diff --git a/ct/homeassistant.sh b/ct/homeassistant.sh index 7d30d82e4..68e59eaa3 100644 --- a/ct/homeassistant.sh +++ b/ct/homeassistant.sh @@ -70,32 +70,7 @@ function update_script() { exit fi if [ "$UPD" == "4" ]; then - msg_info "Installing FileBrowser" - RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g') - $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin - $STD filebrowser config init -a '0.0.0.0' - $STD filebrowser config set -a '0.0.0.0' - $STD filebrowser users add admin community-scripts.org --perm.admin - msg_ok "Installed FileBrowser" - - msg_info "Creating Service" - service_path="/etc/systemd/system/filebrowser.service" - echo "[Unit] -Description=Filebrowser -After=network-online.target -[Service] -User=root -WorkingDirectory=/root/ -ExecStart=/usr/local/bin/filebrowser -r / -[Install] -WantedBy=default.target" >$service_path - - $STD systemctl enable --now filebrowser - msg_ok "Created Service" - - msg_ok "Completed successfully!\n" - echo -e "FileBrowser should be reachable by going to the following URL. - ${BL}http://$LOCAL_IP:8080${CL} admin|community-scripts.org\n" + bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)" exit fi } diff --git a/ct/podman-homeassistant.sh b/ct/podman-homeassistant.sh index a3a569dab..552fc2393 100644 --- a/ct/podman-homeassistant.sh +++ b/ct/podman-homeassistant.sh @@ -66,33 +66,7 @@ function update_script() { exit fi if [ "$UPD" == "3" ]; then - msg_info "Installing FileBrowser" - $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash - $STD filebrowser config init -a '0.0.0.0' - $STD filebrowser config set -a '0.0.0.0' - $STD filebrowser users add admin community-scripts.org --perm.admin - msg_ok "Installed FileBrowser" - - msg_info "Creating Service" - cat </etc/systemd/system/filebrowser.service -[Unit] -Description=Filebrowser -After=network-online.target - -[Service] -User=root -WorkingDirectory=/root/ -ExecStart=/usr/local/bin/filebrowser -r / - -[Install] -WantedBy=default.target -EOF - systemctl enable -q --now filebrowser - msg_ok "Created Service" - - msg_ok "Completed successfully!\n" - echo -e "FileBrowser should be reachable by going to the following URL. - ${BL}http://$LOCAL_IP:8080${CL} admin|community-scripts.org\n" + bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)" exit fi if [ "$UPD" == "4" ]; then diff --git a/install/archivebox-install.sh b/install/archivebox-install.sh index 31c836588..f60249b82 100644 --- a/install/archivebox-install.sh +++ b/install/archivebox-install.sh @@ -48,6 +48,7 @@ chown -R archivebox:archivebox /opt/archivebox/{data,.npm,.cache,.local} chmod -R 755 /opt/archivebox/data $STD uv pip install archivebox --system --break-system-packages cd /opt/archivebox/data +ADMIN_PASS=$(random_password 20) expect <~/archivebox.creds msg_ok "Installed ArchiveBox" msg_info "Creating Service" diff --git a/install/authelia-install.sh b/install/authelia-install.sh index dbf8a9fcb..1cfcf027a 100644 --- a/install/authelia-install.sh +++ b/install/authelia-install.sh @@ -63,12 +63,19 @@ else fi echo "$AUTHELIA_URL" >/etc/authelia/.authelia_url +AUTHELIA_PASS=$(random_password 20) +AUTHELIA_HASH=$(authelia crypto hash generate argon2 --password "$AUTHELIA_PASS" | awk '/Digest:/{print $2}') +{ + echo "Authelia Credentials" + echo "Username: authelia" + echo "Password: ${AUTHELIA_PASS}" +} >~/authelia.creds cat </etc/authelia/users.yml users: authelia: disabled: false displayname: "Authelia Admin" - password: "\$argon2id\$v=19\$m=65536,t=3,p=4\$ZBopMzXrzhHXPEZxRDVT2w\$SxWm96DwhOsZyn34DLocwQEIb4kCDsk632PuiMdZnig" + password: "${AUTHELIA_HASH}" groups: [] EOF cat </etc/authelia/configuration.yml diff --git a/install/firefly-install.sh b/install/firefly-install.sh index b96334e8a..dcdcd7068 100644 --- a/install/firefly-install.sh +++ b/install/firefly-install.sh @@ -26,6 +26,7 @@ chown -R www-data:www-data /opt/firefly chmod -R 775 /opt/firefly/storage cd /opt/firefly cp .env.example .env +sed -i -e "s|^APP_KEY=.