|
|
|
@@ -0,0 +1,621 @@
|
|
|
|
|
#!/bin/bash
|
|
|
|
|
# services/sms-inbound.sh — Inbound SMS from a VoIP DID → ntfy push notification.
|
|
|
|
|
# Part of the modular post-install system (sourced by setup.sh).
|
|
|
|
|
#
|
|
|
|
|
# Built for one specific job: getting SMS **verification codes** sent to a
|
|
|
|
|
# VoIP number onto a phone that has no SIM. It deliberately does not try to be
|
|
|
|
|
# a texting app. Sending is not handled here at all (see the README this
|
|
|
|
|
# writes for why), and inbound messages arrive as push notifications rather
|
|
|
|
|
# than being routed into Asterisk as SIP MESSAGE — a code you need to read and
|
|
|
|
|
# type is better served by a notification than by a chat thread buried in a
|
|
|
|
|
# softphone.
|
|
|
|
|
#
|
|
|
|
|
# Two modes, both configured entirely from the DID provider's own "forward
|
|
|
|
|
# incoming SMS to a URL" setting:
|
|
|
|
|
#
|
|
|
|
|
# direct — the provider calls ntfy itself. No server component at all; the
|
|
|
|
|
# installer just prints the URL to paste into the provider portal.
|
|
|
|
|
# relay — a small systemd HTTP service on this box receives the provider's
|
|
|
|
|
# request and re-publishes to ntfy properly. Costs one more moving
|
|
|
|
|
# part, and buys correct handling of messages containing "&", a
|
|
|
|
|
# secret that isn't your ntfy token, and no ntfy credentials stored
|
|
|
|
|
# in a third party's web portal.
|
|
|
|
|
#
|
|
|
|
|
# No standalone bootstrap block here, matching services/pstn-trunk.sh — this
|
|
|
|
|
# is an add-on for a box the repo already set up, not something you'd curl
|
|
|
|
|
# onto a bare machine on its own.
|
|
|
|
|
|
|
|
|
|
register_service sms-inbound homelab "Inbound SMS (verification codes) from a VoIP DID → ntfy push" 8093
|
|
|
|
|
|
|
|
|
|
SMS_APP_DIR="/opt/sms-inbound"
|
|
|
|
|
SMS_SETTINGS="$SMS_APP_DIR/settings.env"
|
|
|
|
|
SMS_SVC_USER="smsrelay"
|
|
|
|
|
|
|
|
|
|
# ── ntfy target discovery ──────────────────────────────────────────────────
|
|
|
|
|
# A locally-installed ntfy (services/ntfy.sh) is the right default: it keeps
|
|
|
|
|
# verification codes on hardware you control instead of a public relay. Its
|
|
|
|
|
# base-url is the one authoritative place to read the reachable hostname from,
|
|
|
|
|
# since that's what ntfy itself uses to build notification links.
|
|
|
|
|
_sms_detect_ntfy_base() {
|
|
|
|
|
local _cfg="$DOCKER_DIR/ntfy/config/server.yml"
|
|
|
|
|
[[ -f "$_cfg" ]] || return 1
|
|
|
|
|
local _url
|
|
|
|
|
_url="$(grep -oP '(?<=base-url: ")[^"]+' "$_cfg" 2>/dev/null || true)"
|
|
|
|
|
[[ -n "$_url" && "$_url" != "https://ntfy.example.com" ]] || return 1
|
|
|
|
|
echo "$_url"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# ── The relay ──────────────────────────────────────────────────────────────
|
|
|
|
|
# Stdlib only, same reasoning as services/security-dashboard.sh: this shares a
|
|
|
|
|
# small droplet with Asterisk, Caddy and CrowdSec and shouldn't cost a
|
|
|
|
|
# framework's worth of RAM to forward a few dozen text messages a month.
|
|
|
|
|
_sms_write_relay_app() {
|
|
|
|
|
local _dir="$1"
|
|
|
|
|
mkdir -p "$_dir"
|
|
|
|
|
cat > "$_dir/relay.py" << 'PYRELAY'
|
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
|
"""Inbound SMS webhook -> ntfy push.
|
|
|
|
|
|
|
|
|
|
Receives the HTTP request a DID provider makes when an SMS arrives (Anveo
|
|
|
|
|
issues a plain GET with the message interpolated into the query string) and
|
|
|
|
|
re-publishes it to ntfy as a POST, which is the part the provider can't do
|
|
|
|
|
itself.
|
|
|
|
|
|
|
|
|
|
Deliberately minimal: one path, one secret, no state, no database.
