🍽 Fork YunoHost — snapshot mangé par la machine à tsoins

Upstream: https://github.com/YunoHost/yunohost @ 3a5f8bac8301c450897b96cbd43a4c7d3ba750fb
But (José) : transformer tout le code en bions + ploxions du xerboxion.
La carte de digestion vit au labo : /yunohost-digest.json

share/actionsmap-portal.yml

@@ -0,0 +1,96 @@
+_global:
+    namespace: yunohost
+    authentication:
+        api: ldap_ynhuser
+        cli: null
+    lock: false
+    cache: false
+
+portal:
+    category_help: Portal routes
+    actions:
+
+        ### portal_me()
+        me:
+            action_help: Allow user to fetch their own infos
+            api: GET /me
+
+        ### portal_apps()
+        apps:
+            action_help: Allow users to fetch lit of apps they have access to
+            api: GET /me/apps
+
+        ### portal_update()
+        update:
+            action_help: Allow user to update their infos (display name, mail aliases/forward, password, ...)
+            api: PUT /update
+            arguments:
+                --fullname:
+                    help: The full name of the user. For example 'Camille Dupont'
+                    extra:
+                        pattern: &pattern_fullname
+                            - !!str ^([^\W_]{1,30}[ ,.'-]{0,3})+$
+                            - "pattern_fullname"
+                --mail:
+                    help: Main email
+                    extra:
+                        pattern: &pattern_email
+                            - !!str ^[\w.-]+@([^\W_A-Z]+([-]*[^\W_A-Z]+)*\.)+((xn--)?[^\W_]{2,})$
+                            - "pattern_email"
+                --mailforward:
+                    help: Mailforward addresses to add
+                    nargs: "*"
+                    metavar: MAIL
+                    extra:
+                        pattern: &pattern_email_forward
+                            - !!str ^[\w\+.-]+@([^\W_A-Z]+([-]*[^\W_A-Z]+)*\.)+((xn--)?[^\W_]{2,})$
+                            - "pattern_email_forward"
+                --mailalias:
+                    help: Mail aliases to add
+                    nargs: "*"
+                    metavar: MAIL
+                    extra:
+                        pattern: *pattern_email
+                --currentpassword:
+                    help: Current password
+                    nargs: "?"
+                --newpassword:
+                    help: New password to set
+                    nargs: "?"
+
+        ### portal_update_password()
+        # update_password:
+        #     action_help: Allow user to change their password
+        #     api: PUT /me/update_password
+        #     arguments:
+        #         -c:
+        #             full: --current
+        #             help: Current password
+        #         -p:
+        #             full: --password
+        #             help: New password to set
+
+        ### portal_reset_password()
+        reset_password:
+            action_help: Allow user to update their infos (display name, mail aliases/forward, ...)
+            api: PUT /me/reset_password
+            authentication:
+                # FIXME: to be implemented ?
+                api: reset_password_token
+            # FIXME: add args etc
+
+        ### portal_register()
+        register:
+            action_help: Allow user to register using an invite token or ???
+            api: POST /me
+            authentication:
+                # FIXME: to be implemented ?
+                api: register_invite_token
+            # FIXME: add args etc
+
+        ### portal_public()
+        public:
+            action_help: Allow anybody to list public apps and other infos regarding the public portal
+            api: GET /public
+            authentication:
+                api: null

share/config_app.toml

@@ -0,0 +1,35 @@
+version = "1.0"
+i18n = "app_config"
+
+[_core]
+
+    # This is duplicated for each permission and named "permission_main", "permission_admin" etc.
+    # Keys are also made unique by prefixing them with "permission_main" / "permission_admin",
+    # for example the label key is "permission_{permid}_label"
+    [_core.permissions]
+
+        [_core.permissions.url]
+        type = "url"
+        visible = false
+
+        [_core.permissions.location]
+        type = "markdown"
+        # Core automatically add a "visible=false" if url is empty (but since the keys are dynamic, can't do it here)
+
+        [_core.permissions.label]
+        type = "string"
+
+        [_core.permissions.description]
+        type = "string"
+
+        [_core.permissions.show_tile]
+        type = "boolean"
+        # Core automatically add a "visible=false" if url is empty (but since the keys are dynamic, can't do it here)
+
+        [_core.permissions.logo]
+        type = "file"
+        accept = ["image/png"]
+
+        [_core.permissions.allowed]
+        type = "tags"
+        # Core automatically add a "readonly" if protected is true

