FM / scripts

/usr/local/cpanel/scripts

Name	Size	Mode	Actions
cpan_sandbox/	-	0755	rm
php_sandbox/	-	0755	rm
activesync-invite-reply	1734	0755	edit dl rm
adddns	2418	0755	edit dl rm
addpop	6228	0755	edit dl rm
addsystemuser	3345	0755	edit dl rm
adduser	92	0755	edit dl rm
add_dns	2418	0755	edit dl rm
agent360.sh	16410	0700	edit dl rm
apachelimits	4410	0755	edit dl rm
archive_sync_zones	3122	0755	edit dl rm
auto-adjust-mysql-limits	1854	0755	edit dl rm
autorepair	1274	0755	edit dl rm
backups_clean_metadata_for_missing_backups	1612	0755	edit dl rm
backups_create_metadata	16126	0755	edit dl rm
backups_list_user_files	4671	0755	edit dl rm
backup_jobs_helper	11139	0755	edit dl rm
balance_linked_node_quotas	2643	0755	edit dl rm
biglogcheck	1729	0755	edit dl rm
builddovecotconf	9869	0755	edit dl rm
buildeximconf	7167	0755	edit dl rm
buildhttpdconf	2664	0755	edit dl rm
buildpureftproot	539	0755	edit dl rm
build_bandwidthdb_root_cache_in_background	1561	0755	edit dl rm
build_cpnat	3494	0755	edit dl rm
build_mail_sni	3966	0755	edit dl rm
build_maxemails_config	1169	0755	edit dl rm
call_pkgacct	2306	0755	edit dl rm
ccs-check	5031	0755	edit dl rm
checkalldomainsmxs	2462	0755	edit dl rm
checkbashshell	1205	0755	edit dl rm
checkccompiler	1253	0755	edit dl rm
checkexim.pl	3172	0755	edit dl rm
checklink	1323	0755	edit dl rm
checkusers	856	0755	edit dl rm
check_cpanel_pkgs	10856	0755	edit dl rm
check_domain_tls_service_domains.pl	6841	0755	edit dl rm
check_immutable_files	5621	0755	edit dl rm
check_mail_spamassassin_compiledregexps_body_0	187	0755	edit dl rm
check_maxmem_against_domains_count	3652	0755	edit dl rm
check_mount_procfs	2072	0755	edit dl rm
check_mysql	5697	0755	edit dl rm
check_plugin_pkgs	2512	0755	edit dl rm
check_security_advice_changes	8477	0755	edit dl rm
check_unmonitored_enabled_services	4666	0755	edit dl rm
check_unreliable_resolvers	3672	0755	edit dl rm
check_users_my_cnf	6191	0755	edit dl rm
check_valid_server_hostname	7840	0755	edit dl rm
chkpaths	141	0755	edit dl rm
chpass	416	0755	edit dl rm
ckillall	1139	0755	edit dl rm
cleandns	13429	0755	edit dl rm
cleandns8	417	0755	edit dl rm
cleanmsglog	735	0755	edit dl rm
cleanphpsessions	932	0755	edit dl rm
cleanphpsessions.php	658	0644	edit dl rm
cleanquotas	1651	0755	edit dl rm
cleansessions	6032	0755	edit dl rm
cleanupinterchange	2706	0755	edit dl rm
cleanupmysqlprivs	773	0755	edit dl rm
clean_dead_mailman_locks	2141	0755	edit dl rm
clean_up_temp_wheel_users	2498	0755	edit dl rm
clean_user_php_sessions	4875	0755	edit dl rm
clear_orphaned_virtfs_mounts	3645	0755	edit dl rm
comet_license_registration_sync	1711	0755	edit dl rm
comet_protected_item_maintenance	21281	0755	edit dl rm
comparecdb	1561	0755	edit dl rm
compilers	2932	0755	edit dl rm
compilerscheck	999	0755	edit dl rm
configure_firewall_for_cpanel	520	0755	edit dl rm
configure_rh_firewall_for_cpanel	520	0755	edit dl rm
configure_rh_ipv6_firewall_for_cpanel	520	0755	edit dl rm
convert2dovecot	682	0755	edit dl rm
convert_accesshash_to_token	4171	0755	edit dl rm
convert_and_migrate_from_legacy_backup	2017	0755	edit dl rm
convert_maildir_to_mdbox	1703	0755	edit dl rm
convert_mdbox_to_maildir	1698	0755	edit dl rm
convert_roundcube_mysql2sqlite	26748	0755	edit dl rm
convert_to_dovecot_delivery	4438	0755	edit dl rm
convert_whmxfer_to_sqlite	1499	0755	edit dl rm
copy_user_mail_as_root	1281	0755	edit dl rm
copy_user_mail_as_user	1375	0755	edit dl rm
cpanelsync	28991	0755	edit dl rm
cpanelsync_postprocessor	1657	0755	edit dl rm
cpanel_initial_install	69583	0755	edit dl rm
cpanpingtest	965	0755	edit dl rm
cpan_config	2870	0755	edit dl rm
cpbackup	45861	0755	edit dl rm
cpbackup_transport_file	5781	0755	edit dl rm
cpdig	2882	0755	edit dl rm
cpfetch	1258	0755	edit dl rm
cphulkdblacklist	433	0755	edit dl rm
cphulkdwhitelist	1336	0755	edit dl rm
cpservice	2934	0755	edit dl rm
cpuser_port_authority	19755	0755	edit dl rm
cpuser_service_manager	11113	0755	edit dl rm
createacct	31904760	0700	edit dl rm
create_default_featurelist	11903	0700	edit dl rm
custom_backup_destination.pl.sample	5182	0755	edit dl rm
custom_backup_destination.pl.skeleton	2906	0755	edit dl rm
dcpumon-wrapper	850	0755	edit dl rm
delpop	6350	0755	edit dl rm
detect_env_capabilities	508	0755	edit dl rm
disablefileprotect	2241	0755	edit dl rm
disable_prelink	2841	0755	edit dl rm
distro_changed_hook	1185	0755	edit dl rm
dnscluster	4546	0755	edit dl rm
dnsqueuecron	1316	0755	edit dl rm
dnssec-cluster-keys	3840	0755	edit dl rm
dovecot_maintenance	7842	0755	edit dl rm
dovecot_set_defaults.pl	984	0755	edit dl rm
dumpcdb	866	0755	edit dl rm
dumpinodes	687	0755	edit dl rm
dumpquotas	616	0755	edit dl rm
dumpstor	913	0755	edit dl rm
ea4_fresh_install	2699	0755	edit dl rm
editquota	3512	0755	edit dl rm
edit_cpanelsync_exclude_list	2641	0755	edit dl rm
elevate-cpanel	424577	0700	edit dl rm
email_archive_maintenance	6300	0755	edit dl rm
email_hold_maintenance	1495	0755	edit dl rm
enablefileprotect	2149	0755	edit dl rm
enable_spf_dkim_globally	9039	0755	edit dl rm
ensure_autoenabled_features	3322632	0700	edit dl rm
ensure_conf_dir_crt_key	4940	0755	edit dl rm
ensure_cpuser_file_ip	2610	0755	edit dl rm
ensure_crontab_permissions	1101	0755	edit dl rm
ensure_dovecot_memory_limits_meet_minimum	3208	0755	edit dl rm
ensure_hostname_resolves	2572	0755	edit dl rm
ensure_includes	601	0755	edit dl rm
ensure_vhost_includes	13851	0755	edit dl rm
eximconfgen	1350	0755	edit dl rm
eximstats_spam_check	867	0755	edit dl rm
exim_tidydb	3036	0755	edit dl rm
expunge_expired_certificates_from_sslstorage	3648	0755	edit dl rm
expunge_expired_pkgacct_sessions	852	0755	edit dl rm
expunge_expired_transfer_sessions	1089	0755	edit dl rm
fastmail	5281	0755	edit dl rm
featuremod	1970	0755	edit dl rm
fetchfile	422	0755	edit dl rm
find_and_fix_rpm_issues	7157	0755	edit dl rm
find_outdated_services	6625	0755	edit dl rm
find_pids_with_inotify_watch_on_path	3745	0755	edit dl rm
fix-cpanel-perl	29112	0755	edit dl rm
fix-listen-on-localhost	4036	0755	edit dl rm
fix-web-vhost-configuration	6296	0755	edit dl rm
fixetchosts	4424	0755	edit dl rm
fixheaders	572	0755	edit dl rm
fixmailinglistperms	1008	0755	edit dl rm
fixmailman	2144	0755	edit dl rm
fixnamedviews	1247	0755	edit dl rm
fixndc	413	0755	edit dl rm
fixquotas	18834	0755	edit dl rm
fixrelayd	1784	0755	edit dl rm
fixrndc	16780	0755	edit dl rm
fixtar	503	0755	edit dl rm
fixtlsversions	4816	0755	edit dl rm
fixvaliases	2047	0755	edit dl rm
fixwebalizer	966	0755	edit dl rm
fix_dns_zone_ttls	1369	0755	edit dl rm
fix_innodb_tables	4149	0755	edit dl rm
fix_reseller_acls	10958	0755	edit dl rm
forcelocaldomain	895	0755	edit dl rm
ftpfetch	2251	0755	edit dl rm
ftpquotacheck	8511	0755	edit dl rm
ftpsfetch	2416	0755	edit dl rm
ftpupdate	261	0755	edit dl rm
gather_update_logs_setupcrontab	5582	0700	edit dl rm
gather_update_log_stats	4354	0700	edit dl rm
gemwrapper	1783	0755	edit dl rm
gencrt	6410	0755	edit dl rm
generate_account_suspension_include	5840	0755	edit dl rm
generate_google_drive_credentials	1135	0755	edit dl rm
generate_google_drive_oauth_uri	984	0755	edit dl rm
generate_maildirsize	14908	0755	edit dl rm
gensysinfo	1185	0755	edit dl rm
getremotecpmove	23084	0755	edit dl rm
get_locale_from_legacy_name_info	2041	0755	edit dl rm
grpck	1218	0755	edit dl rm
hackcheck	3092	0755	edit dl rm
hook	1487	0755	edit dl rm
httpspamdetect	2891	0755	edit dl rm
hulk-unban-ip	4301456	0700	edit dl rm
import_exim_data	8593	0755	edit dl rm
increase_filesystem_limits	891	0755	edit dl rm
initacls	5107	0755	edit dl rm
initfpsuexec	444	0755	edit dl rm
initialize_360monitoring	2824	0700	edit dl rm
initquotas	19811	0755	edit dl rm
initsuexec	4123	0755	edit dl rm
installpkg	575	0755	edit dl rm
installpostgres	6715	0755	edit dl rm
installsqlite3	1866	0755	edit dl rm
install_cpanel_analytics	1973	0755	edit dl rm
install_dovecot_fts	1605	0755	edit dl rm
install_plugin	2869	0755	edit dl rm
install_tuxcare_els_php	1889	0755	edit dl rm
ipcheck	4020	0755	edit dl rm
ipusage	7624	0755	edit dl rm
isdedicatedip	602	0755	edit dl rm
is_update_available	3343	0755	edit dl rm
jetbackup-check	3776	0755	edit dl rm
killdns	422	0755	edit dl rm
killdns-dnsadmin	1180	0755	edit dl rm
killmysqluserprivs	433	0755	edit dl rm
killmysqlwildcard	1180	0755	edit dl rm
killpvhost	853	0755	edit dl rm
killspamkeys	937	0755	edit dl rm
linksubemailtomainacct	3248	0755	edit dl rm
link_3rdparty_binaries	1271	0755	edit dl rm
listcheck	538	0755	edit dl rm
listsubdomains	1074	0755	edit dl rm
litespeed-check	3952	0755	edit dl rm
locale_export	5331	0755	edit dl rm
locale_import	4803	0755	edit dl rm
locale_info	4086	0755	edit dl rm
logo.dat	205	0644	edit dl rm
log_retention	21793	0755	edit dl rm
magicloader	1985	0755	edit dl rm
maildir_converter	6222	0755	edit dl rm
mailperm	16923	0755	edit dl rm
mailscannerupdate	2478	0755	edit dl rm
mainipcheck	10236	0755	edit dl rm
maintenance	53445	0755	edit dl rm
make_config	407	0644	edit dl rm
make_hostname_unowned	1189	0755	edit dl rm
manage_extra_marketing	13068	0700	edit dl rm