|
|
|
|
|
"""
|
|
|
|
|
import hmac
|
|
|
|
|
import os
|
|
|
|
|
import time
|
|
|
|
|
import urllib.parse
|
|
|
|
|
import urllib.request
|
|
|
|
|
from collections import deque
|
|
|
|
|
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
|
|
|
|
|
|
|
|
|
PORT = int(os.environ.get("SMS_RELAY_PORT", "8093"))
|
|
|
|
|
TOKEN = os.environ.get("SMS_RELAY_TOKEN", "")
|
|
|
|
|
NTFY_URL = os.environ.get("SMS_NTFY_URL", "")
|
|
|
|
|
NTFY_TOKEN = os.environ.get("SMS_NTFY_TOKEN", "")
|
|
|
|
|
NTFY_PRIORITY = os.environ.get("SMS_NTFY_PRIORITY", "high")
|
|
|
|
|
|
|
|
|
|
# The token is the only thing standing between the public internet and your
|
|
|
|
|
# push topic, so cap how fast anyone can hammer it. Well above any real SMS
|
|
|
|
|
# volume; low enough that a leaked URL can't be used to spam the phone.
|
|
|
|
|
RATE_LIMIT = 60 # requests
|
|
|
|
|
RATE_WINDOW = 60 # seconds
|
|
|
|
|
_hits = deque()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def rate_limited():
|
|
|
|
|
now = time.monotonic()
|
|
|
|
|
while _hits and now - _hits[0] > RATE_WINDOW:
|
|
|
|
|
_hits.popleft()
|
|
|
|
|
if len(_hits) >= RATE_LIMIT:
|
|
|
|
|
return True
|
|
|
|
|
_hits.append(now)
|
|
|
|
|
return False
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def extract_message(query):
|
|
|
|
|
"""Pull the message body out of the raw query string.
|
|
|
|
|
|
|
|
|
|
Not parse_qs: providers interpolate the message text into the URL without
|
|
|
|
|
escaping it, so a body containing "&" (very common in marketing footers —
|
|
|
|
|
"Reply STOP & we'll remove you") splits into extra parameters and the
|
|
|
|
|
message silently truncates at the ampersand. Taking everything after the
|
|
|
|
|
LAST "message=" verbatim sidesteps that entirely, which is why the URL
|
|
|
|
|
this installer prints always puts the message parameter last.
|
|
|
|
|
"""
|
|
|
|
|
for key in ("message=", "text=", "body="):
|
|
|
|
|
idx = query.rfind(key)
|
|
|
|
|
if idx != -1:
|
|
|
|
|
return urllib.parse.unquote_plus(query[idx + len(key):])
|
|
|
|
|
return ""
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def extract_param(query, name):
|
|
|
|
|
"""Ordinary parse for the numeric fields, which never contain '&'."""
|
|
|
|
|
# Stop at the message so its contents can't be mistaken for parameters.
|
|
|
|
|
head = query
|
|
|
|
|
for key in ("message=", "text=", "body="):
|
|
|
|
|
idx = head.rfind(key)
|
|
|
|
|
if idx != -1:
|
|
|
|
|
head = head[:idx]
|
|
|
|
|
values = urllib.parse.parse_qs(head).get(name, [])
|
|
|
|
|
return values[0] if values else ""
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def publish(sender, recipient, message):
|
|
|
|
|
title = "SMS from {}".format(sender or "unknown")
|
|
|
|
|
if recipient:
|
|
|
|
|
title += " to {}".format(recipient)
|
|
|
|
|
req = urllib.request.Request(
|
|
|
|
|
NTFY_URL,
|
|
|
|
|
data=message.encode("utf-8"),
|
|
|
|
|
method="POST",
|
|
|
|
|
headers={
|
|
|
|
|
"Title": title,
|
|
|
|
|
"Priority": NTFY_PRIORITY,
|
|
|
|
|
"Tags": "incoming_envelope",
|
|
|
|
|
"Content-Type": "text/plain; charset=utf-8",
|
|
|
|
|
},
|
|
|
|
|
)
|
|
|
|
|
if NTFY_TOKEN:
|
|
|
|
|
req.add_header("Authorization", "Bearer " + NTFY_TOKEN)
|
|
|
|
|
with urllib.request.urlopen(req, timeout=10) as resp:
|
|
|
|
|
return 200 <= resp.status < 300
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class Handler(BaseHTTPRequestHandler):
|
|
|
|
|
def _respond(self, status):
|
|
|
|
|
self.send_response(status)
|
|
|
|
|
self.send_header("Content-Length", "0")
|
|
|
|
|
self.end_headers()
|
|
|
|
|
|
|
|
|
|
def _handle(self):
|
|
|
|
|
path, _, query = self.path.partition("?")