share/config_domain.toml

@@ -0,0 +1,125 @@
+version = "1.0"
+i18n = "domain_config"
+
+[feature]
+
+    [feature.mail]
+        [feature.mail.mail_out]
+        type = "boolean"
+        default = 1
+
+        [feature.mail.mail_in]
+        type = "boolean"
+        default = 1
+
+    [feature.app]
+        [feature.app.default_app]
+        type = "app"
+        filter = "is_webapp"
+        default = "_none"
+
+    [feature.portal]
+    # Only available for "topest" domains
+
+        [feature.portal.enable_public_apps_page]
+        type = "boolean"
+        default = false
+
+        [feature.portal.show_other_domains_apps]
+        type = "boolean"
+        default = true
+
+        [feature.portal.portal_title]
+        type = "string"
+        default = "YunoHost"
+
+        [feature.portal.portal_logo]
+        type = "file"
+        accept = ["image/png", "image/jpeg", "image/svg+xml"]
+        mode = "python"
+        bind = "/usr/share/yunohost/portal/customassets/{filename}{ext}"
+
+        [feature.portal.portal_theme]
+        type = "select"
+        choices = ["system", "light", "dark", "omg", "legacy", "black", "synthwave", "halloween", "coffee", "cupcake", "cyberpunk", "valentine", "nord"]
+        default = "system"
+
+        [feature.portal.portal_tile_theme]
+        type = "select"
+        optional = false
+        choices = ["descriptive", "simple", "periodic"]
+        default = "simple"
+
+        [feature.portal.search_engine]
+        type = "url"
+        default = ""
+
+        [feature.portal.search_engine_name]
+        type = "string"
+        visible = "search_engine"
+
+        [feature.portal.portal_user_intro]
+        type = "text"
+
+        [feature.portal.portal_public_intro]
+        type = "text"
+
+        # FIXME link to GCU
+
+        [feature.portal.custom_css]
+        # NB: this is wrote into "/usr/share/yunohost/portal/customassets/{domain}.custom.css"
+        type = "text"
+
+[dns]
+
+    [dns.registrar]
+    # This part is automatically generated in DomainConfigPanel
+
+[cert]
+
+    [cert.cert_]
+    # The section has a different id than 'cert' otherwise it ends up with an unecessary "name" because it's defined for the panel (in i18n.json)
+
+        [cert.cert_.cert_summary]
+        type = "alert"
+        # Automatically filled by DomainConfigPanel
+
+        [cert.cert_.cert_validity]
+        type = "number"
+        readonly = true
+        visible = "false"
+        # Automatically filled by DomainConfigPanel
+
+        [cert.cert_.cert_issuer]
+        type = "string"
+        visible = false
+        # Automatically filled by DomainConfigPanel
+
+        [cert.cert_.acme_eligible]
+        type = "boolean"
+        visible = false
+        # Automatically filled by DomainConfigPanel
+
+        [cert.cert_.acme_eligible_explain]
+        type = "alert"
+        style = "warning"
+        visible = "acme_eligible == false || acme_eligible == null"
+
+        [cert.cert_.cert_no_checks]
+        type = "boolean"
+        default = false
+        visible = "acme_eligible == false || acme_eligible == null"
+
+        [cert.cert_.cert_install]
+        type = "button"
+        icon = "star"
+        style = "success"
+        visible = "cert_issuer != 'letsencrypt'"
+        enabled = "acme_eligible || cert_no_checks"
+
+        [cert.cert_.cert_renew]
+        type = "button"
+        icon = "refresh"
+        style = "warning"
+        visible = "cert_issuer == 'letsencrypt'"
+        enabled = "acme_eligible || cert_no_checks"

