diff --git a/LICENSE.md b/LICENSE.md deleted file mode 100644 index 9827b9d..0000000 --- a/LICENSE.md +++ /dev/null @@ -1,661 +0,0 @@ -### GNU AFFERO GENERAL PUBLIC LICENSE - -Version 3, 19 November 2007 - -Copyright (C) 2007 Free Software Foundation, Inc. - - -Everyone is permitted to copy and distribute verbatim copies of this -license document, but changing it is not allowed. - -### Preamble - -The GNU Affero General Public License is a free, copyleft license for -software and other kinds of works, specifically designed to ensure -cooperation with the community in the case of network server software. - -The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -our General Public Licenses are intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains -free software for all its users. - -When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - -Developers that use our General Public Licenses protect your rights -with two steps: (1) assert copyright on the software, and (2) offer -you this License which gives you legal permission to copy, distribute -and/or modify the software. - -A secondary benefit of defending all users' freedom is that -improvements made in alternate versions of the program, if they -receive widespread use, become available for other developers to -incorporate. Many developers of free software are heartened and -encouraged by the resulting cooperation. However, in the case of -software used on network servers, this result may fail to come about. -The GNU General Public License permits making a modified version and -letting the public access it on a server without ever releasing its -source code to the public. - -The GNU Affero General Public License is designed specifically to -ensure that, in such cases, the modified source code becomes available -to the community. It requires the operator of a network server to -provide the source code of the modified version running there to the -users of that server. Therefore, public use of a modified version, on -a publicly accessible server, gives the public access to the source -code of the modified version. - -An older license, called the Affero General Public License and -published by Affero, was designed to accomplish similar goals. This is -a different license, not a version of the Affero GPL, but Affero has -released a new version of the Affero GPL which permits relicensing -under this license. - -The precise terms and conditions for copying, distribution and -modification follow. - -### TERMS AND CONDITIONS - -#### 0. Definitions. - -"This License" refers to version 3 of the GNU Affero General Public -License. - -"Copyright" also means copyright-like laws that apply to other kinds -of works, such as semiconductor masks. - -"The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - -To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of -an exact copy. The resulting work is called a "modified version" of -the earlier work or a work "based on" the earlier work. - -A "covered work" means either the unmodified Program or a work based -on the Program. - -To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - -To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user -through a computer network, with no transfer of a copy, is not -conveying. - -An interactive user interface displays "Appropriate Legal Notices" to -the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - -#### 1. Source Code. - -The "source code" for a work means the preferred form of the work for -making modifications to it. "Object code" means any non-source form of -a work. - -A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - -The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - -The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - -The Corresponding Source need not include anything that users can -regenerate automatically from other parts of the Corresponding Source. - -The Corresponding Source for a work in source code form is that same -work. - -#### 2. Basic Permissions. - -All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - -You may make, run and propagate covered works that you do not convey, -without conditions so long as your license otherwise remains in force. -You may convey covered works to others for the sole purpose of having -them make modifications exclusively for you, or provide you with -facilities for running those works, provided that you comply with the -terms of this License in conveying all material for which you do not -control copyright. Those thus making or running the covered works for -you must do so exclusively on your behalf, under your direction and -control, on terms that prohibit them from making any copies of your -copyrighted material outside their relationship with you. - -Conveying under any other circumstances is permitted solely under the -conditions stated below. Sublicensing is not allowed; section 10 makes -it unnecessary. - -#### 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - -No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - -When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such -circumvention is effected by exercising rights under this License with -respect to the covered work, and you disclaim any intention to limit -operation or modification of the work as a means of enforcing, against -the work's users, your or third parties' legal rights to forbid -circumvention of technological measures. - -#### 4. Conveying Verbatim Copies. - -You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - -You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - -#### 5. Conveying Modified Source Versions. - -You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these -conditions: - -- a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. -- b) The work must carry prominent notices stating that it is - released under this License and any conditions added under - section 7. This requirement modifies the requirement in section 4 - to "keep intact all notices". -- c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. -- d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - -A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - -#### 6. Conveying Non-Source Forms. - -You may convey a covered work in object code form under the terms of -sections 4 and 5, provided that you also convey the machine-readable -Corresponding Source under the terms of this License, in one of these -ways: - -- a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. -- b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the