package           : tis-remote-repo-tftp
version           : 2.6.0.17392-6
architecture      : x64
section           : base
priority          : optional
name              : Remote Repository TFTP
categories        : System and network
maintainer        : WAPT Team,Tranquil IT,Jimmy PELÉ,Ingrid TALBOT, Bertrand LEMOIGNE
description       : Package for installing WaptTFTPServer for remote repositories agents
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : linux
min_wapt_version  : 2.3
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Paquet pour l'installation de WaptTFTPServer pour les agents de dépôts distants
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : tftp,wapt
licence           : 
homepage          : 
package_uuid      : 2685eb43-a5bf-4cfe-b77a-92f3d0a3baca
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : 29f1849f2f6845086ee6dd95bcaeae5cb0438ab7435b1af6d30d57f520a5cfe3
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2025-08-03T10:15:00.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : vfdDG5KPX3ZtrW+jAHmWyhJ05eTLCrE2fPGqYlBR3WU6QxXZS/8s55F3+ON1o9tyq4nE5ItnSoc++moE2iO8VwbeCqO2pn7W0lJXE4mZX2B/+5Bt5YIl8B1UNqAs8JOX1hnOGL5eJKAgcOpXUoFJ46taxkSqv2Vu+pw8SUhjMm+M2FtddWw2oCGrVs22/hPRa3E92/mY450VlPqF1EfjbsFuzahceiq973GW2H/v2pBcFycLLo6d1rI7EHzaWOttwYrUzKDxBtMWoyYR6uCBddHn0gQMuj9lsaYeEzNHETTsa48lDs0UhTleAJLNvCiKWDn7hZK2mtfqKRfwB42yHQ==

# -*- coding: utf-8 -*-
from setuphelpers import *
import re

bin_name = "wapttftpserver.bin"
service_name = "wapttftpserver"


def install():
    tftp_bin = os.path.join(WAPT.wapt_base_dir, bin_name)
    if service_is_enabled("wapttftpserver"):
        run("systemctl stop wapttftpserver")
    killalltasks(bin_name)
    filecopyto(bin_name, tftp_bin)
    run("chmod +x %s" % tftp_bin)

    # print("Apply wapttftpserver config")
    repo_path = inifile_readstring(WAPT.config_filename, "repo-sync", "local_repo_path")
    if not repo_path:
        if is_debian_based():
            repo_path = "/var/www"
        elif is_redhat_based():
            repo_path = "/var/www/html"
        else:
            makepath(WAPT.wapt_base_dir, "repository")
    tftp_path = makepath(repo_path, "wads", "pxe")
    mkdirs(tftp_path)

    if is_redhat_based():
        print("Add wapttftpserver firewall rule")
        setup_firewall()

        package_prefix = control.package.split("-", 1)[0]
        pkg_name = package_prefix + "-" + "remote-repo-nginx"
        if not WAPT.is_installed(pkg_name):
            # SELinux rules for CentOS/RedHat
            if re.match("^SELinux status:.*enabled", run("sestatus")):
                print("Redhat/Centos detected, tweaking SELinux rules")
                selinux_rules(repo_path)
                print("Nginx - SELinux correctly configured for Nginx reverse proxy")

    print("Create wapttftpserver service")

    wapttftpserver = rf'''
    [Unit]
Description=WAPT/WADS TFTP Server startup script
After=network-online.target

[Service]
Type=forking
RemainAfterExit=no
UMask=0027
#PIDFile=/run/wapttftpserver.pid
ExecStart=/opt/wapt/wapttftpserver.bin --fork --username=root --root_dir={tftp_path} --verbose --log-path=/dev/stdout
ExecStop=/opt/wapt/wapttftpserver.bin -k
TimeoutSec=300
SyslogIdentifier=wapttftpserver

[Install]
WantedBy=multi-user.target
'''

    with open('/usr/lib/systemd/system/wapttftpserver.service','w') as t:
        t.write(wapttftpserver)
        t.close

    if is_redhat_based():
        run("chcon -vR system_u:object_r:systemd_unit_file_t:s0  /usr/lib/systemd/system/wapttftpserver.service")

    run("chmod 644  /usr/lib/systemd/system/wapttftpserver.service")
    run("systemctl enable /usr/lib/systemd/system/wapttftpserver.service")
    run("systemctl restart wapttftpserver.service")


def uninstall():
    tftp_bin = os.path.join(WAPT.wapt_base_dir, bin_name)
    server_conf_dir = makepath(WAPT.wapt_base_dir, "conf")

    print("Disable wapttftpserver service")
    if service_is_enabled('wapttftpserver'):
        run("systemctl disable wapttftpserver")
    run("systemctl stop wapttftpserver")

    if isfile(tftp_bin):
        remove_file(tftp_bin)
    if len(glob.glob(server_conf_dir + os.sep + "*")) == 1:
        remove_tree(server_conf_dir)


def setup_firewall():
    """Add permanent rules for firewalld"""
    if not type_redhat():
        # only firewalld is supported right now
        return
    # check if firewalld is running
    if run("firewall-cmd --state", accept_returncodes=[0, 252]).strip() == "running":
        run("firewall-cmd --permanent --add-service=tftp")
        run("firewall-cmd --reload")
    else:
        run("firewall-offline-cmd --add-service=tftp")


def selinux_rules(local_repo):
    """SELinux httpd security rules"""
    run("setsebool -P httpd_can_network_connect 1")
    run("setsebool -P httpd_setrlimit on")
    for sepath in "wads":
        path = makepath(local_repo, sepath)
        mkdirs(path)
        try:
            run('semanage fcontext -a -t httpd_sys_content_t "%s(/.*)?"' % (path))
        except:
            try:
                run('semanage fcontext -m -t httpd_sys_content_t "%s(/.*)?"' % (path))
            except:
                pass
        run("restorecon -R -v %s" % (path))


def service_is_enabled(service):
    try:
        res = run("systemctl is-enabled wapttftpserver")
        return res.splitlines()[0] == "enabled"
    except:
        return False

# -*- coding: utf-8 -*-
from setuphelpers import *
import json


def update_package():
    # Declaring local variables
    package_updated = False
    proxies = get_proxies()
    if not proxies:
        proxies = get_proxies_from_wapt_console()
    download_url = "https://wapt.tranquil.it/wapt/releases/latest/bin/linux-x64/wapttftpserver"
    latest_bin = "wapttftpserver.bin"
    version = json.loads(wgets("https://wapt.tranquil.it/wapt/releases/latest/wapt_agent_list.json", proxies=proxies))[0]["wapt_version"]

    # Deleting binaries
    for f in glob.glob("*.exe") + glob.glob("*.msi") + glob.glob("*.bin"):
        print("Removing: %s" % f)
        remove_file(f)

    # Downloading latest binaries
    print("Download URL is: %s" % download_url)
    if not isfile(latest_bin):
        print("Downloading: %s" % latest_bin)
        wget(download_url, latest_bin, proxies=proxies)
    else:
        print("Binary is present: %s" % latest_bin)

    # Changing version of the package
    if Version(version) > Version(control.get_software_version()):
        print("Software version updated (from: %s to: %s)" % (control.get_software_version(), Version(version)))
        package_updated = True
    else:
        print("Software version up-to-date (%s)" % Version(version))
    control.set_software_version(version)
    control.save_control_to_wapt()

    # Validating or not update-package-sources
    return package_updated