freedombone-app-matrix

#!/bin/bash
#  _____               _           _
# |   __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
# |   __|  _| -_| -_| . | . |     | . | . |   | -_|
# |__|  |_| |___|___|___|___|_|_|_|___|___|_|_|___|
#
#                              Freedom in the Cloud
#
# matrix server
#
# Test by visiting https://$MATRIX_DOMAIN_NAME/_matrix/key/v2/server/auto
#
# If working then telnet $MATRIX_DOMAIN_NAME 8448 should return a response
#
# License
# =======
#
# Copyright (C) 2016-2018 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

# Login username is @username:domain

VARIANTS='full full-vim chat'

APP_CATEGORY=chat

IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=1
NOT_ON_HOMEPAGE=1
MINIMUM_RAM_MB=900
MATRIX_MINIMUM_RAM_MB=900

MATRIX_DOMAIN_NAME=
MATRIX_CODE=

MATRIX_DATA_DIR='/var/lib/matrix'
MATRIX_HTTP_PORT=8448
MATRIX_PORT=8009
MATRIX_ONION_PORT=8109
MATRIX_REPO="https://github.com/matrix-org/synapse"
MATRIX_COMMIT='678ad155a2eecc344d93c6849f7bd887bcc42191'
REPORT_STATS="no"
MATRIX_SECRET=
MATRIX_EXPIRE_MONTHS=1

#MATRIX_PIP=/usr/local/bin/pip
MATRIX_PIP=/usr/bin/pip3
#MATRIX_PYTHON=/usr/bin/python
MATRIX_PYTHON=/usr/bin/python3

MATRIX_SHORT_DESCRIPTION=$'Chat system'
MATRIX_DESCRIPTION=$'Chat system'
MATRIX_MOBILE_APP_URL='https://f-droid.org/packages/im.vector.alpha'

matrix_variables=(ONION_ONLY
                  MY_USERNAME
                  MATRIX_SECRET
                  DEFAULT_DOMAIN_NAME
                  MATRIX_DOMAIN_NAME
                  MATRIX_EXPIRE_MONTHS
                  MATRIX_CODE)

function matrix_add_onion_federation {
    if grep -q ":$MATRIX_HTTP_PORT" "/etc/torrc.d/${PROJECT_NAME}"; then
        return
    fi

    sed -i "/:${MATRIX_ONION_PORT}/a HiddenServicePort ${MATRIX_HTTP_PORT} 127.0.0.1:${MATRIX_HTTP_PORT}" "/etc/torrc.d/${PROJECT_NAME}"

    systemctl restart tor
}


function matrix_systemd_daemon {
    matrix_systemd_daemon_recreate=

    if [ ! -f /etc/matrix/run-matrix ]; then
        matrix_systemd_daemon_recreate=1
    else
        if ! grep -q "$MATRIX_PYTHON " /etc/matrix/run-matrix; then
            matrix_systemd_daemon_recreate=1
        fi
    fi
    if [ ! -f /etc/systemd/system/matrix.service ]; then
        matrix_systemd_daemon_recreate=1
    fi

    if [ ! $matrix_systemd_daemon_recreate ]; then
        return
    fi

    { echo '#!/bin/bash';
      echo 'cd /etc/matrix || exit 1';
      echo "alias python='$MATRIX_PYTHON'";
      echo "$MATRIX_PYTHON -m synapse.app.homeserver --config-path ${MATRIX_DATA_DIR}/homeserver.yaml"; } > /etc/matrix/run-matrix
    chmod +x /etc/matrix/run-matrix
    chown matrix:matrix /etc/matrix/run-matrix

    { echo '[Unit]';
      echo 'Description=Synapse Matrix homeserver';
      echo 'After=network.target nginx.target';
      echo '';
      echo '[Service]';
      echo 'Type=simple';
      echo 'User=matrix';
      echo "WorkingDirectory=/etc/matrix";
      echo 'ExecStart=/etc/matrix/run-matrix';
      echo 'Restart=on-failure';
      echo 'RestartSec=10';
      echo 'PrivateTmp=true';
      echo 'PrivateDevices=false';
      echo 'NoNewPrivileges=true';
      echo 'CapabilityBoundingSet=~CAP_SYS_ADMIN';
      echo '';
      echo '[Install]';
      echo 'WantedBy=multi-user.target'; } > /etc/systemd/system/matrix.service
    systemctl enable matrix
    systemctl daemon-reload
}

function matrix_expire_old_posts {
    read_config_param ONION_ONLY
    read_config_param MY_USERNAME
    read_config_param MATRIX_DOMAIN_NAME
    read_config_param MATRIX_EXPIRE_MONTHS

    matrix_remove_posts=/usr/bin/matrix-remove
    curl_command='curl'
    homebase="https://$MATRIX_DOMAIN_NAME"
    if [[ "$ONION_ONLY" != 'no' ]]; then
        curl_command='torsocks curl'
        homebase="http://$(cat /var/lib/tor/hidden_service_matrix/hostname)"
    fi