Corresponding - Source from a network server at no charge. -- c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. -- d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. -- e) Convey the object code using peer-to-peer transmission, - provided you inform other peers where the object code and - Corresponding Source of the work are being offered to the general - public at no charge under subsection 6d. - -A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - -A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, -family, or household purposes, or (2) anything designed or sold for -incorporation into a dwelling. In determining whether a product is a -consumer product, doubtful cases shall be resolved in favor of -coverage. For a particular product received by a particular user, -"normally used" refers to a typical or common use of that class of -product, regardless of the status of the particular user or of the way -in which the particular user actually uses, or expects or is expected -to use, the product. A product is a consumer product regardless of -whether the product has substantial commercial, industrial or -non-consumer uses, unless such uses represent the only significant -mode of use of the product. - -"Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to -install and execute modified versions of a covered work in that User -Product from a modified version of its Corresponding Source. The -information must suffice to ensure that the continued functioning of -the modified object code is in no case prevented or interfered with -solely because modification has been made. - -If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - -The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or -updates for a work that has been modified or installed by the -recipient, or for the User Product in which it has been modified or -installed. Access to a network may be denied when the modification -itself materially and adversely affects the operation of the network -or violates the rules and protocols for communication across the -network. - -Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - -#### 7. Additional Terms. - -"Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - -When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - -Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders -of that material) supplement the terms of this License with terms: - -- a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or -- b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or -- c) Prohibiting misrepresentation of the origin of that material, - or requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or -- d) Limiting the use for publicity purposes of names of licensors - or authors of the material; or -- e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or -- f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions - of it) with contractual assumptions of liability to the recipient, - for any liability that these contractual assumptions directly - impose on those licensors and authors. - -All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - -If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - -Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; the -above requirements apply either way. - -#### 8. Termination. - -You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - -However, if you cease all violation of this License, then your license -from a particular copyright holder is reinstated (a) provisionally, -unless and until the copyright holder explicitly and finally -terminates your license, and (b) permanently, if the copyright holder -fails to notify you of the violation by some reasonable means prior to -60 days after the cessation. - -Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - -Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - -#### 9. Acceptance Not Required for Having Copies. - -You are not required to accept this License in order to receive or run -a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - -#### 10. Automatic Licensing of Downstream Recipients. - -Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - -An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - -You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - -#### 11. Patents. - -A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - -A contributor's "essential patent claims" are all patent claims owned -or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - -Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - -In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - -If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - -If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - -A patent license is "discriminatory" if it does not include within the -scope of its coverage, prohibits the exercise of, or is conditioned on -the non-exercise of one or more of the rights that are specifically -granted under this License. You may not convey a covered work if you -are a party to an arrangement with a third party that is in the -business of distributing software, under which you make payment to the -third party based on the extent of your activity of conveying the -work, and under which the third party grants, to any of the parties -who would receive the covered work from you, a discriminatory patent -license (a) in connection with copies of the covered work conveyed by -you (or copies made from those copies), or (b) primarily for and in -connection with specific products or compilations that contain the -covered work, unless you entered into that arrangement, or that patent -license was granted, prior to 28 March 2007. - -Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - -#### 12. No Surrender of Others' Freedom. - -If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under -this License and any other pertinent obligations, then as a -consequence you may not convey it at all. For example, if you agree to -terms that obligate you to collect a royalty for further conveying -from those to whom you convey the Program, the only way you could -satisfy both those terms and this License would be to refrain entirely -from conveying the Program. - -#### 13. Remote Network Interaction; Use with the GNU General Public License. - -Notwithstanding any other provision of this License, if you modify the -Program, your modified version must prominently offer all users -interacting with it remotely through a computer