manage_greylisting	16719	0755	edit dl rm
manage_mysql_profiles	16727	0755	edit dl rm
mass_change_php_setting	10904	0755	edit dl rm
migrate_ccs_to_cpdavd	48186	0755	edit dl rm
migrate_local_ini_to_php_ini	7587	0755	edit dl rm
migrate_whmtheme_file_to_userdata	3025	0755	edit dl rm
MirrorSearch_pingtest	2437	0755	edit dl rm
mkwwwacctconf	2385	0755	edit dl rm
modify_accounts	4169	0755	edit dl rm
modify_featurelist	11597	0700	edit dl rm
modify_packages	3726	0755	edit dl rm
modsec_vendor	16008	0755	edit dl rm
mysqlconnectioncheck	6877	0755	edit dl rm
mysqlpasswd	4235	0755	edit dl rm
named.ca	1603	0644	edit dl rm
named.rfc1912.zones	774	0644	edit dl rm
notify_expiring_certificates	9592	0755	edit dl rm
notify_expiring_certificates_on_linked_nodes	1361	0755	edit dl rm
oopscheck	1142	0755	edit dl rm
optimize_eximstats	3975	0755	edit dl rm
panel_ini	4210	0755	edit dl rm
patchfdsetsize	2784	0755	edit dl rm
patch_mail_spamassassin_compiledregexps_body_0	2452	0755	edit dl rm
pedquota	2310	0755	edit dl rm
perform_sqlite_auto_rebuild_db_maintenance	2031	0755	edit dl rm
perlinstaller	528	0755	edit dl rm
perlmods	1204	0755	edit dl rm
phpini_tidy	687	0755	edit dl rm
php_fpm_config	9968	0755	edit dl rm
pkgacct	92065	0755	edit dl rm
post_snapshot	2144	0755	edit dl rm
post_sync_cleanup	5973	0755	edit dl rm
primary_virtual_host_migration	2502	0755	edit dl rm
process_cpmove	4419	0755	edit dl rm
process_pending_cpanel_php_pear_registration	2793	0755	edit dl rm
proxydomains	9822	0755	edit dl rm
ptycheck	724	0755	edit dl rm
purge_modsec_log	1563	0755	edit dl rm
purge_old_config_caches	2125	0755	edit dl rm
pwck	708	0755	edit dl rm
quickdnslookup	1159	0755	edit dl rm
quickwhoisips	2348	0755	edit dl rm
quotacheck	22900	0755	edit dl rm
quota_auto_fix	1440	0755	edit dl rm
rawchpass	460	0755	edit dl rm
rdate	4913	0755	edit dl rm
realadduser	5743	0755	edit dl rm
realchpass	3336	0755	edit dl rm
realperlinstaller	5805	0755	edit dl rm
realrawchpass	425	0755	edit dl rm
rebuilddnsconfig	26110	0755	edit dl rm
rebuildhttpdconf	2664	0755	edit dl rm
rebuildinstalledssldb	2917	0755	edit dl rm
rebuildippool	509	0755	edit dl rm
rebuilduserssldb	948	0755	edit dl rm
rebuild_bandwidthdb_root_cache	1487	0755	edit dl rm
rebuild_dbmap	5937	0755	edit dl rm
rebuild_provider_openid_connect_links_db	1039	0755	edit dl rm
rebuild_whm_chrome	2277	0755	edit dl rm
refresh-dkim-validity-cache	6110	0755	edit dl rm
regenerate_tokens	2228	0755	edit dl rm
remote_log_transfer	11875	0755	edit dl rm
removeacct	29654400	0700	edit dl rm
remove_dovecot_index_files	6028	0755	edit dl rm
rescan_user_dovecot_fts	3048	0755	edit dl rm
resetmailmanurls	2077	0755	edit dl rm
resetquotas	4723	0755	edit dl rm
reset_mail_quotas_to_sane_values	6982	0755	edit dl rm
restartsrv	3266	0755	edit dl rm
restartsrv_apache	422	0755	edit dl rm
restartsrv_apache_php_fpm	11368960	0755	edit dl rm
restartsrv_base	11368960	0755	edit dl rm
restartsrv_bind	11368960	0755	edit dl rm
restartsrv_chkservd	427	0755	edit dl rm
restartsrv_clamd	11368960	0755	edit dl rm
restartsrv_cpanellogd	11368960	0755	edit dl rm
restartsrv_cpanel_php_fpm	11368960	0755	edit dl rm
restartsrv_cpdavd	11368960	0755	edit dl rm
restartsrv_cpgreylistd	11368960	0755	edit dl rm
restartsrv_cphulkd	11368960	0755	edit dl rm
restartsrv_cpipv6	11368960	0755	edit dl rm
restartsrv_cpsrvd	11368960	0755	edit dl rm
restartsrv_crond	11368960	0755	edit dl rm
restartsrv_dnsadmin	11368960	0755	edit dl rm
restartsrv_dovecot	11368960	0755	edit dl rm
restartsrv_exim	11368960	0755	edit dl rm
restartsrv_eximstats	504	0755	edit dl rm
restartsrv_ftpd	426	0755	edit dl rm
restartsrv_ftpserver	911	0755	edit dl rm
restartsrv_httpd	11368960	0755	edit dl rm
restartsrv_imap	437	0755	edit dl rm
restartsrv_inetd	2525	0755	edit dl rm
restartsrv_ipaliases	11368960	0755	edit dl rm
restartsrv_lmtp	437	0755	edit dl rm
restartsrv_mailman	11368960	0755	edit dl rm
restartsrv_mysql	11368960	0755	edit dl rm
restartsrv_named	579	0755	edit dl rm
restartsrv_nscd	11368960	0755	edit dl rm
restartsrv_p0f	11368960	0755	edit dl rm
restartsrv_pdns	11368960	0755	edit dl rm
restartsrv_pop3	437	0755	edit dl rm
restartsrv_postgres	427	0755	edit dl rm
restartsrv_postgresql	11368960	0755	edit dl rm
restartsrv_powerdns	442	0755	edit dl rm
restartsrv_proftpd	11368960	0755	edit dl rm
restartsrv_pureftpd	11368960	0755	edit dl rm
restartsrv_queueprocd	11368960	0755	edit dl rm
restartsrv_rsyslog	11368960	0755	edit dl rm
restartsrv_rsyslogd	437	0755	edit dl rm
restartsrv_spamd	11368960	0755	edit dl rm
restartsrv_sshd	11368960	0755	edit dl rm
restartsrv_syslogd	2458	0755	edit dl rm
restartsrv_tailwatchd	11368960	0755	edit dl rm
restartsrv_unknown	11368960	0755	edit dl rm
restartsrv_xinetd	422	0755	edit dl rm
restorecpuserfromcache	2008	0755	edit dl rm
restorepkg	51194360	0700	edit dl rm
rfc1912_zones.tar	10240	0644	edit dl rm
rpmup	5191	0755	edit dl rm
rsync-user-homedir.pl	5903	0755	edit dl rm
runstatsonce	440	0755	edit dl rm
runweblogs	1045	0755	edit dl rm
run_if_exists	512	0755	edit dl rm
run_plugin_lifecycle	4060	0700	edit dl rm
sa-update_wrapper	3418	0755	edit dl rm
safetybits.pl	844	0755	edit dl rm
secureit	4834	0755	edit dl rm
securemysql	4501	0755	edit dl rm
securerailsapps	3661	0755	edit dl rm
securetmp	17162	0755	edit dl rm
sendicq	474	0755	edit dl rm
servicedomains	9822	0755	edit dl rm
setpostgresconfig	6181	0755	edit dl rm
setupftpserver	10726	0755	edit dl rm
setupmailserver	9618	0755	edit dl rm
setupnameserver	12898	0755	edit dl rm
setup_greylist_db	16719	0755	edit dl rm
setup_modsec_db	1335	0755	edit dl rm
setup_systemd_timer_for_plugins	4015	0700	edit dl rm
set_mailman_archive_perms	1796	0755	edit dl rm
show_php_settings	3762	0755	edit dl rm
shrink_modsec_ip_database	13285	0755	edit dl rm
simpleps	3124	0755	edit dl rm
slurp_exim_mainlog	5914	0755	edit dl rm
smartcheck	15491	0755	edit dl rm
smtpmailgidonly	8343	0755	edit dl rm
snapshot_prep	6017	0755	edit dl rm
spamassassindisable	3830	0755	edit dl rm
spamassassin_dbm_cleaner	5993	0755	edit dl rm
spamboxdisable	2324	0755	edit dl rm
sshcontrol	14722	0755	edit dl rm
ssl_crt_status	3928	0755	edit dl rm
suspendacct	18516	0755	edit dl rm
suspendmysqlusers	4890	0755	edit dl rm
swapip	3914	0755	edit dl rm
sync-mysql-users-from-grants	1225	0755	edit dl rm
synctransfers	1971	0755	edit dl rm
sync_child_accounts	1813	0755	edit dl rm
sync_contact_emails_to_cpanel_users_files	1163	0755	edit dl rm
syslog_check	1391	0755	edit dl rm
sysup	645	0755	edit dl rm
test_sa_compiled	1093	0755	edit dl rm
transfermysqlusers	10627296	0700	edit dl rm
transfer_accounts_as_root	4870	0755	edit dl rm
transfer_account_as_user	2398	0755	edit dl rm
transfer_in_progress	3156	0755	edit dl rm
transfer_in_progress.pod	312	0644	edit dl rm
try-later	8140	0755	edit dl rm
unblockip	667	0755	edit dl rm
uninstall_cpanel_analytics	1230	0755	edit dl rm
uninstall_dovecot_fts	562	0755	edit dl rm
uninstall_plugin	2907	0755	edit dl rm
unlink_service_account	2682	0755	edit dl rm
unpkgacct	4713	0755	edit dl rm
unslavenamedconf	863	0755	edit dl rm
unsuspendacct	18387	0755	edit dl rm
unsuspendmysqlusers	7266	0755	edit dl rm
upcp	44038	0755	edit dl rm
upcp-running	2768	0755	edit dl rm
upcp.static	977251	0755	edit dl rm
update-packages	5191	0755	edit dl rm
updatedomainips	605	0755	edit dl rm
updatenameserverips	1696	0755	edit dl rm
updatenow	5302	0755	edit dl rm
updatenow.static	2116708	0755	edit dl rm
updatesigningkey	1996	0755	edit dl rm
updatessldomains	1856	0755	edit dl rm
updatesupportauthorizations	2552	0755	edit dl rm
updateuserdatacache	2529	0755	edit dl rm
updateuserdomains	774	0755	edit dl rm
update_apachectl	480	0755	edit dl rm
update_db_cache	430	0755	edit dl rm
update_dkim_keys	1485	0755	edit dl rm
update_exim_rejects	1242	0755	edit dl rm
update_existing_mail_quotas_for_account	4891	0755	edit dl rm
update_feature_flags	957	0755	edit dl rm
update_freebusy_data	5376	0755	edit dl rm
update_known_proxy_ips	1002	0755	edit dl rm
update_local_rpm_versions	4669	0755	edit dl rm
update_mailman_cache	8545	0755	edit dl rm
update_mysql_systemd_config	1094	0755	edit dl rm
update_neighbor_netblocks	487	0755	edit dl rm
update_sa_config	2196	0755	edit dl rm
update_spamassassin_config	10988	0755	edit dl rm
update_users_jail	691	0755	edit dl rm
update_users_vhosts	801	0755	edit dl rm
upgrade_bandwidth_dbs	2272	0755	edit dl rm
upgrade_subaccount_databases	2797	0755	edit dl rm
userdata_wildcard_cleanup	5877	0755	edit dl rm
userdirctl	5134	0755	edit dl rm
validate_sshkey_passphrase	1244	0755	edit dl rm
verify_api_spec_files	757	0755	edit dl rm
verify_pidfile	2008	0755	edit dl rm
verify_vhost_includes	7517	0755	edit dl rm
vps_optimizer	8007	0755	edit dl rm
vzzo-fixer	725	0755	edit dl rm
whmlogin	2390	0755	edit dl rm
whoowns	1155	0755	edit dl rm
wwwacct	31904760	0700	edit dl rm
wwwacct2	88	0755	edit dl rm
xferpoint	3201	0755	edit dl rm
xfertool	16624	0755	edit dl rm
xfer_rcube_schema_migrate.pl	2460	0755	edit dl rm
xfer_rcube_uid_resolver.pl	1846	0755	edit dl rm
zoneexists	800	0755	edit dl rm

