Implement automatic tuwunel pipeline

Fix the path in coturn server configuration file

Update manual with actual information

Implement cli parameters instead of reading user input

Signed-off-by: Filip Wandzio <contact@philw.dev>

1 files changed, 247 insertions, 194 deletions

diff --git a/wh.sh b/wh.sh
index db1c12d..35de2b6 100755
--- a/wh.sh
+++ b/wh.sh
@@ -1,5 +1,11 @@
 #!/bin/sh
 set -eu
+ESCALATE=$(command -v sudo || command -v doas) || {
+    echo "[ERROR] Neither sudo nor doas found. Cannot run as root." >&2
+    exit 1
+}
+
+[ "$(id -u)" -eq 0 ] || exec $ESCALATE "$0" "$@"
 
 BASE_DIR="/opt/matrix"
 
@@ -10,15 +16,15 @@ DOCKER_COMPOSE=$(command -v docker-compose || command -v docker compose) || {
 
 usage() {
     cat <<'EOF'
-whiterabbit: auto-configure Matrix homeservers (Dendrite or Synapse)
+whiterabbit: auto-configure [matrix] Homeservers 
 with a global Coturn instance and Nginx + Let's Encrypt proxy.
 
-Main actions:
-  turn       Install or configure the global Coturn server
-  dendrite   Add a new Matrix server (Dendrite)
-  synapse    Add a new Matrix server (Synapse)
-  list       Show all configured Matrix servers
-  remove     Remove a Matrix server by domain
+Usage:
+  wh turn <domain> <ip> <device> <secret>
+  wh dendrite <matrix_domain> <email> <server_ip>
+  wh tuwunel <domain> <email> <server_ip>  
+  wh list
+  wh remove <domain1> [domain2 ...]
 EOF
     exit 1
 }
@@ -38,36 +44,35 @@ list_servers() {
         [ -d "$dir" ] || continue
         name=$(basename "$dir")
 
-        status=$(docker ps --filter "name=^${name}$" --format "{{.Status}}")
-        ports=$(docker ps --filter "name=^${name}$" --format "{{.Ports}}" | sed 's/, /\n   /g')
+        container_info=$(docker ps --format "{{.Names}} {{.Status}} {{.Ports}}" | grep "^${name}") || container_info=""
 
-        [ -n "$status" ] && {
+        [ -n "$container_info" ] && {
             echo "- $name [RUNNING] on:"
-            echo "   $ports"
+            echo "$container_info" | while read line; do
+                cname=$(echo "$line" | awk '{print $1}')
+                cstatus=$(echo "$line" | awk '{print $2}')
+                cports=$(echo "$line" | awk '{$1=$2=""; print $0}' | sed 's/^ //')
+                echo "   $cname : $cstatus, ports: $cports"
+            done
         } || echo "- $name [STOPPED]"
     done
 }
 
 install_turn() {
-    echo "=== Installing global Coturn ==="
-    printf "TURN domain (eg. turn.example.com): "
-    read -r TURN_DOMAIN
-    require_nonempty TURN_DOMAIN "$TURN_DOMAIN"
+    TURN_DOMAIN="$1"
+    TURN_SERVER_IP="$2"
+    TURN_LISTENING_DEVICE="$3"
+    TURN_SECRET="$4"
 
-    printf "TURN IP (eg. 127.0.0.1): "
-    read -r TURN_SERVER_IP
+    require_nonempty TURN_DOMAIN "$TURN_DOMAIN"
     require_nonempty TURN_SERVER_IP "$TURN_SERVER_IP"
-
-    printf "Listening device (eg. eth0): "
-    read -r TURN_LISTENING_DEVICE
     require_nonempty TURN_LISTENING_DEVICE "$TURN_LISTENING_DEVICE"
-
-    printf "TURN shared secret: "
-    read -r TURN_SECRET
     require_nonempty TURN_SECRET "$TURN_SECRET"
 
+    echo "=== Installing global Coturn ($TURN_DOMAIN) ==="
+
     mkdir -p /etc/turn
-    cat <<EOF > /etc/turn/turnserver.conf
+    cat <<EOF > /etc/turnserver.conf
 listening-device=$TURN_LISTENING_DEVICE
 listening-port=3478
 tls-listening-port=5349
@@ -95,20 +100,20 @@ EOF
 }
 
 common_prompts() {
-    printf "Matrix domain (eg. matrix.example.com): "
-    read -r MATRIX_DOMAIN
-    require_nonempty MATRIX_DOMAIN "$MATRIX_DOMAIN"
+    MATRIX_DOMAIN="$1"
+    EMAIL="$2"
+    MATRIX_SERVER_IP="$3"
 
