myron/novacpx
1
0
Fork 0
mirror of https://github.com/myronblair/novacpx synced 2026-06-30 17:50:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' of https://github.com/myronblair/novacpx

Browse Source 
# Conflicts:
#	db/migrations/002_features_14_17.sql
This commit is contained in:
Myron Blair
2026-06-08 01:22:31 +00:00
parent 6fdccc6dbd 88e98b4727
commit aa93695459
13 changed files with 1181 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
panel/lib/AccountManager.php
+24 -13
View File
@@ -28,9 +28,9 @@ class AccountManager {
// Create Linux user
self::shell("useradd -m -d {$homeDir} -s /sbin/nologin -G www-data " . escapeshellarg($username));
self::shell("echo " . escapeshellarg("{$username}:{$password}") . " | chpasswd");
self::shell("mkdir -p {$docRoot} {$homeDir}/logs {$homeDir}/tmp");
self::shell("chown -R {$username}:www-data {$homeDir}");
self::shell("chmod 750 {$homeDir}; chmod 755 {$docRoot}");
self::shell("sudo mkdir -p {$docRoot} {$homeDir}/logs {$homeDir}/tmp");
self::shell("sudo chown -R {$username}:www-data {$homeDir}");
self::shell("sudo chmod 750 {$homeDir}"); self::shell("sudo chmod 775 {$docRoot}");
// Default index page
file_put_contents("{$docRoot}/index.html",
@@ -116,9 +116,9 @@ class AccountManager {
public static function provisionEmailDNS(int $acctId, string $domain): void {
// Generate DKIM keypair
$keyDir = "/etc/opendkim/keys/{$domain}";
self::shell("mkdir -p " . escapeshellarg($keyDir));
self::shell("sudo mkdir -p " . escapeshellarg($keyDir));
self::shell("opendkim-genkey -b 2048 -s mail -d " . escapeshellarg($domain) . " -D " . escapeshellarg($keyDir));
self::shell("chown -R opendkim:opendkim " . escapeshellarg($keyDir));
self::shell("sudo chown -R opendkim:opendkim " . escapeshellarg($keyDir));
// Parse public key from .txt file
$keyTxt = @file_get_contents("{$keyDir}/mail.txt") ?: '';
@@ -139,13 +139,17 @@ class AccountManager {
);
// DKIM TXT record
DNSManager::addRecord($acctId, $domain, 'TXT', "mail._domainkey", "v=DKIM1; k=rsa; p={$pubKey}", 300);
$zoneRow = DB::getInstance()->fetchOne("SELECT id FROM dns_zones WHERE account_id=? AND domain=?", [$acctId, $domain]);
if ($zoneRow) DNSManager::addRecord((int)$zoneRow['id'], 'mail._domainkey', 'TXT', "v=DKIM1; k=rsa; p={$pubKey}", 300);
}
// SPF
DNSManager::addRecord($acctId, $domain, 'TXT', '@', "v=spf1 mx a ~all", 300);
// DMARC
DNSManager::addRecord($acctId, $domain, 'TXT', '_dmarc', "v=DMARC1; p=quarantine; rua=mailto:dmarc@{$domain}", 300);
// SPF + DMARC — look up zone once
$db2 = DB::getInstance();
$zoneRow = $zoneRow ?? $db2->fetchOne("SELECT id FROM dns_zones WHERE account_id=? AND domain=?", [$acctId, $domain]);
if ($zoneRow) {
DNSManager::addRecord((int)$zoneRow['id'], '@', 'TXT', "v=spf1 mx a ~all", 3600);
DNSManager::addRecord((int)$zoneRow['id'], '_dmarc', 'TXT', "v=DMARC1; p=quarantine; rua=mailto:dmarc@{$domain}", 3600);
}
novacpx_log('info', "Email DNS provisioned for $domain");
}
@@ -154,9 +158,9 @@ class AccountManager {
$db = DB::getInstance();
$selector = 'mail' . date('Ym');
$keyDir = "/etc/opendkim/keys/{$domain}";
self::shell("mkdir -p " . escapeshellarg($keyDir));
self::shell("sudo mkdir -p " . escapeshellarg($keyDir));
self::shell("opendkim-genkey -b 2048 -s {$selector} -d " . escapeshellarg($domain) . " -D " . escapeshellarg($keyDir));
self::shell("chown -R opendkim:opendkim " . escapeshellarg($keyDir));
self::shell("sudo chown -R opendkim:opendkim " . escapeshellarg($keyDir));
$keyTxt = @file_get_contents("{$keyDir}/{$selector}.txt") ?: '';
preg_match('/p=([A-Za-z0-9+\/=]+)/', $keyTxt, $m);
@@ -174,7 +178,8 @@ class AccountManager {
);
// Add new TXT record, remove old mail._domainkey
DNSManager::addRecord($acctId, $domain, 'TXT', "{$selector}._domainkey", "v=DKIM1; k=rsa; p={$pubKey}", 300);