*|APP_KEY=$(random_password 32)|" -e "s|^STATIC_CRON_TOKEN=.*|STATIC_CRON_TOKEN=$(random_password 32)|" /opt/firefly/.env sed -i "s/DB_HOST=.*/DB_HOST=localhost/" /opt/firefly/.env sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$MARIADB_DB_PASS/" /opt/firefly/.env $STD composer install --no-dev --no-plugins --no-interaction diff --git a/install/homelable-install.sh b/install/homelable-install.sh index 2356e5b7a..36d2e78e3 100644 --- a/install/homelable-install.sh +++ b/install/homelable-install.sh @@ -33,7 +33,13 @@ msg_ok "Set up Python Backend" msg_info "Configuring Homelable" mkdir -p /opt/homelable/data SECRET_KEY=$(openssl rand -hex 32) -BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt; print(bcrypt.hashpw(b'admin', bcrypt.gensalt()).decode())") +HOMELABLE_PASS=$(random_password 20) +BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt,sys; print(bcrypt.hashpw(sys.argv[1].encode(), bcrypt.gensalt()).decode())" "$HOMELABLE_PASS") +{ + echo "Homelable Credentials" + echo "Username: admin" + echo "Password: ${HOMELABLE_PASS}" +} >~/homelable.creds cat </opt/homelable/backend/.env SECRET_KEY=${SECRET_KEY} SQLITE_PATH=/opt/homelable/data/homelab.db diff --git a/install/keycloak-install.sh b/install/keycloak-install.sh index 4feb8958c..e522551fd 100644 --- a/install/keycloak-install.sh +++ b/install/keycloak-install.sh @@ -21,6 +21,7 @@ PG_DB_NAME="keycloak" PG_DB_USER="keycloak" setup_postgresql_db fetch_and_deploy_gh_release "keycloak_app" "keycloak/keycloak" "prebuild" "latest" "/opt/keycloak" "keycloak-*.tar.gz" msg_info "Creating Service" +ADMIN_PASS=$(random_password 20) cat </etc/systemd/system/keycloak.service [Unit] Description=Keycloak Service @@ -40,7 +41,7 @@ Environment="KC_DB_USERNAME=keycloak" Environment="KC_DB_PASSWORD=$PG_DB_PASS" Environment="KC_HTTP_ENABLED=true" Environment="KC_BOOTSTRAP_ADMIN_USERNAME=tmpadm" -Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=admin123" +Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=${ADMIN_PASS}" # Comment following line and uncomment the next 2 if working behind a reverse proxy Environment="KC_HOSTNAME_STRICT=false" #Environment="KC_HOSTNAME=keycloak.example.com" @@ -48,6 +49,13 @@ Environment="KC_HOSTNAME_STRICT=false" [Install] WantedBy=multi-user.target EOF +chmod 600 /etc/systemd/system/keycloak.service +{ + echo "Keycloak Credentials" + echo "Temporary admin, replace it with a permanent one" + echo "Username: tmpadm" + echo "Password: ${ADMIN_PASS}" +} >~/keycloak.creds systemctl enable -q --now keycloak msg_ok "Created Service" diff --git a/install/kimai-install.sh b/install/kimai-install.sh index be054803d..3a77019af 100644 --- a/install/kimai-install.sh +++ b/install/kimai-install.sh @@ -40,6 +40,7 @@ cp .env.dist .env sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://kimai:$MARIADB_DB_PASS@127.0.0.1:3306/kimai_db?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env $STD bin/console kimai:install -n +ADMIN_PASS=$(random_password 20) $STD expect <~/kimai.creds $STD composer update --no-interaction cat </opt/kimai/config/packages/local.yaml kimai: diff --git a/install/monica-install.sh b/install/monica-install.sh index c09bd0339..ff7f2d9ec 100644 --- a/install/monica-install.sh +++ b/install/monica-install.sh @@ -33,7 +33,13 @@ $STD yarn config set ignore-engines true $STD yarn install $STD yarn run production $STD php artisan key:generate -$STD php artisan setup:production --email=admin@community-scripts.org --password=community-scripts.org --force +ADMIN_PASS=$(random_password 20) +$STD php artisan setup:production --email=admin@community-scripts.org --password="${ADMIN_PASS}" --force +{ + echo "Monica Credentials" + echo "Email: admin@community-scripts.org" + echo "Password: ${ADMIN_PASS}" +} >~/monica.creds chown -R www-data:www-data /opt/monica chmod -R 775 /opt/monica/storage echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab diff --git a/install/nagios-install.sh b/install/nagios-install.sh index 35f2d86f2..330e703c6 100644 --- a/install/nagios-install.sh +++ b/install/nagios-install.sh @@ -63,7 +63,13 @@ setcap cap_net_raw+p /bin/ping msg_ok "Built Nagios Plugins" msg_info "Configuring Web Authentication" -$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin +NAGIOS_PASS=$(random_password 20) +$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin "$NAGIOS_PASS" +{ + echo "Nagios Credentials" + echo "Username: nagiosadmin" + echo "Password: ${NAGIOS_PASS}" +} >~/nagios.creds chown root:www-data /usr/local/nagios/etc/htpasswd.users chmod 640 /usr/local/nagios/etc/htpasswd.users msg_ok "Configured Web Authentication" diff --git a/install/neko-install.sh b/install/neko-install.sh index cc47b9f1a..517324fa2 100644 --- a/install/neko-install.sh +++ b/install/neko-install.sh @@ -201,6 +201,13 @@ cat <<'EOF' >/etc/neko/openbox.xml EOF +NEKO_ADMIN_PASS=$(random_password 20) +NEKO_USER_PASS=$(random_password 20) +{ + echo "Neko Credentials" + echo "Admin password: ${NEKO_ADMIN_PASS}" + echo "User password: ${NEKO_USER_PASS}" +} >~/neko.creds cat </etc/neko/neko.yaml server: bind: "0.0.0.0:8080" @@ -219,8 +226,8 @@ desktop: member: provider: "multiuser" multiuser: - admin_password: "admin" - user_password: "neko" + admin_password: "${NEKO_ADMIN_PASS}" + user_password: "${NEKO_USER_PASS}" EOF msg_ok "Set up Runtime" diff --git a/install/nodebb-install.sh b/install/nodebb-install.sh index 865318035..7d2fc552d 100644 --- a/install/nodebb-install.sh +++ b/install/nodebb-install.sh @@ -31,6 +31,7 @@ NODEBB_USER="nodebb" NODEBB_PWD="$(random_password 13)" MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb" NODEBB_SECRET=$(uuidgen) +NODEBB_ADMIN_PASS="$(random_password 20)" cat <~/nodebb.creds NodeBB-Credentials Mongo Database User: $MONGO_ADMIN_USER @@ -38,6 +39,8 @@ Mongo Database Password: $MONGO_ADMIN_PWD NodeBB User: $NODEBB_USER NodeBB Password: $NODEBB_PWD NodeBB Secret: $NODEBB_SECRET +NodeBB Admin User: community-scripts +NodeBB Admin Password: $NODEBB_ADMIN_PASS EOF $STD mongosh <~/npmplus.creds msg_info "Building and Starting NPMplus (Patience)" $STD docker compose up -d diff --git a/install/octoprint-install.sh b/install/octoprint-install.sh index eff030fa4..fb29c0df4 100644 --- a/install/octoprint-install.sh +++ b/install/octoprint-install.sh @@ -30,7 +30,13 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED msg_ok "Setup Python3" msg_info "Creating user octoprint" -useradd -m -s /bin/bash -p $(openssl passwd -1 octoprint) octoprint +OCTOPRINT_PASS=$(random_password 20) +useradd -m -s /bin/bash -p "$(openssl passwd -6 "$OCTOPRINT_PASS")" octoprint +{ + echo "OctoPrint Linux user Credentials" + echo "Username: octoprint" + echo "Password: ${OCTOPRINT_PASS}" +} >~/octoprint.creds usermod -aG sudo,tty,dialout octoprint chown -R octoprint:octoprint /opt echo "octoprint ALL=NOPASSWD: $(command -v systemctl) restart octoprint, $(command -v reboot), $(command -v poweroff)" >/etc/sudoers.d/octoprint diff --git a/install/paymenter-install.sh b/install/paymenter-install.sh index 30591f37f..3338656e8 100644 --- a/install/paymenter-install.sh +++ b/install/paymenter-install.sh @@ -43,7 +43,13 @@ $STD php artisan migrate --force --seed msg_ok "Set up database" msg_info "Creating Admin User" -$STD php