@underpostnet/cyberia 3.2.80

package/scripts/rocky-pwa.sh

@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# rocky-pwa.sh
+# Purpose: Build and install a PWA as a native application on Rocky Linux (RHEL).
+# Usage: sudo ./rocky-pwa.sh <URL> <APP_NAME>
+
+if [[ $EUID -ne 0 ]]; then
+   echo "ERROR: This script must be run as root." >&2
+   exit 1
+fi
+
+if [[ $# -lt 2 ]]; then
+    echo "Usage: $0 <URL> <APP_NAME>"
+    echo "Example: $0 'https://underpost.net' 'Underpost'"
+    exit 1
+fi
+
+TARGET_URL="$1"
+RAW_NAME="$2"
+# Sanitize name for filesystem (My App -> My_App)
+APP_NAME="${RAW_NAME// /_}"
+DEST_DIR="/opt/$APP_NAME"
+
+echo ">>> Starting PWA installation for '$APP_NAME' ($TARGET_URL)"
+
+# ------------------------------------------------------------------------------
+# 1. Install Dependencies
+# ------------------------------------------------------------------------------
+echo ">>> Installing system dependencies..."
+# Common Electron/Nativefier requirements
+dnf install -y nodejs desktop-file-utils libXScrnSaver libX11 libXrandr \
+    alsa-lib atk at-spi2-core cups-libs wget curl grep \
+    || echo "Warning: specific package install failed, proceeding in case they exist..."
+
+# ------------------------------------------------------------------------------
+# 2. Install/Update Nativefier
+# ------------------------------------------------------------------------------
+if ! command -v nativefier &> /dev/null; then
+    echo ">>> Installing nativefier..."
+    npm install -g nativefier || echo "Warning: Global install had issues. Attempting to run via npx..."
+fi
+
+# ------------------------------------------------------------------------------
+# 3. Build Application
+# ------------------------------------------------------------------------------
+BUILD_TMP=$(mktemp -d)
+trap 'rm -rf "$BUILD_TMP"' EXIT
+
+echo ">>> Building application in temporary directory..."
+cd "$BUILD_TMP"
+
+# --single-instance: Only allow one window
+# --internal-urls ".*": Don't open links in external browser (keep user inside app)
+npx --yes nativefier --name "$APP_NAME" \
+    --platform linux \
+    --arch x64 \
+    --single-instance \
+    --internal-urls ".*" \
+    "$TARGET_URL"
+
+# ------------------------------------------------------------------------------
+# 4. Install to /opt
+# ------------------------------------------------------------------------------
+# Nativefier creates a folder named like "Underpost-linux-x64"
+BUILT_FOLDER=$(find . -maxdepth 1 -type d -name "*-linux-x64" | head -n 1)
+
+if [[ -z "$BUILT_FOLDER" ]]; then
+    echo "ERROR: Build failed. No output directory found."
+    exit 1
+fi
+
+echo ">>> Installing to $DEST_DIR..."
+rm -rf "$DEST_DIR"
+mv "$BUILT_FOLDER" "$DEST_DIR"
+
+# Fix ownership
+chown -R root:root "$DEST_DIR"
+chmod -R 755 "$DEST_DIR"
+
+# ------------------------------------------------------------------------------
+# 5. Locate Executable & Fix Nested Structure
+# ------------------------------------------------------------------------------
+# Sometimes Nativefier nests: /opt/App/App-linux-x64/App
+# We want: /opt/App/App
+# Check if the DEST_DIR contains only one folder which is also named *-linux-x64
+NESTED_DIR=$(find "$DEST_DIR" -mindepth 1 -maxdepth 1 -type d -name "*-linux-x64" | head -n 1)
+
+if [[ -n "$NESTED_DIR" ]]; then
+    echo ">>> Flattening nested directory structure..."
+    # Move contents up
+    mv "$NESTED_DIR"/* "$DEST_DIR/"
+    rmdir "$NESTED_DIR"
+fi
+
+# Find the binary
+EXECUTABLE="$DEST_DIR/$APP_NAME"
+if [[ ! -f "$EXECUTABLE" ]]; then
+    # Try finding any executable file that isn't a library or helper
+    EXECUTABLE=$(find "$DEST_DIR" -maxdepth 2 -type f -executable ! -name "*.so*" ! -name "chrome_sandbox" ! -name "*.sh" | head -n 1)
+fi
+
+if [[ -z "$EXECUTABLE" || ! -f "$EXECUTABLE" ]]; then
+    echo "ERROR: Could not locate executable file in $DEST_DIR"
+    exit 1
+fi
+
+echo ">>> Found binary: $EXECUTABLE"
+
+# ------------------------------------------------------------------------------
+# 6. System Integration (Symlink, Icon, Desktop File)
+# ------------------------------------------------------------------------------
+BIN_LINK="/usr/local/bin/$APP_NAME"
+echo ">>> Creating symlink at $BIN_LINK..."