|
|
|
|
|
# Constant-time compare: the token is a secret, and a naive ==
|
|
|
|
|
# leaks its prefix to anyone willing to time enough requests.
|
|
|
|
|
if not TOKEN or not hmac.compare_digest(path.rstrip("/"), "/sms/" + TOKEN):
|
|
|
|
|
self._respond(404)
|
|
|
|
|
return
|
|
|
|
|
if rate_limited():
|
|
|
|
|
self._respond(429)
|
|
|
|
|
return
|
|
|
|
|
|
|
|
|
|
message = extract_message(query)
|
|
|
|
|
sender = extract_param(query, "from")
|
|
|
|
|
recipient = extract_param(query, "to")
|
|
|
|
|
if not message:
|
|
|
|
|
self._respond(400)
|
|
|
|
|
return
|
|
|
|
|
|
|
|
|
|
try:
|
|
|
|
|
ok = publish(sender, recipient, message)
|
|
|
|
|
except Exception as exc: # noqa: BLE001
|
|
|
|
|
print("publish failed: {}".format(exc), flush=True)
|
|
|
|
|
self._respond(502)
|
|
|
|
|
return
|
|
|
|
|
|
|
|
|
|
# Never log the body: these are one-time passcodes, and the journal is
|
|
|
|
|
# readable by more people than the push notification is.
|
|
|
|
|
print("sms from={} to={} chars={} published={}".format(
|
|
|
|
|
sender or "?", recipient or "?", len(message), ok), flush=True)
|
|
|
|
|
self._respond(204 if ok else 502)
|
|
|
|
|
|
|
|
|
|
def do_GET(self):
|
|
|
|
|
self._handle()
|
|
|
|
|
|
|
|
|
|
def do_POST(self):
|
|
|
|
|
length = int(self.headers.get("Content-Length", 0) or 0)
|
|
|
|
|
if length:
|
|
|
|
|
self.rfile.read(length)
|
|
|
|
|
self._handle()
|
|
|
|
|
|
|
|
|
|
def log_message(self, fmt, *args):
|
|
|
|
|
pass # the journal already has what we print above
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def main():
|
|
|
|
|
if not NTFY_URL or not TOKEN:
|
|
|
|
|
raise SystemExit("SMS_NTFY_URL and SMS_RELAY_TOKEN must both be set")
|
|
|
|
|
ThreadingHTTPServer.allow_reuse_address = True
|
|
|
|
|
# 0.0.0.0, not loopback: Caddy runs in a container and reaches this over
|
|
|
|
|
# the Docker bridge gateway, which a loopback-only bind refuses. Access is
|
|
|
|
|
# scoped by UFW and by the token in the path, not by the bind address —
|
|
|
|
|
# same pattern services/security-dashboard.sh uses.
|
|
|
|
|
with ThreadingHTTPServer(("0.0.0.0", PORT), Handler) as httpd:
|
|
|
|
|
print("sms-inbound relay listening on 0.0.0.0:{}".format(PORT), flush=True)
|
|
|
|
|
httpd.serve_forever()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
|
main()
|
|
|
|
|
PYRELAY
|
|
|
|
|
chmod 755 "$_dir/relay.py"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_sms_write_systemd_unit() {
|
|
|
|
|
local _port="$1" _token="$2" _ntfy_url="$3" _ntfy_token="$4"
|
|
|
|
|
cat > /etc/systemd/system/sms-inbound.service << SMSSVC
|
|
|
|
|
[Unit]
|
|
|
|
|
Description=Inbound SMS webhook to ntfy relay
|
|
|
|
|
After=network.target
|
|
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=simple
|
|
|
|
|
User=$SMS_SVC_USER
|
|
|
|
|
Group=$SMS_SVC_USER
|
|
|
|
|
Environment=SMS_RELAY_PORT=$_port
|
|
|
|
|
Environment=SMS_RELAY_TOKEN=$_token
|
|
|
|
|
Environment=SMS_NTFY_URL=$_ntfy_url
|
|
|
|
|
Environment=SMS_NTFY_TOKEN=$_ntfy_token
|
|
|
|
|
ExecStart=/usr/bin/python3 $SMS_APP_DIR/relay.py
|
|
|
|
|
Restart=on-failure
|
|
|
|
|
RestartSec=3
|
|
|
|
|
NoNewPrivileges=true
|
|
|
|
|
ProtectSystem=strict
|
|
|
|
|
ProtectHome=true
|
|
|
|
|
PrivateTmp=true
|
|
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
|
|
|
|
SMSSVC
|
|
|
|
|
systemctl daemon-reload
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# Own site block rather than configure_caddy_for_service, for two reasons the
|
|
|
|
|
# helper can't accommodate: this endpoint must NOT sit behind Authelia (the
|
|
|
|
|
# SMS provider can't log in), and the installer has to know the exact final
|
|
|
|
|
# URL to print for the provider portal, which the helper doesn't hand back.
|
|
|
|
|
# Everything else — HSTS/nosniff headers, JSON access log, reload-then-restart
|
|
|
|
|
# fallback — matches what the helper would have written.
|
|
|
|
|
_sms_configure_caddy() {
|
|
|
|
|
local _domain="$1" _port="$2"
|
|
|
|
|
local _caddyfile="$DOCKER_DIR/caddy/Caddyfile"
