#!/bin/sh
# Provision a FreeBSD 15.1 host for the rChat relay (run as root).
set -eu

# Service user: no login shell, home /var/db/rchat (created below), the same
# as install.sh.
if ! pw usershow rchat >/dev/null 2>&1; then
    pw useradd rchat -c "rChat relay" -d /var/db/rchat -s /usr/sbin/nologin
fi
RCHAT_UID=$(id -u rchat)

install -d -o root -g rchat -m 0750 /usr/local/etc/rchat
install -d -o rchat -g rchat -m 0700 /var/db/rchat
install -d -o rchat -g rchat -m 0750 /var/log/rchat

# Let only the rchat user bind :443 (mac_portacl), nothing else unprivileged
# may bind a low port.
sysrc -f /boot/loader.conf mac_portacl_load="YES" >/dev/null
kldstat -q -m mac_portacl || kldload mac_portacl

cat > /etc/sysctl.conf.local <<SYSCTL
security.mac.portacl.rules=uid:${RCHAT_UID}:tcp:443
net.inet.ip.portrange.reservedlow=0
net.inet.ip.portrange.reservedhigh=0
# Hardening
kern.coredump=0
security.bsd.see_other_uids=0
security.bsd.see_other_gids=0
security.bsd.see_jail_proc=0
security.bsd.unprivileged_read_msgbuf=0
security.bsd.unprivileged_proc_debug=0
kern.randompid=1
net.inet.tcp.blackhole=2
net.inet.udp.blackhole=1
net.inet.ip.random_id=1
net.inet.tcp.drop_synfin=1
net.inet.icmp.drop_redirect=1
net.inet.ip.redirect=0
SYSCTL
sysctl -f /etc/sysctl.conf.local >/dev/null

# Logs rotated daily, 14 kept; daemon -H reopens on SIGHUP.
mkdir -p /usr/local/etc/newsyslog.conf.d
cat > /usr/local/etc/newsyslog.conf.d/rchat.conf <<NSL
/var/log/rchat/server.log rchat:rchat 640 14 * @T00 JC /var/run/rchat.pid 1
NSL

# Services the relay does not need.
sysrc sendmail_enable=NONE sendmail_submit_enable=NO sendmail_outbound_enable=NO sendmail_msp_queue_enable=NO >/dev/null
sysrc clear_tmp_enable=YES >/dev/null

echo "provisioned (rchat uid ${RCHAT_UID})"