+ln -sf "$EXECUTABLE" "$BIN_LINK"
+
+# Handle Icon
+ICON_DEST="/usr/share/pixmaps/$APP_NAME.png"
+FOUND_ICON=""
+
+# 1. Look in resources
+if [[ -f "$DEST_DIR/resources/app/icon.png" ]]; then
+    FOUND_ICON="$DEST_DIR/resources/app/icon.png"
+elif [[ -f "$DEST_DIR/resources/app/icon.ico" ]]; then
+    FOUND_ICON="$DEST_DIR/resources/app/icon.ico"
+fi
+
+# 2. If not found, try to download from PWA manifest (Simplified)
+if [[ -z "$FOUND_ICON" ]]; then
+    echo ">>> Icon not found in build. Attempting to fetch from website..."
+    # Simple heuristic: try to grab apple-touch-icon or shortcut icon
+    ICON_URL=$(curl -sL "$TARGET_URL" | grep -oP 'rel="(apple-touch-icon|icon|shortcut icon)" href="\K[^"]+' | head -n 1)
+
+    if [[ -n "$ICON_URL" ]]; then
+        # Handle relative URLs
+        if [[ "$ICON_URL" != http* ]]; then
+             # Remove trailing slash from base if present and leading slash from path
+             BASE_URL="${TARGET_URL%/}"
+             PATH_URL="${ICON_URL#/}"
+             ICON_URL="$BASE_URL/$PATH_URL"
+        fi
+
+        echo ">>> Downloading icon from $ICON_URL..."
+        wget -q -O "$BUILD_TMP/downloaded_icon" "$ICON_URL"
+        if [[ -s "$BUILD_TMP/downloaded_icon" ]]; then
+            FOUND_ICON="$BUILD_TMP/downloaded_icon"
+        fi
+    fi
+fi
+
+if [[ -n "$FOUND_ICON" ]]; then
+    cp "$FOUND_ICON" "$ICON_DEST"
+    chmod 644 "$ICON_DEST"
+    echo ">>> Icon installed to $ICON_DEST"
+else
+    echo ">>> WARNING: No icon found. Desktop entry will use generic icon."
+fi
+
+# Desktop File
+DESKTOP_FILE="/usr/share/applications/$APP_NAME.desktop"
+echo ">>> Creating desktop entry at $DESKTOP_FILE..."
+
+cat > "$DESKTOP_FILE" <<EOF
+[Desktop Entry]
+Name=$RAW_NAME
+Exec=$BIN_LINK %U
+Icon=$APP_NAME
+Type=Application
+StartupNotify=true
+Categories=Network;Web;
+Terminal=false
+StartupWMClass=$APP_NAME
+EOF
+
+# Update cache
+if command -v update-desktop-database &> /dev/null; then
+    update-desktop-database /usr/share/applications
+fi
+
+# ------------------------------------------------------------------------------
+# 7. Create /bin wrapper with --no-sandbox flag
+# ------------------------------------------------------------------------------
+BIN_WRAPPER="/bin/$APP_NAME"
+echo ">>> Creating wrapper script at $BIN_WRAPPER..."
+
+cat > "$BIN_WRAPPER" <<EOF
+#!/usr/bin/env bash
+exec '$DEST_DIR/$APP_NAME' --no-sandbox "\$@"
+EOF
+
+chmod 755 "$BIN_WRAPPER"
+echo ">>> Wrapper script created: $BIN_WRAPPER"
+
+echo "------------------------------------------------------"
+echo " Installation Complete!"
+echo " App Name:  $RAW_NAME"
+echo " Command:   $APP_NAME"
+echo " Location:  $DEST_DIR"
+echo " Wrapper:   $BIN_WRAPPER"
+echo "------------------------------------------------------"

package/scripts/rocky-setup.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Script to install a recommended base package set on Rocky Linux.