|
|
|
|
|
|
|
|
|
|
local _site_block
|
|
|
|
|
_site_block="$(cat << CBLOCK
|
|
|
|
|
|
|
|
|
|
# Inbound SMS webhook (sms-inbound) — deliberately NOT behind Authelia:
|
|
|
|
|
# the SMS provider calls this unauthenticated. The secret is the token in
|
|
|
|
|
# the request path, checked by the relay itself.
|
|
|
|
|
${_domain} {
|
|
|
|
|
reverse_proxy host.docker.internal:${_port}
|
|
|
|
|
|
|
|
|
|
header {
|
|
|
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
|
|
|
X-Content-Type-Options "nosniff"
|
|
|
|
|
Referrer-Policy "no-referrer"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
log {
|
|
|
|
|
output file /var/log/caddy/${_domain}.log
|
|
|
|
|
format json
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
CBLOCK
|
|
|
|
|
)"
|
|
|
|
|
|
|
|
|
|
if [[ -f "$_caddyfile" ]]; then
|
|
|
|
|
cp "$_caddyfile" "$_caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
|
|
|
|
|
else
|
|
|
|
|
touch "$_caddyfile"
|
|
|
|
|
fi
|
|
|
|
|
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
|
|
|
|
|
log_warning "${_domain} already in the Caddyfile — leaving the existing entry alone."
|
|
|
|
|
return 0
|
|
|
|
|
fi
|
|
|
|
|
printf '%s\n' "$_site_block" >> "$_caddyfile"
|
|
|
|
|
log_success "Added ${_domain} to the Caddyfile"
|
|
|
|
|
docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
|
|
|
|
|
if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
|
|
|
|
|
:
|
|
|
|
|
elif docker restart caddy &>/dev/null; then
|
|
|
|
|
log_success "Caddy restarted to apply changes (the reload API is disabled by default)"
|
|
|
|
|
else
|
|
|
|
|
log_warning "Caddy reload/restart failed — check: docker logs caddy"
|
|
|
|
|
fi
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
_sms_write_readme() {
|
|
|
|
|
local _mode="$1" _url="$2" _ntfy_url="$3" _relay_domain="$4"
|
|
|
|
|
write_readme "$SMS_APP_DIR" << MD
|
|
|
|
|
# Inbound SMS → ntfy
|
|
|
|
|
|
|
|
|
|
Gets SMS sent to a VoIP DID onto a phone as a push notification. Built for
|
|
|
|
|
**verification codes**, not for conversations.
|
|
|
|
|
|
|
|
|
|
Mode: **${_mode}**
|
|
|
|
|
|
|
|
|
|
## The URL to paste into your DID provider
|
|
|
|
|
|
|
|
|
|
In the provider portal, open the DID's SMS settings, choose "forward to URL"
|
|
|
|
|
and paste this:
|
|
|
|
|
|
|
|
|
|
\`\`\`
|
|
|
|
|
${_url}
|
|
|
|
|
\`\`\`
|
|
|
|
|
|
|
|
|
|
Keep the message placeholder **last** in that URL. Providers interpolate the
|
|
|
|
|
message text without escaping it, so a body containing \`&\` splits into extra
|
|
|
|
|
query parameters; with the message last, everything after it can be read back
|
|
|
|
|
verbatim.
|
|
|
|
|
|
|
|
|
|
Treat this URL like a password — anyone holding it can push notifications to
|
|
|
|
|
your phone.
|
|
|
|
|
|
|
|
|
|
## What this does not do
|
|
|
|
|
|
|
|
|
|
- **Sending.** There's no outbound path here. On Anveo, outbound SMS needs an
|
|
|
|
|
Anveo *Retail* account rather than Anveo Direct; a free texting app covers
|
|
|
|
|
the sending side without involving this box at all.
|
|
|
|
|
- **MMS.** No VoIP provider delivers MMS over SIP, and MMS to a VoIP DID
|
|
|
|
|
generally either drops or arrives as a media link through a separate API.
|
|
|
|
|
US **group texts are MMS**, so expect to miss those entirely.
|
|
|
|
|
- **Native Messages integration.** Android's Messages app reads the telephony
|
|
|
|
|
SMS provider, which only the cellular radio (or the default SMS app) writes
|
|
|
|
|
to; iOS lets nothing write to Messages. Codes arrive as ntfy notifications,
|
|
|
|
|
which for a passcode you're about to type is the more useful place anyway.
|
|
|
|
|
|
|
|
|
|
## Will verification codes actually arrive?
|
|
|
|
|
|
|
|
|
|
Two separate hurdles, both outside this box:
|
|
|
|
|
|
|
|
|
|
1. **Short codes.** Most codes come from short codes (262966, 32665...).
|
|
|
|
|
Anveo supports short-code SMS to its DIDs, which is unusual — VoIP.ms, for
|
|
|
|
|
example, does not except for Google. Check that short codes are enabled on
|
|
|
|
|
your specific DID; not every number in the pool has it.
|
|
|
|
|
2. **VoIP rejection at signup.** Many services refuse a number their lookup
|
|
|
|
|
flags as VoIP, before any SMS is sent. Anveo also sells **mobile** DIDs,
|
|
|
|
|
sourced from wireless carriers, which are classified as mobile in the
|
|
|
|
|
industry databases those checks use — a much better bet for this purpose
|
|
|
|
|
than a geographic landline-class DID, at a higher monthly price. If codes
|
|
|
|
|
are the whole reason for the number, order a mobile one.