    { echo '#!/bin/bash';
      echo "cd $MATRIX_DATA_DIR || exit 1";
      echo "HOMEBASE=\"$homebase\"";
      echo "ADMIN=\"@${MY_USERNAME}:$MATRIX_DOMAIN_NAME\"";
      echo "TOKEN=\$(sqlite3 homeserver.db \"SELECT token FROM access_tokens WHERE user_id='\$ADMIN' ORDER BY id DESC LIMIT 1;\")";
      echo "TIME=\"$MATRIX_EXPIRE_MONTHS months ago\"";
      echo "UNIX_TIMESTAMP=\$(date +%s%3N --date='TZ=\"UTC\" '\"$TIME\")";
      echo "ROOMS=\$(sqlite3 homeserver.db \"SELECT room_id FROM rooms;\")";
      echo "date --date='TZ=\"UTC\" '\"\$TIME\"";
      echo "for ROOM_NAME in \$ROOMS; do";
      echo "    $curl_command --silent --header \"Content-Type: application/json\" --request POST --data '{\"purge_up_to_ts\":'\$UNIX_TIMESTAMP',\"delete_local_events\": true}' \$HOMEBASE':$MATRIX_HTTP_PORT/_matrix/client/r0/admin/purge_history/'\$ROOM_NAME'?access_token='\$TOKEN";
      echo 'done';
      echo "$curl_command --silent --request POST \$HOMEBASE':$MATRIX_HTTP_PORT/_matrix/client/r0/admin/purge_media_cache?before_ts='\$UNIX_TIMESTAMP'&access_token='\$TOKEN";
      echo 'sqlite3 homeserver.db "VACUUM;"';
      echo 'sqlite3 homeserver.db "PRAGMA auto_vacuum;"'; } > $matrix_remove_posts

    chmod +x $matrix_remove_posts

    echo '#!/bin/bash' > /etc/cron.monthly/matrix-purge
    echo "$matrix_remove_posts 2> /dev/null" >> /etc/cron.monthly/matrix-purge
    chmod +x /etc/cron.monthly/matrix-purge
}

function logging_on_matrix {
    if [ -f "${MATRIX_DATA_DIR}/homeserver.yaml" ]; then
        if ! grep -q "log_file: /etc/matrix/homeserver.log" "${MATRIX_DATA_DIR}/homeserver.yaml"; then
            sed -i 's|log_file:.*|log_file: /etc/matrix/homeserver.log|g' "${MATRIX_DATA_DIR}/homeserver.yaml"
        fi
        if ! grep -q "#log_config:" "${MATRIX_DATA_DIR}/homeserver.yaml"; then
            sed -i 's|log_config:|#log_config:|g' "${MATRIX_DATA_DIR}/homeserver.yaml"
        fi
    fi
}

function logging_off_matrix {
    if [ -f "${MATRIX_DATA_DIR}/homeserver.yaml" ]; then
        if ! grep -q "log_file: /dev/null" "${MATRIX_DATA_DIR}/homeserver.yaml"; then
            sed -i 's|log_file:.*|log_file: /dev/null|g' "${MATRIX_DATA_DIR}/homeserver.yaml"
        fi
        if ! grep -q "#log_config:" "${MATRIX_DATA_DIR}/homeserver.yaml"; then
            sed -i 's|log_config:|#log_config:|g' "${MATRIX_DATA_DIR}/homeserver.yaml"
        fi
        if [ -f /etc/matrix/homeserver.log ]; then
            $REMOVE_FILES_COMMAND /etc/matrix/homeserver.log
        fi
        if [ -f /etc/matrix/homeserver.log.1 ]; then
            $REMOVE_FILES_COMMAND /etc/matrix/homeserver.log.1
        fi
        if [ -f /etc/matrix/homeserver.log.2 ]; then
            $REMOVE_FILES_COMMAND /etc/matrix/homeserver.log.2
        fi
        if [ -f /etc/matrix/homeserver.log.3 ]; then
            $REMOVE_FILES_COMMAND /etc/matrix/homeserver.log.3
        fi
    fi
}

function create_matrix_nginx_config {
    MATRIX_ONION_HOSTNAME=$(add_onion_service matrix 80 ${MATRIX_ONION_PORT})

    matrix_nginx_site=/etc/nginx/sites-available/$MATRIX_DOMAIN_NAME
    if [[ $ONION_ONLY == "no" ]]; then
        { echo 'server {';
          echo "  listen 443;";
          echo "  server_name ${MATRIX_DOMAIN_NAME};";
          echo ''; } > $matrix_nginx_site
        function_check nginx_ssl
        nginx_ssl ${MATRIX_DOMAIN_NAME}

        function_check nginx_security_options
        nginx_security_options ${MATRIX_DOMAIN_NAME}

        { echo '  add_header Strict-Transport-Security max-age=15768000;';
          echo '';
          echo '  access_log /dev/null;';
          echo '  error_log /dev/null;';
          echo '';
          echo "  root ${MATRIX_DATA_DIR}/media_store;";
          echo '';
          echo '  index index.html;';
          echo '';
          echo '  location /_matrix {'; } >> $matrix_nginx_site
        function_check nginx_limits
        nginx_limits ${MATRIX_DOMAIN_NAME} '15m'
        { echo "    proxy_pass http://localhost:${MATRIX_PORT};";
          echo '  }';
          echo '}';
          echo '';
          echo 'server {';
          echo "  listen ${MATRIX_HTTP_PORT};";
          echo "  server_name ${MATRIX_DOMAIN_NAME};";
          echo '';
          echo '  # Security'; } >> $matrix_nginx_site
        function_check nginx_ssl
        nginx_ssl ${MATRIX_DOMAIN_NAME}

        function_check nginx_security_options
        nginx_security_options ${MATRIX_DOMAIN_NAME}