+# Usage examples:
+#   sudo ./scripts/rocky-setup.sh                # install base packages
+#   sudo ./scripts/rocky-setup.sh --install-dev  # install base packages + Development Tools
+#   INSTALL_DEV=1 sudo ./scripts/rocky-setup.sh  # same as --install-dev
+
+PACKAGES=(
+  dnf-plugins-core
+  epel-release
+  vim
+  nano
+  bash-completion
+  curl
+  wget
+  unzip
+  zip
+  tar
+  gzip
+  bzip2
+  rsync
+  git
+  python3
+  python3-pip
+  openssh-server
+  openssh-clients
+  firewalld
+  chrony
+  NetworkManager
+  which
+  net-tools
+  bind-utils
+  tcpdump
+)
+
+# Defaults
+INSTALL_DEV=0
+
+# Parse CLI args (simple)
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --install-dev|--yes-dev)
+      INSTALL_DEV=1
+      shift
+      ;;
+    --no-install-dev)
+      INSTALL_DEV=0
+      shift
+      ;;
+    --help|-h)
+      cat <<EOF
+Usage: sudo ./scripts/rocky-setup.sh [options]
+
+Options:
+  --install-dev, --yes-dev    Install Development Tools group (gcc, make, etc.)
+  --no-install-dev            Explicitly skip Development Tools
+  --help, -h                  Show this help and exit
+
+You can also set the environment variable INSTALL_DEV=1 to enable development tools.
+EOF
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# Environment variable overrides (if set)
+if [[ "${INSTALL_DEV:-}" =~ ^(1|y|yes|true)$ ]]; then
+  INSTALL_DEV=1
+fi
+
+# Refresh cache and install basic packages
+echo "[+] Refreshing DNF cache..."
+dnf makecache --refresh -y
+
+echo "[+] Installing dnf-plugins-core and epel-release (if not present)..."
+dnf install dnf-plugins-core epel-release -y
+
+echo "[+] Refreshing DNF cache after enabling repositories..."
+dnf makecache --refresh -y
+
+echo "[+] Installing base packages: ${#PACKAGES[@]} packages"
+dnf install "${PACKAGES[@]}" -y
+
+# Decide on Development Tools
+if [[ $INSTALL_DEV -eq 1 ]]; then
+  echo "[+] Installing Development Tools..."
+  dnf groupinstall "Development Tools" -y
+else
+  echo "[+] Skipping Development Tools. To enable, run with --install-dev or set INSTALL_DEV=1"
+fi
+
+echo "[+] Updating all packages to latest versions..."
+dnf update -y --skip-broken --nobest
+
+# Cleanup
+echo "[+] Cleanup: remove unnecessary packages and old metadata"
+dnf autoremove -y
+dnf clean all
+
+echo "[+] Setup complete! Rocky Linux is now configured with the recommended base packages."

package/scripts/rpmfusion-ffmpeg-setup.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "1) Ensure dnf-plugins-core is installed"
+dnf -y install dnf-plugins-core
+
+echo "2) Enable CRB"
+dnf config-manager --set-enabled crb || true
+
+echo "3) Install EPEL"
+dnf -y install epel-release \
+|| dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
+
+echo "4) Install RPM Fusion repositories"
+dnf -y install \
+https://download1.rpmfusion.org/free/el/rpmfusion-free-release-9.noarch.rpm \
+https://download1.rpmfusion.org/nonfree/el/rpmfusion-nonfree-release-9.noarch.rpm
+
+
+echo "5) Install libwebp-tools (for ffmpeg to support WebP)"
+dnf -y install libwebp-tools
+
+echo "6) Refresh metadata"
+dnf clean all
+dnf makecache --refresh
+
+echo "7) Install ffmpeg"
+dnf -y install ffmpeg ffmpeg-devel --allowerasing
+
+echo
+echo "Done."
+ffmpeg -version | head -n 1

package/scripts/ssl.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# RHEL / Rocky Linux — Generate local TLS cert + fullchain (cert + root CA) using mkcert
+# Usage:
+#   ./generate-local-ssl-fullchain.sh /path/to/target "localhost 127.0.0.1 ::1"
+
+set -euo pipefail
+IFS=$'\n\t'
+
+err() { echo "[ERROR] $*" >&2; }
+info() { echo "[INFO] $*"; }
+
+print_usage() {
+  cat <<'EOF'
+Usage: $0 TARGET_DIR "domain1 domain2 ..."