|
|
|
|
|
|
|
|
|
|
## Security
|
|
|
|
|
|
|
|
|
|
Verification codes are bearer credentials for your accounts. Two things
|
|
|
|
|
matter:
|
|
|
|
|
|
|
|
|
|
- **The ntfy topic is a secret.** This installer generated a long random topic
|
|
|
|
|
name, which makes it unguessable, but the repo's ntfy defaults to
|
|
|
|
|
\`auth-default-access: read-write\` — anyone who *learns* the name can read
|
|
|
|
|
it. Adding an ntfy access token and restricting the topic is worthwhile:
|
|
|
|
|
\`\`\`bash
|
|
|
|
|
docker exec -it ntfy ntfy access # show current rules
|
|
|
|
|
docker exec -it ntfy ntfy user add --role=user reader
|
|
|
|
|
docker exec -it ntfy ntfy access reader '<topic>' read-only
|
|
|
|
|
docker exec -it ntfy ntfy access '*' '<topic>' deny
|
|
|
|
|
\`\`\`
|
|
|
|
|
- **Don't publish to a public relay.** \`ntfy.sh\` topics are readable by
|
|
|
|
|
anyone who knows the name; a self-hosted instance keeps codes on your own
|
|
|
|
|
hardware.
|
|
|
|
|
|
|
|
|
|
Current ntfy target: \`${_ntfy_url}\`
|
|
|
|
|
|
|
|
|
|
## Manage
|
|
|
|
|
|
|
|
|
|
\`\`\`bash
|
|
|
|
|
systemctl status sms-inbound # relay mode only
|
|
|
|
|
journalctl -u sms-inbound -f # from/to and length, never the message body
|
|
|
|
|
sudo ./setup.sh sms-inbound # re-run to change settings
|
|
|
|
|
\`\`\`
|
|
|
|
|
|
|
|
|
|
The relay logs who sent what and how long it was, deliberately never the
|
|
|
|
|
message itself — the journal has a wider audience than the notification does.
|
|
|
|
|
|
|
|
|
|
$( [[ -n "$_relay_domain" ]] && printf 'Public endpoint: `https://%s` (Caddy → the relay on this box).\n' "$_relay_domain" )
|
|
|
|
|
|
|
|
|
|
## Testing it
|
|
|
|
|
|
|
|
|
|
Substitute a real message for the provider's placeholder and call the URL
|
|
|
|
|
yourself — no need to wait for a text:
|
|
|
|
|
|
|
|
|
|
\`\`\`bash
|
|
|
|
|
curl -s -o /dev/null -w '%{http_code}\\n' \\
|
|
|
|
|
"$(printf '%s' "$_url" | sed 's/\$\[from\]\$/15555550123/; s/\$\[to\]\$/15555550199/; s/\$\[message\]\$/test+code+123456/')"
|
|
|
|
|
\`\`\`
|
|
|
|
|
|
|
|
|
|
$( if [[ "$_mode" == "relay" ]]; then cat << 'RELAYTEST'
|
|
|
|
|
**204** means the relay accepted it and ntfy took the message — your phone
|
|
|
|
|
should buzz. **404** means the token in the path is wrong, **502** means ntfy
|
|
|
|
|
rejected the publish (check the ntfy token and topic), **429** means the rate
|
|
|
|
|
limit tripped (60 requests/minute).
|
|
|
|
|
RELAYTEST
|
|
|
|
|
else cat << 'DIRECTTEST'
|
|
|
|
|
**200** means ntfy accepted the publish and your phone should buzz. **401**
|
|
|
|
|
or **403** means the `auth=` parameter is wrong or the topic is restricted;
|
|
|
|
|
**404** means the topic URL is malformed.
|
|
|
|
|
DIRECTTEST
|
|
|
|
|
fi )
|
|
|
|
|
MD
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
install_sms-inbound() {
|
|
|
|
|
log_info "Setting up inbound SMS → ntfy..."