        { echo '  add_header Strict-Transport-Security max-age=15768000;';
          echo '';
          echo '  # Logs';
          echo '  access_log /dev/null;';
          echo '  error_log /dev/null;';
          echo '';
          echo "  root ${MATRIX_DATA_DIR}/media_store;";
          echo '';
          echo '  # Index';
          echo '  index index.html;';
          echo '';
          echo '  # Location';
          echo '  location /_matrix {'; } >> $matrix_nginx_site
        function_check nginx_limits
        nginx_limits ${MATRIX_DOMAIN_NAME} '15m'
        { echo "    proxy_pass http://localhost:${MATRIX_PORT};";
          echo '  }';
          echo '}';
          echo ''; } >> $matrix_nginx_site
    else
        echo -n '' > $matrix_nginx_site
    fi

    { echo 'server {';
      echo "    listen 127.0.0.1:$MATRIX_ONION_PORT default_server;";
      echo '    port_in_redirect off;';
      echo "    server_name $MATRIX_ONION_HOSTNAME;";
      echo ''; } >> $matrix_nginx_site
    function_check nginx_security_options
    nginx_security_options $MATRIX_DOMAIN_NAME
    { echo '';
      echo '  # Logs';
      echo '  access_log /dev/null;';
      echo '  error_log /dev/null;';
      echo '';
      echo "  root ${MATRIX_DATA_DIR}/media_store;";
      echo '';
      echo '  # Location';
      echo '  location /_matrix {'; } >> $matrix_nginx_site
    function_check nginx_limits
    nginx_limits ${MATRIX_DOMAIN_NAME} '15m'
    { echo "    proxy_pass http://localhost:${MATRIX_PORT};";
      echo '  }';
      echo '}'; } >> "$matrix_nginx_site"

    if [ ! -d "/var/www/$MATRIX_DOMAIN_NAME" ]; then
        mkdir -p "/var/www/$MATRIX_DOMAIN_NAME/htdocs"
    fi

    sed -i 's|limit_conn conn_limit_per_ip.*|limit_conn conn_limit_per_ip 50;|g' "$matrix_nginx_site"
    sed -i 's|limit_req zone.*|limit_req zone=req_limit_per_ip burst=50 nodelay;|g' "$matrix_nginx_site"

    nginx_ensite $MATRIX_DOMAIN_NAME

    function_check add_ddns_domain
    add_ddns_domain $MATRIX_DOMAIN_NAME
}

function matrix_generate_homeserver_file {
    local filepath="${1}"
    domain=${MATRIX_DOMAIN_NAME}

    if [[ "$ONION_ONLY" != 'no' ]]; then
        domain=$(cat /var/lib/tor/hidden_service_matrix/hostname)
    fi

    cd /etc/matrix || exit 46
    $MATRIX_PYTHON -m synapse.app.homeserver \
                   --config-path "${filepath}" \
                   --generate-config \
                   --report-stats ${REPORT_STATS} \
                   --server-name "${domain}"
}

function matrix_configure_homeserver_yaml {
    turnkey="${1}"
    filepath="${2}"

    ymltemp="$(mktemp)"

    awk -v TURNURIES="turn_uris: [\"turn:${DEFAULT_DOMAIN_NAME}:${TURN_PORT}?transport=udp\", \"turn:${DEFAULT_DOMAIN_NAME}:${TURN_PORT}?transport=tcp\"]" \
        -v TURNSHAREDSECRET="turn_shared_secret: \"${turnkey}\"" \
        -v PIDFILE="pid_file: ${MATRIX_DATA_DIR}/homeserver.pid" \
        -v DATABASE="database: \"${MATRIX_DATA_DIR}/homeserver.db\"" \
        -v LOGFILE="log_file: \"/dev/null\"" \
        -v MEDIASTORE="media_store_path: \"${MATRIX_DATA_DIR}/media_store\"" \
        '{
        sub(/turn_shared_secret: "YOUR_SHARED_SECRET"/, TURNSHAREDSECRET);
        sub(/turn_uris: \[\]/, TURNURIES);
        sub(/pid_file: \/homeserver.pid/, PIDFILE);
        sub(/database: "\/homeserver.db"/, DATABASE);
        sub(/log_file: "\/homeserver.log"/, LOGFILE);
        sub(/media_store_path: "\/media_store"/, MEDIASTORE);
        print;
        }' "${filepath}" > "${ymltemp}"