-    printf "Let's Encrypt certificate email: "
-    read -r EMAIL
+    require_nonempty MATRIX_DOMAIN "$MATRIX_DOMAIN"
     require_nonempty EMAIL "$EMAIL"
+    require_nonempty MATRIX_SERVER_IP "$MATRIX_SERVER_IP"
+
     DB_PASS=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
     REG_SECRET=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 64)
-    printf "MATRIX server IP (eg. 127.0.0.1): "
-    read -r MATRIX_SERVER_IP
-    require_nonempty MATRIX_SERVER_IP "$MATRIX_SERVER_IP"
+
     TURN_DOMAIN=$(cat /etc/turn/domain)
     TURN_SECRET=$(cat /etc/turn/secret)
+
     HASH=$(printf "%s" "$MATRIX_DOMAIN" | cksum | cut -d ' ' -f1)
     PORT_BASE=$(( (HASH % 1000) + 8000 ))
     PORT_HTTP=$PORT_BASE
@@ -151,24 +156,67 @@ EOF
     ln -sf "/etc/nginx/sites-available/$DOMAIN" "/etc/nginx/sites-enabled/$DOMAIN"
     nginx -t || { echo "[ERROR] Invalid nginx config"; exit 1; }
 
-    
     case $(command -v systemctl >/dev/null && echo y || echo n) in
         y) systemctl reload nginx ;;
         n) nginx -s reload ;;
     esac
 
     case $(command -v certbot >/dev/null && echo y || echo n) in
-    y) certbot --nginx --non-interactive --agree-tos -m "$EMAIL" -d "$DOMAIN" || {
-         echo "[WARN] Certbot failed for $DOMAIN"
-         } ;;
-     n) echo "[WARN] Certbot not installed, skipping TLS setup" ;;
+        y) certbot --nginx --non-interactive --agree-tos -m "$EMAIL" -d "$DOMAIN" || {
+             echo "[WARN] Certbot failed for $DOMAIN"
+        } ;;
+        n) echo "[WARN] Certbot not installed, skipping TLS setup" ;;
     esac
 }
 
+install_tuwunel() {
+ echo "=== Installing Tuwunel ==="
+    common_prompts "$@"
+
+    INSTALL_DIR="$BASE_DIR/$MATRIX_DOMAIN"
+    mkdir -p "$INSTALL_DIR/config"
+    cd "$INSTALL_DIR" || exit 1
 
+    cat <<EOF > .env
+TUWUNEL_SERVER_NAME=$MATRIX_DOMAIN
+TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
+TUWUNEL_PORT=6167
+TUWUNEL_MAX_REQUEST_SIZE=20000000
+TUWUNEL_ALLOW_REGISTRATION=false
+TUWUNEL_REGISTRATION_TOKEN=$REG_SECRET
+TUWUNEL_ALLOW_ENCRYPTION=true
+TUWUNEL_ALLOW_FEDERATION=true
+TUWUNEL_TRUSTED_SERVERS='["matrix.org", "matrix.philw.dev"]'
+
+TUWUNEL_ADDRESS=0.0.0.0
+TUWUNEL_TURN_SECRET="$TURN_SECRET"
+TUWUNEL_TURN_URIS=["turn:$TURN_DOMAIN?transport=udp", "turn:$TURN_DOMAIN?transport=tcp"]
+TUWUNEL_NEW_USER_DISPLAYNAME_SUFFIX=""
+EOF
+
+cat <<EOF > compose.yml
+services:
+  homeserver:
+    image: jevolk/tuwunel:latest
+    container_name: tuw.philw.dev-tuwunel
+    restart: unless-stopped
+    ports:
+      - "$PORT_HTTP:6167"
+    volumes:
+      - db:/var/lib/tuwunel
+    env_file:
+      - .env
+volumes:
+  db:
+EOF
+
+    $DOCKER_COMPOSE up -d
+    configure_nginx "$MATRIX_DOMAIN" "$PORT_HTTP"
+    echo "[OK] Tuwunel server ($MATRIX_DOMAIN) is running."
+}
 install_dendrite() {
-    echo "=== Installing Matrix Dendrite ==="
-    common_prompts
+    echo "=== Installing Dendrite ==="
+    common_prompts "$@"
 