|
|
|
|
|
|
|
|
|
|
if [ "$DRY_RUN" = true ]; then
|
|
|
|
|
echo "[DRY-RUN] Would detect a local ntfy install and reuse its base-url, or prompt for one"
|
|
|
|
|
echo "[DRY-RUN] Would generate a long random ntfy topic (verification codes must not land"
|
|
|
|
|
echo "[DRY-RUN] on a guessable topic — the repo's ntfy defaults to read-write access)"
|
|
|
|
|
echo "[DRY-RUN] Would offer two modes:"
|
|
|
|
|
echo "[DRY-RUN] direct — print a provider 'forward SMS to URL' string pointing straight"
|
|
|
|
|
echo "[DRY-RUN] at ntfy; no server component installed"
|
|
|
|
|
echo "[DRY-RUN] relay — install $SMS_APP_DIR/relay.py as a systemd service, front it with"
|
|
|
|
|
echo "[DRY-RUN] Caddy on a domain you'll be prompted for (no Authelia — the SMS"
|
|
|
|
|
echo "[DRY-RUN] provider can't log in; a random token in the path is the secret),"
|
|
|
|
|
echo "[DRY-RUN] and open the port to caddy_net only"
|
|
|
|
|
echo "[DRY-RUN] Would print the exact URL to paste into the DID provider's SMS settings"
|
|
|
|
|
echo "[DRY-RUN] Would write $SMS_APP_DIR/README.md covering short codes, mobile DIDs, MMS"
|
|
|
|
|
echo "[DRY-RUN] and why the native Messages app never sees these"
|
|
|
|
|
return 0
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# ── Existing install? ─────────────────────────────────────────────────────
|
|
|
|
|
if [[ -f "$SMS_SETTINGS" ]]; then
|
|
|
|
|
echo ""
|
|
|
|
|
log_info "Existing sms-inbound configuration found at $SMS_SETTINGS."
|
|
|
|
|
local MODE=""
|
|
|
|
|
prompt_reinstall_mode MODE
|
|
|
|
|
case "$MODE" in
|
|
|
|
|
update)
|
|
|
|
|
# shellcheck disable=SC1090
|
|
|
|
|
source "$SMS_SETTINGS"
|
|
|
|
|
if [[ "${SMS_MODE:-}" == "relay" ]]; then
|
|
|
|
|
_sms_write_relay_app "$SMS_APP_DIR"
|
|
|
|
|
chown -R "$SMS_SVC_USER:$SMS_SVC_USER" "$SMS_APP_DIR" 2>/dev/null || true
|
|
|
|
|
_sms_write_systemd_unit "${SMS_RELAY_PORT}" "${SMS_RELAY_TOKEN}" "${SMS_NTFY_URL}" "${SMS_NTFY_TOKEN:-}"
|
|
|
|
|
systemctl restart sms-inbound \
|
|
|
|
|
&& log_success "Relay refreshed and restarted." \
|
|
|
|
|
|| log_warning "Restart failed — check: journalctl -u sms-inbound -n 50"
|
|
|
|
|
else
|
|
|
|
|
log_info "Direct mode — nothing to refresh on this box."
|
|
|
|
|
fi
|
|
|
|
|
echo ""
|
|
|
|
|
log_success "Settings, Caddy and firewall rules were left untouched."
|
|
|
|
|
echo " Provider URL: ${SMS_FORWARD_URL}"
|
|
|
|
|
echo ""
|
|
|
|
|
return 0
|
|
|
|
|
;;
|
|
|
|
|
cancel)
|
|
|
|
|
log_info "Leaving the existing setup as-is — nothing changed."
|
|
|
|
|
return 0
|
|
|
|
|
;;
|
|
|
|
|
fresh) log_info "Reconfiguring from scratch — every prompt below runs again." ;;
|
|
|
|
|
esac
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# ── ntfy target ───────────────────────────────────────────────────────────
|
|
|
|
|
echo ""
|
|
|
|
|
local NTFY_BASE=""
|
|
|
|
|
if NTFY_BASE="$(_sms_detect_ntfy_base)"; then
|
|
|
|
|
log_success "Found a configured local ntfy at $NTFY_BASE — using it."
|
|
|
|
|
log_info "Self-hosted is the right answer here: these are verification codes."
|
|
|
|
|
else
|
|
|
|
|
log_warning "No configured local ntfy found (services/ntfy.sh installs one)."
|
|
|
|
|
log_warning "A public relay like ntfy.sh works, but its topics are readable by anyone"
|
|
|
|
|
log_warning "who learns the name — a poor place for one-time passcodes."
|
|
|
|
|
prompt_text "ntfy base URL [https://ntfy.sh]:" "https://ntfy.sh" NTFY_BASE
|
|
|
|
|
fi
|
|
|
|
|
NTFY_BASE="${NTFY_BASE%/}"
|
|
|
|
|
|
|
|
|
|
# A long random topic, not "sms": with ntfy's default read-write access the
|
|
|
|
|
# topic name IS the read credential, so it needs real entropy rather than
|
|
|
|
|
# something guessable.
|
|
|
|
|
local NTFY_TOPIC=""
|
|
|
|
|
NTFY_TOPIC="sms-$(generate_password 24)"
|
|
|
|
|
log_info "Generated ntfy topic: $NTFY_TOPIC"
|
|
|
|
|
log_info "Subscribe to it in the ntfy app — that's where codes will appear."
|
|
|
|
|
|
|
|
|
|
local NTFY_TOKEN_VAL=""
|
|
|
|
|
prompt_text "ntfy access token, if your instance requires one for publishing [blank=none]:" "" NTFY_TOKEN_VAL
|
|
|
|
|
|
|
|
|
|
local NTFY_TOPIC_URL="${NTFY_BASE}/${NTFY_TOPIC}"
|
|
|
|
|
|
|
|
|
|
# ── Mode ──────────────────────────────────────────────────────────────────
|
|
|
|
|
echo ""
|
|
|
|
|
echo " How should the provider reach ntfy?"