    # shellcheck disable=SC2086
    mv ${ymltemp} ${filepath}

    if [[ $ONION_ONLY == "no" ]]; then
        sed -i "s|tls_certificate_path:.*|tls_certificate_path: \"/etc/ssl/certs/${MATRIX_DOMAIN_NAME}.pem\"|g" "${filepath}"
        if ! grep -q '#tls_private_key_path' "${filepath}"; then
            sed -i 's|tls_private_key_path|#tls_private_key_path|g' "${filepath}"
        fi
        sed -i "s|tls_dh_params_path:.*|tls_dh_params_path: \"/etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam\"|g" "${filepath}"
    fi
    sed -i "s|${MATRIX_HTTP_PORT}|8449|g" "${filepath}"
    sed -i "s|8008|${MATRIX_PORT}|g" "${filepath}"
    sed -i 's|tls:.*|tls: False|g' "${filepath}"
    sed -i 's|no_tls: .*|no_tls: True|g' "${filepath}"
    sed -i ':a;N;$!ba;s/ tls: [^\n]*/ tls: False/2' "${filepath}"
    sed -i 's|enable_registration_captcha.*|enable_registration_captcha: False|g' "${filepath}"
    sed -i "s|database: \".*|database: \"${MATRIX_DATA_DIR}/homeserver.db\"|g" "${filepath}"
    sed -i "s|media_store_path:.*|media_store_path: \"${MATRIX_DATA_DIR}/media_store\"|g" "${filepath}"
    sed -i "s|pid_file:.*|pid_file: \"${MATRIX_DATA_DIR}/homeserver.pid\"|g" "${filepath}"
    sed -i "s|log_file:.*|log_file: \"/dev/null\"|g" "${filepath}"
    sed -i "s|log_config:|#log_config:|g" "${filepath}"
    sed -i 's|bind_address:.*|bind_address: 127.0.0.1|g' "${filepath}"
    sed -i "s|bind_addresses:.*|bind_addresses: ['127.0.0.1']|g" "${filepath}"
    sed -i 's|x_forwarded:.*|x_forwarded: false|g' "${filepath}"
    sed -i "s|server_name:.*|server_name: \"${MATRIX_DOMAIN_NAME}\"|g" "${filepath}"
    sed -i "/trusted_third_party_id_servers:/a     - ${MATRIX_DOMAIN_NAME}" "${filepath}"
    sed -i "s|- ${MATRIX_DOMAIN_NAME}|    - ${MATRIX_DOMAIN_NAME}|g" "${filepath}"
    sed -i "s|enable_registration:.*|enable_registration: False|g" "${filepath}"
}

function matrix_diff {
    DIFFPARAMS="${DIFFPARAMS:-Naur}"
    MATRIX_DOMAIN_NAME="${MATRIX_DOMAIN_NAME:-demo_server_name}"
    REPORT_STATS="${REPORT_STATS:-no_or_yes}"
    export MATRIX_DOMAIN_NAME REPORT_STATS

    matrix_generate_synapse_file "$INSTALL_DIR/homeserver.synapse.yaml"
    # shellcheck disable=SC2086
    diff -${DIFFPARAMS} "$INSTALL_DIR/homeserver.synapse.yaml" "${MATRIX_DATA_DIR}/homeserver.yaml"
    rm "$INSTALL_DIR/homeserver.synapse.yaml"
}

function matrix_generate {
    breakup="0"
    [[ -z "${MATRIX_DOMAIN_NAME}" ]] && echo "STOP! environment variable MATRIX_DOMAIN_NAME must be set" && breakup="1"
    [[ -z "${REPORT_STATS}" ]] && echo "STOP! environment variable REPORT_STATS must be set to 'no' or 'yes'" && breakup="1"
    [[ "${breakup}" == "1" ]] && exit 1

    [[ "${REPORT_STATS}" != "yes" ]] && [[ "${REPORT_STATS}" != "no" ]] && \
        echo "STOP! REPORT_STATS needs to be 'no' or 'yes'" && breakup="1"

    homeserver_config="${MATRIX_DATA_DIR}/homeserver.yaml"
    if [ -f $homeserver_config ]; then
        rm $homeserver_config
    fi
    matrix_generate_homeserver_file $homeserver_config

    turnkey=$(grep 'static-auth-secret' /var/lib/turn/turnserver.conf | awk -F '=' '{print $2}')
    matrix_configure_homeserver_yaml "${turnkey}" $homeserver_config
}

function create_matrix_user_removal_script {
    read_config_param ONION_ONLY
    read_config_param MY_USERNAME
    read_config_param MATRIX_DOMAIN_NAME

    curl_command='curl'
    homebase="https://$MATRIX_DOMAIN_NAME"
    if [[ "$ONION_ONLY" != 'no' ]]; then
        curl_command='torsocks curl'
        homebase="http://$(cat /var/lib/tor/hidden_service_matrix/hostname)"
    fi

    matrix_remove_user=/usr/bin/matrix-remove-user
    { echo '#!/bin/bash';
      echo "cd $MATRIX_DATA_DIR";
      echo "remove_username=\$1";
      echo "ADMIN=\"@${MY_USERNAME}:$MATRIX_DOMAIN_NAME\"";
      echo 'BUSY="pragma busy_timeout=20000"';
      echo "BUFFER=\$(sqlite3 homeserver.db \"\$BUSY;select token from access_tokens where user_id like '\$ADMIN' order by id desc limit 1;\")";
      echo "TOKEN=\$(echo \$BUFFER|awk '{print \$2}')";
      echo 'set -x';
      echo "${curl_command} -X POST '${homebase}/_matrix/client/r0/admin/deactivate/%40\$remove_username%3A$MATRIX_DOMAIN_NAME?access_token=\$TOKEN' --data '{}'"; } > $matrix_remove_user

    chmod +x $matrix_remove_user
}

function remove_user_matrix {
    remove_username="$1"

    create_matrix_user_removal_script
    "${PROJECT_NAME}-pass" -u "$remove_username" --rmapp matrix
    $matrix_remove_user "$remove_username"
}

function add_user_matrix {
    new_username="$1"
    new_user_password="$2"
    add_user_matrix_admin=''

    read_config_param MY_USERNAME
    read_config_param MATRIX_DOMAIN_NAME

    if [[ "$new_username" == "$MY_USERNAME" ]]; then
        add_user_matrix_admin='-a'
    fi

