powerdns: move poweradmin database outside the web root

ct/fleet.sh

@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/fleetdm/fleet
-
-APP="Fleet"
-var_tags="${var_tags:-monitoring;device-management;security}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-ubuntu}"
-var_version="${var_version:-24.04}"
-#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /opt/fleet/fleet ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "fleet" "fleetdm/fleet"; then
-    msg_info "Stopping Service"
-    systemctl stop fleet
-    msg_ok "Stopped Service"
-
-    fetch_and_deploy_gh_release "fleet" "fleetdm/fleet" "prebuild" "latest" "/opt/fleet" "fleet_v*_linux.tar.gz"
-    chmod +x /opt/fleet/fleet
-
-    msg_info "Running Database Migrations"
-    set -a && source /opt/fleet/.env && set +a
-    $STD /opt/fleet/fleet prepare db --no-prompt
-    msg_ok "Ran Database Migrations"
-
-    msg_info "Starting Service"
-    systemctl start fleet
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
-echo -e "${INFO}${YW} Admin Email:${CL} ${BGN}admin@fleet.local${CL}"
-echo -e "${INFO}${YW} Admin Password:${CL} ${BGN}Check inside the container: cat /opt/fleet/.env${CL}"

ct/headers/fleet

@@ -1,6 +0,0 @@
-    ________          __ 
-   / ____/ /__  ___  / /_
-  / /_  / / _ \/ _ \/ __/
- / __/ / /  __/  __/ /_  
-/_/   /_/\___/\___/\__/  
-                         

ct/powerdns.sh

@@ -30,13 +30,26 @@ function update_script() {
     exit
   fi
 
+  if [[ -f /opt/poweradmin/powerdns.db ]]; then
+    msg_info "Moving PowerDNS database out of the web root"
+    systemctl stop pdns apache2
+    mkdir -p /var/lib/powerdns
+    mv /opt/poweradmin/powerdns.db /var/lib/powerdns/powerdns.db
+    sed -i 's#/opt/poweradmin/powerdns.db#/var/lib/powerdns/powerdns.db#' \
+      /etc/powerdns/pdns.d/gsqlite3.conf /opt/poweradmin/config/settings.php
+    chown pdns:pdns /var/lib/powerdns/powerdns.db
+    chmod 664 /var/lib/powerdns/powerdns.db
+    systemctl start pdns apache2
+    msg_ok "Moved PowerDNS database out of the web root"
+  fi
+
   msg_info "Updating PowerDNS"
   $STD apt update
   $STD apt install -y --only-upgrade pdns-server pdns-backend-sqlite3
   msg_ok "Updated PowerDNS"
 
   if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    create_backup /opt/poweradmin/config/settings.php
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
@@ -46,8 +59,6 @@ function update_script() {
     rm -rf /opt/poweradmin/install
     chown -R www-data:pdns /opt/poweradmin
     chmod 775 /opt/poweradmin
-    chown pdns:pdns /opt/poweradmin/powerdns.db
-    chmod 664 /opt/poweradmin/powerdns.db
     msg_ok "Updated Poweradmin"
 
     msg_info "Restarting Services"