share/config_global.toml

@@ -0,0 +1,210 @@
+version = "1.0"
+i18n = "global_settings_setting"
+
+[security]
+    [security.password]
+
+        [security.password.admin_strength]
+        type = "select"
+        choices.1 = "Require at least 8 chars"
+        choices.2 = "ditto, but also require at least one digit, one lower and one upper char"
+        choices.3 = "ditto, but also require at least one special char"
+        choices.4 = "ditto, but also require at least 12 chars"
+        default = "1"
+
+        [security.password.user_strength]
+        type = "select"
+        choices.1 = "Require at least 8 chars"
+        choices.2 = "ditto, but also require at least one digit, one lower and one upper char"
+        choices.3 = "ditto, but also require at least one special char"
+        choices.4 = "ditto, but also require at least 12 chars"
+        default = "1"
+
+        [security.password.passwordless_sudo]
+        type = "boolean"
+        # The actual value is dynamically computed by checking the sudoOption of cn=admins,ou=sudo
+        default = false
+
+    [security.ssh]
+
+        [security.ssh.ssh_compatibility]
+        type = "select"
+        choices.intermediate = "Intermediate (compatible with older softwares)"
+        choices.modern = "Modern (recommended)"
+        default = "modern"
+
+        [security.ssh.ssh_port]
+        type = "number"
+        default = 22
+
+        [security.ssh.ssh_password_authentication]
+        type = "boolean"
+        default = true
+
+    [security.nginx]
+        [security.nginx.nginx_redirect_to_https]
+        type = "boolean"
+        default = true
+
+        [security.nginx.nginx_compatibility]
+        type = "select"
+        choices.intermediate = "Intermediate (compatible with Firefox 27, Android 4.4.2, Chrome 31, Edge, IE 11, Opera 20, and Safari 9)"
+        choices.modern = "Modern (compatible with Firefox 63, Android 10.0, Chrome 70, Edge 75, Opera 57, and Safari 12.1)"
+        default = "intermediate"
+
+    [security.postfix]
+
+        [security.postfix.postfix_compatibility]
+        type = "select"
+        choices.intermediate = "Intermediate (allows TLS 1.2)"
+        choices.modern = "Modern (TLS 1.3 only)"
+        default = "intermediate"
+
+    [security.webadmin]
+        [security.webadmin.webadmin_allowlist_enabled]
+        type = "boolean"
+        default = false
+
+        [security.webadmin.webadmin_allowlist]
+        type = "tags"
+        visible = "webadmin_allowlist_enabled"
+        optional = true
+        default = ""
+
+    [security.portal]
+        [security.portal.portal_allow_edit_email]
+        type = "boolean"
+        default = false
+
+        [security.portal.portal_allow_edit_email_alias]
+        type = "boolean"
+        default = true
+
+        [security.portal.portal_allow_edit_email_forward]
+        type = "boolean"
+        default = true
+
+    [security.root_access]
+        [security.root_access.root_access_explain]
+        type = "alert"
+        style = "info"
+        icon = "info"
+
+        [security.root_access.root_password]
+        type = "password"
+        optional = true
+        default = ""
+
+        [security.root_access.root_password_confirm]
+        type = "password"
+        optional = true
+        default = ""
+
+    [security.experimental]
+        [security.experimental.security_experimental_enabled]
+        type = "boolean"
+        default = false
+
+[email]
+    [email.pop3]
+        [email.pop3.pop3_enabled]
+        type = "boolean"
+        default = false
+
+    [email.smtp]
+        [email.smtp.smtp_allow_ipv6]
+        type = "boolean"
+        default = true
+
+        [email.smtp.smtp_relay_enabled]
+        type = "boolean"
+        default = false
+
+        [email.smtp.smtp_relay_host]
+        type = "string"
+        default = ""
+        optional = true
+        visible="smtp_relay_enabled"
+
+        [email.smtp.smtp_relay_port]
+        type = "number"
+        default = 587
+        visible="smtp_relay_enabled"
+
+        [email.smtp.smtp_relay_user]
+        type = "string"
+        default = ""
+        optional = true
+        visible="smtp_relay_enabled"
+
+        [email.smtp.smtp_relay_password]
+        type = "password"
+        default = ""
+        optional = true
+        visible="smtp_relay_enabled"
+        help = ""  # This is empty string on purpose, otherwise the core automatically set the 'good_practice_admin_password' string here which is not relevant, because the admin is not actually "choosing" the password ...
+
+        [email.smtp.smtp_backup_mx_domains]
+        type = "string"
+        default = ""
+        optional = true
+
+        [email.smtp.smtp_backup_mx_emails_whitelisted]
+        type = "string"
+        default = ""
+        optional = true
+        visible = "smtp_backup_mx_domains"
+
+    [email.antispam]
+        [email.antispam.enable_blocklists]
+        type = "boolean"
+        default = true
+
+[misc]
+
+    [misc.backup]
+        [misc.backup.backup_compress_tar_archives]
+        type = "boolean"
+        default = false
+
+    [misc.network]
+
+        [misc.network.dns_exposure]
+        type = "select"
+        choices.both = "Both"
+        choices.ipv4 = "IPv4 Only"
+        choices.ipv6 = "IPv6 Only"
+        default = "both"
+
+        [misc.network.dns_custom_resolvers_enabled]
+        type = "boolean"
+        default = false
+
+        [misc.network.dns_custom_resolvers_list]
+        type = "tags"
+        # Regex is <IPv4 regex or IPv6 regex> <IPv4 regex or IPv6 regex>+
+        # Regex from Jonas Jared Jacek <https://www.ditig.com/validating-ipv4-and-ipv6-addresses-with-regexp>
+        pattern.regexp = '^((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|(([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,7}:|:(:[0-9A-Fa-f]{1,4}){1,7}|([0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,5}(:[0-9A-Fa-f]{1,4}){1,2}|([0-9A-Fa-f]{1,4}:){1,4}(:[0-9A-Fa-f]{1,4}){1,3}|([0-9A-Fa-f]{1,4}:){1,3}(:[0-9A-Fa-f]{1,4}){1,4}|([0-9A-Fa-f]{1,4}:){1,2}(:[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(:[0-9A-Fa-f]{1,4}){1,6}|:(:[0-9A-Fa-f]{1,4}){1,6}))(,?((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|(([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,7}:|:(:[0-9A-Fa-f]{1,4}){1,7}|([0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,5}(:[0-9A-Fa-f]{1,4}){1,2}|([0-9A-Fa-f]{1,4}:){1,4}(:[0-9A-Fa-f]{1,4}){1,3}|([0-9A-Fa-f]{1,4}:){1,3}(:[0-9A-Fa-f]{1,4}){1,4}|([0-9A-Fa-f]{1,4}:){1,2}(:[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(:[0-9A-Fa-f]{1,4}){1,6}|:(:[0-9A-Fa-f]{1,4}){1,6})))+$'
+        pattern.error = "You should specify a valid resolver Ipv4/Ipv6, such as 89.234.141.66 or 2a00:5881:8100:1000::3"
+        default = ""
+        visible = "dns_custom_resolvers_enabled"
+
+    [misc.tls_passthrough]
+
+        [misc.tls_passthrough.tls_passthrough_enabled]
+        type = "boolean"
+        default = false
+
+        [misc.tls_passthrough.tls_passthrough_explain]
+        type = "alert"
+        style = "info"
+        icon = "info"
+        visible = "tls_passthrough_enabled"
+
+        [misc.tls_passthrough.tls_passthrough_list]
+        type = "tags"
+        # Regex is just <domain regex>;<destination>;<port>
+        pattern.regexp = '^((([^\W_A-Z]+([-]*[^\W_A-Z]+)*\.)+((xn--)?[^\W_]{2,}));(([^\W_A-Z]+([-]*[^\W_A-Z]+)*\.)+((xn--)?([^\W_]{2,}|[0-9]{1,3})));[0-9]{1,}(?:,|$))+'
+        pattern.error = "You should specify a list of items formatted as DOMAIN;DESTINATION;DESTPORT, such as yolo.test;192.168.1.42;443"
+        default = ""
+        visible = "tls_passthrough_enabled"