    "${PROJECT_NAME}-pass" -u "$new_username" -a matrix -p "$new_user_password"

    # shellcheck disable=SC2034
    for i in {1..10}
    do
        if register_new_matrix_user -c "${MATRIX_DATA_DIR}/homeserver.yaml" -u "${new_username}" -p "${new_user_password}" $add_user_matrix_admin http://localhost:${MATRIX_PORT}; then
            echo "0"
            return
        fi
        sleep 2
    done

    echo "1"
}

function install_interactive_matrix {
    if [ ! "$ONION_ONLY" ]; then
        ONION_ONLY='no'
    fi

    if [[ $ONION_ONLY != "no" ]]; then
        MATRIX_DOMAIN_NAME='matrix.local'
        write_config_param "MATRIX_DOMAIN_NAME" "$MATRIX_DOMAIN_NAME"
    else
        function_check interactive_site_details
        interactive_site_details "matrix" "MATRIX_DOMAIN_NAME" "MATRIX_CODE"
        if [ ! $MATRIX_DOMAIN_NAME ]; then
            return
        fi
        read_config_param "MATRIX_DOMAIN_NAME"
        read_config_param "MATRIX_CODE"
    fi
    APP_INSTALLED=1
}

function change_password_matrix {
    #curr_username="$1"
    new_user_password="$2"

    #${PROJECT_NAME}-pass -u "$curr_username" -a matrix -p "$new_user_password"
}

function reconfigure_matrix {
    echo -n ''
}

function upgrade_matrix {
    if [ ! -d /etc/matrix ]; then
       return
    fi

    matrix_add_onion_federation

    # update connection rate limits
    read_config_param MATRIX_DOMAIN_NAME
    matrix_nginx_site=/etc/nginx/sites-available/$MATRIX_DOMAIN_NAME
    if ! grep -q 'req_limit_per_ip burst=50 ' "$matrix_nginx_site"; then
        sed -i 's|limit_req zone.*|limit_req zone=req_limit_per_ip burst=50 nodelay;|g' "$matrix_nginx_site"
    fi
    if ! grep -q 'conn_limit_per_ip 50;' "$matrix_nginx_site"; then
        sed -i 's|limit_conn conn_limit_per_ip.*|limit_conn conn_limit_per_ip 50;|g' "$matrix_nginx_site"
    fi

    matrix_expire_old_posts

    CURR_MATRIX_COMMIT=$(get_completion_param "matrix commit")
    if [[ "$CURR_MATRIX_COMMIT" == "$MATRIX_COMMIT" ]]; then

        # alter systemd daemon if necessary for the current python version
        if [ ! -f /etc/matrix/run-matrix ]; then
            matrix_systemd_daemon
            systemctl restart matrix
        else
            if ! grep -q "$MATRIX_PYTHON " /etc/matrix/run-matrix; then
                matrix_systemd_daemon
                systemctl restart matrix
            fi
        fi

        return
    fi

    systemctl stop turn
    systemctl stop matrix

    function_check set_repo_commit
    set_repo_commit /etc/matrix "matrix commit" "$MATRIX_COMMIT" $MATRIX_REPO
    cd /etc/matrix || exit 62
    if [ ! -d /etc/matrix/tmp ]; then
        mkdir /etc/matrix/tmp
    fi
    export TMPDIR=/etc/matrix/tmp

    # install python3 packages
    if [[ "$MATRIX_PYTHON" != '/usr/bin/python' ]]; then
        $INSTALL_PACKAGES --reinstall python3-pip
        $INSTALL_PACKAGES python3 python3-dev \
                          python3-pip python3-psycopg2 python3-venv \
                          python3-setuptools libpq-dev \
                          python3-lxml python3-treq

        # shellcheck disable=SC2230
        MATRIX_PIP=$(which pip3)
    fi

    # recreate the daemon if needed
    matrix_systemd_daemon

    $MATRIX_PIP install --upgrade --process-dependency-links .
    $MATRIX_PIP install --upgrade --force "pynacl>=1.2.1"

    sed -i 's/ssl.PROTOCOL_SSLv23/ssl.PROTOCOL_TLSv1/g' /usr/local/bin/register_new_matrix_user

    chown -R matrix:matrix /etc/matrix
    chown -R matrix:matrix $MATRIX_DATA_DIR

    # upgrade option causes breakage on ARM
    $MATRIX_PIP install --upgrade --force "psycopg2"
    $MATRIX_PIP install --upgrade --force "python-ldap"
    $MATRIX_PIP install --upgrade --force "pynacl>=1.2.1"
    $MATRIX_PIP install --upgrade --force "canonicaljson>=1.1.3"
    $MATRIX_PIP install --upgrade --force "phonenumbers>=8.2.0"
    $MATRIX_PIP install --upgrade --force "sortedcontainers>=2.0.4"
    $MATRIX_PIP install --upgrade --force "prometheus_client>=0.3.0"

