diff options
Diffstat (limited to 'packages/meshbay-client/build/installer.nsh')
| -rw-r--r-- | packages/meshbay-client/build/installer.nsh | 92 |
1 files changed, 61 insertions, 31 deletions
diff --git a/packages/meshbay-client/build/installer.nsh b/packages/meshbay-client/build/installer.nsh index d2307c8..70858c6 100644 --- a/packages/meshbay-client/build/installer.nsh +++ b/packages/meshbay-client/build/installer.nsh @@ -1,16 +1,28 @@ ; electron-builder NSIS customisation (auto-included: build/installer.nsh). ; -; Per-user install, no elevation (package.json build.nsis). This does three -; things beyond the default: put the bundled daemon on the user's PATH so -; `meshbay-node` works in a terminal; offer to add the inbound firewall rules -; in one elevated step instead of two "Allow access" dialogs later; and clean -; up the one piece of state that lives outside the install directory (the W3 -; "run at sign-in" launcher). +; Per-user install, no elevation (package.json build.nsis) -- that part never +; changes. What this adds, all conditional on interactive setup (never +; ${Silent}): +; - the bundled daemon dir on the user's PATH, so `meshbay-node` works in a +; terminal; +; - a choice of autostart: the normal per-user Startup-folder launcher (no +; admin, starts at sign-in -- see meshbay_node.platform._startup_vbs), +; or a background-service mode (one admin confirmation, starts at boot, +; no sign-in required -- see meshbay_node.platform.service_install and +; packaging/win/service.ps1); +; - the inbound firewall rules, folded into that SAME elevation when service +; mode is chosen, or offered on their own otherwise -- never two UAC +; prompts for one install; +; - cleanup of whichever of those is outside $INSTDIR on the way out (the +; Startup .vbs; the scheduled task and firewall rules, together, if the +; user opts in). ; ; Deliberately NOT touched: ; - %LOCALAPPDATA%\meshbay\ (node.toml, keystore.enc, unlock.key, data/) -- ; the keystore must survive an uninstall/reinstall; installers place files, -; never remove secrets. +; never remove secrets. This is also why service mode needs no code +; changes to platform.py: it runs as this same user (S4U), so it is the +; same profile either way. !include "WinMessages.nsh" !include "WordFunc.nsh" @@ -40,27 +52,42 @@ WriteRegExpandStr HKCU "Environment" "Path" "$1" SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000 - ; Firewall. MeshBay.exe / meshbay-node.exe (WebRTC) and MeshBay.exe again - ; (LAN cast) each need an inbound allow, and Windows prompts "Allow access" - ; the first time each does. A per-user installer cannot pre-create a - ; firewall rule (that needs admin), so offer one elevated helper: one UAC - ; prompt instead of up to four dialogs spread across first use. - ; - ; Checked first, UNELEVATED (Get-NetFirewallRule needs no admin, only - ; New/Remove do) -- so re-running setup with the rules already in place - ; asks nothing and never pops UAC again. - nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check' - Pop $0 - ${If} $0 != 0 - ${IfNot} ${Silent} + ${IfNot} ${Silent} + ; Already configured -- an upgrade, or a repair install -- asks nothing. + ; Checked unelevated: reading firewall rules needs no admin, only + ; creating them does (same reasoning as the service task below). Whether + ; service mode or per-user mode was chosen last time, firewall rules + ; existing already means there is nothing left for this dialog to do. + nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check' + Pop $0 + ${If} $0 == 0 + Goto mb_mode_done + ${EndIf} + + ; The choice. Service mode needs admin to CREATE (a boot trigger touches + ; system-wide scheduler state -- the same reason /sc onlogon needed it + ; too); day-to-day start/stop from the Node page does not, once the task + ; exists, because Task Scheduler grants the owning user that much itself. + MessageBox MB_YESNO|MB_ICONQUESTION \ + "Run MeshBay Node as a background service?$\n$\nIt starts automatically at boot, even before you sign in, and needs one administrator confirmation now (which also sets up the Windows Firewall rules, in the same step).$\n$\nChoose No for the normal per-user mode instead: it starts when you sign in, no admin needed, and you will be asked about the firewall rules separately." \ + IDNO mb_peruser_mode + + ; -- Service mode: one elevation, both jobs -------------------------- + ExecShellWait "runas" "${MB_PWSH}" \ + '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action install' \ + SW_HIDE + Goto mb_mode_done + + mb_peruser_mode: + ; -- Per-user mode: the firewall question stands on its own ---------- MessageBox MB_YESNO|MB_ICONQUESTION \ "Allow MeshBay through Windows Firewall now?$\n$\nMeshBay connects to other devices on your local network. Choosing Yes adds the rules in one step (Windows will ask for administrator confirmation). Choosing No is fine too -- Windows will ask you to allow access the first time MeshBay connects." \ - /SD IDYES IDNO mb_skip_fw + /SD IDYES IDNO mb_mode_done ExecShellWait "runas" "${MB_PWSH}" \ '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" add' \ SW_HIDE - mb_skip_fw: - ${EndIf} + + mb_mode_done: ${EndIf} !macroend @@ -73,18 +100,21 @@ WriteRegExpandStr HKCU "Environment" "Path" "$1" SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000 - ; Offer to take the firewall rules back out (needs admin again). A stale - ; allow-rule pointing at a deleted exe is inert, so this is opt-in and - ; default-No -- a silent uninstall skips it entirely. customUnInstall runs - ; before the files are removed, so firewall.ps1 is still there. + ; Offer to take the firewall rules, and the service task if one was set up, + ; back out together (needs admin again -- one prompt for both, same as + ; install). Both underlying removes are no-ops when there is nothing to + ; remove, so this is safe to run unconditionally regardless of which mode + ; was chosen. Stale rules/tasks are inert if left, so this is opt-in and + ; default-No; a silent uninstall skips it entirely. customUnInstall runs + ; before the files are removed, so service-mode.ps1 is still there. ${IfNot} ${Silent} MessageBox MB_YESNO|MB_ICONQUESTION \ - "Remove MeshBay's Windows Firewall rules? This needs one administrator confirmation. They are harmless if left." \ - /SD IDNO IDNO mb_keep_fw + "Remove MeshBay's Windows Firewall rules and its boot-time service task, if you set one up? This needs one administrator confirmation. Both are harmless if left." \ + /SD IDNO IDNO mb_keep_privileged ExecShellWait "runas" "${MB_PWSH}" \ - '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" remove' \ + '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action remove' \ SW_HIDE - mb_keep_fw: + mb_keep_privileged: ${EndIf} ; meshbay_node.platform._startup_vbs() -- if the user ran "meshbay-node |