-extension.php"
|
||
PLUGIN_BUNDLED_EXTENSION_SHA256="6e2f098b172838ccb3736506867396dc0954a6383fdd7b7c5e7739ab21baafeb"
|
||
|
||
CB_DIR="/usr/local/directadmin/custombuild"
|
||
CB_BUILD="${CB_DIR}/build"
|
||
APACHE_ALIAS_CUSTOM="${CB_DIR}/custom/ap2/conf/extra/httpd-alias.conf"
|
||
APACHE_ALIAS_SOURCE="/etc/httpd/conf/extra/httpd-alias.conf"
|
||
APACHE_ALIAS_CONFIGURE="${CB_DIR}/configure/ap2/conf/extra/httpd-alias.conf"
|
||
|
||
PLUGIN_SETTINGS="/usr/local/directadmin/plugins/da-postgresql/plugin-settings.conf"
|
||
PLUGIN_OWNER="diradmin:diradmin"
|
||
ADMINER_PUBLIC_DEFAULT="false"
|
||
ADMINER_PUBLIC_MODE="0"
|
||
|
||
detect_apache_group() {
|
||
local group_name=""
|
||
|
||
if [[ -f /etc/httpd/conf/httpd.conf ]]; then
|
||
group_name="$(awk 'tolower($1)=="group" {print $2; exit}' /etc/httpd/conf/httpd.conf | tr -d '[:space:]')"
|
||
fi
|
||
|
||
if [[ -z "$group_name" && -f /etc/apache2/apache2.conf ]]; then
|
||
group_name="$(awk 'tolower($1)=="group" {print $2; exit}' /etc/apache2/apache2.conf | tr -d '[:space:]')"
|
||
fi
|
||
|
||
if [[ -z "$group_name" ]]; then
|
||
for candidate in apache www-data nobody; do
|
||
if getent group "$candidate" >/dev/null 2>&1; then
|
||
group_name="$candidate"
|
||
break
|
||
fi
|
||
done
|
||
fi
|
||
|
||
[[ -n "$group_name" ]] || die "Nie można wykryć grupy użytkownika Apache."
|
||
echo "$group_name"
|
||
}
|
||
|
||
set_setting() {
|
||
local key="$1"
|
||
local value="$2"
|
||
local file="$3"
|
||
|
||
[[ -f "$file" ]] || return 0
|
||
sed -i "/^${key}=/d" "$file" || true
|
||
echo "${key}=${value}" >> "$file"
|
||
}
|
||
|
||
set_setting_if_missing() {
|
||
local key="$1"
|
||
local value="$2"
|
||
local file="$3"
|
||
|
||
[[ -f "$file" ]] || return 0
|
||
if grep -q "^${key}=" "$file"; then
|
||
return 0
|
||
fi
|
||
echo "${key}=${value}" >> "$file"
|
||
}
|
||
|
||
bool_is_true() {
|
||
local v
|
||
v="$(echo "${1:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
|
||
case "$v" in
|
||
1|true|yes|y|on|tak|t) return 0 ;;
|
||
*) return 1 ;;
|
||
esac
|
||
}
|
||
|
||
read_adminer_public_mode() {
|
||
local raw="$ADMINER_PUBLIC_DEFAULT"
|
||
if [[ -f "$PLUGIN_SETTINGS" ]]; then
|
||
local found
|
||
found="$(awk -F= '/^ADMINER_PUBLIC=/{print $2; exit}' "$PLUGIN_SETTINGS" | tr -d '[:space:]')"
|
||
if [[ -n "$found" ]]; then
|
||
raw="$found"
|
||
fi
|
||
fi
|
||
|
||
if bool_is_true "$raw"; then
|
||
ADMINER_PUBLIC_MODE="1"
|
||
else
|
||
ADMINER_PUBLIC_MODE="0"
|
||
fi
|
||
}
|
||
|
||
write_runtime_public_config() {
|
||
local public_json="false"
|
||
if [[ "$ADMINER_PUBLIC_MODE" == "1" ]]; then
|
||
public_json="true"
|
||
fi
|
||
|
||
cat > "$ADMINER_RUNTIME_CONFIG_FILE" <<EOF
|
||
{"version":1,"adminer_public":${public_json},"updated_at":$(date +%s)}
|
||
EOF
|
||
}
|
||
|
||
sha256_file() {
|
||
local path="$1"
|
||
if command -v sha256sum >/dev/null 2>&1; then
|
||
sha256sum "$path" | awk '{print $1}'