share/dnsbl_list.yml

@@ -0,0 +1,182 @@
+# Used by GAFAM
+- name: Spamhaus ZEN
+  dns_server: zen.spamhaus.org
+  website: https://www.spamhaus.org/zen/
+  ipv4: true
+  ipv6: true
+  domain: false
+  non_blocklisted_return_code: []
+- name: Barracuda Reputation Block List
+  dns_server: b.barracudacentral.org
+  website: https://barracudacentral.org/rbl/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Hostkarma
+  dns_server: hostkarma.junkemailfilter.com
+  website: https://ipadmin.junkemailfilter.com/remove.php
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: ['127.0.0.1', '127.0.0.5', '127.0.1.1']
+- name: ImproWare IP based spamlist
+  dns_server: spamrbl.imp.ch
+  website: https://antispam.imp.ch/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: ImproWare IP based wormlist
+  dns_server: wormrbl.imp.ch
+  website: https://antispam.imp.ch/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Backscatterer.org
+  dns_server: ips.backscatterer.org
+  website: http://www.backscatterer.org/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: inps.de
+  dns_server: dnsbl.inps.de
+  website: http://dnsbl.inps.de/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: LASHBACK
+  dns_server: ubl.unsubscore.com
+  website: https://blacklist.lashback.com/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Mailspike.org
+  dns_server: bl.mailspike.net
+  website: http://www.mailspike.net/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: NiX Spam
+  dns_server: ix.dnsbl.manitu.net
+  website: http://www.dnsbl.manitu.net/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: REDHAWK
+  dns_server: access.redhawk.org
+  website: https://www.redhawk.org/SpamHawk/query.php
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: SORBS Open SMTP relays
+  dns_server: smtp.dnsbl.sorbs.net
+  website: http://www.sorbs.net/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: SORBS Spamhost (last 28 days)
+  dns_server: recent.spam.dnsbl.sorbs.net
+  website: http://www.sorbs.net/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: SORBS Spamhost (last 48 hours)
+  dns_server: new.spam.dnsbl.sorbs.net
+  website: http://www.sorbs.net/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: SpamCop Blocking List
+  dns_server: bl.spamcop.net
+  website: https://www.spamcop.net/bl.shtml
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Spam Eating Monkey SEM-BACKSCATTER
+  dns_server: backscatter.spameatingmonkey.net
+  website: https://spameatingmonkey.com/services
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Spam Eating Monkey SEM-BLACK
+  dns_server: bl.spameatingmonkey.net
+  website: https://spameatingmonkey.com/services
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Spam Eating Monkey SEM-IPV6BL
+  dns_server: bl.ipv6.spameatingmonkey.net
+  website: https://spameatingmonkey.com/services
+  ipv4: false
+  ipv6: true
+  domain: false
+  non_blocklisted_return_code: []
+- name: SpamRATS! all
+  dns_server: all.spamrats.com
+  website: http://www.spamrats.com/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: PSBL (Passive Spam Block List)
+  dns_server: psbl.surriel.com
+  website: http://psbl.surriel.com/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: SWINOG
+  dns_server: dnsrbl.swinog.ch
+  website: https://antispam.imp.ch/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: GBUdb Truncate
+  dns_server: truncate.gbudb.net
+  website: http://www.gbudb.com/truncate/index.jsp
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: Weighted Private Block List
+  dns_server: db.wpbl.info
+  website: http://www.wpbl.info/
+  ipv4: true
+  ipv6: false
+  domain: false
+  non_blocklisted_return_code: []
+- name: AntiCaptcha.NET IPv6
+  dns_server: dnsbl6.anticaptcha.net
+  website: http://anticaptcha.net/
+  ipv4: false
+  ipv6: true
+  domain: false
+  non_blocklisted_return_code: []
+- name: Suomispam Blacklist
+  dns_server: bl.suomispam.net
+  website: http://suomispam.net/
+  ipv4: true
+  ipv6: true
+  domain: false
+  non_blocklisted_return_code: []
+- name: NordSpam
+  dns_server: bl.nordspam.com
+  website: https://www.nordspam.com/
+  ipv4: true
+  ipv6: true
+  domain: false