    if [ -f /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam ]; then
        chmod 755 /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam
    fi
    systemctl start turn
    systemctl start matrix

    export TMPDIR=/tmp
    if [ -d /etc/matrix/tmp ]; then
        rm -rf /etc/matrix/tmp/*
    fi
}

function backup_local_matrix {
    source_directory=/etc/matrix
    if [ -d $source_directory ]; then
        systemctl stop turn
        systemctl stop matrix

        function_check backup_directory_to_usb
        backup_directory_to_usb $source_directory matrix
        source_directory=$MATRIX_DATA_DIR
        if [ -d $source_directory ]; then
            backup_directory_to_usb $source_directory matrixdata
        fi

        systemctl start turn
        systemctl start matrix
    fi
}

function restore_local_matrix {
    if [ -d /etc/matrix ]; then
        systemctl stop turn
        systemctl stop matrix

        temp_restore_dir=/root/tempmatrix
        function_check restore_directory_from_usb
        restore_directory_from_usb $temp_restore_dir matrix
        if [ -d $temp_restore_dir/etc/matrix ]; then
            cp -r $temp_restore_dir/etc/matrix/* /etc/matrix
        else
            cp -r $temp_restore_dir/* /etc/matrix/
        fi
        # shellcheck disable=SC2181
        if [ ! "$?" = "0" ]; then
            function_check backup_unmount_drive
            backup_unmount_drive
            exit 37
        fi
        rm -rf $temp_restore_dir
        chown -R matrix:matrix /etc/matrix

        temp_restore_dir=/root/tempmatrixdata
        restore_directory_from_usb $temp_restore_dir matrixdata
        if [ -d "$temp_restore_dir$MATRIX_DATA_DIR" ]; then
            cp -r "$temp_restore_dir$MATRIX_DATA_DIR"/* $MATRIX_DATA_DIR
        else
            cp -r $temp_restore_dir/* $MATRIX_DATA_DIR/
        fi
        # shellcheck disable=SC2181
        if [ ! "$?" = "0" ]; then
            function_check backup_unmount_drive
            backup_unmount_drive
            exit 78
        fi
        rm -rf $temp_restore_dir
        chown -R matrix:matrix $MATRIX_DATA_DIR

        if [[ "$ONION_ONLY" == "no" ]]; then
            if [ -f /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam ]; then
                chmod 755 /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam
            fi
        fi

        systemctl start turn
        systemctl start matrix
    fi
}

function backup_remote_matrix {
    echo -n ''
}

function restore_remote_matrix {
    echo -n ''
}

function remove_matrix {
    if [[ "$ONION_ONLY" == 'no' ]]; then
        firewall_remove ${MATRIX_HTTP_PORT}
    fi

    nginx_dissite $MATRIX_DOMAIN_NAME
    remove_certs $MATRIX_DOMAIN_NAME
    if [ -f /etc/nginx/sites-available/$MATRIX_DOMAIN_NAME ]; then
        rm /etc/nginx/sites-available/$MATRIX_DOMAIN_NAME
    fi
    if [ ! -d /var/www/$MATRIX_DOMAIN_NAME ]; then
        rm -rf /var/www/$MATRIX_DOMAIN_NAME
    fi
    function_check remove_ddns_domain
    remove_ddns_domain $MATRIX_DOMAIN_NAME

    systemctl stop matrix

    function_check remove_turn
    remove_turn

    systemctl disable matrix
    if [ -f /etc/systemd/system/matrix.service ]; then
        rm /etc/systemd/system/matrix.service
    fi
    systemctl daemon-reload
    $REMOVE_PACKAGES_PURGE coturn
    cd /etc/matrix || exit 26
    $MATRIX_PIP uninstall .
    rm -rf $MATRIX_DATA_DIR
    rm -rf /etc/matrix

    groupdel -f matrix
    userdel -r matrix

    remove_onion_service matrix ${MATRIX_ONION_PORT} ${MATRIX_HTTP_PORT}

    #sed -i "/# Matrix Server/,/# End of Matrix Server/d" /etc/nginx/sites-available/${MATRIX_DOMAIN_NAME}
    systemctl restart nginx

    remove_completion_param install_matrix
    sed -i '/matrix/d' "$COMPLETION_FILE"

    rm /etc/avahi/services/matrix.service
    systemctl restart avahi-daemon
}

function matrix_wait_for_database {
    # remove any pre-existing database
    if [ ! -f "$MATRIX_DATA_DIR/homeserver.db" ]; then
        systemctl start matrix
    else
        systemctl stop matrix
        rm "$MATRIX_DATA_DIR/homeserver.db"
        systemctl restart matrix
    fi

    systemctl restart nginx

    echo $'Waiting for the database to be created'
    # shellcheck disable=SC2034
    for i in {1..60}
    do
        echo -n '.'
        sleep 2
        if [ -f "$MATRIX_DATA_DIR/homeserver.db" ]; then
            break
        fi
    done
    echo ''