|
||
return 0
|
||
fi
|
||
|
||
if command -v shasum >/dev/null 2>&1; then
|
||
shasum -a 256 "$path" | awk '{print $1}'
|
||
return 0
|
||
fi
|
||
|
||
if command -v openssl >/dev/null 2>&1; then
|
||
openssl dgst -sha256 "$path" | awk '{print $NF}'
|
||
return 0
|
||
fi
|
||
|
||
return 1
|
||
}
|
||
|
||
render_adminer_wrapper() {
|
||
cat > "$ADMINER_INDEX_FILE" <<'PHPEOF'
|
||
<?php
|
||
declare(strict_types=1);
|
||
|
||
const DA_ADMINER_RUNTIME_DIR = '/var/www/html/adminer/runtime';
|
||
const DA_ADMINER_TICKETS_DIR = DA_ADMINER_RUNTIME_DIR . '/tickets';
|
||
const DA_ADMINER_CONFIG_FILE = DA_ADMINER_RUNTIME_DIR . '/config.json';
|
||
const DA_ADMINER_CORE_FILE = __DIR__ . '/adminer-core.php';
|
||
const DA_ADMINER_EXTENSION_FILE = __DIR__ . '/adminer-extension.php';
|
||
const DA_ADMINER_SESSION_KEY = 'da_adminer_auth';
|
||
const DA_ADMINER_SESSION_NAME = 'DA_POSTGRESQL_ADMINER';
|
||
const DA_ADMINER_PUBLIC_DEFAULT = __ADMINER_PUBLIC_MODE__;
|
||
|
||
header('X-Frame-Options: SAMEORIGIN');
|
||
header('X-Content-Type-Options: nosniff');
|
||
header('Referrer-Policy: no-referrer');
|
||
header('Cache-Control: no-store, no-cache, must-revalidate');
|
||
header('Pragma: no-cache');
|
||
|
||
session_name(DA_ADMINER_SESSION_NAME);
|
||
session_set_cookie_params([
|
||
'lifetime' => 0,
|
||
'path' => '/adminer',
|
||
'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
|
||
'httponly' => true,
|
||
'samesite' => 'Lax',
|
||
]);
|
||
session_start();
|
||
|
||
$now = time();
|
||
$adminerPublic = load_public_mode();
|
||
|
||
if (isset($_GET['logout'])) {
|
||
clear_session();
|
||
if (!$adminerPublic) {
|
||
render_placeholder('Sesja Adminera zostala zamknieta. Otworz Adminera ponownie z panelu DirectAdmin.');
|
||
}
|
||
}
|
||
|
||
$auth = null;
|
||
$ticketId = ticket_id_from_request();
|
||
if ($ticketId !== '') {
|
||
$ticketAccepted = false;
|
||
$ticketRejectReason = '';
|
||
$ticketBinding = '';
|
||
$ticket = load_ticket($ticketId);
|
||
if ($ticket !== null) {
|
||
$ticketBinding = isset($ticket['user_binding']) && is_string($ticket['user_binding']) ? $ticket['user_binding'] : '';
|
||
}
|
||
|
||
if ($ticket === null) {
|
||
$ticketRejectReason = 'ticket_missing_or_unreadable';
|
||
} elseif (validate_ticket($ticket, $now, $adminerPublic, $ticketRejectReason)) {
|
||
$auth = [
|
||
'host' => 'localhost',
|
||
'port' => (int)($ticket['port'] ?? 5432),
|
||
'user' => (string)($ticket['role'] ?? ''),
|
||
'password' => (string)($ticket['password'] ?? ''),
|
||
'database' => (string)($ticket['database'] ?? ''),
|
||
'expires_at' => (int)($ticket['session_expires_at'] ?? ($now + 900)),
|
||
];
|
||
$_SESSION[DA_ADMINER_SESSION_KEY] = $auth;
|
||
@unlink(ticket_path($ticketId));
|
||
clear_ticket_from_request();
|
||
$ticketAccepted = true;
|
||
}
|
||
|
||
debug_ticket_event($ticketId, $ticketAccepted, $ticketRejectReason, $ticketBinding, current_user_binding());