share/ffdhe2048.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----

share/html/502.html

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>502 Bad Gateway</title>
+<style>
+    body {
+        width: 35em;
+        margin: 0 auto;
+        font-family: Tahoma, Verdana, Arial, sans-serif;
+    }
+</style>
+</head>
+<body>
+<h1>502 Bad Gateway</h1>
+<p>If you see this page, your connection with the server is working but the internal service providing this path is not responding.</p>
+<p>Administrator, make sure that the service is running, and check its logs if it is not.
+The Services page is in your webadmin, under <code>Tools > Services</code>.</p>
+<p><em>Thank you for using YunoHost.</em></p>
+</body>
+</html>

share/registrar_list.toml

@@ -0,0 +1,826 @@
+[aliyun]
+    [aliyun.auth_key_id]
+    type = "string"
+    redact = true
+
+    [aliyun.auth_secret]
+    type = "string"
+    redact = true
+
+[arvancloud]
+    [arvancloud.auth_token]
+    type = "string"
+    redact = true
+
+[aurora]
+    [aurora.auth_api_key]
+    type = "string"
+    redact = true
+
+    [aurora.auth_secret_key]
+    type = "string"
+    redact = true
+
+[azure]
+    [azure.auth_client_id]
+    type = "string"
+    redact = true
+    
+    [azure.auth_client_secret]
+    type = "string"
+    redact = true
+    
+    [azure.auth_tenant_id]
+    type = "string"
+    redact = true
+    
+    [azure.auth_subscription_id]
+    type = "string"
+    redact = true
+    
+    [azure.resource_group]
+    type = "string"
+    redact = true
+    
+[cloudflare]
+    [cloudflare.auth_username]
+    type = "string"
+    redact = true
+    
+    [cloudflare.auth_token]
+    type = "string"
+    redact = true
+    
+    [cloudflare.zone_id]
+    type = "string"
+    redact = true
+    
+[cloudns]
+    [cloudns.auth_id]
+    type = "string"
+    redact = true
+    
+    [cloudns.auth_subid]
+    type = "string"
+    redact = true
+    
+    [cloudns.auth_subuser]
+    type = "string"
+    redact = true
+    
+    [cloudns.auth_password]
+    type = "password"
+    
+    [cloudns.weight]
+    type = "number"
+    
+    [cloudns.port]
+    type = "number"
+
+[cloudxns]
+    [cloudxns.auth_username]
+    type = "string"
+    redact = true
+    
+    [cloudxns.auth_token]
+    type = "string"
+    redact = true
+    
+[conoha]
+    [conoha.auth_region]
+    type = "string"
+    redact = true
+    
+    [conoha.auth_token]
+    type = "string"
+    redact = true
+    
+    [conoha.auth_username]
+    type = "string"
+    redact = true
+    
+    [conoha.auth_password]
+    type = "password"
+    
+    [conoha.auth_tenant_id]
+    type = "string"
+    redact = true
+    
+[constellix]
+    [constellix.auth_username]
+    type = "string"
+    redact = true
+    
+    [constellix.auth_token]
+    type = "string"
+    redact = true
+
+[ddns]
+    [ddns.auth_token]
+    type = "string"
+    redacte = true
+
+    [ddns.ddns_server]
+    type = "string"
+    redact = true
+
+[devnomads]
+    [devnomads.auth_token]
+    type = "string"
+    redact = true
+
+[digitalocean]
+    [digitalocean.auth_token]
+    type = "string"
+    redact = true
+    
+[dinahosting]
+    [dinahosting.auth_username]
+    type = "string"
+    redact = true
+    
+    [dinahosting.auth_password]
+    type = "password"
+    
+[directadmin]
+    [directadmin.auth_password]
+    type = "password"
+    
+    [directadmin.auth_username]
+    type = "string"
+    redact = true
+    
+    [directadmin.endpoint]
+    type = "string"
+    redact = true
+    
+[dnsimple]
+    [dnsimple.auth_token]
+    type = "string"
+    redact = true
+    
+    [dnsimple.auth_username]
+    type = "string"
+    redact = true
+    
+    [dnsimple.auth_password]
+    type = "password"
+    
+    [dnsimple.auth_2fa]
+    type = "string"
+    redact = true
+    
+[dnsmadeeasy]
+    [dnsmadeeasy.auth_username]
+    type = "string"
+    redact = true
+    
+    [dnsmadeeasy.auth_token]
+    type = "string"