     INSTALL_DIR="$BASE_DIR/$MATRIX_DOMAIN"
     mkdir -p "$INSTALL_DIR/config"
@@ -309,192 +357,197 @@ dns_cache:
 EOF
 
     echo "[INFO] Generating Dendrite keys..."
-
-    docker run --rm --entrypoint=""   -v $(pwd):/mnt   matrixdotorg/dendrite-monolith:latest   /usr/bin/generate-keys   -private-key /mnt/matrix_key.pem   -tls-cert /mnt/server.crt   -tls-key /mnt/server.key
-        echo "[OK] Keys generated in $PWD"
+    docker run --rm --entrypoint="" -v "$(pwd)":/mnt matrixdotorg/dendrite-monolith:latest \
+      /usr/bin/generate-keys -private-key /mnt/matrix_key.pem -tls-cert /mnt/server.crt -tls-key /mnt/server.key
+    echo "[OK] Keys generated in $PWD"
 
     $DOCKER_COMPOSE up -d
     configure_nginx "$MATRIX_DOMAIN" "$PORT_HTTP"
     echo "[OK] Dendrite server ($MATRIX_DOMAIN) is running."
 }
 
-install_synapse() {
-    echo "=== Installing Matrix Synapse ==="
-    common_prompts
-
-    INSTALL_DIR="$BASE_DIR/$MATRIX_DOMAIN"
-    mkdir -p "$INSTALL_DIR"
-    cd "$INSTALL_DIR" || exit 1
-    mkdir -p data db
-    chown -R 991:991 data/
-    chown -R 999:999 db/
-    DB_USER="synapse"
-    DB_NAME="synapse"
-    DB_PASS=$(openssl rand -hex 16)
-    REG_SECRET=$(openssl rand -hex 32)
-
-    : "${PORT_HTTP:=8008}"
-    : "${PORT_HTTPS:=8448}"
-
-    cat <<EOF > .env
-# Matrix Synapse environment
-MATRIX_DOMAIN=$MATRIX_DOMAIN
-PORT_HTTP=$PORT_HTTP
-PORT_HTTPS=$PORT_HTTPS
-
-DB_USER=$DB_USER
-DB_NAME=$DB_NAME
-DB_PASS=$DB_PASS
-
-REG_SECRET=$REG_SECRET
-TURN_DOMAIN=$TURN_DOMAIN
-TURN_SECRET=$TURN_SECRET
-EOF
-
-
-cat <<EOF > compose.yml
-services:
-  db:
-    image: postgres:15-alpine
-    restart: always
-    environment:
-      POSTGRES_USER: ${DB_USER}
-      POSTGRES_PASSWORD: ${DB_PASS}
-      POSTGRES_DB: ${DB_NAME}
-      LANG: C
-      LC_ALL: C
-    command: postgres -c lc_collate=C -c lc_ctype=C
-    volumes:
-      - ./db:/var/lib/postgresql/data
-    networks:
-      - synapse-net
-
-  synapse:
-    image: matrixdotorg/synapse:latest
-    restart: always
-    depends_on:
-      - db
-    environment:
-      SYNAPSE_SERVER_NAME: ${MATRIX_DOMAIN}
-      SYNAPSE_REPORT_STATS: "yes"
-    ports:
-      - "${PORT_HTTP}:8008"
-      - "${PORT_HTTPS}:8448"
-    volumes:
-      - ./data:/data
-    networks:
-      - synapse-net
-
-networks:
-  synapse-net:
-    driver: bridge
-EOF
-
-$DOCKER_COMPOSE --env-file .env up -d
-docker run -it --rm -v ./data:/data -e SYNAPSE_SERVER_NAME=$MATRIX_DOMAIN -e SYNAPSE_REPORT_STATS=no matrixdotorg/synapse:latest generate
-
-echo "[INFO] Generating homeserver.yaml for Postgres + TURN..."
-cat <<EOF > data/homeserver.yaml
-server_name: $MATRIX_DOMAIN
-pid_file: /data/homeserver.pid
-
-listeners:
-  - port: $PORT_HTTP
-    tls: false
-    type: http
-    x_forwarded: true
-    resources:
-      - names: [client, federation]
-        compress: false
-
-database:
-  name: psycopg2
-  args:
-    user: $DB_USER
-    password: $DB_PASS
-    host: db
-    database: $DB_NAME
-    cp_min: 5
-    cp_max: 10
-
-enable_registration: false
-registration_shared_secret: "$REG_SECRET"
-
-turn_uris:
-  - turn:$TURN_DOMAIN?transport=udp
-  - turn:$TURN_DOMAIN?transport=tcp
-turn_shared_secret: "$TURN_SECRET"
-turn_user_lifetime: "5m"
-
-log_config: "/data/$MATRIX_DOMAIN.log.config"
-media_store_path: /data/media_store
-report_stats: false
-
-macaroon_secret_key: $REG_SECRET
-form_secret: $REG_SECRET
-signing_key_path: "/data/$MATRIX_DOMAIN.signing.key"
-
-trusted_key_servers:
-  - server_name: "matrix.org"
-suppress_key_server_warning: true
-EOF
-
-    echo "[INFO] Restarting Synapse with full config..."
-    $DOCKER_COMPOSE --env-file .env restart synapse
-    $DOCKER_COMPOSE --env-file .env restart synapse
-
-    configure_nginx "$MATRIX_DOMAIN" "$PORT_HTTP"
-    echo "[OK] Synapse server ($MATRIX_DOMAIN) is running with Postgres."
-}
-
+# @TODO STILL BROKEN
+# install_synapse() {
+#     echo "=== Installing Synapse ==="
+#     MATRIX_DOMAIN="$1"
+#     EMAIL="$2"
+#     MATRIX_SERVER_IP="$3"
+#
+#     require_nonempty MATRIX_DOMAIN "$MATRIX_DOMAIN"
+#     require_nonempty EMAIL "$EMAIL"