|
||
|
||
if (!$ticketAccepted && !$adminerPublic) {
|
||
render_placeholder('Nieprawidlowy lub wygasly link logowania. Otworz Adminera z poziomu pluginu.');
|
||
}
|
||
}
|
||
|
||
if ($auth === null) {
|
||
$auth = $_SESSION[DA_ADMINER_SESSION_KEY] ?? null;
|
||
}
|
||
if (!is_array($auth) || empty($auth['user']) || empty($auth['password'])) {
|
||
$auth = null;
|
||
if (!$adminerPublic) {
|
||
render_placeholder();
|
||
}
|
||
}
|
||
|
||
if ($auth !== null) {
|
||
$expiresAt = (int)($auth['expires_at'] ?? 0);
|
||
if ($expiresAt <= 0 || $expiresAt < $now) {
|
||
clear_session();
|
||
$auth = null;
|
||
if (!$adminerPublic) {
|
||
render_placeholder('Sesja Adminera wygasla. Otworz Adminera ponownie z poziomu pluginu.');
|
||
}
|
||
}
|
||
}
|
||
|
||
if (has_forbidden_driver_params()) {
|
||
clear_session();
|
||
http_response_code(403);
|
||
render_placeholder('Dozwolony jest tylko sterownik PostgreSQL.');
|
||
}
|
||
|
||
$_GET['pgsql'] = 'localhost';
|
||
|
||
if ($auth !== null) {
|
||
bootstrap_adminer_session($auth);
|
||
unset($_POST['auth']);
|
||
} else {
|
||
normalize_post_auth();
|
||
}
|
||
$GLOBALS['da_adminer_sso_auth'] = $auth;
|
||
|
||
require DA_ADMINER_EXTENSION_FILE;
|
||
require DA_ADMINER_CORE_FILE;
|
||
exit;
|
||
|
||
function ticket_id_from_request(): string
|
||
{
|
||
$ticket = $_GET['ticket'] ?? '';
|
||
if (!is_string($ticket)) {
|
||
return '';
|
||
}
|
||
$ticket = trim($ticket);
|
||
if ($ticket === '' || !preg_match('/^[A-Za-z0-9_-]{20,128}$/', $ticket)) {
|
||
return '';
|
||
}
|
||
return $ticket;
|
||
}
|
||
|
||
function ticket_path(string $ticketId): string
|
||
{
|
||
return DA_ADMINER_TICKETS_DIR . '/' . $ticketId . '.json';
|
||
}
|
||
|
||
function clear_ticket_from_request(): void
|
||
{
|
||
unset($_GET['ticket']);
|
||
|
||
$uri = $_SERVER['REQUEST_URI'] ?? '';
|
||
if (!is_string($uri) || $uri === '') {
|
||
return;
|
||
}
|
||
|
||
$parts = parse_url($uri);
|
||
if (!is_array($parts)) {
|
||
return;
|
||
}
|
||
|
||
$path = isset($parts['path']) && is_string($parts['path']) ? $parts['path'] : '/adminer';
|
||
$query = [];
|
||
if (isset($parts['query']) && is_string($parts['query']) && $parts['query'] !== '') {
|
||
parse_str($parts['query'], $query);
|
||
if (is_array($query)) {
|
||
unset($query['ticket']);
|
||
} else {
|
||
$query = [];
|
||
}
|
||
}
|
||
|
||
$newQuery = http_build_query($query);
|
||
$_SERVER['REQUEST_URI'] = $path . ($newQuery !== '' ? ('?' . $newQuery) : '');
|
||
}
|
||
|
||
function load_ticket(string $ticketId): ?array
|
||
{
|
||
$path = ticket_path($ticketId);
|
||
if (!is_file($path) || !is_readable($path)) {
|
||
return null;
|
||
}
|
||
|
||
$raw = @file_get_contents($path);
|
||
if (!is_string($raw) || $raw === '') {
|
||
return null;
|
||
}
|
||
|
||
$decoded = json_decode($raw, true);
|
||
return is_array($decoded) ? $decoded : null;
|
||
}
|
||
|
||