+    redact = true
+    
+[dnspark]
+    [dnspark.auth_username]
+    type = "string"
+    redact = true
+    
+    [dnspark.auth_token]
+    type = "string"
+    redact = true
+    
+[dnspod]
+    [dnspod.auth_username]
+    type = "string"
+    redact = true
+    
+    [dnspod.auth_token]
+    type = "string"
+    redact = true
+
+[dnsservices]
+    [dnsservices.auth_username]
+    type = "string"
+    redact = true
+
+    [dnsservices.auth_password]
+    type = "string"
+    
+[dreamhost]
+    [dreamhost.auth_token]
+    type = "string"
+    redact = true
+
+[duckdns]
+    [duckdns.auth_token]
+    type = "string"
+    redact = true
+    
+[dynu]
+    [dynu.auth_token]
+    type = "string"
+    redact = true
+    
+[easydns]
+    [easydns.auth_username]
+    type = "string"
+    redact = true
+    
+    [easydns.auth_token]
+    type = "string"
+    redact = true
+    
+[easyname]
+    [easyname.auth_username]
+    type = "string"
+    redact = true
+    
+    [easyname.auth_password]
+    type = "password"
+    
+[euserv]
+    [euserv.auth_username]
+    type = "string"
+    redact = true
+    
+    [euserv.auth_password]
+    type = "password"
+    
+[exoscale]
+    [exoscale.auth_key]
+    type = "string"
+    redact = true
+    
+    [exoscale.auth_secret]
+    type = "string"
+    redact = true
+
+[flexibleengine]
+    [flexibleengine.auth_token]
+    type = "string"
+    redact = true
+
+    [flexibleengine.zone_id]
+    type = "string"
+    redact = true
+
+[gandi]
+    [gandi.auth_token]
+    type = "string"
+    redact = true
+    
+    [gandi.api_protocol]
+    type = "select"
+    choices.rpc = "RPC"
+    choices.rest = "REST"
+    default = "rpc"
+    visible = "false"
+    
+[gehirn]
+    [gehirn.auth_token]
+    type = "string"
+    redact = true
+    
+    [gehirn.auth_secret]
+    type = "string"
+    redact = true
+    
+[glesys]
+    [glesys.auth_username]
+    type = "string"
+    redact = true
+    
+    [glesys.auth_token]
+    type = "string"
+    redact = true
+    
+[godaddy]
+    [godaddy.auth_key]
+    type = "string"
+    redact = true
+    
+    [godaddy.auth_secret]
+    type = "string"
+    redact = true
+    
+[googleclouddns]
+    [goggleclouddns.auth_service_account_info]
+    type = "string"
+    redact = true
+    
+[gransy]
+    [gransy.auth_username]
+    type = "string"
+    redact = true
+    
+    [gransy.auth_password]
+    type = "password"
+    
+[gratisdns]
+    [gratisdns.auth_username]
+    type = "string"
+    redact = true
+    
+    [gratisdns.auth_password]
+    type = "password"
+    
+[henet]
+    [henet.auth_username]
+    type = "string"
+    redact = true
+    
+    [henet.auth_password]
+    type = "password"
+    
+[hetzner]
+    [hetzner.auth_token]
+    type = "string"
+    redact = true
+    
+[hostingde]
+    [hostingde.auth_token]
+    type = "string"
+    redact = true
+    
+[hover]
+    [hover.auth_username]
+    type = "string"
+    redact = true
+    
+    [hover.auth_password]
+    type = "password"
+
+    [hover.auth_totp_secret]
+    type = "string"
+    redact = true
+    
+[infoblox]
+    [infoblox.auth_user]
+    type = "string"
+    redact = true
+    
+    [infoblox.auth_psw]
+    type = "password"
+    
+    [infoblox.ib_view]
+    type = "string"
+    redact = true
+    
+    [infoblox.ib_host]
+    type = "string"
+    redact = true
+    
+[infomaniak]
+    [infomaniak.auth_token]
+    type = "string"
+    redact = true
+    
+[internetbs]
+    [internetbs.auth_key]
+    type = "string"
+    redact = true
+    
+    [internetbs.auth_password]
+    type = "string"
+    redact = true
+    
+[inwx]
+    [inwx.auth_username]
+    type = "string"
+    redact = true
+    
+    [inwx.auth_password]
+    type = "password"
+
+[ionos]
+    [ionos.api_key]
+    type = "string"
+    redact = true
+    
+[joker]
+    [joker.auth_token]
+    type = "string"
+    redact = true
+    
+[linode]
+    [linode.auth_token]
+    type = "string"
+    redact = true