artisan app:user:create paymenter admin admin@paymenter.org paymenter 1 -q +PAYMENTER_PASS=$(random_password 20) +$STD php artisan app:user:create paymenter admin admin@paymenter.org "$PAYMENTER_PASS" 1 -q +{ + echo "Paymenter Credentials" + echo "Email: admin@paymenter.org" + echo "Password: ${PAYMENTER_PASS}" +} >~/paymenter.creds msg_ok "Created Admin User" msg_info "Configuring Nginx" diff --git a/install/photoprism-install.sh b/install/photoprism-install.sh index 741a20ed1..ebb16af05 100644 --- a/install/photoprism-install.sh +++ b/install/photoprism-install.sh @@ -46,10 +46,16 @@ tar -xzf /tmp/libheif.tar.gz -C /usr/local ldconfig echo "${LIBHEIF_URL}" >~/.photoprism_libheif chmod -R 755 /opt/photoprism/photos/originals +ADMIN_PASS=$(random_password 20) +{ + echo "PhotoPrism Credentials" + echo "Username: admin" + echo "Password: ${ADMIN_PASS}" +} >~/photoprism.creds cat </opt/photoprism/config/.env # Authentication PHOTOPRISM_ADMIN_USER='admin' -PHOTOPRISM_ADMIN_PASSWORD='changeme' +PHOTOPRISM_ADMIN_PASSWORD='${ADMIN_PASS}' PHOTOPRISM_AUTH_MODE='password' PHOTOPRISM_PUBLIC='false' @@ -112,7 +118,7 @@ StoragePath: "/opt/photoprism/storage" OriginalsPath: "/opt/photoprism/photos/originals" ImportPath: "/media" AdminUser: "admin" -AdminPassword: "changeme" +AdminPassword: "${ADMIN_PASS}" AuthMode: "password" DatabaseDriver: "sqlite" HttpHost: "0.0.0.0" diff --git a/install/qbittorrent-install.sh b/install/qbittorrent-install.sh index 6f02ae8c4..52ab5364b 100644 --- a/install/qbittorrent-install.sh +++ b/install/qbittorrent-install.sh @@ -18,12 +18,20 @@ fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "sin msg_info "Setup qBittorrent-nox" mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox mkdir -p ~/.config/qBittorrent/ +QB_PASS=$(random_password 20) +QB_SALT=$(random_password 16) +QB_HASH="$(printf '%s' "$QB_SALT" | base64 -w0):$(openssl kdf -keylen 64 -kdfopt digest:SHA512 -kdfopt pass:"$QB_PASS" -kdfopt salt:"$QB_SALT" -kdfopt iter:100000 -binary PBKDF2 | base64 -w0)" +{ + echo "qBittorrent Credentials" + echo "Username: admin" + echo "Password: ${QB_PASS}" +} >~/qbittorrent.creds cat <~/.config/qBittorrent/qBittorrent.conf [LegalNotice] Accepted=true [Preferences] -WebUI\Password_PBKDF2="@ByteArray(amjeuVrF3xRbgzqWQmes5A==:XK3/Ra9jUmqUc4RwzCtrhrkQIcYczBl90DJw2rT8DFVTss4nxpoRhvyxhCf87ahVE3SzD8K9lyPdpyUCfmVsUg==)" +WebUI\Password_PBKDF2="@ByteArray(${QB_HASH})" WebUI\Port=8090 WebUI\UseUPnP=false WebUI\Username=admin diff --git a/install/rabbitmq-install.sh b/install/rabbitmq-install.sh index 0f69f7848..52e44c32d 100644 --- a/install/rabbitmq-install.sh +++ b/install/rabbitmq-install.sh @@ -43,9 +43,15 @@ $STD rabbitmqctl enable_feature_flag all msg_ok "Enabled RabbitMQ Management Plugin" msg_info "Creating User" -$STD rabbitmqctl add_user proxmox proxmox +RABBITMQ_PASS=$(random_password 20) +$STD rabbitmqctl add_user proxmox "$RABBITMQ_PASS" $STD rabbitmqctl set_user_tags proxmox administrator $STD rabbitmqctl set_permissions -p / proxmox ".*" ".*" ".*" +{ + echo "RabbitMQ Credentials" + echo "Username: proxmox" + echo "Password: ${RABBITMQ_PASS}" +} >~/rabbitmq.creds msg_ok "Created User" motd_ssh diff --git a/install/signoz-install.sh b/install/signoz-install.sh index b9eecbcb4..1a207adf7 100644 --- a/install/signoz-install.sh +++ b/install/signoz-install.sh @@ -151,7 +151,7 @@ INVITE_EMAIL_TEMPLATE=/opt/signoz/templates/invitation_email_template.html SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db SIGNOZ_WEB_ENABLED=true SIGNOZ_WEB_DIRECTORY=/opt/signoz/web -SIGNOZ_JWT_SECRET=secret +SIGNOZ_JWT_SECRET=$(openssl rand -hex 32) SIGNOZ_ALERTMANAGER_PROVIDER=signoz SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://localhost:9000?password= diff --git a/install/snapotter-install.sh b/install/snapotter-install.sh index 498d874bd..ace6c6476 100644 --- a/install/snapotter-install.sh +++ b/install/snapotter-install.sh @@ -78,6 +78,12 @@ msg_info "Configuring SnapOtter" mkdir -p /opt/snapotter_data/files mkdir -p /tmp/snapotter-workspace +SNAPOTTER_PASS=$(random_password 20) +{ + echo "SnapOtter Credentials" + echo "Username: admin" + echo "Password: ${SNAPOTTER_PASS}" +} >~/snapotter.creds cat </opt/snapotter_data/.env PORT=1349 NODE_ENV=production @@ -92,7 +98,7 @@ FEATURE_MANIFEST_PATH=/opt/snapotter/docker/feature-manifest.json U2NET_HOME=/opt/snapotter_data/ai/models/rembg AUTH_ENABLED=true DEFAULT_USERNAME=admin -DEFAULT_PASSWORD=admin +DEFAULT_PASSWORD=${SNAPOTTER_PASS} LOG_LEVEL=info TRUST_PROXY=true FILE_MAX_AGE_HOURS=72 diff --git a/install/stirling-pdf-install.sh b/install/stirling-pdf-install.sh index 24922bd3e..8b973bb96 100644 --- a/install/stirling-pdf-install.sh +++ b/install/stirling-pdf-install.sh @@ -116,10 +116,6 @@ if [[ "$login_mode" == "true" ]]; then # activate Login DISABLE_ADDITIONAL_FEATURES=false SECURITY_ENABLELOGIN=true - -# login credentials -SECURITY_INITIALLOGIN_USERNAME=admin -SECURITY_INITIALLOGIN_PASSWORD=stirling EOF fi msg_ok "Created Environment Variables" diff --git a/tools/addon/coder-code-server.sh b/tools/addon/coder-code-server.sh index 7b126d572..b2f103dc6 100644 --- a/tools/addon/coder-code-server.sh +++ b/tools/addon/coder-code-server.sh @@ -85,12 +85,16 @@ function install() { mkdir -p "${HOME}/.config/code-server/" if [ "$preexisting_config" = false ]; then + CS_PASS=$(random_password 20) cat <"$config_path" bind-addr: 0.0.0.0:8680 -auth: none -password: +auth: password +password: ${CS_PASS} cert: false EOF + chmod 600 "$config_path" + echo -e "Coder Code Server\nPassword: ${CS_PASS}" >~/coder-code-server.creds + chmod 600 ~/coder-code-server.creds fi systemctl enable -q --now code-server@"$USER" systemctl restart code-server@"$USER" @@ -111,7 +115,7 @@ EOF msg_ok "Created update script (/usr/local/bin/update_coder-code-server)" echo -e "${APP} should be reachable by going to the following URL. - ${BL}http://${IP}:8680${CL} \n" + ${BL}http://${IP}:8680${CL} (password in ~/coder-code-server.creds)\n" } # ============================================================================== diff --git a/tools/addon/copyparty.sh b/tools/addon/copyparty.sh index c9f4ebd1d..5b598d91b 100644 --- a/tools/addon/copyparty.sh +++ b/tools/addon/copyparty.sh @@ -151,9 +151,9 @@ function install() { else read -rp "${TAB}Set admin username [admin]: " admin_user admin_user=${admin_user:-admin} - read -rsp "${TAB}Set admin password [community-scripts.org]: " admin_pass + read -rsp "${TAB}Set admin password [random]: " admin_pass echo "" - admin_pass=${admin_pass:-community-scripts.org} + admin_pass=${admin_pass:-$(random_password 20)} msg_ok "Configured with admin user: ${admin_user}" fi @@ -291,8 +291,10 @@ UPDATEEOF msg_ok "Storage: ${BL}${DATA_PATH}${CL}" msg_ok "Config: ${BL}${CONF_PATH}${CL}" if [[ -n "$admin_user" ]]; then + echo -e "Copyparty\nUsername: ${admin_user}\nPassword: ${admin_pass}" >~/copyparty.creds + chmod 600 ~/copyparty.creds echo "" - msg_ok "Login: ${GN}${admin_user}${CL} / ${GN}${admin_pass}${CL}" + msg_ok "Login: ${GN}${admin_user}${CL} (password in ~/copyparty.creds)" fi } diff --git a/tools/addon/filebrowser-quantum.sh b/tools/addon/filebrowser-quantum.sh index 6db8e401b..d5c46f0d2 100644 --- a/tools/addon/filebrowser-quantum.sh +++ b/tools/addon/filebrowser-quantum.sh @@ -189,6 +189,8 @@ chown root:root /usr/local/community-scripts chmod 755 /usr/local/community-scripts msg_ok "Directory prepared" +ADMIN_PASS=$(random_password 20) +msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file." echo -n "${TAB}Use No Authentication? (y/N): " read -r noauth_prompt @@ -234,9 +236,12 @@ server: - neverWatchPath: "/lost+found" auth: adminUsername: admin - adminPassword: community-scripts.org + adminPassword: ${ADMIN_PASS} EOF - msg_ok "Configured with default admin (admin / community-scripts.org)" + chmod 600 "$CONFIG_PATH" + echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds + chmod 600 ~/filebrowser-quantum.creds + msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)" fi msg_info "Creating service" @@ -276,4 +281,13 @@ EOF fi msg_ok "Service created successfully" + +# auth.adminPassword resets the password on every start, so it stays only until the admin exists +if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then + for _ in {1..30}; do + [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break + sleep 1 + done + sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH" +fi msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}" diff --git a/tools/addon/filebrowser.sh b/tools/addon/filebrowser.sh index 9f54ea311..17608c350 100644 --- a/tools/addon/filebrowser.sh +++ b/tools/addon/filebrowser.sh @@ -122,9 +122,11 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then chmod 755 /usr/local/community-scripts touch "$DB_PATH" chown root:root "$DB_PATH" - chmod 644 "$DB_PATH" + chmod 600 "$DB_PATH" msg_ok "Directory created successfully" + ADMIN_PASS=$(random_password 20) + msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file." read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then msg_info "Configuring No Authentication" @@ -133,16 +135,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" $STD filebrowser config set --auth.method=noauth --database "$DB_PATH" if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then - $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH" + $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH" fi msg_ok "No Authentication configured" else - msg_info "Setting up default authentication" + msg_info "Setting up authentication" cd /usr/local/community-scripts $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" - $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH" - msg_ok "Default authentication configured (admin:community-scripts.org)" + $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH" + echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds + chmod 600 ~/filebrowser.creds + msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)" fi msg_info "Creating service" @@ -156,7 +160,6 @@ After=network-online.target User=root WorkingDirectory=/usr/local/community-scripts ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db -ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT} Restart=always diff --git a/tools/addon/webmin.sh b/tools/addon/webmin.sh index 2fab3337e..c4178af58 100644 --- a/tools/addon/webmin.sh +++ b/tools/addon/webmin.sh @@ -30,6 +30,7 @@ catch_errors # Initialize all core functions (colors, formatting, icons, STD mode) load_functions +confirm_not_pve_host require_debian_like header_info @@ -49,9 +50,13 @@ msg_ok "Installed Prerequisites" msg_info "Installing ${APP}" fetch_and_deploy_gh_release "webmin" "webmin/webmin" "binary" "latest" "/opt/webmin" "webmin_*_all.deb" -/usr/share/webmin/changepass.pl /etc/webmin root root &>/dev/null +WEBMIN_PASS=$(random_password 20) +/usr/share/webmin/changepass.pl /etc/webmin root "$WEBMIN_PASS" &>/dev/null +echo -e "Webmin\nUsername: root\nPassword: ${WEBMIN_PASS}" >~/webmin.creds +chmod 600 ~/webmin.creds msg_ok "Installed ${APP}" get_lxc_ip echo -e "Successfully Installed!! ${APP} should be reachable by going to ${BL}https://${LOCAL_IP}:10000${CL}" +echo -e "Login: root, password in ~/webmin.creds"