function load_public_mode(): bool
|
||
{
|
||
$default = (DA_ADMINER_PUBLIC_DEFAULT === 1);
|
||
if (!is_file(DA_ADMINER_CONFIG_FILE) || !is_readable(DA_ADMINER_CONFIG_FILE)) {
|
||
return $default;
|
||
}
|
||
|
||
$raw = @file_get_contents(DA_ADMINER_CONFIG_FILE);
|
||
if (!is_string($raw) || $raw === '') {
|
||
return $default;
|
||
}
|
||
|
||
$decoded = json_decode($raw, true);
|
||
if (!is_array($decoded) || !array_key_exists('adminer_public', $decoded)) {
|
||
return $default;
|
||
}
|
||
|
||
return parse_bool_value($decoded['adminer_public'], $default);
|
||
}
|
||
|
||
function parse_bool_value($value, bool $default = false): bool
|
||
{
|
||
if (is_bool($value)) {
|
||
return $value;
|
||
}
|
||
if (is_int($value) || is_float($value)) {
|
||
return ((int)$value) !== 0;
|
||
}
|
||
if (!is_string($value)) {
|
||
return $default;
|
||
}
|
||
|
||
$normalized = strtolower(trim($value));
|
||
if (in_array($normalized, ['1', 'true', 'yes', 'y', 'on', 'tak', 't'], true)) {
|
||
return true;
|
||
}
|
||
if (in_array($normalized, ['0', 'false', 'no', 'n', 'off', 'nie'], true)) {
|
||
return false;
|
||
}
|
||
|
||
return $default;
|
||
}
|
||
|
||
function validate_ticket(array $ticket, int $now, bool $adminerPublic, string &$reason = ''): bool
|
||
{
|
||
$required = ['role', 'password', 'database', 'host', 'port', 'expires_at', 'session_expires_at', 'user_binding'];
|
||
foreach ($required as $key) {
|
||
if (!array_key_exists($key, $ticket)) {
|
||
$reason = 'missing_key:' . $key;
|
||
return false;
|
||
}
|
||
}
|
||
|
||
$expiresAt = is_numeric($ticket['expires_at']) ? (int)$ticket['expires_at'] : 0;
|
||
if ($expiresAt < $now) {
|
||
$reason = 'ticket_expired';
|
||
return false;
|
||
}
|
||
|
||
$sessionExpiresAt = is_numeric($ticket['session_expires_at']) ? (int)$ticket['session_expires_at'] : 0;
|
||
if ($sessionExpiresAt < $now) {
|
||
$reason = 'session_expired';
|
||
return false;
|
||
}
|
||
|
||
$role = (string)$ticket['role'];
|
||
if ($role === '' || !preg_match('/^[a-z0-9_]{1,63}$/', $role)) {
|
||
$reason = 'invalid_role';
|
||
return false;
|
||
}
|
||
|
||
$binding = (string)$ticket['user_binding'];
|
||
if (!is_binding_valid($binding, current_user_binding(), $adminerPublic)) {
|
||
$reason = 'binding_mismatch';
|
||
return false;
|
||
}
|
||
|
||
$reason = 'ok';
|
||
return true;
|
||
}
|
||
|
||
function current_user_binding(): string
|
||
{
|
||
$ua = (string)($_SERVER['HTTP_USER_AGENT'] ?? '');
|
||
return hash('sha256', $ua);
|
||
}
|
||
|
||
function is_binding_valid(string $ticketBinding, string $currentBinding, bool $adminerPublic): bool
|
||
{
|
||
if ($adminerPublic) {
|
||
return true;
|
||
}
|
||
|
||
if ($ticketBinding === '') {
|
||
return false;
|
||
}
|
||
|
||
if (hash_equals($ticketBinding, $currentBinding)) {
|
||
return true;
|
||
}
|
||
|
||
// Kompatybilność: starsze ticket-y mogły być wystawione bez HTTP_USER_AGENT po stronie DA.