Edit: /usr/local/cpanel/scripts/cpanel_initial_install (69583B)

#!/usr/local/cpanel/3rdparty/bin/perl

#                                      Copyright 2026 WebPros International, LLC
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited.

package scripts::cpanel_initial_install;

use cPstrict;

use Cpanel::ChildErrorStringifier      ();
use Cpanel::Chkservd::Manage           ();
use Cpanel::Chkservd::Tiny             ();
use Cpanel::Config::LoadConfig         ();
use Cpanel::Config::ConfigObj          ();
use Cpanel::Config::CpConfGuard        ();
use Cpanel::Config::FlushConfig        ();
use Cpanel::Config::LoadCpConf         ();
use Cpanel::ConfigFiles                ();
use Cpanel::DnsUtils::Add              ();
use Cpanel::DIp::Update                ();
use Cpanel::Timezones                  ();
use Cpanel::RPM::Versions::File        ();
use Proc::FastSpawn                    ();
use Cpanel::FeatureShowcase            ();
use Cpanel::Finally                    ();
use Cpanel::Carp                       ();
use Cpanel::LoadModule                 ();
use Cpanel::FileUtils::TouchFile       ();
use Cpanel::FileUtils::Write           ();
use Cpanel::Kernel                     ();
use Cpanel::Kernel::GetDefault         ();
use Cpanel::NSCD::Log                  ();
use Cpanel::Quota::Utils               ();
use Cpanel::Pkgr                       ();
use Cpanel::Usage                      ();
use Cpanel::NAT                        ();
use Cpanel::Init::Simple               ();
use Cpanel::TimeHiRes                  ();
use Cpanel::Server::Type               ();
use Cpanel::Sys::Hostname::Modify      ();
use Cpanel::TimeHiRes                  ();
use Cwd                                ();
use File::Path                         ();
use File::Copy                         ();
use Cpanel::MariaDB                    ();
use Cpanel::SafeRun::Object            ();
use Cpanel::Services::Running          ();
use Cpanel::Yum::Vars                  ();
use Cpanel::MysqlUtils::ServiceName    ();
use Cpanel::MysqlUtils::MyCnf::Adjust  ();
use Whostmgr::Services                 ();
use Whostmgr::TweakSettings            ();
use Cpanel::ForkAsync                  ();
use Cpanel::Wait::Constants            ();
use Cpanel::ServerTasks                ();    # a sub is overridden later in code so let's load it for safety.
use Cpanel::Daemonizer::Tiny           ();
use Cpanel::Install::EA4               ();
use Cpanel::Install::Utils::Packaged   ();
use Cpanel::Install::Utils::Logger     ();
use Cpanel::Install::Utils::Command    ();
use Cpanel::Install::LetsEncrypt       ();
use Cpanel::Install::MySQL             ();
use Cpanel::Install::JobRunner         ();
use Cpanel::NameServer::Utils::Enabled ();
use Cpanel::OS                         ();
use Cpanel::OSSys::Env                 ();
use Cpanel::Slurper                    ();
use Cpanel::Resolvers                  ();
use Cpanel::Systemd                    ();
use Cpanel::Binaries                   ();

# These start off as 0 and once they have been deferred they will
# be set to 1
my %targets_to_defer_to_after_first_upcp = ( 'mailman' => 0 );
my %module_by_type                       = (
    'MySQL'   => 'Cpanel::Mysql::Install',
    'MariaDB' => 'Cpanel::MariaDB::Install',
);

# We only use this file in the installer and we delete it when
# we are done.
my $mysql_rpm_download_complete_file = '/var/cpanel/mysql_rpm_download_completed';

my $systemctl_bin = Cpanel::Binaries::path("systemctl");

my %background_pids;
my $run_tasks_in_main_process = 0;

Cpanel::Carp::enable();    #make sure fatal results in a backtrace

my $MAIN_PROCESS_PID;

exit __PACKAGE__->script(@ARGV) unless caller();

# loggers helper
sub INFO ($msg) {
    return Cpanel::Install::Utils::Logger::INFO($msg);
}

sub DEBUG ($msg) {
    return Cpanel::Install::Utils::Logger::DEBUG($msg);
}

sub WARN ($msg) {
    return Cpanel::Install::Utils::Logger::WARN($msg);
}

sub FATAL ($msg) {
    return Cpanel::Install::Utils::Logger::FATAL($msg);
}

sub script (@ARGS) {

if ( !$ENV{'CPANEL_BASE_INSTALL'} ) {
        die("This program is designed to be run from the cpanel installer. It is probably destructive to run but if you insist, you'll need to set the environment variable CPANEL_BASE_INSTALL=1 before you run it\n");
    }

# ensure locale are set
    local @ENV{qw{LANG LANGUAGE LC_ALL LC_MESSAGES LC_CTYPE}} = qw{C C C C C};

my $skip_apache     = 0;
    my $skip_repo_setup = 0;
    my $installstart    = time();

my %opts = (
        'skipapache'    => \$skip_apache,
        'installstart'  => \$installstart,
        'skipreposetup' => \$skip_repo_setup,
    );

Cpanel::Usage::wrap_options( \@ARGS, \&usage, \%opts );

#Set this because we also run during sysup which is done as a result of a deferred task
    #also done during upcp so this is a forever thing that has to be tracked by touchfile
    touch($Cpanel::ConfigFiles::SKIP_REPO_SETUP_FLAG) if $skip_repo_setup;

my $lock_file = $Cpanel::ConfigFiles::BASE_INSTALL_IN_PROGRESS_FILE;
    $| = 1;    ## no critic qw(Variables::RequireLocalizedPunctuationVars)
    umask 022;

## no critic qw(ProhibitStringyEval)
    # Don't create the END block until run time.
    $MAIN_PROCESS_PID = $$;
    eval q{
        # Cleanup the lock file on exit.
        END {

return unless $MAIN_PROCESS_PID && $$ == $MAIN_PROCESS_PID;

if ( $lock_file and open(my $fh, '<', $lock_file ) ) {
                my $pid = <$fh>;
                close $fh;

chomp $pid if ($pid);
                if ( !$pid or $pid == $$ ) {
                    print "Removing $lock_file\n";
                    unlink $lock_file;
                }
            }
        }
    };
    ## use critic qw(ProhibitStringyEval)

# Create the lock file.
    touch( $lock_file, $$ );

# Open the install logs for append.
    open_logs();

# case CPANEL-28892:
    # securetmp cannot run in the background because it has a window of broken-ness for
    # /tmp where the files are being moved around.
    INFO('Securing the /tmp and /var/tmp directories.');
    Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/securetmp', '--auto', '--install' );

# Determine local distro and version. Fail if unsupported distro.
    die q[Unuspported distribution: ] . Cpanel::OS::display_name() unless Cpanel::OS::is_supported();

# Ensure YUM repos continue to support SHA-1
    ensure_crypto_policy_has_sha1();

# setup /etc/yum/vars/cp_centos_major_version as soon as possible
    Cpanel::Yum::Vars::install();

# if you suspect an error from racing tasks, then you can try setting this to 1 to force tasks to run serially.
    $run_tasks_in_main_process = $ENV{'RUN_TASKS_IN_MAIN_PROCESS'} // 0;
    INFO("run_tasks_in_main_process=$run_tasks_in_main_process");

_run_in_background(
        \&set_up_swap_if_needed,
        'Setting up SWAP'
    );

# Disable fs.protected_regular if it is enabled by default
    disable_fs_protected_regular_if_needed();

# Store the initial install version.
    File::Copy::copy( '/usr/local/cpanel/version', '/var/cpanel/install_version' );

# Upgrade to cloud linux if licensed via cpanel. Change distro if it updates.

upgrade_to_cloud_linux();

# /var/cpanel/cpanel.config probably already exists from updatenow.static, but updatenow and *.static files
    # are considered daemons and CpConfGuard does not compute dynamic values for daemons.
    Cpanel::Config::CpConfGuard->new();

my $installer_dir = Cwd::getcwd();

# Now software is installed, call rdate in case it couldn't be called earlier.
    $installstart = update_system_clock($installstart);
    {
        # Save the /var/cpanel/cpanel.config and cache file we've been avoiding up to this point.
        INFO("Setting up /var/cpanel/cpanel.config");
        local $ENV{CPANEL_BASE_INSTALL} = 0;
        Cpanel::Config::CpConfGuard::clearcache();
        Cpanel::Config::LoadCpConf::loadcpconf();
    }

# Remember resolv.conf in case its data goes missing:
    my $resolv_conf = Cpanel::Slurper::read('/etc/resolv.conf');

# Lowercase the host name if necessary (no need to fork anymore, this is now run by cpanel perl)
    Cpanel::Sys::Hostname::Modify::make_hostname_lowercase_fqdn();

# NAT auto-detection/configuration
    Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/build_cpnat');

# Check if the hostname resolves - this *must* be done after build_cpnat
    # so that the resolution checks are performed properly on NAT environments
    Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/ensure_hostname_resolves', '-y' );

# If the resolvers went missing, tell NetworkManager to leave them alone, then put them back:
    if ( $ENV{CPANEL_BASE_INSTALL} && !Cpanel::Resolvers::fetchresolvers()->@* ) {
        WARN("The system DNS resolvers went missing when cPanel adjusted the hostname.");
        if ( Cpanel::OS::networking() eq 'NetworkManager' ) {

my $nm_conf_file = '/etc/NetworkManager/conf.d/99-cpanel.conf';
            WARN("Configuring NetworkManager using file “$nm_conf_file”.");
            Cpanel::Slurper::write( $nm_conf_file, <<'EOF', 0644 );
[main]
dns = none
EOF

Cpanel::Systemd::systemctl(qw(reload NetworkManager.service));
            sleep 1;    # give everything time to settle
        }

