From 60f0a037a76380e81bb38640f47e32ac461bd986 Mon Sep 17 00:00:00 2001
From: MickLesk <mickey.leskowitz@gmail.com>
Date: Fri, 14 Aug 2026 09:15:48 +0200
Subject: [PATCH] powerdns: move poweradmin database outside the web root

---
 ct/powerdns.sh              | 17 ++++++++++++++---
 install/powerdns-install.sh | 15 ++++++++-------
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/ct/powerdns.sh b/ct/powerdns.sh
index a41fec84c..4d445eba0 100644
--- a/ct/powerdns.sh
+++ b/ct/powerdns.sh
@@ -30,13 +30,26 @@ function update_script() {
     exit
   fi
 
+  if [[ -f /opt/poweradmin/powerdns.db ]]; then
+    msg_info "Moving PowerDNS database out of the web root"
+    systemctl stop pdns apache2
+    mkdir -p /var/lib/powerdns
+    mv /opt/poweradmin/powerdns.db /var/lib/powerdns/powerdns.db
+    sed -i 's#/opt/poweradmin/powerdns.db#/var/lib/powerdns/powerdns.db#' \
+      /etc/powerdns/pdns.d/gsqlite3.conf /opt/poweradmin/config/settings.php
+    chown pdns:pdns /var/lib/powerdns/powerdns.db
+    chmod 664 /var/lib/powerdns/powerdns.db
+    systemctl start pdns apache2
+    msg_ok "Moved PowerDNS database out of the web root"
+  fi
+
   msg_info "Updating PowerDNS"
   $STD apt update
   $STD apt install -y --only-upgrade pdns-server pdns-backend-sqlite3
   msg_ok "Updated PowerDNS"
 
   if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    create_backup /opt/poweradmin/config/settings.php
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
@@ -46,8 +59,6 @@ function update_script() {
     rm -rf /opt/poweradmin/install
     chown -R www-data:pdns /opt/poweradmin
     chmod 775 /opt/poweradmin
-    chown pdns:pdns /opt/poweradmin/powerdns.db
-    chmod 664 /opt/poweradmin/powerdns.db
     msg_ok "Updated Poweradmin"
 
     msg_info "Restarting Services"
diff --git a/install/powerdns-install.sh b/install/powerdns-install.sh
index 021056d9c..904a43b1c 100644
--- a/install/powerdns-install.sh
+++ b/install/powerdns-install.sh
@@ -40,24 +40,25 @@ $STD apt install -y \
   pdns-backend-sqlite3
 sed -i 's/^launch=$/# launch=/' /etc/powerdns/pdns.conf
 rm -f /etc/powerdns/pdns.d/bind.conf
+mkdir -p /var/lib/powerdns
 cat <<EOF >/etc/powerdns/pdns.d/gsqlite3.conf
 launch=gsqlite3
-gsqlite3-database=/opt/poweradmin/powerdns.db
+gsqlite3-database=/var/lib/powerdns/powerdns.db
 EOF
 msg_ok "Setup PowerDNS"
 
 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
 msg_info "Setting up Poweradmin"
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
 PA_ADMIN_USERNAME="admin"
 PA_ADMIN_EMAIL="admin@example.com"
 PA_ADMIN_FULLNAME="Administrator"
 PA_ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d "=+/" | cut -c1-16)
 PA_SESSION_KEY=$(openssl rand -base64 75 | tr -dc 'A-Za-z0-9^@#!(){}[]%_\-+=~' | head -c 50)
 PASSWORD_HASH=$(php -r "echo password_hash(\$argv[1], PASSWORD_DEFAULT);" -- "${PA_ADMIN_PASSWORD}" 2>/dev/null)
-sqlite3 /opt/poweradmin/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
+sqlite3 /var/lib/powerdns/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
   VALUES ('$(escape_sql "${PA_ADMIN_USERNAME}")', '$(escape_sql "${PASSWORD_HASH}")', '$(escape_sql "${PA_ADMIN_FULLNAME}")', \
   '$(escape_sql "${PA_ADMIN_EMAIL}")', 'System Administrator', 1, 1, 0);"
 
@@ -81,7 +82,7 @@ return [
      */
     'database' => [
         'type' => 'sqlite',
-        'file' => '/opt/poweradmin/powerdns.db',
+        'file' => '/var/lib/powerdns/powerdns.db',
     ],
 
     /**
@@ -133,8 +134,8 @@ EOF
 $STD a2enmod rewrite headers
 chown -R www-data:pdns /opt/poweradmin
 chmod 775 /opt/poweradmin
-chown pdns:pdns /opt/poweradmin/powerdns.db
-chmod 664 /opt/poweradmin/powerdns.db
+chown pdns:pdns /var/lib/powerdns/powerdns.db
+chmod 664 /var/lib/powerdns/powerdns.db
 usermod -aG pdns www-data
 $STD systemctl restart pdns apache2
 msg_ok "Created Service"