+Example: $0 /etc/ssl/local "localhost 127.0.0.1 ::1"
+
+Outputs created in TARGET_DIR:
+ - <name>.pem          : leaf/server certificate
+ - <name>-key.pem      : private key
+ - <name>-fullchain.pem: certificate followed by root CA (use for servers needing full chain)
+ - rootCA.pem          : local root CA (if OpenSSL fallback used or copied from mkcert CAROOT)
+EOF
+}
+
+if [[ ${1-} == "-h" || ${1-} == "--help" ]]; then
+  print_usage; exit 0; fi
+
+TARGET_DIR="${1-}"
+DOMAINS="${2-}"
+
+if [[ -z "$TARGET_DIR" ]]; then read -rp "Target directory to store certificates (absolute path): " TARGET_DIR; fi
+if [[ -z "$DOMAINS" ]]; then read -rp "Space-separated domains/IPs to include (e.g. 'localhost 127.0.0.1 api.myapp.test'): " DOMAINS; fi
+
+TARGET_DIR="$(realpath -m "$TARGET_DIR")"
+mkdir -p "$TARGET_DIR"
+IFS=' ' read -r -a DOMAIN_ARR <<< "$DOMAINS"
+if [[ ${#DOMAIN_ARR[@]} -eq 0 ]]; then err "No domains provided. Exiting."; exit 1; fi
+
+NAME_SAFE="${DOMAIN_ARR[0]//[^a-zA-Z0-9_.-]/_}"
+CERT_FILE="$TARGET_DIR/${NAME_SAFE}.pem"
+KEY_FILE="$TARGET_DIR/${NAME_SAFE}-key.pem"
+FULLCHAIN_FILE="$TARGET_DIR/${NAME_SAFE}-fullchain.pem"
+ROOT_PEM="$TARGET_DIR/rootCA.pem"
+
+info "Target dir: $TARGET_DIR"
+info "Domains: ${DOMAIN_ARR[*]}"
+info "Outputs: $CERT_FILE, $KEY_FILE, $FULLCHAIN_FILE, $ROOT_PEM"
+
+# Install prerequisites
+if ! command -v dnf >/dev/null 2>&1; then err "dnf not found. This script expects RHEL/Rocky with dnf."; exit 1; fi
+
+SUDO=""
+if [ "$EUID" -ne 0 ]; then
+  SUDO="sudo"
+fi
+
+$SUDO dnf install -y curl nss-tools ca-certificates
+
+# Download and install mkcert binary (no 'go install')
+download_mkcert_binary() {
+  UNAME_M=$(uname -m)
+  case "$UNAME_M" in
+    x86_64|amd64) ARCH_STR='linux-amd64' ;;
+    aarch64|arm64) ARCH_STR='linux-arm64' ;;
+    *) ARCH_STR='linux-amd64' ;;
+  esac
+  info "Searching mkcert release for $ARCH_STR"
+  ASSET_URL=$(curl -sS "https://api.github.com/repos/FiloSottile/mkcert/releases/latest" | \
+    grep -E '"browser_download_url":' | grep -i "$ARCH_STR" | head -n1 | sed -E 's/.*"(https:[^"]+)".*/\1/')
+  if [[ -z "$ASSET_URL" ]]; then
+    ASSET_URL=$(curl -sS "https://api.github.com/repos/FiloSottile/mkcert/releases/latest" | \
+      grep -E '"browser_download_url":' | grep -i 'linux' | grep -i 'amd64' | head -n1 | sed -E 's/.*"(https:[^"]+)".*/\1/')
+  fi
+  if [[ -z "$ASSET_URL" ]]; then err "Could not find mkcert asset for your arch"; return 1; fi
+  TMP_BIN="$(mktemp -u /tmp/mkcert.XXXXXX)"
+  if curl -fSL -o "$TMP_BIN" "$ASSET_URL"; then
+    $SUDO mv "$TMP_BIN" /usr/local/bin/mkcert
+    $SUDO chmod +x /usr/local/bin/mkcert
+    info "mkcert installed to /usr/local/bin/mkcert"
+    return 0
+  fi
+  return 1
+}
+
+use_mkcert() {
+  if ! command -v mkcert >/dev/null 2>&1; then
+    info "mkcert not found — attempting to download/install binary"
+    download_mkcert_binary || return 1
+  fi
+  MKCERT_BIN="$(command -v mkcert || echo /usr/local/bin/mkcert)"
+  info "Running mkcert -install as sudo (if necessary)"
+  if ! $SUDO "$MKCERT_BIN" -install >/dev/null 2>&1; then