INFO("Restoring previous DNS resolvers.");
        Cpanel::Slurper::write( '/etc/resolv.conf', $resolv_conf, 0644 );
        sleep 1;        # give everything time to settle
    }

# Import the MySQL key before going to install to avoid conflicts later
    INFO("Attempting to pre-import the mysql gpg key");
    Cpanel::Install::MySQL::install_mysql_keys();

my $mysql_download_pid = _run_in_background(
        sub {
            INFO("Downloading MySQL/MariaDB packages");
            eval { download_mariadb_or_mysql($skip_apache) };
            if ($@) {
                WARN("Errors seen pre-caching the database server packages. A second attempt will be made to download it for install");
            }
            else {
                INFO("Completed downloading MySQL/MariaDB packages");
            }
            return 0;
        },
        'MySQL/MariaDB package Download'
    );

if ( !$skip_repo_setup ) {
        Cpanel::Install::EA4::install_apache_repo();
    }

my $ea4_or_universal_hooks_install_pid;
    if ( Cpanel::Server::Type::is_dnsonly() ) {
        $ea4_or_universal_hooks_install_pid = _install_yum_universal_hooks_in_background();
    }
    elsif ($skip_apache) {
        WARN("Skipping Apache installation due to command line request");
    }
    else {
        $ea4_or_universal_hooks_install_pid = _install_ea4_in_background();
    }

# Setup databases
    my $dbsetup_pid = _setup_databases_and_dependent_apps($skip_apache);

# Created /etc/domainips after build_cpnat and hostname
    Cpanel::DIp::Update::update_dedicated_ips_and_dependencies_or_die();

# Stop and possibly remove some services
    disable_and_remove_init_services();

# Reduce memory pressure as soon as we can
    Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/vps_optimizer');

# Make cpanel.pem right away
    require Cpanel::SSLCerts;
    Cpanel::SSLCerts::checkForExpiredServiceCrts();

# Init the package management system, update installed, then run sysup
    ensure_rpms_installed();

# Setup default cPanel users;
    do_taskrun();

# Update license information ASAP so code can get at it.
    INFO("Updating license information");
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/cpkeyclt});

# Make touch files corresponding to cpanel.config settings.
    do_cpanel_config_touch_files();

if ( -e '/usr/sbin/pwconv' ) {
        INFO("making sure we are shadowed");
        Cpanel::Install::Utils::Command::ssystem('/usr/sbin/pwconv');
    }

_shutdown_cpanel_services();

INFO("Making sure the firewall (if present) is setup for cPanel.");
    Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/configure_firewall_for_cpanel');

_run_modular_jobs();

setup_misc_cpanel_config_files();

setup_exim_config_defaults();

INFO("Setting up the local name server.");
    setup_nameserver();

# make sure dnsadmin is up so we can do dns dcv
    #
    mkdir '/var/cpanel/dnsadmin', 0700;

Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/3rdparty/bin/perl', "/usr/local/cpanel/install/CpanelService.pm" );
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_dnsadmin});

# warn on failure: do not abort the installation if it fails
    _run_and_wait_in_background( \&_setup_dns_and_dkim, 'Setup DNS and DKIM', stop_on_failure => 0 );

_run_tasks_that_can_be_done_after_updatenow_in_the_background();

_defer_targets();

INFO("Downloading deferred packages");
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/check_cpanel_pkgs --fix --no-broken --no-digest --download-only});

if ($ea4_or_universal_hooks_install_pid) {

# Apache needs to be installed before upcp
        _wait_for_background_tasks_to_finish($ea4_or_universal_hooks_install_pid);
    }

_run_webserver_post_install_and_ssl_cert_check_in_background();

INFO("Installing deferred packages");
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/check_cpanel_pkgs --fix --no-broken --no-digest});

setup_ftpserver();

INFO("Waiting for MySQL/MariaDB installation to complete");
    _wait_for_background_tasks_to_finish($dbsetup_pid);
    INFO("Finished waiting for MySQL/MariaDB installation to complete");

_run_tasks_that_must_wait_until_deferred_are_installed();

Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/ensure_crontab_permissions');

# Run upcp for the first time.
    # NOTE: This will start cpanellogd.
    INFO(" ");
    INFO(" ");
    INFO("Running upcp for the first time.");
    INFO(" ");
    INFO(" ");

# upcp will link 3rdparty binaries
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/upcp manual});    # --force should not be needed

_install_deferred_targets();

if ( !Cpanel::Server::Type::is_dnsonly() ) {                                            # Fix for broken mailman installer ( still needed )
        Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/set_mailman_archive_perms', '--background' );
    }

schdir($installer_dir);

# Restore any staged cpanel accounts
    cpanel_account_restore();

# Tailwatchd should be started from the queue
    # to avoid a race condition where its already in the queue
    # and we try to start it.
    #
    # Previously we would start tailwatchd after
    # flushing the task queue which lead to a race
    # condition where the task queue might start it
    # and then restartsrv would try as well.  The one
    # that lost the race would error.  By putting it
    # in the queue we ensure we only do it once.

# CPANEL-26289: Ensure locales are the first thing we do in the background
    # after the install finishes to preserve legacy behavior
    _schedule_task( 'LocaleTasks' => "build_locale_databases", 20 );

_schedule_task( 'TailwatchTasks'    => 'reloadtailwatch',           200 );
    _schedule_task( 'SpamassassinTasks' => 'update_spamassassin_rules', 3000 );

INFO("Queuing system package update");
    _schedule_task( 'API'              => "verify_api_spec_files",     2000 );
    _schedule_task( 'MaintenanceTasks' => 'run_system_package_update', 1000 );    #rpmup

# ensure_rpms_installed will only install the most critical
    # rpms because sysup limits the number of rpms that
    # are installed during CPANEL_BASE_INSTALL=1 to ensure we can
    # move on as fast as possible.
    # Since users have come to expect some rpms will
    # be preinstalled on cPanel systems we do these in the
    # background.
    _schedule_task( 'MaintenanceTasks' => 'run_base_package_update', 700 );    #sysup

_schedule_task( 'TemplateTasks' => "rebuild_templates",                             500 );
    _schedule_task( 'ScriptTasks'   => "run_script /usr/local/cpanel/scripts/mailperm", 3500 );

# Do this last as its of low importance since we won't have enough accounts on the system
    # soon enough for it to matter
    _schedule_task( 'MaintenanceTasks' => 'find_outdated_services', 3600 );

# Remove any unneeded rpms that could not be removed during this install
    # in order to prevent a condition where we see : Error: Rpmdb changed underneath us
    _schedule_task( 'CheckPkgTasks' => 'check_cpanel_pkgs', 2000 );

# CPANEL-26871: ensure httpd.conf is rebuilt once splitlogs has been installed
    # in the upcp
    warn if !eval { Cpanel::ServerTasks::queue_task( ['ApacheTasks'], 'build_apache_conf', 'apache_restart' ); 1 };

# Do not defer this. We need this in place before the first login.
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/install_cpanel_analytics});

# CPANEL-27822: defer checks of spamd for 30 minutes since the latest rules
    # will be installed in the background
    Cpanel::Chkservd::Tiny::suspend_service( 'spamd', 60 * 30 );
    _schedule_task( 'CpServicesTasks' => "restartsrv spamd", 1 );

# Install ImunifyAV if it's available for this platform
    _schedule_task( 'ImunifyTasks' => 'install_imunifyav', 900 );

# Install WP Toolkit
    _schedule_task( 'WPTK' => 'install_wptk', 1200 );

_wait_for_background_tasks_to_finish( keys %background_pids );

INFO("Enabling one-time shutdown hook");

# cpcleartaskqueue utilizes ExecStop to suspend chkservd, stop queueprocd,
    # and runs "bin/servers_queue run" (ignore scheduling and run all queued tasks now)
    # -- upon stoppage of the service i.e. when the server is shut down
    Cpanel::Install::Utils::Command::ssystem( $systemctl_bin, 'start', 'cpcleartaskqueue' );

INFO("Flushing the task queue");

# Queueprocd will start tailwatchd
    # restart a few services and do an on-demand run of the task queue
    restart_services_and_run_all_tasks_in_queue();

my $finishtime        = time();
    my $installtime       = $finishtime - $installstart;
    my $installfinishtime = localtime($finishtime);

INFO( sprintf( "cPanel install finished in %d minutes and %d seconds!", int( $installtime / 60 ), $installtime % 60 ) );

display_howto();

# Check if the kernel set for boot matches what's currently running (uname -r)
    notify_if_boot_kernel_changed();

save_system_config_at_install_for_analytics();

if ( -x '/root/cpanel_profile/postinstallhook' ) {
        INFO("Running /root/cpanel_profile/postinstallhook");
        Cpanel::Install::Utils::Command::ssystem('/root/cpanel_profile/postinstallhook');
    }

return 0;
}

sub _schedule_task ( $plugin, $task, $delay = 120 ) {

die q[Invalid plugin name] if ref $plugin;
    die qq[invalid task name $task] if $task =~ m{^\d+$}a;
    die qq[invalid delay '$delay' for task $task] unless $delay =~ m{^\d+$}a;

INFO("schedule_task: [ $plugin ], $task in $delay seconds.");
    warn unless eval { Cpanel::ServerTasks::schedule_task( [$plugin], $delay, $task ); 1 };

return;
}

### ---- END sub script ---- ####

sub schdir {
    my $dir = shift;
    my $cwd = Cwd::getcwd();
    chdir($dir) || die "Cannot chdir to ${dir} ($!), cwd was: $cwd";

return;
}

sub _run_modular_jobs {
    my $runner = Cpanel::Install::JobRunner->new();
    $runner->dispatch_next() while $runner->get_pending_jobs();

return;
}

# NOTE : This code is duplicated in build-tools/bootstrap_sandbox . If you change this, you probably need to change it there as well.
sub disable_fs_protected_regular_if_needed {

return unless Cpanel::OS::kernel_supports_fs_protected_regular();

my $current_value = Cpanel::SafeRun::Object->new( 'program' => "/usr/sbin/sysctl", 'args' => [ '--binary', '--ignore', 'fs.protected_regular' ] )->stdout();

# Assume that fs.regular_fifos could also be enabled, so disable them now..
    unless ( length $current_value && $current_value eq 0 ) {
        Cpanel::Install::Utils::Command::ssystem( '/usr/sbin/sysctl', 'fs.protected_regular=0' );
        Cpanel::Install::Utils::Command::ssystem( '/usr/sbin/sysctl', 'fs.protected_fifos=0' );
    }

# .. and ensure they stay disabled on reboot
    my $sysctl_conf_path = '/usr/lib/sysctl.d/protect-links.conf';

if ( open( my $sysctl_conf_rd_fh, '<', $sysctl_conf_path ) ) {
        my @file_contents = (<$sysctl_conf_rd_fh>);
        close($sysctl_conf_rd_fh);

if ( open( my $sysctl_conf_wr_fh, '>', $sysctl_conf_path ) ) {
            foreach my $line (@file_contents) {
                chomp $line;
                if ( $line =~ m/^fs\.protected_regular/ ) {
                    print $sysctl_conf_wr_fh "fs.protected_regular = 0\n";
                }
                elsif ( $line =~ m/^fs\.protected_fifos/ ) {
                    print $sysctl_conf_wr_fh "fs.protected_fifos = 0\n";
                }
                else {
                    print $sysctl_conf_wr_fh "$line\n";
                }
            }
            close($sysctl_conf_wr_fh);
        }
    }
    return;
}

sub ensure_rpms_installed {

unlink '/var/cpanel/useyum';    # No longer used by cPanel.