network (if your -version supports such interaction) an opportunity to receive the -Corresponding Source of your version by providing access to the -Corresponding Source from a network server at no charge, through some -standard or customary means of facilitating copying of software. This -Corresponding Source shall include the Corresponding Source for any -work covered by version 3 of the GNU General Public License that is -incorporated pursuant to the following paragraph. - -Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the work with which it is combined will remain governed by version -3 of the GNU General Public License. - -#### 14. Revised Versions of this License. - -The Free Software Foundation may publish revised and/or new versions -of the GNU Affero General Public License from time to time. Such new -versions will be similar in spirit to the present version, but may -differ in detail to address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies that a certain numbered version of the GNU Affero General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU Affero General Public License, you may choose any version ever -published by the Free Software Foundation. - -If the Program specifies that a proxy can decide which future versions -of the GNU Affero General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - -Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - -#### 15. Disclaimer of Warranty. - -THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT -WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND -PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE -DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR -CORRECTION. - -#### 16. Limitation of Liability. - -IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR -CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES -ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT -NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR -LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM -TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER -PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. - -#### 17. Interpretation of Sections 15 and 16. - -If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - -END OF TERMS AND CONDITIONS - -### How to Apply These Terms to Your New Programs - -If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these -terms. - -To do so, attach the following notices to the program. It is safest to -attach them to the start of each source file to most effectively state -the exclusion of warranty; and each file should have at least the -"copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as - published by the Free Software Foundation, either version 3 of the - License, or (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper -mail. - -If your software can interact with users remotely through a computer -network, you should also make sure that it provides a way for users to -get its source. For example, if your program is a web application, its -interface could display a "Source" link that leads users to an archive -of the code. There are many ways you could offer source, and different -solutions will be better for different programs; see section 13 for -the specific requirements. - -You should also get your employer (if you work as a programmer) or -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. For more information on this, and how to apply and follow -the GNU AGPL, see . - diff --git a/README.md b/README.md index 0217cfc..631c2f9 100644 --- a/README.md +++ b/README.md @@ -1,48 +1,79 @@ -# What is this? # -This neat script provides a little fake API to unlock all premium/enterprise/enterprise+ (here called ultimate) features of your own Pritunl VPN server. If Pritunl wouldn't be mostly free already, you could call this a crack. An Open Source crack. +### Назначение +Адаптация проекта https://github.com/simonmicro/Pritunl-Fake-API для развертывания API сервера Pritunl на том же сервере, где запущен VPN сервер Pritunl. -## How to setup (server) ## -Take a look into the `server` folder: You _could_ use the Pritunl source there (or just download this specific version from their GitHub repo) to compile a guaranteed compatible version for this API or just download any other version of the Pritunl server and try your luck. -Then you'll need to execute the `setup.py` script (preferable as `root`, as it needs to modify the Pritunl files directly). -After that log in into the dashboard - there should be a "Update Notification": +Протестировано на +- Ubuntu Server 22.04 LTS +- pritunl/now 1.32.3552.76-0ubuntu1~jammy -![login-msg](docs/login-msg.png) +при использовании клиента OpenVPN. Использование официального клиента Pritunl не тестировалось. -Now try to enter any serial key for your subscription and just follow the hints/notes if you enter an invalid command: +### Как это работает +1. В Docker запускается вебсервер с FakeAPI сервера лицензирования Pritunl +2. В конфигурационных файлах Pritunl подменяется адрес API сервера лиценизирования Pritunl на `pritunl-fakeapi.local` +3. В /etc/hosts вносится запись `127.0.0.1 pritunl-fakeapi.local` +4. Используются самоподписанные сертификаты для обеспечения TLS между Pritunl и FakeAPI сервером лицензирования -![enter-something](docs/enter-something.png) +### Требования +1. Ubuntu Server 22.04 LTS +2. Установленный Docker Compose +3. Установленный Pritunl с бесплатной лицензией +4. Порт веб интерфейса Pritunl сменен со стандартного 443 на любой свободный, кроме 80 и 443 -A valid command would be `bad premium` or `active ultimate`: +### Установка +1. (Рекомендуется) зафиксировать версию Pritunl +``` +sudo apt-mark hold pritunl* +``` +2. Клонировать репозиторий /opt/pritunl-fakeapi +``` +sudo mkdir /opt/pritunl-fakeapi -p && \ +sudo chown ${USER}:${USER} /opt/pritunl-fakeapi && \ +git clone https://github.com/nd4y/Pritunl-Fake-API.git /opt/pritunl-fakeapi && \ +cd /opt/pritunl-fakeapi +``` +3. (Рекомендуется) сгенерировать сертификаты удостоверяющего центра и сервера. (команды для выпуска сертификатов протестированы на OpenSSL 1.1.1w) + 1. Перейти в каталог `cd /opt/pritunl-fakeapi/mounts/nginx/certs` и удалить имеющиеся сертификаты `rm -f *.pem` + 2. Выпустить сертификат удостоверяющго центра + ``` + openssl req -x509 -newkey rsa:4096 -keyout ca.key.pem -out ca.crt.pem -sha256 -days 3650 -nodes -subj "/CN=Self-Signed Root Certification Authority" + ``` + 3. Выпустить запрос на сертификат сервера + ``` + openssl