install/fleet-install.sh

@@ -1,93 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/fleetdm/fleet
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y redis-server mysql-server
-msg_ok "Installed Dependencies"
-
-MYSQL_DB_NAME="fleet" MYSQL_DB_USER="fleet" setup_mysql_db
-fetch_and_deploy_gh_release "fleet" "fleetdm/fleet" "prebuild" "latest" "/opt/fleet" "fleet_v*_linux.tar.gz"
-
-msg_info "Configuring Application"
-chmod +x /opt/fleet/fleet
-PRIVATE_KEY=$(openssl rand -hex 32)
-cat <<EOF >/opt/fleet/.env
-FLEET_MYSQL_ADDRESS=127.0.0.1:3306
-FLEET_MYSQL_DATABASE=fleet
-FLEET_MYSQL_USERNAME=fleet
-FLEET_MYSQL_PASSWORD=${MYSQL_DB_PASS}
-FLEET_SERVER_ADDRESS=0.0.0.0:8080
-FLEET_SERVER_TLS=false
-FLEET_SERVER_PRIVATE_KEY=${PRIVATE_KEY}
-FLEET_REDIS_ADDRESS=127.0.0.1:6379
-FLEET_LOGGING_JSON=true
-EOF
-msg_ok "Configured Application"
-
-msg_info "Running Database Migrations"
-set -a && source /opt/fleet/.env && set +a
-$STD /opt/fleet/fleet prepare db --no-prompt
-msg_ok "Ran Database Migrations"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/fleet.service
-[Unit]
-Description=Fleet
-After=network.target mysql.service redis-server.service
-Requires=mysql.service redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/fleet
-EnvironmentFile=/opt/fleet/.env
-ExecStart=/opt/fleet/fleet serve
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now fleet redis-server
-msg_ok "Created Service"
-
-msg_info "Initializing Fleet"
-FLEET_ADMIN_EMAIL="admin@fleet.local"
-FLEET_ADMIN_PASS="$(openssl rand -hex 8)1!"
-ELAPSED=0
-until curl -sf "http://127.0.0.1:8080/healthz" >/dev/null 2>&1; do
-  sleep 2
-  ELAPSED=$((ELAPSED + 2))
-  [[ $ELAPSED -ge 60 ]] && break
-done
-SETUP_RESPONSE=$(curl -s -X POST "http://127.0.0.1:8080/api/v1/setup" \
-  -H "Content-Type: application/json" \
-  -d "{\"admin\":{\"admin\":true,\"email\":\"${FLEET_ADMIN_EMAIL}\",\"name\":\"Admin\",\"password\":\"${FLEET_ADMIN_PASS}\"},\"org_info\":{\"org_name\":\"Fleet\",\"org_logo_url\":\"\"},\"server_url\":\"http://127.0.0.1:8080\"}")
-FLEET_TOKEN=$(echo "${SETUP_RESPONSE}" | grep -o '"token":"[^"]*"' | cut -d'"' -f4) || true
-if [[ -n "${FLEET_TOKEN}" ]]; then
-  curl -s -X PATCH "http://127.0.0.1:8080/api/latest/fleet/config" \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer ${FLEET_TOKEN}" \
-    -d "{\"server_settings\":{\"server_url\":\"http://${LOCAL_IP}:8080\"}}" >/dev/null
-fi
-cat <<EOF >>/opt/fleet/.env
-FLEET_ADMIN_EMAIL=${FLEET_ADMIN_EMAIL}
-FLEET_ADMIN_PASSWORD=${FLEET_ADMIN_PASS}
-EOF
-msg_ok "Initialized Fleet"
-
-motd_ssh
-customize
-cleanup_lxc

install/powerdns-install.sh

@@ -40,24 +40,25 @@ $STD apt install -y \
   pdns-backend-sqlite3
 sed -i 's/^launch=$/# launch=/' /etc/powerdns/pdns.conf
 rm -f /etc/powerdns/pdns.d/bind.conf
+mkdir -p /var/lib/powerdns
 cat <<EOF >/etc/powerdns/pdns.d/gsqlite3.conf
 launch=gsqlite3
-gsqlite3-database=/opt/poweradmin/powerdns.db
+gsqlite3-database=/var/lib/powerdns/powerdns.db
 EOF
 msg_ok "Setup PowerDNS"
 
 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
 msg_info "Setting up Poweradmin"
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
 PA_ADMIN_USERNAME="admin"
 PA_ADMIN_EMAIL="admin@example.com"
 PA_ADMIN_FULLNAME="Administrator"
 PA_ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d "=+/" | cut -c1-16)
 PA_SESSION_KEY=$(openssl rand -base64 75 | tr -dc 'A-Za-z0-9^@#!(){}[]%_\-+=~' | head -c 50)
 PASSWORD_HASH=$(php -r "echo password_hash(\$argv[1], PASSWORD_DEFAULT);" -- "${PA_ADMIN_PASSWORD}" 2>/dev/null)
-sqlite3 /opt/poweradmin/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
+sqlite3 /var/lib/powerdns/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
   VALUES ('$(escape_sql "${PA_ADMIN_USERNAME}")', '$(escape_sql "${PASSWORD_HASH}")', '$(escape_sql "${PA_ADMIN_FULLNAME}")', \
   '$(escape_sql "${PA_ADMIN_EMAIL}")', 'System Administrator', 1, 1, 0);"
 
@@ -81,7 +82,7 @@ return [
      */
     'database' => [
         'type' => 'sqlite',
-        'file' => '/opt/poweradmin/powerdns.db',
+        'file' => '/var/lib/powerdns/powerdns.db',
     ],
 
     /**
@@ -133,8 +134,8 @@ EOF
 $STD a2enmod rewrite headers
 chown -R www-data:pdns /opt/poweradmin
 chmod 775 /opt/poweradmin
-chown pdns:pdns /opt/poweradmin/powerdns.db
-chmod 664 /opt/poweradmin/powerdns.db
+chown pdns:pdns /var/lib/powerdns/powerdns.db
+chmod 664 /var/lib/powerdns/powerdns.db
 usermod -aG pdns www-data
 $STD systemctl restart pdns apache2
 msg_ok "Created Service"