|
|
|
|
|
echo " 1) Relay (recommended) — a small service here receives the provider's"
|
|
|
|
|
echo " request and republishes properly. Handles '&' in"
|
|
|
|
|
echo " message bodies, and your ntfy token never gets"
|
|
|
|
|
echo " stored in the provider's web portal."
|
|
|
|
|
echo " 2) Direct — the provider calls ntfy itself. Nothing installed"
|
|
|
|
|
echo " on this box, but the URL you paste into the portal"
|
|
|
|
|
echo " carries your ntfy credentials, and a message"
|
|
|
|
|
echo " containing '&' truncates."
|
|
|
|
|
local MODE_CHOICE=""
|
|
|
|
|
prompt_text "Choose [1]:" "1" MODE_CHOICE
|
|
|
|
|
|
|
|
|
|
mkdir -p "$SMS_APP_DIR"
|
|
|
|
|
local SMS_MODE="relay" FORWARD_URL="" RELAY_DOMAIN="" RELAY_PORT="" RELAY_TOKEN=""
|
|
|
|
|
|
|
|
|
|
if [[ "$MODE_CHOICE" == "2" ]]; then
|
|
|
|
|
SMS_MODE="direct"
|
|
|
|
|
# ntfy accepts publishing over GET at /{topic}/(publish|send|trigger),
|
|
|
|
|
# reading message/title from the query string — which is exactly the
|
|
|
|
|
# shape a provider's "forward to URL" feature can produce. Auth, when
|
|
|
|
|
# needed, rides in ?auth= as base64url (no padding) of the literal
|
|
|
|
|
# Authorization header value.
|
|
|
|
|
local _auth_q=""
|
|
|
|
|
if [[ -n "$NTFY_TOKEN_VAL" ]]; then
|
|
|
|
|
_auth_q="&auth=$(printf 'Bearer %s' "$NTFY_TOKEN_VAL" | basenc --base64url 2>/dev/null | tr -d '=' \
|
|
|
|
|
|| printf 'Bearer %s' "$NTFY_TOKEN_VAL" | base64 | tr '+/' '-_' | tr -d '=\n')"
|
|
|
|
|
fi
|
|
|
|
|
# Message placeholder LAST, so a body containing '&' loses only the
|
|
|
|
|
# tail rather than corrupting the title or the auth parameter.
|
|
|
|
|
FORWARD_URL="${NTFY_BASE}/${NTFY_TOPIC}/trigger?title=SMS+from+\$[from]\$&priority=high${_auth_q}&message=\$[message]\$"
|
|
|
|
|
else
|
|
|
|
|
# ── Relay ─────────────────────────────────────────────────────────────
|
|
|
|
|
id -u "$SMS_SVC_USER" &>/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin "$SMS_SVC_USER"
|
|
|
|
|
|
|
|
|
|
RELAY_PORT=8093
|
|
|
|
|
local _limit=$((RELAY_PORT + 100))
|
|
|
|
|
while ss -tlnH "sport = :${RELAY_PORT}" 2>/dev/null | grep -q . && [[ "$RELAY_PORT" -lt "$_limit" ]]; do
|
|
|
|
|
RELAY_PORT=$((RELAY_PORT + 1))
|
|
|
|
|
done
|
|
|
|
|
[[ "$RELAY_PORT" != 8093 ]] && log_info "Port 8093 was taken — the relay will use ${RELAY_PORT}."
|
|
|
|
|
|
|
|
|
|
RELAY_TOKEN="$(generate_password 32)"
|
|
|
|
|
|
|
|
|
|
_sms_write_relay_app "$SMS_APP_DIR"
|
|
|
|
|
chown -R "$SMS_SVC_USER:$SMS_SVC_USER" "$SMS_APP_DIR"
|
|
|
|
|
_sms_write_systemd_unit "$RELAY_PORT" "$RELAY_TOKEN" "$NTFY_TOPIC_URL" "$NTFY_TOKEN_VAL"
|
|
|
|
|
systemctl enable --now sms-inbound >/dev/null 2>&1 \
|
|
|
|
|
&& log_success "Relay service started on port ${RELAY_PORT}." \
|
|
|
|
|
|| log_warning "Relay failed to start — check: journalctl -u sms-inbound -n 50"
|
|
|
|
|
|
|
|
|
|
# The provider calls this from the public internet, so it needs a real
|
|
|
|
|
# certificate — providers generally refuse self-signed targets.
|
|
|
|
|
echo ""
|
|
|
|
|
local _default_domain=""
|
|
|
|
|
[[ -n "${SITE_DOMAIN:-}" && "$SITE_DOMAIN" != "example.com" ]] && _default_domain="sms.${SITE_DOMAIN}"
|
|
|
|
|
prompt_text "Public domain for the webhook (A record must point here) [${_default_domain:-required}]:" "$_default_domain" RELAY_DOMAIN
|
|
|
|
|
|
|
|
|
|
if [[ -z "$RELAY_DOMAIN" ]]; then
|
|
|
|
|
log_warning "No domain entered — the relay is running but nothing can reach it yet."
