From cb0e517a7d9baafe40047fa340e3783ebd07ac51 Mon Sep 17 00:00:00 2001
From: mk <mk@mk.fo>
Date: Tue, 28 Jul 2026 05:57:44 +0300
Subject: [PATCH] =?UTF-8?q?hardening(angie):=20fix=20'angie=5Fuser:=20unbo?=
 =?UTF-8?q?und=20variable'=20under=20set=20-u=20=E2=80=94=20init=20extract?=
 =?UTF-8?q?ion=20locals=20to=20empty;=20also=20read=20source=20AUR=20packa?=
 =?UTF-8?q?ge's=20/etc/nginx/nginx.conf=20as=20alt=20stock=20config=20path?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/50-hardening.sh | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/modules/50-hardening.sh b/modules/50-hardening.sh
index ddd3b3e..aa45be7 100755
--- a/modules/50-hardening.sh
+++ b/modules/50-hardening.sh
@@ -206,17 +206,24 @@ _h_angie_config() {
   sudo_ install -d -m 0755 "$d/_on" "$d/targets" "$d/modules" "$d/modules/http"
 
   # ── extract packaging-specific values from the stock angie.conf ──
-  # Angie packages set user/pid/error_log differently per distro; preserve them.
-  local oldcfg="$d/angie.conf" angie_user angie_pid angie_err angie_modules=""
-  if [[ -f "$oldcfg" ]]; then
-    angie_user=$(grep -E '^\s*user\s+' "$oldcfg" | head -1 | awk '{print $2}' | tr -d ';')
-    angie_pid=$(grep -E '^\s*pid\s+' "$oldcfg" | head -1 | awk '{print $2}' | tr -d ';')
-    angie_err=$(grep -E '^\s*error_log\s+' "$oldcfg" | head -1 | awk '{print $2}' | tr -d ';')
+  # Different Angie packages set user/pid/error_log differently (Arch source
+  # package → /etc/nginx/nginx.conf with 'user http'; angie-bin / Debian .deb
+  # → /etc/angie/angie.conf with 'user angie'). Preserve them when present,
+  # fall back to sane defaults otherwise (defaults cover all distros here).
+  local oldcfg="$d/angie.conf"
+  local altcfg="/etc/nginx/nginx.conf"  # the source AUR package's path
+  local stock="$oldcfg"
+  [[ -f "$oldcfg" ]] || stock="$altcfg"
+  local angie_user="" angie_pid="" angie_err="" angie_modules=""
+  if [[ -f "$stock" ]]; then
+    angie_user=$(grep -E '^\s*user\s+' "$stock" | head -1 | awk '{print $2}' | tr -d ';')
+    angie_pid=$(grep -E '^\s*pid\s+' "$stock" | head -1 | awk '{print $2}' | tr -d ';')
+    angie_err=$(grep -E '^\s*error_log\s+' "$stock" | head -1 | awk '{print $2}' | tr -d ';')
     # collect any load_module lines (dynamic modules)
-    angie_modules=$(grep -E '^\s*load_module\s+' "$oldcfg" || true)
+    angie_modules=$(grep -E '^\s*load_module\s+' "$stock" || true)
   fi
   # sane defaults if not found
-  [[ -z "$angie_user" ]] && angie_user=$({ [[ "$DISTRO" == "arch" ]] && echo http || echo angie; })
+  [[ -z "$angie_user" ]] && angie_user=$({ [[ "${DISTRO:-}" == "arch" ]] && echo http || echo angie; })
   [[ -z "$angie_pid" ]]  && angie_pid=/run/angie.pid
   [[ -z "$angie_err" ]]  && angie_err=/var/log/angie/error.log