# Assure yum exclusions are reinstated
    unlink '/etc/checkyumdisable';

# We do not need to run sysup since its run as part of Cpanel::Update::Now
    return;
}

# We need to ensure that certain repos with legacy SHA-1 signatures still function.
sub ensure_crypto_policy_has_sha1 {
    my $crypto_policies_bin = Cpanel::Binaries::path('update-crypto-policies');
    my $system_module_path  = '/usr/share/crypto-policies/policies/modules';
    my $custom_module_path  = '/etc/crypto-policies/policies/modules';
    my $cpanel_module_path  = '/usr/local/cpanel/etc/crypto-policies';
    my $target_module_name  = 'SHA1';

if ( Cpanel::OS::crypto_policy_needs_sha1() ) {
        if ( !Cpanel::OS::crypto_policy_os_provides_sha1_module() ) {

$target_module_name = 'CPANEL-SHA1';
            File::Copy::cp( "$cpanel_module_path/$target_module_name.pmod", "$custom_module_path/$target_module_name.pmod" );
        }
        Cpanel::Install::Utils::Command::ssystem( $crypto_policies_bin, '--set', "DEFAULT:$target_module_name" );
    }

return;
}

sub update_system_clock {
    my $installstart = shift;

# Set the clock
    my $was = time();
    Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/rdate');
    my $now = time();
    INFO( "Clock set to: " . localtime($now) );
    my $change = $now - $was;

# Adjust the start time if it shifted more than 10 seconds.
    if ( abs($change) > 10 ) {
        WARN("Clock changed by $change seconds.");
        $installstart += $change;
        WARN( "Starting time adjusted to " . localtime($installstart) );
    }
    else {
        INFO("Clock changed by $change seconds");
    }

return $installstart;
}

sub set_up_swap_if_needed {
    INFO('Checking for sufficient memory or swap.');

return if Cpanel::OSSys::Env::get_envtype() eq 'virtuozzo';

Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/bin/create-swap --if-needed --verbose});

return;
}

sub _early_install_tasks {
    return qw{
      Repos FixPamConf MailMan DefaultFeatureFiles
      Users Conf ExternalAuth CPanelPost
      ResellersInit FixLogPermissions Perm SecurityCheck
    };
}

sub do_taskrun {
    INFO('Setting up early taskrun items.');

foreach my $task ( _early_install_tasks() ) {
        Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/3rdparty/bin/perl', "/usr/local/cpanel/install/$task.pm" );
    }

Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_dnsadmin  --stop --notconfigured-ok});
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_dnsadmin  --start});

return;
}

sub download_mariadb_or_mysql {
    my ($skip_apache) = @_;

# If download_mariadb_or_mysql dies this is ok as it will only slow
    # down the install since we retry the download during the install
    my $finally = Cpanel::Finally->new(
        sub {
            Cpanel::FileUtils::TouchFile::touchfile($mysql_rpm_download_complete_file);
        }
    );

local $ENV{CPANEL_BASE_INSTALL} = 0;    # build_mysql_conf will exit if this is 1 to prevent double rebuilds
    my $set_version = _get_mysql_set_version();

# We don't need to do this for MySQL 5.6 and below
    return 1 if ( $set_version < 5.7 );

my $install_obj = _create_mysqldb_install_obj($set_version);

INFO("Preparing to download MySQL/MariaDB packages");

# Work around race condition where the mysql download starts before ea4 install
    # by waiting for ea4 to have profiles in place in order to avoid
    # the state where the mysql download blocks ea4 from installing via yum lock
    _wait_for_ea4_profiles_to_be_installed() if !$skip_apache && !Cpanel::Server::Type::is_dnsonly();

INFO("Starting MySQL/MariaDB package download");
    $install_obj->download_pkgs($set_version);

return 1;
}

sub install_mariadb_or_mysql {
    my ($skip_apache) = @_;
    local $ENV{CPANEL_BASE_INSTALL} = 0;    # build_mysql_conf will exit if this is 1 to prevent double rebuilds
    my $set_version = _get_mysql_set_version();
    INFO("The 'mysql-version' key is set to: $set_version.");
    my $type = _get_mysql_type($set_version);

my $install_obj = _create_mysqldb_install_obj($set_version);
    if ( Cpanel::OS::db_needs_preseed() && !Cpanel::MariaDB::version_is_mariadb($set_version) ) {
        my $preseed_path = $install_obj->write_preseed_file($set_version);
        $install_obj->preseed_configuration($preseed_path);
    }

return _do_mysqlbase_db_install( $type, $set_version, $install_obj, $skip_apache );
}

sub _do_mysqlbase_db_install {
    my ( $type, $set_version, $install_obj, $skip_apache ) = @_;

if ($set_version) {
        INFO("Installing $type");

INFO("Installing $type dependencies");
        if ( $set_version < 5.7 ) {

# Deps will be installed automatically if
            # we are using yum repos so there is no need
            # to do a separate yum transaction which only
            # slows things down
            $install_obj->install_known_deps($set_version);
        }
        else {
            INFO("Installing $type packages");

_wait_for_mysql_to_be_downloaded();
            _wait_for_ea4_to_be_installed() if !$skip_apache && !Cpanel::Server::Type::is_dnsonly();

# A dry-run is pointless since we have not installed
            # $type before
            $install_obj->install_pkgs_without_dry_run($set_version);

# Needs the file /etc/apparmor.d/usr.sbin.mysqld in place (by installing mysql package), so this must be done after installing the packages
            if ( Cpanel::OS::security_service() eq 'apparmor' ) {
                $install_obj->configure_apparmor();
            }
        }
    }

if ( -e '/var/run/mysqld/mysqld.sock' && !-e '/var/lib/mysql/mysql.sock' ) {
        symlink( '/var/run/mysqld/mysqld.sock', '/var/lib/mysql/mysql.sock' );
    }

INFO("Installing $type Upgrade Hooks");
    $install_obj->install_upgrade_hook();

return;
}

sub _get_mysql_set_version {
    my $config = scalar Cpanel::Config::LoadCpConf::loadcpconf_not_copy();
    return $config->{'mysql-version'};
}

sub _get_mysql_type {
    my ($set_version) = @_;
    return Cpanel::MariaDB::version_is_mariadb($set_version) ? 'MariaDB' : 'MySQL';

}

sub _create_mysqldb_install_obj {
    my ($set_version) = @_;
    INFO("The 'mysql-version' key is set to: $set_version.");
    my $type         = _get_mysql_type($set_version);
    my $pass_version = $set_version >= 5.7 ? $set_version : undef;
    my $module       = $module_by_type{$type} or die "Failed to determine module from type: “$type”";
    Cpanel::LoadModule::load_perl_module($module);
    return "$module"->new(
        'output_obj'            => Cpanel::Install::Utils::Logger::get_output_obj(),
        'skip_build_mysql_conf' => 1,

# For 5.7+ we no longer have any targets in etc/rpm.versions
        # so lets not block rpm to do nothing as it slows down the
        # whole install
        ( $set_version >= 5.7 ? ( 'skip_ensure_rpms' => 1 ) : () )
    );
}

sub run_roundcube_ifnecessary {

return unless my $v = Cpanel::Pkgr::get_package_version('cpanel-roundcubemail');

local $ENV{'CPANEL_ROUNDCUBE_INSTALL_VERSION'} = $v;
    INFO('Running /usr/local/cpanel/bin/update-roundcube-db');
    Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/bin/update-roundcube-db});
    INFO('/usr/local/cpanel/bin/update-roundcube-db Done');
    return;
}

sub setup_openidconnect_for_cpanelid() {

INFO("Setup cPanelID");

# In CPANEL-28178 we fixed cPanelID.pm to observe the SUPER's return of
    # undef when the underlying configuration was missing.  This now makes
    # is_configured return the correct result which allows us to fix the
    # missing config.
    require Cpanel::Security::Authn::OpenIdConnect;
    my $provider = Cpanel::Security::Authn::OpenIdConnect::get_openid_provider( 'cpaneld', 'cpanelid' );
    if ( !$provider->is_configured() ) {
        $provider->set_client_configuration( { 'client_id' => 'auto', 'client_secret' => 'auto' } );
    }

return;
}

sub _setup_databases_and_dependent_apps {
    my ($skip_apache) = @_;
    return _run_in_background(
        sub {
            my $finally;

# Defer this
            use warnings qw(once redefine);
            my $restoreconpath = '/usr/sbin/restorecon';
            if ( -l $restoreconpath ) {
                my $target = readlink($restoreconpath);

# This is a hack to avoid modifing the mysql rpms
                # which is only safe since we are doing a base cPanel install
                # and require selinux to be disabled anyways.
                #
                # Prevent the installer from calling restorecon
                # during mysql install since we have selinux disabled
                # and this causes a stall.  We put restorecon back
                # after the mysql parts are done
                unlink($restoreconpath);
                $finally = Cpanel::Finally->new(
                    sub {
                        symlink( $target, $restoreconpath ) or die "Failed to restore $restoreconpath link to $target: $!";
                    }
                );

}

# Install MariaDB or a version of Mysql 5.7+ if necessary.
            install_mariadb_or_mysql($skip_apache);

# Do this before starting mysql
            {
                # Avoid doing anything that requires mysql to be running
                Cpanel::MysqlUtils::MyCnf::Adjust::auto_adjust(
                    {
                        'force'      => 1,
                        'debug'      => 0,
                        'verbose'    => 1,
                        'no-restart' => 1,
                    }
                );
            }

Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/update_mysql_systemd_config');

Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/bin/build_mysql_conf --no-upgrade --no-selinux});

# Run scripts/securemysql is no longer needed
            # since all yum based installed call build_mysql_conf
            # which will do this

Cpanel::Init::Simple::call_cpservice_with( Cpanel::MysqlUtils::ServiceName::get_installed_version_service_name() => qw/enable/ );

undef $finally;

Cpanel::Chkservd::Manage::enable('mysql');

return 0;
        },
        'SQL Databases and dependent apps'
    );
}

sub upgrade_to_cloud_linux {
    DEBUG("Detecting if Cloud Linux is licensed through cpanel");

# Assure local::lib to /usr/bin/perl so perl modules can be installed to home directories.
    # upcp now does this

my $license_options = `/usr/local/cpanel/cpanel -F`;    ## no critic qw(Cpanel::ProhibitQxAndBackticks)
    return if $license_options !~ m/cloudlinux/ms;

my $cloud_installer = '/usr/local/cpanel/bin/cloudlinux_update';
    INFO("Upgrading your distro to Cloud Linux");
    if ( !-x $cloud_installer ) {
        WARN("Cannot convert your system to Cloud Linux without $cloud_installer");
    }
    else {
        Cpanel::Install::Utils::Command::ssystem($cloud_installer);
        Cpanel::OS::clear_cache_after_cloudlinux_update();                                                   #
        die q[Unuspported distribution: ] . Cpanel::OS::display_name() unless Cpanel::OS::is_supported();    # make sure the new version is supported
    }

# Re-check system to make sure we haven't moved to cloud linux
    return;
}

sub setup_ftpserver {

my $config = scalar Cpanel::Config::LoadCpConf::loadcpconf();

# Setup the FTP server. Default to disabled

my $target = $config->{'ftpserver'} || 'disabled';
    $target = 'disabled' if ( Cpanel::Server::Type::is_dnsonly() );    # DNSONLY installs cannot set a custom ftp server.