|
|
|
|
|
log_warning "Re-run this service once DNS is ready, or front it with Caddy by hand."
|
|
|
|
|
elif [[ -d "$DOCKER_DIR/caddy" ]]; then
|
|
|
|
|
_sms_configure_caddy "$RELAY_DOMAIN" "$RELAY_PORT"
|
|
|
|
|
else
|
|
|
|
|
log_warning "Caddy isn't installed here — proxy https://${RELAY_DOMAIN} to"
|
|
|
|
|
log_warning "127.0.0.1:${RELAY_PORT} yourself, with a real certificate."
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
if command -v ufw &>/dev/null; then
|
|
|
|
|
if [[ -d "$DOCKER_DIR/caddy" ]]; then
|
|
|
|
|
# Caddy reaches this over the caddy_net bridge, so the port has
|
|
|
|
|
# no business being open to the internet — but a bare `ufw
|
|
|
|
|
# delete allow` would block Caddy too (see CLAUDE.md).
|
|
|
|
|
ufw delete allow "${RELAY_PORT}/tcp" 2>/dev/null || true
|
|
|
|
|
ufw_allow_from_caddy_net "${RELAY_PORT}"
|
|
|
|
|
else
|
|
|
|
|
ufw allow "${RELAY_PORT}/tcp"
|
|
|
|
|
fi
|
|
|
|
|
ensure_ufw_enabled
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
FORWARD_URL="https://${RELAY_DOMAIN:-<your-domain>}/sms/${RELAY_TOKEN}?from=\$[from]\$&to=\$[to]\$&message=\$[message]\$"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# ── Persist settings ──────────────────────────────────────────────────────
|
|
|
|
|
cat > "$SMS_SETTINGS" << ENV
|
|
|
|
|
# Written by services/sms-inbound.sh — re-run that to change any of this.
|
|
|
|
|
SMS_MODE="${SMS_MODE}"
|
|
|
|
|
SMS_NTFY_URL="${NTFY_TOPIC_URL}"
|
|
|
|
|
SMS_NTFY_TOKEN="${NTFY_TOKEN_VAL}"
|
|
|
|
|
SMS_RELAY_PORT="${RELAY_PORT}"
|
|
|
|
|
SMS_RELAY_TOKEN="${RELAY_TOKEN}"
|
|
|
|
|
SMS_RELAY_DOMAIN="${RELAY_DOMAIN}"
|
|
|
|
|
# The exact string to paste into the DID provider's "forward SMS to URL" box.
|
|
|
|
|
# Secret: anyone holding it can push notifications to your phone.
|
|
|
|
|
SMS_FORWARD_URL="${FORWARD_URL}"
|
|
|
|
|
ENV
|
|
|
|
|
chmod 600 "$SMS_SETTINGS"
|
|
|
|
|
|
|
|
|
|
_sms_write_readme "$SMS_MODE" "$FORWARD_URL" "$NTFY_TOPIC_URL" "$RELAY_DOMAIN"
|
|
|
|
|
|
|
|
|
|
# ── Summary ───────────────────────────────────────────────────────────────
|
|
|
|
|
echo ""
|
|
|
|
|
log_success "Inbound SMS → ntfy configured (${SMS_MODE} mode)."
|
|
|
|
|
echo ""
|
|
|
|
|
echo " 1. Subscribe to this topic in the ntfy app:"
|
|
|
|
|
echo " ${NTFY_TOPIC_URL}"
|
|
|
|
|
echo ""
|
|
|
|
|
echo " 2. In your DID provider's portal, open the number's SMS settings,"
|
|
|
|
|
echo " choose \"forward to URL\", and paste exactly:"
|
|
|
|
|
echo ""
|
|
|
|
|
echo " ${FORWARD_URL}"
|
|
|
|
|
echo ""
|
|
|
|
|
echo " Keep the message placeholder last — see the README for why."
|
|
|
|
|
echo ""
|
|
|
|
|
echo " 3. Text the number from another phone. The notification should"
|
|
|
|
|
echo " arrive within a few seconds."
|
|
|
|
|
echo ""
|
|
|
|
|
log_warning "That URL is a secret — anyone with it can push to your phone."
|
|
|
|
|
if [[ "$SMS_MODE" == "direct" ]]; then
|
|
|
|
|
log_warning "It also carries your ntfy credentials, because the provider talks to ntfy"
|
|
|
|
|
log_warning "directly in this mode. Relay mode avoids that if you'd rather it didn't."
|
|
|
|
|
fi
|
|
|
|
|
echo " Details, caveats and testing: $SMS_APP_DIR/README.md"
|
|
|
|
|
echo ""
|
|
|
|
|
}
|
Claude