powerdns: move poweradmin database outside the web root

ct/patchmon.sh

@@ -9,7 +9,7 @@ APP="PatchMon"
 var_tags="${var_tags:-monitoring}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
+var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -30,8 +30,6 @@ function update_script() {
     exit
   fi
 
-  CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
-
   if check_for_gh_release "PatchMon" "PatchMon/PatchMon"; then
     msg_info "Stopping Service"
     systemctl stop patchmon-server

ct/powerdns.sh

@@ -30,13 +30,26 @@ function update_script() {
     exit
   fi
 
+  if [[ -f /opt/poweradmin/powerdns.db ]]; then
+    msg_info "Moving PowerDNS database out of the web root"
+    systemctl stop pdns apache2
+    mkdir -p /var/lib/powerdns
+    mv /opt/poweradmin/powerdns.db /var/lib/powerdns/powerdns.db
+    sed -i 's#/opt/poweradmin/powerdns.db#/var/lib/powerdns/powerdns.db#' \
+      /etc/powerdns/pdns.d/gsqlite3.conf /opt/poweradmin/config/settings.php
+    chown pdns:pdns /var/lib/powerdns/powerdns.db
+    chmod 664 /var/lib/powerdns/powerdns.db
+    systemctl start pdns apache2
+    msg_ok "Moved PowerDNS database out of the web root"
+  fi
+
   msg_info "Updating PowerDNS"
   $STD apt update
   $STD apt install -y --only-upgrade pdns-server pdns-backend-sqlite3
   msg_ok "Updated PowerDNS"
 
   if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    create_backup /opt/poweradmin/config/settings.php
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
@@ -46,8 +59,6 @@ function update_script() {
     rm -rf /opt/poweradmin/install
     chown -R www-data:pdns /opt/poweradmin
     chmod 775 /opt/poweradmin
-    chown pdns:pdns /opt/poweradmin/powerdns.db
-    chmod 664 /opt/poweradmin/powerdns.db
     msg_ok "Updated Poweradmin"
 
     msg_info "Restarting Services"

install/patchmon-install.sh

@@ -60,7 +60,6 @@ REDIS_PORT=6379
 # OIDC_ENFORCE_HTTPS=true
 
 AGENT_BINARIES_DIR=/opt/patchmon/agents
-SSG_CONTENT_DIR=/opt/patchmon/ssg-content
 EOF
 msg_ok "Configured PatchMon"
 
@@ -86,8 +85,6 @@ for arch in "${AGENT_NAME[@]}"; do
 done
 msg_ok "Fetched PatchMon agent binaries"
 
-fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
-
 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/patchmon-server.service
 [Unit]

install/powerdns-install.sh

@@ -40,24 +40,25 @@ $STD apt install -y \
   pdns-backend-sqlite3
 sed -i 's/^launch=$/# launch=/' /etc/powerdns/pdns.conf
 rm -f /etc/powerdns/pdns.d/bind.conf
+mkdir -p /var/lib/powerdns
 cat <<EOF >/etc/powerdns/pdns.d/gsqlite3.conf
 launch=gsqlite3
-gsqlite3-database=/opt/poweradmin/powerdns.db
+gsqlite3-database=/var/lib/powerdns/powerdns.db
 EOF
 msg_ok "Setup PowerDNS"
 
 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
 msg_info "Setting up Poweradmin"
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
 PA_ADMIN_USERNAME="admin"
 PA_ADMIN_EMAIL="admin@example.com"
 PA_ADMIN_FULLNAME="Administrator"
 PA_ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d "=+/" | cut -c1-16)
 PA_SESSION_KEY=$(openssl rand -base64 75 | tr -dc 'A-Za-z0-9^@#!(){}[]%_\-+=~' | head -c 50)
 PASSWORD_HASH=$(php -r "echo password_hash(\$argv[1], PASSWORD_DEFAULT);" -- "${PA_ADMIN_PASSWORD}" 2>/dev/null)
-sqlite3 /opt/poweradmin/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
+sqlite3 /var/lib/powerdns/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
   VALUES ('$(escape_sql "${PA_ADMIN_USERNAME}")', '$(escape_sql "${PASSWORD_HASH}")', '$(escape_sql "${PA_ADMIN_FULLNAME}")', \
   '$(escape_sql "${PA_ADMIN_EMAIL}")', 'System Administrator', 1, 1, 0);"
 
@@ -81,7 +82,7 @@ return [
      */
     'database' => [
         'type' => 'sqlite',
-        'file' => '/opt/poweradmin/powerdns.db',
+        'file' => '/var/lib/powerdns/powerdns.db',
     ],
 
     /**
@@ -133,8 +134,8 @@ EOF
 $STD a2enmod rewrite headers
 chown -R www-data:pdns /opt/poweradmin
 chmod 775 /opt/poweradmin
-chown pdns:pdns /opt/poweradmin/powerdns.db
-chmod 664 /opt/poweradmin/powerdns.db
+chown pdns:pdns /var/lib/powerdns/powerdns.db
+chmod 664 /var/lib/powerdns/powerdns.db
 usermod -aG pdns www-data
 $STD systemctl restart pdns apache2
 msg_ok "Created Service"