Cpanel::Install::Utils::Logger::INFO("Setting up FTP server to '$target'");
    if ( $target !~ m/^(disabled|proftpd|pure-ftpd)$/ ) {
        Cpanel::Install::Utils::Logger::WARN("$target is an unsupported ftpserver. Will default to 'disabled' instead");
        $target = 'disabled';
    }

my $no_anon_ftp = '/var/cpanel/noanonftp';
    if ( !-e $no_anon_ftp && $target ne 'disabled' ) {
        Cpanel::Install::Utils::Logger::INFO('Defaulting Anonymous FTP off');
        Cpanel::FileUtils::TouchFile::touchfile('/var/cpanel/noanonftp');    # Default
    }

Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/setupftpserver', $target );

return;
}

sub setup_nameserver {

my $config = scalar Cpanel::Config::LoadCpConf::loadcpconf();

# Setup the name server. Default to PowerDNS
    {
        # powerdns should be the default everywhere unless another choice was set
        my $default_nameserver = Cpanel::OS::list_contains_value( 'dns_supported', 'powerdns' ) ? 'powerdns'    #
          : Cpanel::OS::list_contains_value( 'dns_supported', 'bind' ) ? 'bind'
          : 'disabled'                                                                                          #
          ;

my $target = $config->{'local_nameserver_type'} || $default_nameserver;
        INFO("Setting up name server to '$target'");

# Make sure the nameserver can be installed on the system
        my ( $valid, $reason ) = Cpanel::NameServer::Utils::Enabled::valid_nameserver_type($target);
        if ( !$valid ) {
            my $fallback = $target ne $default_nameserver ? $default_nameserver : 'disabled';
            WARN("$target cannot be setup on your system (will default to '$fallback' instead): $reason");
            $target = $fallback;
            ( $valid, $reason ) = Cpanel::NameServer::Utils::Enabled::valid_nameserver_type($target);
            FATAL("$target is an unsupported name server: $reason.") unless $valid;
        }

# The name server must be set up before attempting to reset it to cPanel defaults.
        Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/setupnameserver', '--force', $target );

if ( $target =~ m/^(bind|powerdns)$/ ) {
            if ( -e '/etc/named.conf' ) {
                INFO("Saving /etc/named.conf, and rebuild with cPanel defaults");
                if ( rename '/etc/named.conf', '/etc/named.conf.precpanelinstall' ) {
                    Cpanel::Install::Utils::Command::ssystem('/usr/local/cpanel/scripts/rebuilddnsconfig');
                }
                else {
                    WARN("Unable to rebuild /etc/named.conf file");
                }
            }
        }

}

# Setup the mail server.
    {
        my $target = $config->{'mailserver'};
        $target = 'disabled' if ( Cpanel::Server::Type::is_dnsonly() );    # DNSONLY installs cannot set a custom mail server.

INFO("Setting up mail server to '$target'");
        if ( $target !~ m/^(disabled|dovecot)$/ ) {
            WARN("$target is an unsupported mail server. Will default to 'dovecot' instead");
            $target = 'dovecot';
        }
        Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/setupmailserver', $target );
    }

return;
}

sub setup_misc_cpanel_config_files {

INFO('Setting up misc cPanel config files.');

# FB Case about running this out of maintenance and into the install script
    DEBUG('  Running scripts/secureit');
    Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/scripts/secureit', '--fast' );

# rc.local is not run with systemd.
    if ( Cpanel::OS::service_manager() eq 'initd' ) {

# sync time on reboot.
        my $rc_local = '/etc/rc.d/rc.local';
        DEBUG('  Configuring rdate to run on reboot');
        if ( open my $rc_fh, '>>', $rc_local ) {
            print {$rc_fh} "/usr/local/cpanel/scripts/rdate &\n";
            close $rc_fh;
        }
    }

DEBUG('  Setting WHM theme to x');
    Cpanel::FileUtils::Write::overwrite( '/var/cpanel/whmtheme', 'x', 0644 );

# can be missing on some systems
    Cpanel::FileUtils::TouchFile::touchfile('/etc/fstab');

DEBUG("Setup /var/cpanel/user_notifications/");
    mkdir '/var/cpanel/user_notifications/', 0751;

return;
}

sub setup_exim_config_defaults {

INFO('Setting up exim default configuration options.');

# Load the initial config, if the config file exists,
    # if it does not exist, start with an empty hash.
    my $initial_config = Cpanel::Config::LoadConfig::loadConfig( '/etc/exim.conf.localopts', undef, "=", undef, undef, 1 );
    $initial_config ||= {};

# Get all the initial config values that are not undefs
    my %config = map { $_ => $initial_config->{$_} }
      grep { defined $initial_config->{$_} }
      keys %{$initial_config};

# Fill the config with default values for any we don't already have
    # We don't want to step on any values already setup in the config file
    Whostmgr::TweakSettings::load_module('Mail');
    my $mail_conf;
    {
        no warnings 'once';
        $mail_conf = Whostmgr::TweakSettings::Mail::get_conf();    # PPI NO PARSE - loaded with load_module
    }

# Once Whostmgr::TweakSettings::Configure::Mail implements a save
    # function we can get rid of this and just use the save via
    # Whostmgr::TweakSettings::apply_module_settings
    foreach my $key ( sort keys %{$mail_conf} ) {

# Don't overwrite initial values
        next if exists $config{$key};

my $section;
        {
            no warnings 'once';
            $section = $Whostmgr::TweakSettings::Mail::Conf{$key};
        }
        next unless exists $section->{'default'};

# Start with the default value
        my $value = $section->{'default'};

# Execute if it is a code ref rather than an actual value
        $value = $value->() if ref $value eq 'CODE';

$config{$key} = $value;

# Some of these have actions to trigger creation of touch-files or symlinks
        # See that the action gets run
        if ( exists $section->{'action'} and ref $section->{'action'} eq 'CODE' ) {

# Pass the value as both the new value and the old value since this is to
            # be the initial value and we don't want to trigger running updateuserdomains multiple times
            $section->{'action'}->( $value, $value );
        }
    }

# Write out all settings
    my $rc = Cpanel::Config::FlushConfig::flushConfig( '/etc/exim.conf.localopts', \%config, undef, undef, { 'sort' => 1 } );
    WARN('Error writing exim default configuration options to:  /etc/exim.conf.localopts') unless $rc;

return;
}

sub os_service_restart {
    my $service = shift or die;

DEBUG("Restarting service $service");
    Cpanel::Init::Simple::call_cpservice_with( $service => qw/restart/ );

return;
}

sub cpanel_account_restore {
    my $acct_restore_file = '/etc/cpanelacctrestore';
    return if ( !-e $acct_restore_file );

INFO("Restoring Accounts.");
    sleep(2);

if ( open( my $fh, '<', $acct_restore_file ) ) {
        while (<$fh>) {
            s/\n//g;
            DEBUG("Restoring $_");
            Cpanel::Install::Utils::Command::ssystem( "/usr/local/cpanel/scripts/restorepkg", "$_" );
        }
        close($fh);
    }
    else {
        WARN("Failed to open $acct_restore_file: $!");
    }

return unlink($acct_restore_file);
}

sub enable_cphulkd {
    my $conf_dir = '/var/cpanel/hulkd';

INFO("Enabling cphulkd ...");
    mkdir "$conf_dir", 0755 unless -e "$conf_dir";

if ( Whostmgr::Services::enable('cphulkd') ) {

# Set up monitoring by default.
        Cpanel::Chkservd::Manage::enable('cphulkd');
        INFO("Done");
    }
    else {
        WARN("Unable to enable cphulkd");
    }

return;
}

sub enable_quotas {
    INFO("Enabling quotas ...");

my $old_umask = umask(0077);    # Case 92381: Logs should not be world-readable.
    open( my $fh, ">", _enable_quotas_log() ) || WARN("Unable to open log file for enabling quotas.");
    umask($old_umask);

my $quotas_run = Cpanel::SafeRun::Object->new(
        program => "/usr/local/cpanel/scripts/fixquotas",
        stdout  => $fh,
        stderr  => $fh,
    );

my $needs_reboot = Cpanel::Quota::Utils::reboot_required();
    WARN( $quotas_run->autopsy() ) if !$needs_reboot && $quotas_run->CHILD_ERROR();

if ($needs_reboot) {
        WARN("You must reboot the server after you enable quotas.");
    }

INFO("Done");

return;
}

sub hide_feature_showcase {
    INFO("Disabling feature showcase ...");

my $drivers  = Cpanel::Config::ConfigObj::get_available_drivers( 1, 1 );
    my $showcase = Cpanel::FeatureShowcase->new();
    my @features = $showcase->get_feature_showcase_names();
    push @features, keys %{$drivers};

return unless scalar @features;

$showcase->mark_features_as_viewed( $Cpanel::FeatureShowcase::SOURCE_GUI, @features );

INFO("Done");

return;
}

sub _enable_quotas_log {
    return "/var/log/quota_enable.log";
}

sub notify_if_boot_kernel_changed {
    my $boot_kernel = eval { Cpanel::Kernel::GetDefault::get() } // '';
    WARN($@) if $@;

my $current_kernel = Cpanel::Kernel::get_running_version() // '';
    return if $current_kernel eq $boot_kernel;

WARN("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
    WARN("Your system kernel may have been updated.");
    WARN("Current kernel ($current_kernel) has been changed to: $boot_kernel");
    WARN("Before rebooting the system, please ensure that the installed kernel version is compatible with your deployment.");
    if ( Cpanel::OS::is_cloudlinux() ) {
        WARN(" ");
        WARN(" ************************************************************************************************************");
        WARN(" ");
        WARN("   NOTE: Because this is a Cloud Linux install, cPanel WILL NOT BE FULLY FUNCTIONAL until you reboot. ");
        WARN(" ");
        WARN(" ************************************************************************************************************");
        WARN(" ");
    }
    WARN("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");

return;
}

sub open_logs {
    my $log_file = '/var/log/cpanel-install.log';
    $ENV{'TZ'} = Cpanel::Timezones::calculate_TZ_env();
    Cpanel::Install::Utils::Logger::init($log_file);
    return;
}

sub os_service_stop {
    my $service = shift or die;

DEBUG("Ensuring service $service is not running");
    local $@;

# Do not warn since many of these may not be installed
    eval {
        local $SIG{'__WARN__'} = sub { return; };
        Cpanel::Init::Simple::call_cpservice_with( $service => qw/stop/ );
    };

# Even if the init script doesn't exist, try to kill the service.
    if ( Cpanel::Install::Utils::Command::ssystem( 'killall', '-q', $service ) == 0 ) {
        Cpanel::Install::Utils::Command::ssystem( 'killall', '-q', '-9', $service );
        DEBUG("Killed $service");
    }

return;
}

sub touch {    ## no critic qw(RequireArgUnpacking)
    my $file = shift;

open( my $fh, ">>", $file ) or return;
    print {$fh} '';    # Must send something to the file or it doesn't save

foreach my $line (@_) {    # concat anything passed into the subroutine.
        print {$fh} $line;
    }
    close $fh;

return;
}

sub usage {
    my $prog = $0;
    $prog =~ s{^.+/(.+)$}{$1};
    print "This script should not be called manually.\n";
    exit;                      ## no critic qw(Cpanel::NoExitsFromSubroutines) -- pre-existing code; protects against manual invocation
}

sub disable_and_remove_init_services {
    INFO("Disabling unneeded services...");

my @service_shutdown = qw(named);
    push @service_shutdown, qw(smail sendmail postfix master httpd apache wu-ftpd inetd)
      if ( !Cpanel::Server::Type::is_dnsonly() );

Cpanel::NSCD::Log::disable_logging();

INFO("Stopping services:");
    foreach my $service (@service_shutdown) {
        os_service_stop($service);
    }