    if [ ! -f "$MATRIX_DATA_DIR/homeserver.db" ]; then
        echo $'No matrix home server database was created'
        exit 23
    fi
    chmod -R 700 "$MATRIX_DATA_DIR/homeserver.db"
}

function install_home_server {
    if [ -d /etc/matrix ]; then
        rm -rf /etc/matrix
    fi

    if [ -d /repos/matrix ]; then
        mkdir /etc/matrix
        cp -r -p /repos/matrix/. /etc/matrix
        cd /etc/matrix || exit 23
        git pull
    else
        function_check git_clone
        git_clone $MATRIX_REPO /etc/matrix
    fi

    if [ ! -d /etc/matrix ]; then
        echo $'Unable to clone matrix repo'
        exit 67
    fi

    cd /etc/matrix || exit 73
    git checkout $MATRIX_COMMIT -b $MATRIX_COMMIT
    set_completion_param "matrix commit" "$MATRIX_COMMIT"
    if [ ! -d "$INSTALL_DIR/matrix" ]; then
        mkdir -p "$INSTALL_DIR/matrix"
    fi
    rm -rf /usr/local/lib/python2.7/dist-packages/ldap*
    rm -rf /usr/local/lib/python3.5/dist-packages/ldap*
    if [ -d "$INSTALL_DIR/matrix" ]; then
        rm -rf "$INSTALL_DIR/matrix/"*
    fi
    if ! $MATRIX_PIP install --upgrade --process-dependency-links . -b "$INSTALL_DIR/matrix"; then
        echo $'Failed to install matrix home server'
        exit 78
    fi

    if [ ! -d "$MATRIX_DATA_DIR" ]; then
        mkdir "$MATRIX_DATA_DIR"
    fi

    groupadd matrix
    useradd -c "Matrix system account" -d "$MATRIX_DATA_DIR" -m -r -g matrix matrix
    usermod -a -G www-data matrix
    usermod -a -G ssl-cert matrix

    function_check install_turn
    install_turn
    # shellcheck disable=SC2034
    MATRIX_SECRET="${turnkey}"

    function_check matrix_generate
    matrix_generate

    # Disable the web client
    sed -i 's|web_client:.*|web_client: False|g' "$MATRIX_DATA_DIR/homeserver.yaml"
    sed -i 's|, webclient||g' "$MATRIX_DATA_DIR/homeserver.yaml"
    sed -i "/- '0.0.0.0'/d" "$MATRIX_DATA_DIR/homeserver.yaml"
    if ! grep -q "# - '::'" "$MATRIX_DATA_DIR/homeserver.yaml"; then
        sed -i "s| - '::'|# - '::'|g" "$MATRIX_DATA_DIR/homeserver.yaml"
    fi

    if [[ "$ONION_ONLY" != 'no' ]]; then
        sed -i "s|- matrix.local|- $MATRIX_ONION_HOSTNAME|g" "$MATRIX_DATA_DIR/homeserver.yaml"
    fi

    chmod -R 700 "$MATRIX_DATA_DIR/homeserver.yaml"
    chown -R matrix:matrix /etc/matrix
    chown -R matrix:matrix $MATRIX_DATA_DIR

    sed -i 's/ssl.PROTOCOL_SSLv23/ssl.PROTOCOL_TLSv1/g' /usr/local/bin/register_new_matrix_user

    matrix_systemd_daemon

    matrix_wait_for_database

    echo $'Accessing the homeserver database'
    cd "$MATRIX_DATA_DIR" || exit 36
    homeserver_database_updated=
    # shellcheck disable=SC2034
    for i in {1..60}
    do
        echo -n '.'
        sleep 2
        if sqlite3 homeserver.db "PRAGMA auto_vacuum = FULL;"; then
            homeserver_database_updated=1
            break
        fi
    done
    echo ''

    if [ ! $homeserver_database_updated ]; then
        echo $"$MATRIX_DATA_DIR/homeserver.db could not be accessed"
    fi

    if [ ! "${MATRIX_PASSWORD}" ]; then
        if [ -f "${IMAGE_PASSWORD_FILE}" ]; then
            MATRIX_PASSWORD="$(printf "%s" "$(cat "$IMAGE_PASSWORD_FILE")")"
        else
            MATRIX_PASSWORD="$(create_password "${MINIMUM_PASSWORD_LENGTH}")"
        fi
    fi

    if [[ "$ONION_ONLY" == 'no' ]]; then
        firewall_add matrix ${MATRIX_HTTP_PORT}
    fi

    rm -rf "${MATRIX_DATA_DIR}/Maildir"
    rm -rf "${MATRIX_DATA_DIR}/.mutt"
    rm -f "${MATRIX_DATA_DIR}/.muttrc"
    rm -f "${MATRIX_DATA_DIR}/.mutt-alias"
    rm -f "${MATRIX_DATA_DIR}/.procmailrc"
    rm -f "${MATRIX_DATA_DIR}/.emacs-mutt"
}