$zoneRow = $db->fetchOne("SELECT id FROM dns_zones WHERE account_id=? AND domain=?", [$acctId, $domain]);
if ($zoneRow) DNSManager::addRecord((int)$zoneRow['id'], "{$selector}._domainkey", 'TXT', "v=DKIM1; k=rsa; p={$pubKey}", 300);
novacpx_log('info', "DKIM rotated for $domain, new selector: $selector");
return $selector;
}
@@ -185,6 +190,12 @@ class AccountManager {
}
private static function shell(string $cmd): string {
// Prefix privileged commands with sudo so www-data can run them
$privileged = ['useradd','userdel','usermod','chpasswd','a2ensite','a2dissite','apache2ctl','certbot','opendkim-genkey','rndc','named-checkzone','systemctl'];
$cmdBase = explode(' ', ltrim($cmd))[0];
foreach ($privileged as $p) {
if (str_ends_with($cmdBase, $p) || $cmdBase === $p) { $cmd = 'sudo ' . $cmd; break; }
}
$out = shell_exec($cmd . ' 2>&1');
novacpx_log('debug', "shell: $cmd");
return $out ?: '';
panel/lib/Auth.php
+29 -2
View File
@@ -1,8 +1,13 @@
<?php
if (!class_exists('TOTP')) require_once __DIR__ . '/TOTP.php';
class Auth {
private static ?Auth $instance = null;
private ?array $user = null;
// Returned by attempt() when password is correct but TOTP code still needed
public const TOTP_REQUIRED = 'TOTP_REQUIRED';
private function __construct() {}
public static function getInstance(): self {
@@ -54,14 +59,36 @@ class Auth {
return true;
}
public function attempt(string $username, string $password): ?string {
$db = DB::getInstance();
/**
* Returns null (bad credentials), self::TOTP_REQUIRED (need 2FA code), or session token string.
*/
public function attempt(string $username, string $password, ?string $totpCode = null): ?string {
$db = DB::getInstance();
$user = $db->fetchOne(
"SELECT * FROM users WHERE (username = ? OR email = ?) AND status = 'active'",
[$username, $username]
);
if (!$user || !password_verify($password, $user['password'])) return null;
// TOTP check
if (!empty($user['totp_enabled'])) {
if ($totpCode === null) {
$this->user = $user;
return self::TOTP_REQUIRED;
}
$verified = TOTP::verify($user['totp_secret'] ?? '', $totpCode);
if (!$verified && !empty($user['totp_backup_codes'])) {
$verified = TOTP::verifyBackupCode($totpCode, $user['totp_backup_codes']);
if ($verified) {
// Consume used backup code
$hashes = json_decode($user['totp_backup_codes'], true) ?? [];
$hashes = array_values(array_filter($hashes, fn($h) => !password_verify(strtoupper($totpCode), $h)));
$db->execute("UPDATE users SET totp_backup_codes=? WHERE id=?", [json_encode($hashes), $user['id']]);
}
}
if (!$verified) return null;
}
// Create session
$token = bin2hex(random_bytes(32));
$sessionId = hash('sha256', $token);
panel/lib/DNSManager.php
+4 -4
View File
@@ -26,7 +26,6 @@ class DNSManager {
['www', 'A', $ip, 3600, null],
['mail', 'A', $ip, 3600, null],
['@', 'MX', "mail.{$domain}.", 3600, 10],
['@', 'TXT', "v=spf1 a mx ~all", 3600, null],
];
foreach ($defaults as [$name, $type, $content, $ttl, $prio]) {
$db->execute(
@@ -127,13 +126,14 @@ class DNSManager {
// Include in main named.conf if not already there
$mainConf = '/etc/bind/named.conf';
if (file_exists($mainConf) && !str_contains(file_get_contents($mainConf), 'named.conf.novacpx')) {
file_put_contents($mainConf, "\ninclude \"" . self::$namedConf . "\";\n", FILE_APPEND);
if (file_exists($mainConf) && !str_contains(file_get_contents($mainConf) ?: '', 'named.conf.novacpx')) {
$line = "\ninclude \"" . self::$namedConf . "\";\n";
shell_exec("echo " . escapeshellarg($line) . " | sudo tee -a {$mainConf} > /dev/null 2>&1");
}
}
private static function reloadBind(): void {
shell_exec("rndc reload 2>/dev/null || systemctl reload named 2>/dev/null || true");
shell_exec("sudo rndc reload 2>/dev/null || sudo systemctl reload named 2>/dev/null || sudo systemctl reload bind9 2>/dev/null || true");
}
private static function serverIp(): string {