+    
+[linode4]
+    [linode4.auth_token]
+    type = "string"
+    redact = true
+    
+[localzone]
+    [localzone.filename]
+    type = "string"
+    redact = true
+    
+[luadns]
+    [luadns.auth_username]
+    type = "string"
+    redact = true
+    
+    [luadns.auth_token]
+    type = "string"
+    redact = true
+    
+[memset]
+    [memset.auth_token]
+    type = "string"
+    redact = true
+
+[misaka]
+    [misaka.auth_token]
+    type = "string"
+    redact = true
+    
+[mythicbeasts]
+    [mythicbeasts.auth_username]
+    type = "string"
+    redact = true
+    
+    [mythicbeasts.auth_password]
+    type = "password"
+    
+    [mythicbeasts.auth_token]
+    type = "string"
+    redact = true
+    
+[namecheap]
+    [namecheap.auth_token]
+    type = "string"
+    redact = true
+    
+    [namecheap.auth_username]
+    type = "string"
+    redact = true
+    
+    [namecheap.auth_client_ip]
+    type = "string"
+    redact = true
+    
+    [namecheap.auth_sandbox]
+    type = "string"
+    redact = true
+
+[namecom]
+    [namecom.auth_username]
+    type = "string"
+    redact = true
+
+    [namecom.auth_token]
+    type = "string"
+    redact = true
+    
+[namesilo]
+    [namesilo.auth_token]
+    type = "string"
+    redact = true
+    
+[netcup]
+    [netcup.auth_customer_id]
+    type = "string"
+    redact = true
+    
+    [netcup.auth_api_key]
+    type = "string"
+    redact = true
+    
+    [netcup.auth_api_password]
+    type = "string"
+    redact = true
+    
+[nfsn]
+    [nfsn.auth_username]
+    type = "string"
+    redact = true
+    
+    [nfsn.auth_token]
+    type = "string"
+    redact = true
+    
+[njalla]
+    [njalla.auth_token]
+    type = "string"
+    redact = true
+    
+[nsone]
+    [nsone.auth_token]
+    type = "string"
+    redact = true
+
+[oci]
+    [oci.auth_config_file]
+    type = "string"
+    redact = true
+
+    [oci.auth_profile]
+    type = "string"
+    redact = true
+
+    [oci.auth_user]
+    type = "string"
+    redact = true
+
+    [oci.auth_tenancy]
+    type = "string"
+    redact = true
+
+    [oci.auth_fingerprint]
+    type = "string"
+    redact = true
+
+    [oci.auth_key_content]
+    type = "string"
+    redact = true
+
+    [oci.auth_key_file]
+    type = "string"
+    redact = true
+
+    [oci.auth_pass_phrase]
+    type = "password"
+
+    [oci.auth_region]
+    type = "string"
+    redact = true
+
+    [oci.auth_type]
+    type = "select"
+    choices = ["api_key", "instance_principal"]
+    default = "api_key"
+
+[onapp]
+    [onapp.auth_username]
+    type = "string"
+    redact = true
+    
+    [onapp.auth_token]
+    type = "string"
+    redact = true
+    
+    [onapp.auth_server]
+    type = "string"
+    redact = true
+    
+[online]
+    [online.auth_token]
+    type = "string"
+    redact = true
+    
+[ovh]
+    [ovh.auth_entrypoint]
+    type = "select"
+    choices = ["ovh-eu", "ovh-ca", "ovh-us", "soyoustart-eu", "soyoustart-ca", "kimsufi-eu", "kimsufi-ca"]
+    default = "ovh-eu"
+
+    [ovh.auth_application_key]
+    type = "string"
+    redact = true
+    
+    [ovh.auth_application_secret]
+    type = "string"
+    redact = true
+    
+    [ovh.auth_consumer_key]
+    type = "string"
+    redact = true
+    
+[plesk]
+    [plesk.auth_username]
+    type = "string"
+    redact = true
+    
+    [plesk.auth_password]
+    type = "password"
+    
+    [plesk.plesk_server]
+    type = "string"
+    redact = true
+    
+[pointhq]
+    [pointhq.auth_username]
+    type = "string"
+    redact = true
+    
+    [pointhq.auth_token]
+    type = "string"
+    redact = true
+
+[porkbun]
+    [porkbun.auth_key]
+    type = "string"
+    redact = true
+    
+    [porkbun.auth_secret]
+    type = "string"
+    redact = true
+    
+[powerdns]
+    [powerdns.auth_token]
+    type = "string"
+    redact = true
+    
+    [powerdns.pdns_server]
+    type = "string"
+    redact = true
+    
+    [powerdns.pdns_server_id]
+    type = "string"
+    redact = true
+    
+    [powerdns.pdns_disable_notify]
+    type = "boolean"
+
+[qcloud]
+    [qcloud.secret_id]
+    type = "string"
+    redact = true
+
+    [qcloud.secret_key]
+    type = "string"
+    redact = true
+
+[rackspace]
+    [rackspace.auth_account]
+    type = "string"
+    redact = true
+    
+    [rackspace.auth_username]
+    type = "string"
+    redact = true
+    
+    [rackspace.auth_api_key]
+    type = "string"
+    redact = true
+    
+    [rackspace.auth_token]
+    type = "string"
+    redact = true
+    
+    [rackspace.sleep_time]
+    type = "string"
+    redact = true
+    
+[rage4]
+    [rage4.auth_username]
+    type = "string"
+    redact = true
+    
+    [rage4.auth_token]
+    type = "string"
+    redact = true
+    
+[rcodezero]
+    [rcodezero.auth_token]
+    type = "string"
+    redact = true
+
+[regfish]
+    [regfish.auth_api_key]
+    type = "string"
+    redact = true
+    
+[route53]
+    [route53.auth_access_key]
+    type = "string"
+    redact = true
+    
+    [route53.auth_access_secret]
+    type = "string"
+    redact = true
+    
+    [route53.private_zone]
+    type = "string"
+    redact = true
+
+    [route53.zone_id]
+    type = "string"
+    redact = true
+    
+    [route53.auth_username]
+    type = "string"
+    redact = true
+    
+    [route53.auth_token]
+    type = "string"
+    redact = true
+    
+[safedns]
+    [safedns.auth_token]
+    type = "string"
+    redact = true
+    
+[sakuracloud]
+    [sakuracloud.auth_token]
+    type = "string"
+    redact = true
+    
+    [sakuracloud.auth_secret]
+    type = "string"
+    redact = true
+
+[scaleway]
+    [scaleway.auth_secret_key]
+    type = "string"
+    redact = true
+    
+[softlayer]
+    [softlayer.auth_username]
+    type = "string"
+    redact = true
+    
+    [softlayer.auth_api_key]
+    type = "string"
+    redact = true
+
+[timeweb]
+    [timeweb.auth_token]
+    type = "string"
+    redact = true
+    
+[transip]
+    [transip.auth_username]
+    type = "string"
+    redact = true
+    
+    [transip.auth_api_key]
+    type = "string"
+    redact = true
+    
+[ultradns]
+    [ultradns.auth_token]
+    type = "string"
+    redact = true
+    
+    [ultradns.auth_username]
+    type = "string"
+    redact = true
+    
+    [ultradns.auth_password]
+    type = "password"
+
+[valuedomain]
+    [valuedomain.auth_token]
+    type = "string"
+    redact = true
+
+[vercel]
+    [vercel.auth_token]
+    type = "string"
+    redact = true
+    
+[vultr]
+    [vultr.auth_token]
+    type = "string"
+    redact = true
+
+[wedos]
+    [wedos.auth_username]
+    type = "string"
+
+    [wedos.auth_pass]
+    type = "password"
+
+[yandex]
+    [yandex.auth_token]
+    type = "string"
+    redact = true
+
+[yandexcloud]
+    [yandexcloud.auth_token]
+    type = "string"
+    redact = true
+
+    [yandexcloud.dns_zone_id]
+    type = "string"
+    redact = true
+
+    [yandexcloud.cloud_id]
+    type = "string"
+    redact = true
+
+    [yandexcloud.folder_id]
+    type = "string"
+    redact = true
+
+[zeit]
+    [zeit.auth_token]
+    type = "string"
+    redact = true
+    
+[zilore]
+    [zilore.auth_key]
+    type = "string"
+    redact = true
+    
+[zonomi]
+    [zonomy.auth_token]
+    type = "string"
+    redact = true
+    
+    [zonomy.auth_entrypoint]
+    type = "string"
+    redact = true
+    

share/yunohost-nftables-hooks

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+HOOK_FOLDER="/usr/share/yunohost/hooks/"
+CUSTOM_HOOK_FOLDER="/etc/yunohost/hooks.d/"
+
+run_parts() {
+    dir="$1"
+    if [ -d "$dir" ]; then
+        run-parts "$dir"
+    fi
+}
+
+pre_or_post="${1:-pre}"
+
+run_parts "$HOOK_FOLDER/${pre_or_post}_nftables"
+run_parts "$CUSTOM_HOOK_FOLDER/${pre_or_post}_nftables"
+
+# This one is legacy, apps should use the new ${pre_or_post}_nftables hook
+run_parts "$HOOK_FOLDER/${pre_or_post}_iptable_rules"
+run_parts "$CUSTOM_HOOK_FOLDER/${pre_or_post}_iptable_rules"