function matrix_update_riot_config {
    read_config_param RIOT_DOMAIN_NAME
    if [ ! "$RIOT_DOMAIN_NAME" ]; then
        return
    fi
    if [ ! -d "/var/www/$RIOT_DOMAIN_NAME/htdocs" ]; then
        return
    fi
    if [ -f "/var/www/$RIOT_DOMAIN_NAME/htdocs/config.$RIOT_DOMAIN_NAME.json" ]; then
        sed -i "s|\"default_hs_url\":.*|\"default_hs_url\": \"https://${RIOT_DOMAIN_NAME}\",|g" "/var/www/$RIOT_DOMAIN_NAME/htdocs/config.$RIOT_DOMAIN_NAME.json"
        sed -i "s|\"default_is_url\":.*|\"default_is_url\": \"https://${RIOT_DOMAIN_NAME}\",|g" "/var/www/$RIOT_DOMAIN_NAME/htdocs/config.$RIOT_DOMAIN_NAME.json"
    fi
    if [ -f "/var/www/$RIOT_DOMAIN_NAME/htdocs/config.$MATRIX_ONION_HOSTNAME.json" ]; then
        sed -i "s|\"default_hs_url\":.*|\"default_hs_url\": \"https://${MATRIX_ONION_HOSTNAME}\",|g" "/var/www/$RIOT_DOMAIN_NAME/htdocs/config.$MATRIX_ONION_HOSTNAME.json"
        sed -i "s|\"default_is_url\":.*|\"default_is_url\": \"https://${MATRIX_ONION_HOSTNAME}\",|g" "/var/www/$RIOT_DOMAIN_NAME/htdocs/config.$MATRIX_ONION_HOSTNAME.json"
    fi
}

function install_matrix {
    increment_app_install_progress

    # shellcheck disable=SC2086
    check_ram_availability $MATRIX_MINIMUM_RAM_MB

    if [ ! -d "$INSTALL_DIR" ]; then
        mkdir -p "$INSTALL_DIR"
    fi

    increment_app_install_progress

    if [[ ${ONION_ONLY} == 'no' ]]; then
        if [ ! -f /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.pem ]; then
            if [ -f /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.crt ]; then
                rm /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.crt
            fi
            if [ -f /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam ]; then
                rm /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam
            fi
            echo $'Obtaining certificate for the matrix domain'
            function_check create_site_certificate
            create_site_certificate ${MATRIX_DOMAIN_NAME} 'yes'
            chmod 755 /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.dhparam

            if [ -f /etc/ssl/certs/${MATRIX_DOMAIN_NAME}.crt ]; then
                echo $'Incorrect certificate generated'
                exit 73
            fi
        fi
        chgrp -R ssl-cert /etc/letsencrypt
        chmod -R g=rX /etc/letsencrypt
    fi

    increment_app_install_progress

    export DEBIAN_FRONTEND=noninteractive
    $INSTALL_PACKAGES --reinstall python3-pip
    $INSTALL_PACKAGES coreutils \
            curl file gcc git libevent-2.0-5 \
            libevent-dev libffi-dev libffi6 \
            libgnutls28-dev libjpeg62-turbo \
            libjpeg62-turbo-dev libldap-2.4-2 \
            libldap2-dev libsasl2-dev \
            libsqlite3-dev libssl-dev \
            libssl1.1 libtool libxml2 \
            libxml2-dev libxslt1-dev libxslt1.1 \
            make python python-dev \
            python3 python3-dev python-pip python-psycopg2 \
            python3-pip python3-psycopg2 python3-venv \
            python3-setuptools \
            python-virtualenv sqlite unzip \
            zlib1g zlib1g-dev libpq-dev \
            python-lxml python-treq \
            python3-lxml python3-treq

    increment_app_install_progress

    if [ ! -f "$MATRIX_PIP" ]; then
        if [[ "$MATRIX_PIP" == *'pip' ]]; then
            # shellcheck disable=SC2230
            MATRIX_PIP=$(which pip)
        else
            # shellcheck disable=SC2230
            MATRIX_PIP=$(which pip3)
        fi
    fi

    if [[ "$MATRIX_PIP" == *'pip3' ]]; then
        $MATRIX_PIP install --upgrade pip==9.0.3
    fi

    increment_app_install_progress

    $MATRIX_PIP install --upgrade psycopg2

    increment_app_install_progress

    $MATRIX_PIP install --upgrade python-ldap

    increment_app_install_progress

    $MATRIX_PIP install --upgrade --force "phonenumbers>=8.2.0"

    increment_app_install_progress

    $MATRIX_PIP install --upgrade --force "sortedcontainers>=2.0.4"

    increment_app_install_progress

    $MATRIX_PIP install --upgrade --force "prometheus_client>=0.3.0"

    increment_app_install_progress

    function_check create_matrix_nginx_config
    create_matrix_nginx_config

    increment_app_install_progress

    function_check install_home_server
    install_home_server

    increment_app_install_progress

    systemctl restart nginx

    increment_app_install_progress

    systemctl restart turn

    increment_app_install_progress

    systemctl restart matrix

    increment_app_install_progress

    function_check update_default_domain
    update_default_domain

    # wait for nginx to start otherwise user add fails later
    sleep 5

    increment_app_install_progress

    $MATRIX_PIP install --upgrade --force "pynacl>=1.2.1"

    increment_app_install_progress

    $MATRIX_PIP install --upgrade --force "canonicaljson>=1.1.3"