req -newkey rsa:4096 -nodes -days 3650 -keyout tls.key.pem -out tls.req.pem -subj "/CN=Self-Signed Server Certificate" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:pritunl-fakeapi.local")) + ``` + 4. Подписать запрос на сертификат сервера сертификатом удоствоверяющего центра + ``` + openssl x509 -req -in tls.req.pem -CA ca.crt.pem -CAkey ca.key.pem -out tls.crt.pem -days 3650 -extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:pritunl-fakeapi.local")) + ``` + 5. Удалить файл приватного ключа удостоверяющего центра и файл запроса сертификата сервера + ``` + rm -f ca.key.pem tls.req.pem + ``` -![active-ultimate](docs/active-ultimate.png) +4. Запустить контейнеры +``` +cd /opt/pritunl && docker compose up -d +``` +5. Установить сертификат удостоверяющего центра в доверенные для Pritunl +``` +cat ca.crt.pem >> /usr/lib/pritunl/usr/lib/python3.9/site-packages/certifi/cacert.pem +``` +6. Отключить использование VPN сервером Pritunl порта 80/TCP +``` +sudo pritunl set app.redirect_server false +``` +7. Добавить запись в /etc/hosts +``` +echo "127.0.0.1 pritunl-fakeapi.local" | sudo tee -a /etc/hosts +``` +8. Запустить скрипт setup.py +``` +chmod +x /opt/pritunl-fakeapi/setup.py && sudo /opt/pritunl-fakeapi/setup.py +``` +В скрипте выбрать [I]nstall и в качестве "new API endpoint" указать `pritunl-fakeapi.local` -If everything worked, your subscription should now look like this: - -![done](docs/done.png) - -Make sure to support the developers by buying the choosen subscription for your enterprise or company! - -## How to setup (api) (optional) ## -This is _optional_. You can simply use the default instance of this API (host is noted inside the `setup.py` script) and profit from "automatic" updates. - -## API Only: Using Apache -Just transfer the `www` files inside a public accessible root-folder on your _dedicated_ Apache webserver (really everthing with PHP support works). Also make sure your instance has a valid SSL-certificate (Let's encrypt is enough), otherwise it may won't work. -An example Apache install process can be found [here](docs/apache/install.md). If you want to test your instance, just open the public accessible URI in your browser and append `/healthz` to it - if you see some JSON with the text, then everything worked! - -### API Only: Using Nginx -Just transfer the `www` files inside a public accessible root-folder on your _dedicated_ Nginx webserver (really everthing with PHP support works). Also make sure your instance has a valid SSL-certificate (Let's encrypt is enough), otherwise it may won't work. -See the documentation in [Nginx Install](docs/nginx/install.md). - -### API Only: Using Docker -See the documentation in [Docker Install](docs/docker/api-only-install.md). - -### Fully Patched Pritunl: Using Docker -This api has also its own docker image. Take a look into the `docker` folder and enjoy! - -See the documentation in [Patched Pritunl Docker Install](docs/docker/pritunl-patched-install.md). - -### Nett2Know ### -* This modification will also block any communication to the Pritunl servers - so no calling home :) -* SSO will not work with this api version! As Pritunls own authentication servers handle the whole SSO stuff, track instance ids and verify users, I won't implement this part for privacy concerns (and also this would need to be securly implemented and a database). - -Have fun with your new premium/enterprise/ultimate Pritunl instance! +9. Перезапустить Pritunl +``` +sudo systemctl restart pritunl +``` +10. В веб интерфейсе Pritunl активировать подписку, введя ключ активации `active ultimate` \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..3643046 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,26 @@ +services: + nginx: + image: nginx@sha256:0f04e4f646a3f14bf31d8bc8d885b6c951fdcf42589d06845f64d18aec6a3c4d + restart: always + volumes: + - "${PWD}/mounts/nginx/html:/var/www/html:ro" + - "${PWD}/mounts/nginx/certs:/etc/nginx/certs:ro" + - "${PWD}/mounts/nginx/conf/nginx.conf:/etc/nginx/nginx.conf" + ports: + - "80:80" + - "443:443" + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:80/"] + interval: 10s + timeout: 5s + retries: 3 + start_period: 5s + links: + - fpm + fpm: + image: php:fpm@sha256:245576beb9a87cecac8027e92866d8ed37687023d1efea79a7fc34828d228797 + restart: always + ports: + - ":9000" + volumes: + - "${PWD}/mounts/nginx/html:/var/www/html:ro" \ No newline at end of file diff --git a/docker/.dockerignore b/docker/.dockerignore deleted file mode 100644 index e73baec..0000000 --- a/docker/.dockerignore +++ /dev/null @@ -1 +0,0 @@ -mongodb \ No newline at end of file diff --git a/docker/.gitignore b/docker/.gitignore deleted file mode 100644 index e643dbc..0000000 --- a/docker/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -setup.py -mongodb \ No newline at end of file diff --git a/docker/Dockerfile b/docker/Dockerfile deleted file mode 100644 index 9a85f97..0000000 --- a/docker/Dockerfile +++ /dev/null @@ -1,9 +0,0 @@ -FROM goofball222/pritunl:latest - -ARG API_SERVER_DOMAIN -ENV API_SERVER_DOMAIN $API_SERVER_DOMAIN - -# Yes, you will need to copy it over into the build context... -COPY setup.py . - -RUN chmod +x setup.py; python3 -u setup.py --install --api-server ${API_SERVER_DOMAIN:-}; rm setup.py \ No newline at end of file diff --git a/docker/README.md b/docker/README.md deleted file mode 100644 index 1ff5269..0000000 --- a/docker/README.md +++ /dev/null @@ -1 +0,0 @@ -This uses the docker image for Pritunl by `goofball222/pritunl` and installs the fake api hooks directly into it. diff --git a/docker/api-only/docker-compose.yml b/docker/api-only/docker-compose.yml deleted file mode 100644 index 5cfcc3b..0000000 --- a/docker/api-only/docker-compose.yml +++ /dev/null @@ -1,98 +0,0 @@ -# Runs this API, either on port 80 or behind Traefik, either on docker swarm or single daemon. -# Choose the right configuration for you and comment out the other. -# Read the comments carefully. -# -# -# In case you run behind Traefik, you need to setup the traefik router HOST -# You need correctly setup traefik and docker network (here called proxy_external) -# -# /!\ /!\ Make sure the mount volumes match correctly. /!\ /!