|
||
$legacyNoUaBinding = hash('sha256', '');
|
||
if (hash_equals($ticketBinding, $legacyNoUaBinding)) {
|
||
return true;
|
||
}
|
||
|
||
return false;
|
||
}
|
||
|
||
function debug_ticket_event(
|
||
string $ticketId,
|
||
bool $accepted,
|
||
string $reason,
|
||
string $ticketBinding,
|
||
string $currentBinding
|
||
): void {
|
||
$line = sprintf(
|
||
"[%s] ticket=%s accepted=%s reason=%s ticket_binding=%s current_binding=%s remote=%s ua=%s\n",
|
||
date('c'),
|
||
$ticketId,
|
||
$accepted ? '1' : '0',
|
||
$reason !== '' ? $reason : 'n/a',
|
||
$ticketBinding !== '' ? $ticketBinding : '-',
|
||
$currentBinding !== '' ? $currentBinding : '-',
|
||
(string)($_SERVER['REMOTE_ADDR'] ?? '-'),
|
||
(string)($_SERVER['HTTP_USER_AGENT'] ?? '-')
|
||
);
|
||
|
||
@error_log($line, 3, '/tmp/da_adminer_wrapper_debug.log');
|
||
}
|
||
|
||
function has_forbidden_driver_params(): bool
|
||
{
|
||
$forbidden = ['server', 'sqlite', 'mongo', 'mssql', 'oracle', 'elastic', 'clickhouse'];
|
||
foreach ($forbidden as $key) {
|
||
if (isset($_GET[$key])) {
|
||
return true;
|
||
}
|
||
}
|
||
return false;
|
||
}
|
||
|
||
function bootstrap_adminer_session(array $auth): void
|
||
{
|
||
$driver = 'pgsql';
|
||
$server = 'localhost';
|
||
$user = trim((string)($auth['user'] ?? ''));
|
||
$password = (string)($auth['password'] ?? '');
|
||
$database = trim((string)($auth['database'] ?? ''));
|
||
|
||
if ($user === '' || $password === '') {
|
||
return;
|
||
}
|
||
|
||
$_GET[$driver] = $server;
|
||
$_GET['username'] = $user;
|
||
if ($database !== '' && (!isset($_GET['db']) || !is_string($_GET['db']) || $_GET['db'] === '')) {
|
||
$_GET['db'] = $database;
|
||
}
|
||
|
||
$_SESSION['pwds'][$driver][$server][$user] = $password;
|
||
if ($database !== '') {
|
||
$_SESSION['db'][$driver][$server][$user][$database] = true;
|
||
}
|
||
}
|
||
|
||
function normalize_post_auth(): void
|
||
{
|
||
if (!isset($_POST['auth']) || !is_array($_POST['auth'])) {
|
||
return;
|
||
}
|
||
|
||
$_POST['auth']['driver'] = 'pgsql';
|
||
$_POST['auth']['server'] = 'localhost';
|
||
}
|
||
|
||
function clear_session(): void
|
||
{
|
||
$_SESSION = [];
|
||
if (session_status() === PHP_SESSION_ACTIVE) {
|
||
session_unset();
|
||
session_destroy();
|
||
}
|
||
}
|
||
|
||
function render_placeholder(string $extra = ''): void
|
||
{
|
||
http_response_code(200);
|
||
$message = 'Dostep do Adminera jest mozliwy wylacznie z poziomu panelu DirectAdmin.';
|
||
echo '<!doctype html><html lang="pl"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">';
|
||
echo '<title>Adminer - DirectAdmin</title>';
|
||