+    if ! "$MKCERT_BIN" -install >/dev/null 2>&1; then
+      err "mkcert -install failed"; return 1
+    fi
+  fi
+  MK_ARGS=()
+  for d in "${DOMAIN_ARR[@]}"; do MK_ARGS+=("$d"); done
+  info "Generating cert+key with mkcert"
+  if ! "$MKCERT_BIN" -cert-file "$CERT_FILE" -key-file "$KEY_FILE" "${MK_ARGS[@]}"; then err "mkcert failed to generate"; return 1; fi
+  # copy root CA from mkcert CAROOT into TARGET_DIR
+  if ROOT_FROM_MKCERT="$($MKCERT_BIN -CAROOT 2>/dev/null)"; then
+    if [[ -f "$ROOT_FROM_MKCERT/rootCA.pem" ]]; then
+      cp "$ROOT_FROM_MKCERT/rootCA.pem" "$ROOT_PEM"
+      info "Copied mkcert root CA to $ROOT_PEM"
+    fi
+  fi
+  # create fullchain (cert followed by root CA)
+  if [[ -f "$ROOT_PEM" ]]; then
+    cat "$CERT_FILE" "$ROOT_PEM" > "$FULLCHAIN_FILE"
+    info "Created fullchain: $FULLCHAIN_FILE"
+  else
+    cp "$CERT_FILE" "$FULLCHAIN_FILE"
+    info "No root CA found to append; fullchain contains only leaf cert: $FULLCHAIN_FILE"
+  fi
+  return 0
+}
+
+use_openssl() {
+  command -v openssl >/dev/null 2>&1 || { err "openssl required"; return 1; }
+  ROOT_KEY="$TARGET_DIR/rootCA.key"
+  if [[ ! -f "$ROOT_KEY" || ! -f "$ROOT_PEM" ]]; then
+    openssl genrsa -out "$ROOT_KEY" 4096
+    openssl req -x509 -new -nodes -key "$ROOT_KEY" -sha256 -days 3650 -out "$ROOT_PEM" -subj "/CN=Local Development Root CA"
+  fi
+  CSR_KEY="$TARGET_DIR/${NAME_SAFE}.key"
+  CSR_PEM="$TARGET_DIR/${NAME_SAFE}.csr"
+  openssl genrsa -out "$CSR_KEY" 2048
+  openssl req -new -key "$CSR_KEY" -out "$CSR_PEM" -subj "/CN=${DOMAIN_ARR[0]}"
+  V3EXT="$TARGET_DIR/v3.ext"
+  printf 'authorityKeyIdentifier=keyid,issuer\nbasicConstraints=CA:FALSE\nkeyUsage = digitalSignature, keyEncipherment\nsubjectAltName = @alt_names\n\n[alt_names]\n' > "$V3EXT"
+  DNS=1; IP=1
+  for d in "${DOMAIN_ARR[@]}"; do
+    if [[ "$d" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || [[ "$d" == *":"* ]]; then
+      printf 'IP.%d = %s\n' "$IP" "$d" >> "$V3EXT"; IP=$((IP+1))
+    else
+      printf 'DNS.%d = %s\n' "$DNS" "$d" >> "$V3EXT"; DNS=$((DNS+1))
+    fi
+  done
+  if openssl x509 -req -in "$CSR_PEM" -CA "$ROOT_PEM" -CAkey "$ROOT_KEY" -CAcreateserial -out "$CERT_FILE" -days 825 -sha256 -extfile "$V3EXT"; then
+    mv -f "$CSR_KEY" "$KEY_FILE"
+    # create fullchain: leaf + root
+    cat "$CERT_FILE" "$ROOT_PEM" > "$FULLCHAIN_FILE"
+    $SUDO cp "$ROOT_PEM" /etc/pki/ca-trust/source/anchors/
+    $SUDO update-ca-trust extract
+    if command -v certutil >/dev/null 2>&1; then
+      mkdir -p "$HOME/.pki/nssdb"
+      certutil -d sql:$HOME/.pki/nssdb -A -t "CT,C,C" -n "Local Dev Root CA" -i "$ROOT_PEM"
+    fi
+    info "OpenSSL created cert, key and fullchain"
+    return 0
+  fi
+  err "OpenSSL failed to create certificate"
+  return 1
+}
+
+# main
+if use_mkcert; then
+  info "Done: created cert, key, fullchain and root CA in $TARGET_DIR"
+  exit 0
+else
+  info "mkcert flow failed — trying OpenSSL fallback"
+  if use_openssl; then
+    info "Done: created cert, key, fullchain and root CA in $TARGET_DIR"
+    exit 0
+  fi
+fi
+
+err "Failed to create certificates with mkcert or OpenSSL"
+exit 2