# p0f should be disabled on new installs
    Whostmgr::Services::disable('p0f');

return;
}

sub get_howto {
    my $version = '';

if ( open( my $fh, "<", "/usr/local/cpanel/version" ) ) {
        $version = <$fh>;
        $version =~ s/^(\d+\.\d+).*/$1/gs;
    }

my $map = {
        version => $version,
        ip      => _get_public_ip(),
    };

return _howto_message($map);
}

sub display_howto {
    foreach my $line ( split( "\n", get_howto() ) ) {
        INFO($line);
    }

return;
}

sub save_system_config_at_install_for_analytics {
    my $data = {
        'hostname' => '',
        ## Add more data here
    };

eval {
        require Cpanel::JSON;
        require Cpanel::Analytics;
        require Cpanel::Sys::Hostname;
        require Cpanel::Analytics::Config;

$data->{'hostname'} = Cpanel::Sys::Hostname::gethostname(1);

Cpanel::Analytics::prerequisites();
        Cpanel::JSON::DumpFile( Cpanel::Analytics::Config::ANALYTICS_DATA_DIR() . '/system_config_at_install.json', $data );
    };

return;
}

sub _howto_message {
    my $map = shift;

my $login_url = Cpanel::SafeRun::Object->new( 'program' => "/usr/local/cpanel/scripts/whmlogin" )->stdout();
    chomp $login_url;

require Cpanel::Leika;
    if ( Cpanel::Leika::get_config("AuthProviders.WebProsAccountForceEnabled.whm") ) {
        require Cpanel::Sys::Hostname;
        my $hostname = Cpanel::Sys::Hostname::gethostname(1);
        $login_url .= "\n\n … or use this WebPros Account login:\n\nhttps://$hostname:2087/openid_connect/webpros";
    }

return <<EOM;
\e[0;36;40mCongratulations! Your installation of cPanel & WHM $map->{version} is now complete. The next step is to configure your server. \e[0m

Before you configure your server, ensure that your firewall allows access on port 2087.

After ensuring that your firewall allows access on port 2087, you can configure your server.

1. Open your preferred browser

2. Navigate to the following url using the address bar and enter this one-time autologin url:

$login_url

After the login url expires you generate a new one using the 'whmlogin' command or manually login at:

https://$map->{ip}:2087

Visit https://go.cpanel.net/whminit for more information about first-time configuration of your server.

Visit http://support.cpanel.net or https://go.cpanel.net/allfaq for additional support

Thank you for installing cPanel & WHM $map->{version}!

EOM
}

sub _get_public_ip {
    require Cpanel::DIp::MainIP;
    require Cpanel::NAT;
    return Cpanel::NAT::get_public_ip( Cpanel::DIp::MainIP::getmainip() );
}

sub cpanel_config_actions {
    return qw/
      allow_login_autocomplete apache_port dormant_services email_send_limits_count_mailman email_send_limits_defer_cutoff emailsperdaynotify
      enablecompileroptimizations eximmailtrap jailmountbinsuid jailmountusrbinsuid jailprocmode maxemailsperhour nobodyspam
      popbeforesmtpsenders signature_validation skipbwlimitcheck skipparentcheck userdirprotect securetmp_file_size
      /;
}

sub cpanel_config_post_actions {
    return qw/
      allow_deprecated_accesshash
      api_shell
      conserve_memory
      domainowner_mail_pass
      email_send_limits_min_defer_fail_to_trigger_protection
      enablefileprotect
      exim-retrytime
      invite_sub
      phploader
      popbeforesmtp
      resetpass
      resetpass_sub
      skipanalog
      skipawstats
      skipwebalizer
      ssl_default_key_type
      smtpmailgidonly
      usemysqloldpass
      dav_dos_protection
      /;
}

# This subroutine helps document what action and post_action subs need to be run during a fresh install.
# A unit test will go off if you add a new one and don't update one of these subs
sub cpanel_config_ignored_actions {

# Post actions
    my @ignore = qw/ apache_ssl_port
      allow_login_autocomplete autodiscover_proxy_subdomains ipv6_listen
      proxysubdomains autoupdate_certificate_on_hostname_mismatch /;

# Actions
    push @ignore, qw/allow_server_info_status_from autodiscover_host chkservd_check_interval jailapache skipdiskusage
      system_diskusage_critical_percent system_diskusage_warn_percent tcp_check_failure_threshold/;

# build_global_cache run by cpkeyclt
    push @ignore, qw/allowcpsslinstall display_cpanel_doclinks display_cpanel_promotions/;

# rebuild httpd.conf not required
    push @ignore, qw/enable_piped_logs/;

# MySQL restart is not required
    push @ignore, qw/
      mycnf_auto_adjust_innodb_buffer_pool_size
      mycnf_auto_adjust_maxallowedpacket
      mycnf_auto_adjust_openfiles_limit
      /;

# phpini and php_fpm already handled
    push @ignore, qw/
      php_max_execution_time
      php_memory_limit
      php_post_max_size
      php_upload_max_filesize
      /;
    push @ignore, qw/
      debughooks
      disable_cphttpd
      disk_usage_include_mailman
      disk_usage_include_sqldbs
      emailarchive
      pma_disableis
      requiressl
      server_locale
      skipboxtrapper
      skipmailman
      skipspamassassin
      skipspambox
      ssh_host_key_checking
      usemailformailmanurl
      xframecpsrvd
      /;

return @ignore;
}

sub do_cpanel_config_touch_files {
    my $cp_config = scalar Cpanel::Config::LoadCpConf::loadcpconf();
    Whostmgr::TweakSettings::load_module('Main');
    my $tweak_conf;
    {
        no warnings 'once';
        $tweak_conf = \%Whostmgr::TweakSettings::Main::Conf;
    }

# Block task queueing during a fresh install.
    no warnings 'redefine';
    local *Cpanel::ServerTasks::schedule_task = sub { };

# These actions expect a hash not a string to be passed in.
    $cp_config->{'dormant_services'}           = { map { $_ => 1 } split /\s*,\s*/, $cp_config->{'dormant_services'} };
    $tweak_conf->{'dormant_services'}{'value'} = sub { {} };
    $cp_config->{'phploader'}                  = { map { $_ => 1 } split( /,/, $cp_config->{'phploader'} ) };

# Walk all the actions.
    foreach my $key ( cpanel_config_actions() ) {
        next if ( !exists $cp_config->{$key} );
        next if ( !$tweak_conf->{$key} );
        next if ( ref $tweak_conf->{$key}->{'action'} ne 'CODE' );
        DEBUG("Running defined action for cpanel.config key $key");

$tweak_conf->{$key}->{'action'}->( $cp_config->{$key} );
    }

# Walk all the post actions.
    foreach my $key ( cpanel_config_post_actions() ) {
        next if ( !exists $cp_config->{$key} );
        next if ( !$tweak_conf->{$key} );
        next if ( ref $tweak_conf->{$key}->{'post_action'} ne 'CODE' );

DEBUG("Running defined post_action for cpanel.config key $key");
        $tweak_conf->{$key}->{'post_action'}->( $cp_config->{$key}, undef, 1 );
    }

return;
}

sub _run_in_background ( $code, $desc = '' ) {

if ($run_tasks_in_main_process) {

# fork and wait for the job: do not leak anything to the main processs...
        return _run_and_wait_in_background( $code, $desc );
    }

return __fork_and_run( $code, $desc );
}

sub _run_and_wait_in_background ( $code, $desc = '', %opts ) {

my $pid = __fork_and_run( $code, $desc ) or return;

$opts{verbose} //= 0;

return _wait_for_background_pids( { $pid => 1 }, %opts );
}

sub __fork_and_run ( $code, $desc = '' ) {

my $pid = Cpanel::ForkAsync::do_in_child(
        sub {
            local $0 = "cpanel_initial_install - $desc";
            my $status = $code->() // 0;
            return $status;
        }
    );
    $background_pids{$pid} = $desc;

return $pid;
}

sub _wait_for_background_tasks_to_finish (@pids) {

return 1 unless scalar @pids;

my $verbose = 1;

my %pids_to_check = map { $_ => 1 } @pids;
    while (1) {
        last unless _wait_for_background_pids( \%pids_to_check, verbose => $verbose );
        $verbose = 0;
        my $total_pids = scalar keys %pids_to_check;
        last unless $total_pids;
        _show_wait_for("$total_pids background tasks");
        Cpanel::TimeHiRes::sleep(0.25);
    }
    return 1;
}

sub _wait_for_background_pids ( $pids_to_check_hr, %opts ) {
    return 1 if $run_tasks_in_main_process;
    my @pids = sort keys %$pids_to_check_hr;
    return unless scalar @pids;    # nothing to wait for

my $verbose = delete $opts{verbose} // 1;

DEBUG("_wait_for_background_pids: @pids") if $verbose;

$opts{stop_on_failure} //= 1;    # default
    my $stop_on_failure = delete $opts{stop_on_failure};
    FATAL( "Unknown arguments: " . join( ', ', sort keys %opts ) ) if scalar keys %opts;

foreach my $pid (@pids) {
        my $waitpid_result = waitpid( $pid, $Cpanel::Wait::Constants::WNOHANG );
        if ( $waitpid_result != 0 ) {
            if ( $waitpid_result > 0 ) {    # -1 means its already dead and $? is not set
                my $exit_code = $?;
                if ( $exit_code != 0 ) {
                    my $child_error_msg = Cpanel::ChildErrorStringifier->new($?)->autopsy();
                    my $error_type      = $stop_on_failure ? 'a fatal error' : 'a warning';
                    my $msg             = "The background process “$background_pids{$pid}” failed with $error_type: $child_error_msg";
                    if ($stop_on_failure) {
                        kill 'TERM', keys %background_pids;
                        FATAL($msg);
                    }
                    else {
                        WARN($msg);
                    }
                }
            }
            DEBUG("Process: $pid - $background_pids{$pid} has finished.");
            delete $background_pids{$pid};
            delete $pids_to_check_hr->{$pid};
        }
    }
    return 1;
}

# If a server has 2GB+ ram, we now enable PHP-FPM by default for new accounts
sub set_up_php_fpm_by_default {

require Cpanel::PHPFPM::Config;
    Cpanel::PHPFPM::Config::set_default_accounts_to_fpm(1) if Cpanel::PHPFPM::Config::should_default();

{
        # enforce the creation of /var/cpanel/php-fpm.d
        require Cpanel::Server::FPM::Manager;
        local $@;
        eval { Cpanel::Server::FPM::Manager::sync_config_files(); } or warn $@;
    }

# customer decides in feature showcase
    Cpanel::Chkservd::Manage::disable('cpanel_php_fpm');
    Whostmgr::Services::disable('cpanel_php_fpm');

return;
}

sub _setup_dns_and_dkim {

{
        require Whostmgr::ACLS;
        require Whostmgr::Hostname::DNS;
        local $ENV{'REMOTE_USER'} = 'root';
        Whostmgr::ACLS::init_acls();
        my ( $status, $statusmsg, $statuscode ) = Whostmgr::Hostname::DNS::ensure_dns_for_hostname();

Whostmgr::ACLS::clear_acls();

if ( !$status && $statuscode && $statuscode == Cpanel::DnsUtils::Add::STATUS_NO_NSS_CONFD() ) {

# If there are no nameservers setup this will fail
            # and that is expected.  In this case the hostname
            # change will triger the A entry and DKIM
            # add via Whostmgr::Hostname
            return;
        }
        warn $statusmsg if !$status && length $statusmsg;
    }