echo '<style>body{margin:0;background:#f5f7fb;color:#1f2937;font:16px/1.5 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif}';
|
||
echo '.wrap{max-width:760px;margin:10vh auto;padding:24px}';
|
||
echo '.card{background:#fff;border:1px solid #d7dfeb;border-radius:12px;padding:26px;box-shadow:0 6px 22px rgba(18,38,63,.08)}';
|
||
echo 'h1{margin:0 0 12px;font-size:24px}p{margin:0 0 10px}.muted{color:#52607a;font-size:14px}</style></head><body>';
|
||
echo '<div class="wrap"><div class="card"><h1>Adminer</h1><p>' . htmlspecialchars($message, ENT_QUOTES, 'UTF-8') . '</p>';
|
||
if ($extra !== '') {
|
||
echo '<p class="muted">' . htmlspecialchars($extra, ENT_QUOTES, 'UTF-8') . '</p>';
|
||
}
|
||
echo '<p class="muted">W panelu pluginu PostgreSQL kliknij przycisk "Adminer", aby otworzyc sesje SSO.</p></div></div></body></html>';
|
||
exit;
|
||
}
|
||
PHPEOF
|
||
|
||
sed -i "s/__ADMINER_PUBLIC_MODE__/${ADMINER_PUBLIC_MODE}/g" "$ADMINER_INDEX_FILE"
|
||
}
|
||
|
||
configure_apache_alias() {
|
||
[[ -d "$CB_DIR" ]] || die "Brak katalogu CustomBuild: ${CB_DIR}"
|
||
mkdir -p "$(dirname "$APACHE_ALIAS_CUSTOM")"
|
||
|
||
if [[ ! -f "$APACHE_ALIAS_CUSTOM" ]]; then
|
||
if [[ -f "$APACHE_ALIAS_SOURCE" ]]; then
|
||
cp -p "$APACHE_ALIAS_SOURCE" "$APACHE_ALIAS_CUSTOM"
|
||
elif [[ -f "$APACHE_ALIAS_CONFIGURE" ]]; then
|
||
cp -p "$APACHE_ALIAS_CONFIGURE" "$APACHE_ALIAS_CUSTOM"
|
||
else
|
||
warn "Nie znaleziono źródłowego httpd-alias.conf – tworzę pusty custom template."
|
||
: > "$APACHE_ALIAS_CUSTOM"
|
||
fi
|
||
fi
|
||
|
||
local tmp_file
|
||
tmp_file="$(mktemp)"
|
||
awk '
|
||
BEGIN { skip = 0 }
|
||
/^# BEGIN DA_POSTGRESQL_ADMINER$/ { skip = 1; next }
|
||
/^# END DA_POSTGRESQL_ADMINER$/ { skip = 0; next }
|
||
skip == 0 { print }
|
||
' "$APACHE_ALIAS_CUSTOM" > "$tmp_file"
|
||
|
||
cat >> "$tmp_file" <<EOF
|
||
|
||
# BEGIN DA_POSTGRESQL_ADMINER
|
||
Alias ${ADMINER_URL_PATH} ${ADMINER_INSTALL_DIR}/index.php
|
||
Alias ${ADMINER_URL_PATH}/ ${ADMINER_INSTALL_DIR}/index.php
|
||
|
||
<Directory "${ADMINER_INSTALL_DIR}">
|
||
AllowOverride None
|
||
Options -Indexes
|
||
Require all granted
|
||
<FilesMatch "^adminer-(core|extension)\.php$">
|
||
Require all denied
|
||
</FilesMatch>
|
||
</Directory>
|
||
|
||
<Directory "${ADMINER_RUNTIME_DIR}">
|
||
AllowOverride None
|
||
Options -Indexes
|
||
Require all denied
|
||
</Directory>
|
||
# END DA_POSTGRESQL_ADMINER
|
||
EOF
|
||
|
||
mv "$tmp_file" "$APACHE_ALIAS_CUSTOM"
|
||
chmod 644 "$APACHE_ALIAS_CUSTOM"
|
||
}
|
||
|
||
sekcja "Weryfikacja środowiska"
|
||
command -v php >/dev/null 2>&1 || die "Brak polecenia php."
|
||
id diradmin >/dev/null 2>&1 || die "Brak użytkownika diradmin."