+#     require_nonempty MATRIX_SERVER_IP "$MATRIX_SERVER_IP"
+#
+#     INSTALL_DIR="$BASE_DIR/$MATRIX_DOMAIN"
+#     mkdir -p "$INSTALL_DIR"
+#     cd "$INSTALL_DIR" || exit 1
+#     mkdir -p data db
+#
+#     DB_USER="synapse"
+#     DB_NAME="synapse"
+#     DB_PASS=$(openssl rand -hex 16)
+#     REG_SECRET=$(openssl rand -hex 32)
+#     if command -v docker-compose >/dev/null 2>&1; then
+#         DOCKER_COMPOSE_CMD="docker-compose"
+#     elif command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
+#         DOCKER_COMPOSE_CMD="docker compose"
+#     else
+#         echo "[ERROR] Neither docker-compose nor docker compose available" >&2
+#         exit 1
+#     fi
+#
+#     PORT_HTTP=${PORT_HTTP:-8008}
+#     PORT_HTTPS=${PORT_HTTPS:-8448}
+#     TURN_DOMAIN=$(cat /etc/turn/domain 2>/dev/null || true)
+#     TURN_SECRET=$(cat /etc/turn/secret 2>/dev/null || true)
+#     cat > .env <<EOF
+# MATRIX_DOMAIN=${MATRIX_DOMAIN}
+# PORT_HTTP=${PORT_HTTP}
+# PORT_HTTPS=${PORT_HTTPS}
+#
+# DB_USER=${DB_USER}
+# DB_NAME=${DB_NAME}
+# DB_PASS=${DB_PASS}
+#
+# REG_SECRET=${REG_SECRET}
+# TURN_DOMAIN=${TURN_DOMAIN}
+# TURN_SECRET=${TURN_SECRET}
+# EOF
+#     cat > compose.yml <<EOF
+# services:
+#   db:
+#     image: postgres:15-alpine
+#     container_name: ${MATRIX_DOMAIN}-db
+#     restart: always
+#     environment:
+#       POSTGRES_USER: ${DB_USER}
+#       POSTGRES_PASSWORD: ${DB_PASS}
+#       POSTGRES_DB: ${DB_NAME}
+#       LANG: C
+#       LC_COLLATE: C
+#       LC_CTYPE: C
+#     volumes:
+#       - ./db:/var/lib/postgresql/data
+#     healthcheck:
+#       test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
+#       interval: 5s
+#       timeout: 5s
+#       retries: 5
+#
+#   synapse:
+#     image: matrixdotorg/synapse:latest
+#     container_name: ${MATRIX_DOMAIN}-synapse
+#     restart: always
+#     depends_on:
+#       db:
+#         condition: service_healthy
+#     environment:
+#       SYNAPSE_SERVER_NAME: ${MATRIX_DOMAIN}
+#       SYNAPSE_REPORT_STATS: "no"
+#       POSTGRES_DB: ${DB_NAME}
+#       POSTGRES_USER: ${DB_USER}
+#       POSTGRES_PASSWORD: ${DB_PASS}
+#       POSTGRES_HOST: db
+#     volumes:
+#       - ./data:/data
+#     ports:
+#       - "${PORT_HTTP}:8008"
+#       - "${PORT_HTTPS}:8448"
+# EOF
+# docker run --rm -v "$(pwd)/data:/data" \
+#   -e SYNAPSE_SERVER_NAME="${MATRIX_DOMAIN}" \
+#   -e SYNAPSE_REPORT_STATS="no" \
+#   matrixdotorg/synapse:latest generate
+#     cat > data/homeserver.yaml <<EOF
+# server_name: "${MATRIX_DOMAIN}"
+# pid_file: /data/homeserver.pid
+#
+# listeners:
+#   - port: ${PORT_HTTP}
+#     tls: false
+#     type: http
+#     x_forwarded: true
+#     resources:
+#       - names: [client, federation]
+#         compress: false
+#
+# database:
+#   name: psycopg2
+#   args:
+#     user: "${DB_USER}"
+#     password: "${DB_PASS}"
+#     host: db
+#     database: "${DB_NAME}"
+#     cp_min: 5
+#     cp_max: 10
+#
+# enable_registration: false
+# registration_shared_secret: "${REG_SECRET}"
+#
+# turn_uris:
+#   - turn:${TURN_DOMAIN}?transport=udp
+#   - turn:${TURN_DOMAIN}?transport=tcp
+# turn_shared_secret: "${TURN_SECRET}"
+# turn_user_lifetime: "5m"
+#
+# log_config: "/data/${MATRIX_DOMAIN}.log.config"
+# media_store_path: /data/media_store
+# report_stats: false
+#
+# macaroon_secret_key: "${REG_SECRET}"
+# form_secret: "${REG_SECRET}"
+# signing_key_path: "/data/${MATRIX_DOMAIN}.signing.key"
+#
+# trusted_key_servers:
+#   - server_name: "matrix.org"
+# suppress_key_server_warning: true
+# EOF
+#
+#     if [ "$DOCKER_COMPOSE_CMD" = "docker compose" ]; then
+#         eval "$DOCKER_COMPOSE_CMD --env-file .env up -d"
+#     else
+#         $DOCKER_COMPOSE_CMD --env-file .env up -d
+#     fi
+#
+#     sleep 3
+#     if [ "$DOCKER_COMPOSE_CMD" = "docker compose" ]; then
+#         eval "$DOCKER_COMPOSE_CMD --env-file .env restart synapse"
+#     else
+#         $DOCKER_COMPOSE_CMD --env-file .env restart synapse
+#     fi
+#
+#     configure_nginx "$MATRIX_DOMAIN" "$PORT_HTTP"
+#     echo "[OK] Synapse server ($MATRIX_DOMAIN) is running with Postgres."
+# }
 