\ -# -# The first volume is the path to the www folder from the root of this repo. -# The path shall be a full path, or be next to this docker-compose.yml file. -# No parent folder navigation like `../../../` is allowed by docker. -# -# -> Easy solution: -# Once you have cloned this repo, you shall move this docker-compose.yml file to the root of the repo. -# -# The second volume is the path to the nginx server config file. -# This needs the commited nginx server config (or your own adapted version) to work properly. -# See the file `/docker/api-only/conf.d/pritunl-fake-api.conf` for more details. - -version: '3.7' -services: - web: - image: trafex/php-nginx - volumes: - - "./www:/var/www/html:ro" - - "./docker/api-only/conf.d/pritunl-fake-api.conf:/etc/nginx/conf.d/pritunl-fake-api.conf" - ################################################################# - ### If you run behind Traefik COMMENT OUT the following lines ### - ### BEGIN TRAEFIK_BLOCK ### - ports: - - "80:8080" - ################################################################# - - ################################################################# - - ### BEGIN SINGLE_DAEMON_BLOCK ### - - ### If you run behind on Docker Single Daemon (NOT Swarm) uncomment the following lines ### - # networks: - # - default - # - proxy_external - # labels: - # - "traefik.enable=true" - # - "traefik.docker.network=proxy_external" - # - "traefik.tags=proxy_external" - # ### Services - # ## API - # - "traefik.http.services.pritunl-api.loadbalancer.server.port=8080" - # ### Routers - # - "traefik.http.routers.pritunl-api.entrypoints=https" - # - "traefik.http.routers.pritunl-api.rule=Host(`mypritunlfakeapi.example.com`)" - # - "traefik.http.routers.pritunl-api.service=pritunl-api" - # - "traefik.http.routers.pritunl-api.tls=true" - # - "traefik.http.routers.pritunl-api.tls.certresolver=http" -# networks: -# proxy_external: -# external: true -# name: proxy_external - - ### END SINGLE_DAEMON_BLOCK ### - - - ### BEGIN SWARM_BLOCK ### - - ### If you run on Docker Swarm uncomment the following lines ### - # networks: - # - default - # - proxy_external - # labels: - # - "traefik.enable=true" - # deploy: - # labels: - # - "traefik.enable=true" - # - "traefik.docker.network=proxy_external" - # - "traefik.tags=proxy_external" - # ### Services - # ## API - # - "traefik.http.services.pritunl-api.loadbalancer.server.port=8080" - # ### Routers - # - "traefik.http.routers.pritunl-api.entrypoints=https" - # - "traefik.http.routers.pritunl-api.rule=Host(`mypritunlfakeapi.example.com`)" - # - "traefik.http.routers.pritunl-api.service=pritunl-api" - # - "traefik.http.routers.pritunl-api.tls=true" - # - "traefik.http.routers.pritunl-api.tls.certresolver=http" -# networks: -# proxy_external: -# external: true -# name: proxy_external - - ### END SWARM_BLOCK ### - - - - ### END TRAEFIK BLOCK ### - ################################################################# - \ No newline at end of file diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml deleted file mode 100644 index a761b74..0000000 --- a/docker/docker-compose.yml +++ /dev/null @@ -1,36 +0,0 @@ -version: '3' -services: - mongodb: - image: mongo:latest - restart: always - volumes: - - ./mongodb:/data/db - - pritunl: - # Use the following to build the image from source (assuming you're running inside the repository). - build: - context: ../server - dockerfile: ../docker/Dockerfile - args: - - API_SERVER_DOMAIN=${API_SERVER_DOMAIN:-} - restart: always - depends_on: - - mongodb - privileged: true - sysctls: - - net.ipv6.conf.all.disable_ipv6=0 - links: - - mongodb - volumes: - - /etc/localtime:/etc/localtime:ro - ports: - # Under this port the Pritunl web interface will be exposed (for reverse proxies) - - 9700:9700 - # The following are the two default ports for the tcp+udp servers (you may edit these as needed!) - - 1194:1194 - - 1194:1194/udp - environment: - - TZ=UTC - - MONGODB_URI=mongodb://mongodb:27017/pritunl - # Also enable reverse proxie capabilities - - REVERSE_PROXY=true diff --git a/docs/active-ultimate.png b/docs/active-ultimate.png deleted file mode 100644 index 0416c0b..0000000 Binary files a/docs/active-ultimate.png and /dev/null differ diff --git a/docs/apache/000-default-le-ssl.conf b/docs/apache/000-default-le-ssl.conf deleted file mode 100644 index 76f0eb7..0000000 --- a/docs/apache/000-default-le-ssl.conf +++ /dev/null @@ -1,22 +0,0 @@ - - - # The ServerName directive sets the request scheme, hostname and port that - # the server uses to identify itself. This is used when creating - # redirection URLs. In the context of virtual hosts, the ServerName - # specifies what hostname must appear in the request's Host: header to - # match this virtual host. For the default virtual host (this file) this - # value is not decisive as it is used as a last resort host regardless. - # However, you must set it for any further virtual host explicitly. - #ServerName www.example.com - - ServerAdmin webmaster@localhost - DocumentRoot /var/www/html - - ErrorLog ${APACHE_LOG_DIR}/error.log - CustomLog ${APACHE_LOG_DIR}/access.log combined - - - AllowOverride All - - - diff --git a/docs/apache/install.md b/docs/apache/install.md deleted file mode 100644 index 94d13a8..0000000 --- a/docs/apache/install.md +++ /dev/null @@ -1,76 +0,0 @@ -# HowTo install the selfhost api variant on Apache - -First you want to install the apache2. -```bash -sudo apt-get install apache2 -``` -After install all of the relevent apache modules: -```bash -sudo apt-get -y install php7.4-mysql php7.4-curl php7.4-gd php7.4-intl php-pear php-imagick php7.4-imap php-memcache -``` -Then install certbot for free ssl certs : -```bash -sudo apt-get install -y certbot -``` -After this then create a basic site config for the fake api server, do this by creating a file under /etc/apache2/sites-enabled/000-default-le-ssl.conf with the example conf [example](docs/apache/000-default-le-ssl.conf). - -Then generate a ssl certificate for the website with certbot. -```bash -sudo certbot -d [PUBLIC_ACCESSIBLE_API_DOMAIN] -``` -Once this is done you should check if you have all of the required loaded php modules required for this server. You can check this by running `sudo apache2ctl -M` and the output should look be something like -``` -sudo apache2ctl -M -Loaded Modules: - core_module (static) - so_module (static) - watchdog_module (static) - http_module (static) - log_config_module (static) - logio_module (static) - version_module (static) - unixd_module (static) - access_compat_module (shared) - alias_module (shared) - auth_basic_module (shared) - authn_core_module (shared) - authn_file_module (shared) - authz_core_module (shared) - authz_host_module (shared) - authz_user_module (shared) - autoindex_module (shared) - deflate_module (shared) - dir_module (shared) - env_module (shared) - filter_module (shared) - http2_module (shared) - mime_module (shared) - mpm_prefork_module (shared) - negotiation_module (shared) - php7_module (shared) - proxy_module (shared) - proxy_fcgi_module (shared) - reqtimeout_module (shared) - rewrite_module (shared) - setenvif_module (shared) - socache_shmcb_module (shared) - ssl_module (shared) - status_module (shared) -``` - -Then clone this repo if you've not done this already and `cd` into the root of the project: -```bash -git clone https://gitlab.simonmicro.de/simonmicro/pritunl-fake-api.git -cd ./pritunl-fake-api -``` -After this is done copy over the API server files to the server and set permissions -```bash -sudo cp -R ./www/* /var/html/ -sudo chown www-data:www-data -R /var/www/html -sudo chmod -R 774 /var/www/html/ -``` -Then restart apache2 to make sure all of the configuration is loaded -```bash -sudo systemctl restart apache2 -``` -Once this is done you should get a response when you visit `https://[PUBLIC_ACCESSIBLE_API_DOMAIN]/notification`! diff --git a/docs/docker/api-only-install.md b/docs/docker/api-only-install.md deleted file mode 100644 index 88fc927..0000000 --- a/docs/docker/api-only-install.md +++ /dev/null @@ -1,36 +0,0 @@ -# API Only: Docker - -## Only installs the API (webserver) and not the Pritunl VPN itself. -This approach runs this API, either on port 80 or behind Traefik, either on docker swarm or single daemon. - -You need to have docker up and running on your server. - -- In your server, clone this repo, then `cd` to the cloned folder. -- Copy the docker-compose file provided in `/docker/api-only/docker-compose.yml` to - the root of the cloned folder. - - You shall now have: `/docker-compose.yml` -- Modify the `/docker-compose.yml` to fit your needs and config - - _Watch for volumes, docker swarm or single daemon, behind Traefik or not and the HOST value if behind traefik:_ - - In case you run behind Traefik, you need to setup the traefik router HOST - - You need correctly setup traefik and docker network (here called proxy_external) - - **(!) Make sure the mount volumes match correctly.** - - * The first volume is the path to the www folder from the root of this repo. - - The path shall be a full path, or be next to this docker-compose.yml file. - - No parent folder navigation like `../../../` is allowed by docker. - - * The second volume is the path to the nginx server config file. - - This needs the commited nginx server config (or your own adapted version) to work properly. - - See the file `/docker/api-only/conf.d/pritunl-fake-api.conf` for more details. -- Run the updated `docker-compose.yml` file in daemon mode with: - - `docker-compose up -d` \ No newline at end of file diff --git a/docs/docker/pritunl-patched-install.md b/docs/docker/pritunl-patched-install.md deleted file mode 100644 index 2556f1a..0000000 --- a/docs/docker/pritunl-patched-install.md +++ /dev/null @@ -1,28 +0,0 @@ -# Fully Patched Pritunl: Using Docker - -## Only installs the API (webserver) and not the Pritunl VPN itself. -You need to have docker up and running on your server. - -This uses the docker image for Pritunl by `goofball222/pritunl` and installs the fake api hooks directly into it. - - -Step: - -- In your server, clone this repo, then `cd` to the cloned folder. -- Go to the `docker` folder of the repo. -- Read the `/docker/docker-compose.yml` file carefully and edit to fit your needs (ports, volumes, network, server domain...) -- Run the `docker-compose.yml` file in daemon mode with: - - `docker-compose up -d` - - - This will `docker build` the patched pritunl container and run it on the following ports: - - Under this port the Pritunl web interface will be exposed (for reverse proxies) - - *9700:9700* - - - The following are the two default ports for the tcp+udp servers (you may edit these as needed!) - - *1194:1194* - - *1194:1194/udp* - diff --git a/docs/done.png b/docs/done.png deleted file mode 100644 index 258df4a..0000000 Binary files a/docs/done.png and /dev/null differ diff --git a/docs/enter-something.png b/docs/enter-something.png deleted file mode 100644 index d026e41..0000000 Binary files a/docs/enter-something.png and /dev/null differ diff --git a/docs/login-msg.png b/docs/login-msg.png deleted file mode 100644 index 34bb975..0000000 Binary files a/docs/login-msg.png and /dev/null differ diff --git a/docs/nginx/hard_nginx.conf b/docs/nginx/hard_nginx.conf deleted file mode 100644 index 24a49d0..0000000 --- a/docs/nginx/hard_nginx.conf +++ /dev/null @@ -1,44 +0,0 @@ -worker_processes auto; -error_log stderr warn; -pid /run/nginx.pid; - -events { - worker_connections 64; -} - -http { - include mime.types; - default_type application/octet-stream; - - # Define custom log format to include reponse times - log_format main_timed '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for" ' - '$request_time $upstream_response_time $pipe $upstream_cache_status'; - - access_log /dev/stdout main_timed; - error_log /dev/stderr notice; - - keepalive_timeout 65; - - # Write temporary files to /tmp so they can be created as a non-privileged user - client_body_temp_path /tmp/client_temp; - proxy_temp_path /tmp/proxy_temp_path; - fastcgi_temp_path /tmp/fastcgi_temp; - uwsgi_temp_path /tmp/uwsgi_temp; - scgi_temp_path /tmp/scgi_temp; - - # Hardening - proxy_hide_header X-Powered-By; - fastcgi_hide_header X-Powered-By; - server_tokens off; - - gzip on; - gzip_proxied any; - gzip_types text/plain application/xml text/css text/js text/xml application/x-javascript text/javascript application/json application/xml+rss; - gzip_vary on; - gzip_disable "msie6"; - - # Include other server configs - include /etc/nginx/conf.d/*.conf; -} diff --git a/docs/nginx/install.md b/docs/nginx/install.md deleted file mode 100644 index f481a52..0000000 --- a/docs/nginx/install.md +++ /dev/null @@ -1,105 +0,0 @@ -# HowTo install the selfhost api variant on Nginx - -## Easy way: -Use docker and docker-compose files provided in `docker/api-only` folder. - -See documentation [Docker Install](docs/docker/api-only-install.md). - -The docker compose file has a detailed help in its top too. Read and Roll :) - - -## Hard way: -First, you need to install Nginx. -```bash -sudo apt-get install nginx -``` - -After that, install all of the relevant PHP modules: - -```bash -sudo apt-get -y install php7.4-fpm php7.4-mysql php7.4-curl php7.4-gd php7.4-intl php-pear php-imagick php7.4-imap php-memcache -``` - -Then install certbot for free SSL certs: -```bash -sudo apt-get install -y certbot python3-certbot-nginx -``` - -After this, create a basic site config for the fake api server. Do this by creating a file under /etc/nginx/sites-available/ and create a symbolic link to /etc/nginx/sites-enabled. -You can refer to the provided Nginx server block available in: -`/docker/api-only/conf.d/pritunl-fake-api.conf` - -Then generate an SSL certificate for the website with certbot. -```bash -sudo certbot --nginx -d [PUBLIC_ACCESSIBLE_API_DOMAIN] -``` - -Once this is done, you should check if you have all the required loaded PHP modules for this server. You can check this by running php -m, and the output should list your PHP modules. - -the output should look be something like: -```bash -#... - core_module (static) - so_module (static) - watchdog_module (static) - http_module (static) - log_config_module (static) - logio_module (static) - version_module (static) - unixd_module (static) - access_compat_module (shared) - alias_module (shared) - auth_basic_module (shared) - authn_core_module (shared) - authn_file_module (shared) - authz_core_module (shared) - authz_host_module (shared) - authz_user_module (shared) - autoindex_module (shared) - deflate_module (shared) - dir_module (shared) - env_module (shared) - filter_module (shared) - http2_module (shared) - mime_module (shared) - mpm_prefork_module (shared) - negotiation_module (shared) - php7_module (shared) - proxy_module (shared) - proxy_fcgi_module (shared) - reqtimeout_module (shared) - rewrite_module (shared) - setenvif_module (shared) - socache_shmcb_module (shared) - ssl_module (shared) - status_module (shared) - #... -``` - -Then clone this repository if you haven't done this already and cd into the root of the project: -```bash -git clone https://gitlab.simonmicro.de/simonmicro/pritunl-fake-api.git -cd ./pritunl-fake-api -``` - -After this is done, copy over the API server files to the server and set permissions. -```bash -sudo cp -R ./www/* /var/www/html/ -sudo chown www-data:www-data -R /var/www/html -sudo chmod -R 774 /var/www/html/ -``` - -For your convenience, a hardened Nginx configuration is provided to help you secure and improve your server, -Read it carefully before use and make sure you understand what it does. - -See: `/docs/nginx/hard_nginx.conf` - - -Then restart Nginx to make sure all of the configuration is loaded. -```bash -sudo systemctl restart nginx -``` - -Once this is done, you should get a response when you visit - - `https://[PUBLIC_ACCESSIBLE_API_DOMAIN]/notification`! diff --git a/mounts/nginx/certs/ca.crt.pem b/mounts/nginx/certs/ca.crt.pem new file mode 100644 index 0000000..64991eb --- /dev/null +++ b/mounts/nginx/certs/ca.crt.pem @@ -0,0 +1,31 @@ +-----BEGIN CERTIFICATE----- +MIIFRzCCAy+gAwIBAgIUUmbn9VW2/Yt5JsPXdN8SUE9AOvIwDQYJKoZIhvcNAQEL +BQAwMzExMC8GA1UEAwwoU2VsZi1TaWduZWQgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1 +dGhvcml0eTAeFw0yNDA2MTExNDMzNTNaFw0zNDA2MDkxNDMzNTNaMDMxMTAvBgNV +BAMMKFNlbGYtU2lnbmVkIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIi +MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQD5jz1tcASmQpMTsqWX+VzevSfo +v4dHo9YUipA60Zu8NR0x1hCoVJp42fChotfvzFbhKpDqoeE3eOYSi18y9GYx4gYV +vBsgBc6UoPOkbTB6brlf13fZOHSnfoWcEsXPSu71pXND3UWPn7gE5NsQs3UW+O6m ++dhn6w6cNpZc8/mtH3CwW+klaH3xw1XUe43TyzSM9M8KWBg7CIam7Ba64o2ubB0b +5otccqWcupLyE63ZGpaRn0a4RweCQfUERin5YSaed8fyY/mEte+bF4qNXqGksItv +sCAOI8+5mS7ckicawt+DHst53PnwstaZVDvtWADG6uQr0eV9knTmKJPk8EkpsdQr +bTCfBrfvh88kV5kDZi5prHVhTPTMdLkQNwFfZN5vqEfKHKB7AX+T0K4SNf4rvrDb +eqLQOvpcifX7y9khZ2n2HXFKzOUsy+LRVl95iwcfLetOFrefEi0z4II0t1glKPlz +8r09eSvQu5pLeeQZgnzB0zUDFGqPfY0coVCdSfQ+d7waNy/vZRhfhIhUCuj+u/Dw +KV0fQA9lkFND2hccXfS1tMcmQpGT/Jwdd83Y9vHKEcuigd0iemK0wYzO0xEF4WWt +zmkesMKZ+RAmUPUgjvbFXUvjZwoCvMSAoOOIlbBBe1wDMfxVeK3t/6WohDPqZpnp +H+zY5fz2c8wl4jeEvQIDAQABo1MwUTAdBgNVHQ4EFgQUwPDuKN4xNpMci7miVNiQ +b0wQCC8wHwYDVR0jBBgwFoAUwPDuKN4xNpMci7miVNiQb0wQCC8wDwYDVR0TAQH/ +BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAM/CVbY6qLfhPtWGFGiplqJ+yLR0I +x5+W3OEzt+z8kewFlBBGZkNr9t2m5BiwoegbsmD92popDTRY+ToveqYOaTFMSuCL +9ETNs4PH4f0LPJk66Pco8V+9MolG+QCjSPWr2fiPFycc+N/w/kgl8fCnRT7vU9rB +Kov9MXOfX9OIWbx3JkVaDmMLAoNyjVrctedWMy2PRLbMzJn0wOIKYDVcXl4MwnVy +1aMXUnsjHRQ+gxiQER89+IqKNhtPzZbz8gZtnpikXTPT7gcjQ7wJfooU5j0BeDDg +isQ6CUb9QtOXnZ5G5c6H0bbq/vNXCEOtjevN1BNVbzA4V9wISc2OayTBheqfgx7a +CzFgCCGzRyt4gfQdovKdNfhl0TEhXuSbqvX3RdDlVPM912gaKY9NIFt2Jb5lScS6 +2Lw9VVQ1cm+Wz/UQiId3v1wuQIwqNlOGsGVCb01JCAVorYGOGC5uY8gQq0+8x375 +9llC/CROYB9B8CEUAoYkcSsFxRfmE5hfyOemiq4hmSx89vHkpaQHaXV/ZxwG72A9 +PTSlgd4l1axW2XOtUzmrBddbdrKMFdUjWBAAGi87NkEMq8sGzsXQnBKIe7Doiau5 +Ml363nYCawY8jQOf4UO6ZtUhIjOgKECl7BiED7eotsphOIYH0daUF1E4EvZoydX7 +RU8CdysiQ0OM0Kk= +-----END CERTIFICATE----- diff --git a/mounts/nginx/certs/tls.crt.pem b/mounts/nginx/certs/tls.crt.pem new file mode 100644 index 0000000..92f3bb2 --- /dev/null +++ b/mounts/nginx/certs/tls.crt.pem @@ -0,0 +1,30 @@ +-----BEGIN CERTIFICATE----- +MIIFDjCCAvagAwIBAgIUMIBPMbZBY9ZnJ+owpUTVnu/oHAEwDQYJKoZIhvcNAQEL +BQAwMzExMC8GA1UEAwwoU2VsZi1TaWduZWQgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1 +dGhvcml0eTAeFw0yNDA2MTExNDM0MDJaFw0zNDA2MDkxNDM0MDJaMCkxJzAlBgNV +BAMMHlNlbGYtU2lnbmVkIFNlcnZlciBDZXJ0aWZpY2F0ZTCCAiIwDQYJKoZIhvcN +AQEBBQADggIPADCCAgoCggIBAOTDXbD3WRf/pWa158xYQpTWWgeW67YPXtRnkEBh +B0ztTCui4YbeSBL7y+CeGgfVE5XN+V0aAt0YAZvo5ffHzhd6HXgyhIObo0VHtX1s +P9I/Z9PbdxeOEuJXU0J/0lkAIuv7nhnxDy+qoJ8b01g7fuTvepGwHJZiZXDYiT7k +lb60tqg95JFsdQtMyZrHCYNcSQZK6AkRiouqbCQimYCO1N7SRtcgtaathFDAHTvk +Afne2SvGeO3rxVe5swoXGYjz2aQAPy7lfZgdYsRKPznwxNYPkXq8jx4Pxh0DsyQV +aHFjYRszIot/V8gVePzbDlE7JrpnPuzooMDPqASXkmjk9NDkpxhjmXPmTiOxa8c5 +QAVwB94C+VtHmUomHVAbmj0XM7YOxQDn8wVOeWi0nVj2LGptsSylePsrg242pGwi +83Z87emOEYzvDFFd2hReoHDz3Fp97X/xydyUawTRRx0RtM5Lljps3aGJlSiNIBiy +yQbTxoOmEFVGTOAnv0mG4y9tfttJKxZ0RNYnDKnUDfglfdL60zkBmZqM3XsivLlw +k8/lxgSWsK83iFRQHJ9/GB8wPjmpf5+9y6CZ3LS2ax+hY2IB/z2xYX1s4ZuCEx9N +dSiet1+ueyyax/YigBqqq+2MTiV9W1+1EPa0tQHIwOQQpfN99i7yzUlmFo2HRNhR +BjkzAgMBAAGjJDAiMCAGA1UdEQQZMBeCFXByaXR1bmwtZmFrZWFwaS5sb2NhbDAN +BgkqhkiG9w0BAQsFAAOCAgEAmtFS/A6XSHEZM/8DzOl/beQXtAvhHZGfEX4IFhTq +ov6mGbN5hmSOGaT6C/LrEp1Y6d/K0xlxQQu3t4sWnM+R7CwgBdP0NLEZxtbx+WOq +LZVpGH9+wBsk6flPtUFtcrI1z6YB6RebRvC6ZlzYfhoQpUub9aYHrGyV1F8aYy+d +cmFlQx3F++UG+m1/WVer7WVLUJAOwBfr2BoFdUne5d9Wkhdh8nYFztxpgkdqb8FO +p5g4XFV4fM2zxSwICJWbcwr5VLDGKc2YDuXI195XmHiaC19C0MPH3aJ4VmvPmBWp +eiG8kUtCHzYrXyRu35AlobweT/MIaO54RGHuSAGJ4a1BdU+41mhvheScu//+g5gS +oicR8PaAm6FGc4px8sCYlXxkvWEChOF6KiuwhAYr1kEWcy0UIeERm/h99nsjAzYw ++aQF6eJG9hRXw5DInCv0ll5QZqsQqxFwm7vkGpBLUK7b1Xcel3aPqrl/mhxDUrwi +pvygH3mlCZWx/F5J3Lv7u+toc2cWFQ3CpN0/aYkV/d16BjAiz+9V/is5OwSf02Nq +HrcBt9rUoTtM/vIffijhSxgT0zd5IxMkmtDqf+VrWa0Z1jU/cFdztk24aVxOFnPc +lTiqzzDRXUdiQ7uRcEDnw9E+nLi1fGbxa2GKTjdq+AxbaOOD95FHq3rlE65aMoB3 +B9E= +-----END CERTIFICATE----- diff --git a/mounts/nginx/certs/tls.key.pem b/mounts/nginx/certs/tls.key.pem new file mode 100644 index 0000000..a75ec84 --- /dev/null +++ b/mounts/nginx/certs/tls.key.pem @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDkw12w91kX/6Vm +tefMWEKU1loHluu2D17UZ5BAYQdM7UwrouGG3kgS+8vgnhoH1ROVzfldGgLdGAGb +6OX3x84Xeh14MoSDm6NFR7V9bD/SP2fT23cXjhLiV1NCf9JZACLr+54Z8Q8vqqCf +G9NYO37k73qRsByWYmVw2Ik+5JW+tLaoPeSRbHULTMmaxwmDXEkGSugJEYqLqmwk +IpmAjtTe0kbXILWmrYRQwB075AH53tkrxnjt68VXubMKFxmI89mkAD8u5X2YHWLE +Sj858MTWD5F6vI8eD8YdA7MkFWhxY2EbMyKLf1fIFXj82w5ROya6Zz7s6KDAz6gE +l5Jo5PTQ5KcYY5lz5k4jsWvHOUAFcAfeAvlbR5lKJh1QG5o9FzO2DsUA5/MFTnlo +tJ1Y9ixqbbEspXj7K4NuNqRsIvN2fO3pjhGM7wxRXdoUXqBw89xafe1/8cnclGsE +0UcdEbTOS5Y6bN2hiZUojSAYsskG08aDphBVRkzgJ79JhuMvbX7bSSsWdETWJwyp +1A34JX3S+tM5AZmajN17Iry5cJPP5cYElrCvN4hUUByffxgfMD45qX+fvcugmdy0 +tmsfoWNiAf89sWF9bOGbghMfTXUonrdfrnssmsf2IoAaqqvtjE4lfVtftRD2tLUB +yMDkEKXzffYu8s1JZhaNh0TYUQY5MwIDAQABAoICAQDe9G2e6SNjGVyZ4xY8eZTC +vLrYBMZMFWTl/N2BcU+NMQV4zfGh4Yg7QD7u9wgFtCy3ZxzvGUfLNfdzfaSMPqbl +CLYqDIpMPmb9QatnxxXYksVdnNrQET7kbBmQiUV4SoK+nefz/pY/bbvH9nWf27SL +6b76uLrT8qhNOC1jJ6OuTzBqfpADD8JvNfKTMANcjJf7UwwcsoTmJD3rZfFXc12S +oTw7tPx1q0126hZT5Z/raL8eQ/xeXdhi7HDLl8HiUU8/4KGz0iT7GUDGcFp43Ojq +fBfcmGOf992tL4rr0xWM1T+yI786V+0064CUZ+bnUpAnQjL48Kyj3n8xoowmQWc7 +TCdtIRP7R8slGIUHV0bJMVBgcVvZ2zuI601/5MvSrQFN5YNFUB4/KksG0HZXfRse +JXKjbM35lffIUGmeXK+2mW8dlH0ICgndKo5jdG3A8GsmgyA9a+bDlS/FBT5iQSHn +kmDXnM0M0cWLpA1zTiIhxjPwanAp5gG5QrmrYlgmBBUu2z/rTd3NQmqpzjJO3k7O +mV7OcD8XhNoqojRBqQW32PFuq6Ucmbal604bE6qAJuB2kQnV2WlPV3j9C4+DY84/ +Badt/ybiNVgzFciWfJWBt1D0YfDmYBXMpzBQckdVO2tYsbKseae3WWmDLh1IIPUY +NpSh38mrSb/XBD9qfRFJ+QKCAQEA/hmDgdA4Tkt1+0gXESeTqpIFbnh3yBlnXexL +OJcNMZJW9CaKSUbbVS2TV7vIfaXC/+OXwFPJfQfULvSjaPg74xAS/DYjW9sNF+5A +HdLb/0fYzNhLDc/vxHzfqjwAT/wR23d2oraHkYDqNzaPKiktU8MhtdPuow416ZDY +F/kcU+I781zVrHqBSPGjE4/9IG7pkFyzTENhwm+EOZVQSjguS65JoyO5+NRMkcit +5dmF/lK+ee+4HH3BkapJnFBTW01wgH77GHtBdbp3wYMzNPdioYXxud9Y0mhlOHYG +HUX4KUin5D+Lu1hrioi2/yuNS/XxUOcihcfHRSJ/pDXtZ+uTpwKCAQEA5nlYIqqX +LjDWrp++Ks3qJlmu39gDP6vcSzSue2yM38p1GbFHAwR0OyNbUI5X6KVj1y1Q7CVE +xpPAokQC2T47lBF035viXMTSmxun7g7amdToHB/OMbW0J+97otXfaK8uq+i+4qaU +dfm2lG6Ubtfv8Xi0dOemwp7c4rZR/qxqMSM/8rrfU/GtVZMwHE1FiYOvEkY8OOlq +NHw6ExXpnZrksDtELvICcJffMPF4hvtiwek/OpMKGwNYJS1Yopfh4iUVBU8LO6q0 +6JUUgYnXUl7ERC3kRlNi4fq7JF4ELGgc3sG1KQAyTirtM+is86QWVNxZCaUnD6BC +VBUQj1WbYPmPlQKCAQEA69yA7mF5smtnQ22CQ+Ept529PvLBtNKn2U358Lh9fbMp +1Y1ktWn5M9KPP1PGYaMZI29+L/9WOyGmOkPI3yn0ZOtJxCT4o03slHcJuuU8YnSt +cE+hM1v9YrTK5Hi3jYcciEwWqiimJFC2l7OkJm18bpDlXKMxktchAgH6JB6Oxeps +3ZQhnu1DzpLFXeY8/vsVAHSb1cGCH/plkRHhKlOF3agVIEKMYMWnoXbWvFEyiIUD +26nBi2jL4ctgcqE5DroOIKg9qVbXx1Dj0pNXV+X9/pKXc4I3L2/J7SPYvxlwpdmU +RlEaAjer8za+LpOdn5HWgtNZfzaW6LyCIMoR6XGJZwKCAQEAkD2xY0DQjSATvAZN +xgxJVucaAw32OoscvBSkfqpZIFZdI09H2iOXesuOAsSTUA7yhWDfHGvWt1ERZnya +K8w/DVQ/iRLOgLDN/jU4zEyPk2ckPTXKnmHR9oxzHF4uDB5XX0+y57bJg2xdUFhE +nXqXuNCKX//65iL2qwzgFDtj2oztIMTDsI24pa4QliXmN0Iq94ztc9DhnyeAUSGN +rA2cwo7VBWyBCmaCUOdPP2tlS2bnI4mS8YUOTXYr2tajkB0VItVtelJEFqv2wXu7 +PtoAi4sNKtZVNIjvRrtwcTpXlzI0Zwywbyt+eNZOJ82yDDo7n0W1RJpP6L+mNY6m +R/LoYQKCAQB1snQrgPc7Hp7F6Q0iZr9ALcvYxXo5V2qUlSJ91x0uEH+oN+C5kXkq +VsIsaCX8gpoYB46VYN4BwA5pgpTF+FvsVducKPGtgX7YTJBcisaXBiUu0TZibHpa +omaCsUX6M4b4LKoFi4K7BqFdMPANarfWksdR9mK+vIm6cHKI74TqPPYdDIFONJP6 +0uSTzydYG5tOPZokPAGT64jP9FWBrK+ry3KfDat2fOSkQ8qKgjD2P4wWMznqS7UM +HnzXUkFKXpzuG/h8vuT7Jms3nNlJ9xFE6R2bf5TfcmGlHq1eZthNvgobxGMf4m4/ +nRwpKtDIScnPoUXH1TyjLz9R75GFO5US +-----END PRIVATE KEY----- diff --git a/docker/api-only/conf.d/pritunl-fake-api.conf b/mounts/nginx/conf/nginx.conf similarity index 50% rename from docker/api-only/conf.d/pritunl-fake-api.conf rename to mounts/nginx/conf/nginx.conf index 9423ed8..8376687 100644 --- a/docker/api-only/conf.d/pritunl-fake-api.conf +++ b/mounts/nginx/conf/nginx.conf @@ -1,8 +1,48 @@ + +user nginx; +worker_processes auto; + +#error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /dev/stdout main; + error_log /dev/stdout info; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + # Pritunl Fake API Server definition server { - listen [::]:80 default_server; - listen 80 default_server; + listen 80; server_name _; + return 301 https://$host$request_uri; + } + server { + listen [::]:443 ssl; + listen 443 ssl; + server_name _; + ssl_certificate /etc/nginx/certs/tls.crt.pem; + ssl_certificate_key /etc/nginx/certs/tls.key.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; sendfile off; tcp_nodelay on; @@ -21,7 +61,7 @@ location ~ \.php$ { try_files $uri =404; fastcgi_split_path_info ^(.+\.php)(/.+)$; - fastcgi_pass unix:/run/php-fpm.sock; + fastcgi_pass fpm:9000; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_NAME $fastcgi_script_name; fastcgi_index index.php; @@ -37,4 +77,5 @@ log_not_found off; deny all; } - } \ No newline at end of file + } +} \ No newline at end of file diff --git a/www/.htaccess b/mounts/nginx/html/.htaccess similarity index 100% rename from www/.htaccess rename to mounts/nginx/html/.htaccess diff --git a/www/custom.css b/mounts/nginx/html/custom.css similarity index 100% rename from www/custom.css rename to mounts/nginx/html/custom.css diff --git a/www/enterprise.css b/mounts/nginx/html/enterprise.css similarity index 100% rename from www/enterprise.css rename to mounts/nginx/html/enterprise.css diff --git a/www/enterprise_plus.css b/mounts/nginx/html/enterprise_plus.css similarity index 100% rename from www/enterprise_plus.css rename to mounts/nginx/html/enterprise_plus.css diff --git a/www/index.php b/mounts/nginx/html/index.php similarity index 100% rename from www/index.php rename to mounts/nginx/html/index.php diff --git a/www/logo.png b/mounts/nginx/html/logo.png similarity index 100% rename from www/logo.png rename to mounts/nginx/html/logo.png diff --git a/www/logo.xcf b/mounts/nginx/html/logo.xcf similarity index 100% rename from www/logo.xcf rename to mounts/nginx/html/logo.xcf diff --git a/www/premium.css b/mounts/nginx/html/premium.css similarity index 100% rename from www/premium.css rename to mounts/nginx/html/premium.css diff --git a/server/setup.py b/setup.py old mode 100644 new mode 100755 similarity index 100% rename from server/setup.py rename to setup.py