{
        require Cpanel::DKIM;
        require Cpanel::Hostname;
        my $hostname = Cpanel::Hostname::gethostname(1);
        if ( !Cpanel::DKIM::get_domain_private_key($hostname) ) {
            require Cpanel::DKIM::Transaction;
            my $dkim = Cpanel::DKIM::Transaction->new();

# We do not care about failures here since
            # we expect they won't control DNS most of
            # the time for the hostname.
            $dkim->set_up_user_domains( 'root', [$hostname] );
            $dkim->commit();
        }
    }
    return;
}

sub restart_services_and_run_all_tasks_in_queue {
    return Cpanel::Daemonizer::Tiny::run_as_daemon(
        sub {
            local $ENV{CPANEL_BASE_INSTALL} = 0;
            open( STDERR, '>>', '/usr/local/cpanel/logs/error_log' )
              or die "Could not redirect STDERR to /usr/local/cpanel/logs/error_log: $!";
            open( STDOUT, '>&=', \*STDERR );    ## no critic(InputOutput::RequireCheckedOpen)

Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_cpsrvd});
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_queueprocd});
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_apache_php_fpm});

say "[$$] Flushing task queue.";
            system(qw{/usr/local/cpanel/bin/servers_queue run});
            say "[$$] Completed flushing task queue.";

say "[$$] Done.";

return;
        }
    );
}

sub _run_tasks_that_must_wait_until_deferred_are_installed {

{
        require '/usr/local/cpanel/scripts/fixquotas';    ## no critic qw(RequireBarewordIncludes)
        Scripts::FixQuotas::_install_quota_packages_conditional_if_needed();
    }

return _run_in_background(
        sub {

# Enable services for startup.
            # TODO: Add chkconfig to RPM spec entries and remove this code.
            my @services = qw/cpanel sshd nscd/;
            INFO('Adding services to startup.');
            foreach my $service (@services) {
                INFO(" - Enabling $service");
                Cpanel::Init::Simple::call_cpservice_with( $service => qw/enable/ );
            }

# enable cphulkd by default
            enable_cphulkd();

# enable quotas by default except on DNSONLY systems
            enable_quotas() unless Cpanel::Server::Type::is_dnsonly();

INFO("Automatically enabling features");
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/ensure_autoenabled_features --run});

# mark features as shown, so no feature showcase is
            # seen on new installs
            hide_feature_showcase();

# This does not need MySQL to be installed yet
            INFO("Update phpMyAdmin configuration");
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/bin/update_phpmyadmin_config --force});

# do roundcube finishing touches #
            run_roundcube_ifnecessary();

# deferred Exim RPM installation overwrote changes to /etc/sysconfig/exim, so restore those:
            require Whostmgr::Exim::Sysconfig;
            my $cp_config = scalar Cpanel::Config::LoadCpConf::loadcpconf();
            Whostmgr::Exim::Sysconfig::update_sysconfig( $cp_config->{'exim-retrytime'} ) if defined $cp_config->{'exim-retrytime'};

# Setup cPanelID
            setup_openidconnect_for_cpanelid();

return 0;
        },
        "Apps that require deferred packages"
    );
}

sub _run_webserver_post_install_and_ssl_cert_check_in_background {
    return _run_in_background(
        sub {
            # We Start cpsrvd and httpd because there may be a license type change in the middle
            # of the install
            #
            # If the WebServer is disabled then checkallsslcerts will be doing HTTP DCV with cpsrvd
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_cpsrvd --force});

# If the WebServer is not disabled then checkallsslcerts will be doing HTTP DCV with httpd
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/restartsrv_httpd --force});

# Since we wait for the apache install to finish
            # we do this after _wait_for_background_tasks_to_finish on $ea4_or_universal_hooks_install_pid
            # Enable PHP-FPM by default for new accounts on systems with 2GB+ ram
            set_up_php_fpm_by_default();

# Now that apache is up we can try to get an ssl certificate
            Cpanel::Install::LetsEncrypt::install_and_activate();
            Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/bin/checkallsslcerts --verbose});

# Try again to get an ssl certificate to decrease the chances that
            # their first WHM login is to an insecure page.

warn if !eval { Cpanel::ServerTasks::schedule_task( ['SSLTasks'], 60, 'checkallsslcerts --retry' ); 1 };

# sanity fix existing zones on the server
            warn if !eval { Cpanel::ServerTasks::schedule_task( ['ScriptTasks'], 1, 'run_script /usr/local/cpanel/scripts/fix_dns_zone_ttls --fix' ); 1 };

return 0;
        },
        'WebServer post install and SSL certificate check'
    );

}

sub _run_tasks_that_can_be_done_after_updatenow_in_the_background {

return _run_in_background(
        sub {
            DEBUG("Starting tasks_that_can_be_done_after_updatenow_in_the_background");

# We do these in a background on initial install
            # while we are waiting for upcp
            my @pre_maint = (

# CPANEL-26289: ensure en is available right away after install finishes
                ['/usr/local/cpanel/bin/hulkdsetup'],
                [ '/usr/local/cpanel/bin/build_locale_databases', '--locale=en' ],
                [ '/usr/local/cpanel/scripts/autorepair',         'autorepair' ],
                [ '/usr/local/cpanel/scripts/manage_greylisting', '--init', '--update_common_mail_providers' ],
                ['/usr/local/cpanel/bin/setupdbmap'],
                [ '/usr/local/cpanel/scripts/check_maxmem_against_domains_count', '--always-fix' ],
                ['/usr/local/cpanel/scripts/fixetchosts'],
                [ '/usr/local/cpanel/scripts/litespeed-check', '--run' ],
                [qw{/usr/local/cpanel/bin/install-login-profile --install cpanel-user-commands}],
            );
            foreach my $cmd (@pre_maint) {
                DEBUG("Task after updatenow: @$cmd");
                Cpanel::Install::Utils::Command::ssystem(@$cmd);
            }

for my $cmd (
                'migrate_tweak_settings',
                'legacy_cfg_installer',
                'register_hooks',
                'build_userdata_cache',
            ) {
                DEBUG("Task after updatenow: $cmd");
                Cpanel::Install::Utils::Command::ssystem("/usr/local/cpanel/bin/$cmd");
            }

my $eximdb_run = Cpanel::SafeRun::Object->new(
                program => $^X,
                args    => [
                    '-MCpanel::EximStats::ConnectDB',
                    '-e' => 'Cpanel::EximStats::ConnectDB::dbconnect()',
                ],
                stdout => \*STDOUT,
                stderr => \*STDERR,
            );

warn $eximdb_run->autopsy() if $eximdb_run->CHILD_ERROR();

return 0;
        },
        'Background install tasks',
    );
}

# We do not want to start the yum install of MySQL until cPanel has
# started installing RPMs because as soon as yum gets the lock it will
# block the rpm install which will defeat the performance improvement of
# downloading rpms via yum while rpm is installing the cPanel provided rpms
#
# We also do not want to start the yum install until the background download
# has finished in order to ensure we do not end up downloading the rpms 2x
# because the background download was not yet finished
sub _wait_for_mysql_to_be_downloaded {
    my $verbose = 1;
    while (1) {
        if ( -e $mysql_rpm_download_complete_file ) {
            unlink $mysql_rpm_download_complete_file;
            return;
        }

_show_wait_for("MySQL package download to begin installing packages");
        last unless _wait_for_background_pids( {%background_pids}, verbose => $verbose );
        Cpanel::TimeHiRes::sleep(0.25);
        $verbose = 0;
    }
    return;
}

sub _wait_for_ea4_profiles_to_be_installed {
    my $verbose = 1;
    while (1) {
        _show_wait_for("EA4 profiles to be installed");
        last unless _wait_for_background_pids( {%background_pids}, verbose => $verbose );
        return if -s "/usr/local/bin/ea_install_profile";
        Cpanel::TimeHiRes::sleep(0.25);
        $verbose = 0;

}
    return 1;
}

sub _wait_for_ea4_to_be_installed {
    my $verbose = 1;
    while (1) {
        return if -s "/usr/sbin/httpd";
        _show_wait_for("EA4 to be installed");
        last unless _wait_for_background_pids( {%background_pids}, verbose => $verbose );
        Cpanel::TimeHiRes::sleep(0.25);
        $verbose = 0;

}
    return 1;
}

sub _show_wait_for ( $blocking_proc_text = undef ) {
    state $last_message;
    state $last_time;

if ( $blocking_proc_text && $last_message && $last_message eq $blocking_proc_text ) {
        return if time() - $last_time < 30;    # only display every 30 sec the same message...
    }

$last_message = $blocking_proc_text;
    $last_time    = time();

INFO( "Waiting for (" . join( ', ', ( $blocking_proc_text ? "[$blocking_proc_text]" : () ), sort values %background_pids ) . ")." );

return;
}

sub _shutdown_cpanel_services {
    INFO("Making sure cPanel processes are not running");

# If the cpsrvd binary isn't in place we haven't installed
    # binaries yet so there is no need to proceed.
    return if !-e '/usr/local/cpanel/cpsrvd';
    foreach my $app (qw(cpsrvd cpdavd cphulkd)) {
        if ( Cpanel::Services::Running::is_online($app) ) {
            Cpanel::Install::Utils::Command::ssystem( '/usr/local/cpanel/etc/init/stop' . $app );
        }
    }
    return;
}

sub _install_yum_universal_hooks_in_background {

#On DNSONLY we need EA4's yum-universal-plugins package to fix mysql, etc.
    #
    return _run_in_background(
        sub {

# XXX TODO following short circuit will be removed later once we have EA4 sorted for ubuntu
            return 0 unless Cpanel::OS::is_yum_based();
            INFO("Installing YUM universal hooks...");
            if ( !Cpanel::Install::Utils::Packaged::install_needed_packages('yum-plugin-universal-hooks') ) {
                FATAL("Failed to install “yum-plugin-universal-hooks”");
            }
            return 0;
        },
        'Install YUM universal hooks'
    );
}

sub _install_ea4_in_background {
    return _run_in_background(
        sub {
            INFO("Installing EA4");
            Cpanel::Install::EA4::setup_config_and_fs_for_ea4();
            if ( !Cpanel::Install::EA4::install_apache() ) {
                FATAL("Failed to install EA4");
            }
            return 0;
        },
        'EA4 Install',
    );
}

sub _defer_targets {
    my $rpm_file = Cpanel::RPM::Versions::File->new();
    foreach my $target ( keys %targets_to_defer_to_after_first_upcp ) {
        my $value = $rpm_file->target_settings($target) || '';
        if ( $value ne 'uninstalled' ) {
            $targets_to_defer_to_after_first_upcp{$target} = 1;
            INFO("Marking $target to be uninstalled");
            $rpm_file->set_target_settings( { 'key' => [$target], 'value' => 'uninstalled' } );
        }
        else {
            INFO("$target is already set to uninstalled ($value)");
        }

}
    $rpm_file->save();
    return;
}

sub _install_deferred_targets {
    my $rpm_file               = Cpanel::RPM::Versions::File->new();
    my $has_targets_to_install = 0;
    foreach my $target ( keys %targets_to_defer_to_after_first_upcp ) {
        if ( $targets_to_defer_to_after_first_upcp{$target} ) {
            $has_targets_to_install = 1;
            $rpm_file->delete_target_settings( { 'key' => [$target], 'value' => 'uninstalled' } );
        }
    }
    if ($has_targets_to_install) {
        $rpm_file->save();
        undef $rpm_file;

INFO("Installing deferred targets");
        Cpanel::Install::Utils::Command::ssystem(qw{/usr/local/cpanel/scripts/check_cpanel_pkgs --fix --no-broken --no-digest});
    }
    return;
}

cmd: