"""Schema reference for `integration.conf`.
Values are always returned as strings by `BaseConfig.get`. Type parsing
(int, int list, bool, rule-id map) is the caller's responsibility. The
format columns below are advisory conventions shared between producers
(wizard, installers, panel templates) and consumers, not runtime-enforced
schemas.
Validation today is narrow: `other/compatibility-check.sh` validates INI
syntax, `[paths] ui_path`, and the `panel_info` script at install time;
integration-script JSON outputs are validated at runtime via Cerberus
schemas under `panels/generic/users_script_schemas/`. All other keys are
read on demand and trusted.
Non-obvious `.get()` behavior:
- Missing file returns `None` (ConfigParser.read silently ignores missing
paths; use `BaseConfig.exists()` to distinguish).
- Malformed INI propagates `configparser.Error`; `.get()` only catches
`KeyError`.
- Section names are case-sensitive (ConfigParser default); option names
are case-insensitive. Match the casing documented below.
Sections
--------
`[PAM]`
- `SERVICE_NAME` (str): PAM service used for UI login
authentication.
`[panel]`
- `type` (str, `cpanel`|`plesk`|`directadmin`|`generic`):
master switch for panel class selection.
`[panel_ports]`
Comma-separated integer lists (e.g. `2082, 2095`). Empty or absent
means "no ports of this class".
- `http_ports`: ports the panel listens on for HTTP admin traffic.
- `https_ports`: HTTPS equivalents.
- `webshield_protected_ports`: subset of the above that WebShield
should protect.
`[panel_login]`
- `ossec_rules` (str, comma-separated `rule_id:bool` pairs, e.g.
`11006:false,11009:true`): OSSEC rule IDs to auto-whitelist for
panel-login events.
`[features]`
Boolean feature flags. Conventional values: `true` / `false`
(case-insensitive).
- `webshield_enabled` (bool)
- `cphulk_enabled` (bool)
`[smtp]`
- `allow_users` (str, comma-separated list of usernames): system
users allowed to send SMTP when the SMTP block feature is active.
- `conflict_config_file` (str, absolute path): panel config file
whose value toggles the SMTP-block conflict check.
- `conflict_config_key` (str): key inside `conflict_config_file`
that holds the conflicting setting.
`[web_server]`
- `server_type` (str, `apache`|`nginx`|...): web server in use.
- `modsec_audit_log` (str, absolute path): ModSecurity audit log
file.
- `modsec_audit_logdir` (str, absolute path): ModSecurity audit log
directory (concurrent writer layout).
- `graceful_restart_script` (str, command string): whitespace-split
command used to gracefully restart the web server
(e.g. `/usr/bin/systemctl restart apache2`).
- `config_test_script` (str, command string): whitespace-split
command used to validate the web server configuration before
reload (e.g. `/usr/sbin/apache2ctl -t`).
`[integration_scripts]`
Values are absolute paths to scripts executed by the agent as root.
Populate with trusted, integrator-controlled paths only; do not
interpolate user-controlled data.
- `users` (str path): emits JSON user list.
- `domains` (str path): emits JSON domain -> owner mapping.
- `admins` (str path): emits JSON admin list.
- `panel_info` (str path): emits JSON `{name, version, ...}`
describing the panel.
- `modsec_domain_config_script` (str path): emits per-domain
ModSecurity overrides.
`[paths]`
- `ui_path` (str, absolute path): document root for the standalone
UI.
- `ui_path_owner` (str, `user:group`): owner applied to UI files
during install.
`[malware]`
- `basedir` (str, **whitespace-separated** paths): base directories
scanned for malware. Note the separator differs from port lists
(whitespace here, comma for port lists).
`[metadata]`
- `schema_version` (int): schema version number.
- `created_by` (str, `wizard`|`agent`|`manual`): who wrote the file;
useful for support triage.
"""
import os
from typing import Optional
from defence360agent.application.determine_hosting_panel import GP_FILE
class BaseConfig:
@classmethod
def exists(cls):
return os.path.exists(cls._conf_path)
@classmethod
def to_dict(cls):
from configparser import ConfigParser
integration_conf = ConfigParser()
integration_conf.read(cls._conf_path)
return integration_conf
@classmethod
def get(cls, section: str, option: str) -> Optional[str]:
"""
Return *option* value in *section* in config if exist,
None otherwise.
"""
try:
return cls.to_dict()[section][option]
except KeyError:
return None
class IntegrationConfig(BaseConfig):
_conf_path = GP_FILE
class ClIntegrationConfig(BaseConfig):
_conf_path = "/opt/cpvendor/etc/integration.ini"
|