 remove_server() {
     [ "$#" -eq 0 ] && echo "Usage: remove_server <domain1> [domain2 ...]" && return 1
-
     for DOMAIN in "$@"; do
         SERVER_DIR="$BASE_DIR/$DOMAIN"
-
         case "$DOMAIN" in
             ""|"/"|".") 
                 echo "[ERROR] Refusing to delete dangerous path ($DOMAIN)"
                 continue
                 ;;
         esac
-
         [ -d "$SERVER_DIR" ] && \
             echo "[INFO] Stopping and removing server: $DOMAIN" && \
             (cd "$SERVER_DIR" && $DOCKER_COMPOSE down -v) || \
             echo "[WARN] Failed to stop container for $DOMAIN"
-
         rm -rf "$SERVER_DIR"
         rm -f "/etc/nginx/sites-available/$DOMAIN" "/etc/nginx/sites-enabled/$DOMAIN"
     done
-
     nginx -t && (systemctl reload nginx 2>/dev/null || nginx -s reload)
     echo "[OK] Done removing servers: $*"
 }
 
 CMD="${1:-}"
-
 case "$CMD" in
-    -t) install_turn ;;
-    -d) install_dendrite ;;
-    -s) install_synapse ;;
-    -l) list_servers ;;
-    -r) 
-        [ -z "$2" ] && { echo "Usage: $0 -r <domain1> [domain2 ...]"; exit 1; }
-        shift
-        remove_server "$@"
-        ;;
-    turn) install_turn ;;
-    dendrite) install_dendrite ;;
-    synapse) install_synapse ;;
+    turn) shift; install_turn "$@" ;;
+    dendrite) shift; install_dendrite "$@" ;;
+    # synapse) shift; install_synapse "$@" ;;
+    tuwunel) shift; install_tuwunel "$@" ;;
     list) list_servers ;;
-    remove) 
-        [ -z "$2" ] && { echo "Usage: $0 remove <domain1> [domain2 ...]"; exit 1; }
-        shift
-        remove_server "$@"
-        ;;
+    remove) shift; remove_server "$@" ;;
     *) usage ;;
 esac