|
||
|
||
APACHE_GROUP="$(detect_apache_group)"
|
||
info "Wykryta grupa Apache: ${APACHE_GROUP}"
|
||
read_adminer_public_mode
|
||
if [[ "$ADMINER_PUBLIC_MODE" == "1" ]]; then
|
||
info "Tryb ADMINER_PUBLIC: true (bezpośredni dostęp do /adminer bez SSO)."
|
||
else
|
||
info "Tryb ADMINER_PUBLIC: false (dostęp wyłącznie przez SSO z pluginu)."
|
||
fi
|
||
|
||
sekcja "Instalacja z bundla Adminera ${ADMINER_VERSION}-${ADMINER_FLAVOR}"
|
||
mkdir -p "$ADMINER_INSTALL_DIR"
|
||
[[ -f "$PLUGIN_BUNDLED_ADMINER" ]] || die "Brak zbundlowanego pliku Adminera: ${PLUGIN_BUNDLED_ADMINER}"
|
||
[[ -f "$PLUGIN_BUNDLED_EXTENSION" ]] || die "Brak zbundlowanego rozszerzenia Adminera: ${PLUGIN_BUNDLED_EXTENSION}"
|
||
|
||
EXPECTED_SUM="$PLUGIN_BUNDLED_ADMINER_SHA256"
|
||
ACTUAL_SUM="$(sha256_file "$PLUGIN_BUNDLED_ADMINER" || true)"
|
||
[[ -n "$ACTUAL_SUM" ]] || die "Nie można policzyć SHA256 dla ${PLUGIN_BUNDLED_ADMINER}."
|
||
[[ "$ACTUAL_SUM" == "$EXPECTED_SUM" ]] \
|
||
|| die "Niezgodna suma SHA256 dla zbundlowanego Adminera. Oczekiwano: ${EXPECTED_SUM}, otrzymano: ${ACTUAL_SUM}"
|
||
|
||
cp -f "$PLUGIN_BUNDLED_ADMINER" "$ADMINER_CORE_FILE"
|
||
info "Adminer ${ADMINER_VERSION}-${ADMINER_FLAVOR} skopiowany do: ${ADMINER_CORE_FILE}"
|
||
|
||
EXPECTED_EXTENSION_SUM="$PLUGIN_BUNDLED_EXTENSION_SHA256"
|
||
ACTUAL_EXTENSION_SUM="$(sha256_file "$PLUGIN_BUNDLED_EXTENSION" || true)"
|
||
[[ -n "$ACTUAL_EXTENSION_SUM" ]] || die "Nie można policzyć SHA256 dla ${PLUGIN_BUNDLED_EXTENSION}."
|
||
[[ "$ACTUAL_EXTENSION_SUM" == "$EXPECTED_EXTENSION_SUM" ]] \
|
||
|| die "Niezgodna suma SHA256 dla zbundlowanego rozszerzenia Adminera. Oczekiwano: ${EXPECTED_EXTENSION_SUM}, otrzymano: ${ACTUAL_EXTENSION_SUM}"
|
||
|
||
cp -f "$PLUGIN_BUNDLED_EXTENSION" "$ADMINER_EXTENSION_FILE"
|
||
info "Rozszerzenie Adminera skopiowane do: ${ADMINER_EXTENSION_FILE}"
|
||
|
||
sekcja "Konfiguracja wrappera bezpieczeństwa"
|
||
mkdir -p "$ADMINER_RUNTIME_DIR" "$ADMINER_TICKETS_DIR"
|
||
render_adminer_wrapper
|
||
|
||
chown root:root "$ADMINER_INSTALL_DIR"
|
||
chmod 755 "$ADMINER_INSTALL_DIR"
|
||
|
||
chown root:root "$ADMINER_CORE_FILE" "$ADMINER_EXTENSION_FILE" "$ADMINER_INDEX_FILE"
|
||
chmod 644 "$ADMINER_CORE_FILE" "$ADMINER_EXTENSION_FILE" "$ADMINER_INDEX_FILE"
|
||
|
||
chown diradmin:"$APACHE_GROUP" "$ADMINER_RUNTIME_DIR" "$ADMINER_TICKETS_DIR"
|
||
chmod 711 "$ADMINER_RUNTIME_DIR"
|
||
chmod 2733 "$ADMINER_TICKETS_DIR"
|
||
|
||
write_runtime_public_config
|
||
chown diradmin:"$APACHE_GROUP" "$ADMINER_RUNTIME_CONFIG_FILE"
|
||
chmod 644 "$ADMINER_RUNTIME_CONFIG_FILE"
|
||
|
||
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
|
||
warn "Wykryto SELinux: ustawiam kontekst zapisu runtime dla Apache."
|
||
if command -v chcon >/dev/null 2>&1; then
|
||
chcon -R -t httpd_sys_rw_content_t "$ADMINER_RUNTIME_DIR" || warn "Nie udało się ustawić kontekstu SELinux dla runtime."
|
||
chcon -t httpd_sys_content_t "$ADMINER_CORE_FILE" "$ADMINER_EXTENSION_FILE" "$ADMINER_INDEX_FILE" || warn "Nie udało się ustawić kontekstu SELinux dla plików PHP."
|
||
else
|
||
warn "Brak chcon - ustaw kontekst SELinux ręcznie."
|
||
fi
|
||
fi
|
||
|
||
sekcja "Konfiguracja aliasu /adminer (DirectAdmin CustomBuild)"
|
||
configure_apache_alias
|
||
|
||
if [[ -x "$CB_BUILD" ]]; then
|
||
(cd "$CB_DIR" && ./build rewrite_confs) \
|
||
|| die "rewrite_confs zakończył się błędem."
|
||
info "rewrite_confs wykonane pomyślnie."
|
||
else
|
||
warn "Brak ${CB_BUILD} - uruchom ręcznie: cd ${CB_DIR} && ./build rewrite_confs"
|
||
fi
|
||
|
||
if systemctl is-active --quiet httpd 2>/dev/null; then
|
||
systemctl reload httpd || warn "Nie udało się przeładować httpd."
|
||
fi
|
||
|
||
sekcja "Aktualizacja ustawień pluginu"
|
||
if [[ -f "$PLUGIN_SETTINGS" ]]; then
|
||
set_setting "ENABLE_ADMINER" "true" "$PLUGIN_SETTINGS"
|
||
set_setting_if_missing "ADMINER_PUBLIC" "false" "$PLUGIN_SETTINGS"
|
||
set_setting_if_missing "ADMINER_PUBLIC_BASE_URL" "" "$PLUGIN_SETTINGS"
|
||
set_setting "ADMINER_URL_PATH" "$ADMINER_URL_PATH" "$PLUGIN_SETTINGS"
|
||
set_setting "ADMINER_SSO_DIR" "$ADMINER_RUNTIME_DIR" "$PLUGIN_SETTINGS"
|
||
set_setting "ADMINER_TICKET_TTL" "120" "$PLUGIN_SETTINGS"
|
||
set_setting "ADMINER_SESSION_TTL" "900" "$PLUGIN_SETTINGS"
|
||
set_setting "ADMINER_ROLE_TTL" "1200" "$PLUGIN_SETTINGS"
|
||
chown "$PLUGIN_OWNER" "$PLUGIN_SETTINGS" 2>/dev/null || true
|
||
chmod 640 "$PLUGIN_SETTINGS" 2>/dev/null || true
|
||
info "Zaktualizowano: ${PLUGIN_SETTINGS}"
|
||
else
|
||
warn "Nie znaleziono pliku ${PLUGIN_SETTINGS} - ustawienia pluginu pominięte."
|
||
fi
|
||
|
||
sekcja "Instalacja zakończona"
|
||
echo "Adminer URL: ${ADMINER_URL_PATH}"
|
||
echo "Katalog: ${ADMINER_INSTALL_DIR}"
|
||
echo "Runtime ticketów: ${ADMINER_TICKETS_DIR}"
|
||
echo "Runtime config: ${ADMINER_RUNTIME_CONFIG_FILE}"
|
||
echo "Alias template: ${APACHE_ALIAS_CUSTOM}"
|
||
echo "Log: ${LOGFILE}"
|