escape the sed replacements, and stop the script failing silently

The sed pass that configures the daemon punished anyone setting a strong
password: '&' in a replacement means the whole match, so a password
containing one was silently rewritten into something else, and the '|'
delimiter made sed exit with 'unknown option to s'. Every setting rode in
one invocation and the script had no set -e, so that failure applied none
of them -- not apipassword, not apienabled, not apiinterface -- and the
daemon came up on whatever it had before without saying so.

esc() now escapes backslash, '&' and the delimiter via printf. The
expressions are anchored to the start of the line and name their key in the
replacement instead of using \1, so no backreference is involved and
nothing in another section can match. keys.dat also holds privsigningkey
and privencryptionkey for this node's Bitmessage identities; editing in
place leaves every byte outside [bitmessagesettings] untouched, which is
why this stays a line edit rather than a parse-and-rewrite.

The clients needed the other half of this: credentials go into an XML-RPC
URL, where '@' splits the userinfo and '#' truncates the rest, so a strong
password wrote correctly and still failed to connect. Both now
percent-encode. A '%' in the password remains unusable -- it breaks
PyBitmessage's own config reader and every API call returns 500.

Also here, all found while making the above safe:
- set -eu, with the keys.dat chown guarded. A misconfiguration now stops
  the container instead of passing unnoticed.
- The seed-address retry loop used bash brace expansion under CMD ["sh"],
  where /bin/sh is dash and {1..4} is a literal, so it ran once, not four
  times.
- apt-get update shared a layer with nothing, letting a cached update feed
  install months-stale package lists.
- HEALTHCHECK gained a start period; the startup VACUUM takes tens of
  seconds on a large messages.dat and the container reported unhealthy for
  all of it.
- Removed the AppImage systemd unit, AppArmor profile and updater script.
  Nothing referenced them -- not the image, the deployment or the ansible
  roles -- and the updater fetched a binary with no signature or checksum
  check.

docker/run.sh

@@ -1,5 +1,7 @@
 #!/bin/sh
 
+set -eu
+
 export BITMESSAGE_API_USER="${BITMESSAGE_API_USER:-bitmessage_api_user}"
 export BITMESSAGE_API_PASSWORD="${BITMESSAGE_API_PASSWORD:-bitmessage_api_password}"
 export BITMESSAGE_SEED_ADDRESSES="${BITMESSAGE_SEED_ADDRESSES:-0}"
@@ -8,33 +10,56 @@ export BITMESSAGE_TTL="${BITMESSAGE_TTL:-172800}"
 export BITMESSAGE_STOPRESENDINGAFTERXDAYS="${BITMESSAGE_STOPRESENDINGAFTERXDAYS:-30}"
 export BITMESSAGE_APIVARIANT="${BITMESSAGE_APIVARIANT:-legacy}"
 
-if [ -z "$BITMESSAGE_SEED_PHRASE" ]
+if [ -z "${BITMESSAGE_SEED_PHRASE:-}" ]
 then
   BITMESSAGE_SEED_PHRASE="$(cat /dev/random | tr -dc "a-z" | head -c32)"
   export BITMESSAGE_SEED_PHRASE
 fi
 
-# this command must be run as root (for bind mounts to container)
-chown bitmessage:bitmessage keys.dat
-chmod 600 keys.dat
+# Escape a value for use on the right-hand side of the sed expressions below.
+# There, a backslash starts an escape, "&" stands for the whole match, and "|"
+# ends the replacement because it is the delimiter. Unescaped, a password
+# containing "&" was silently rewritten into something else and one containing
+# "|" made sed fail outright.
+esc() {
+	printf '%s' "$1" | sed -e 's/[\\&|]/\\&/g'
+}
 
-# set config values
-gosu bitmessage sed -i -e "s|\(apiinterface = \).*|\10\.0\.0\.0|g" \
-	-e "s|\(apivariant = \).*|\1$BITMESSAGE_APIVARIANT|g" \
-	-e "s|\(apiusername = \).*|\1$BITMESSAGE_API_USER|g" \
-	-e "s|\(apipassword = \).*|\1$BITMESSAGE_API_PASSWORD|g" \
-	-e "s|\(apiport = \).*|\1$BITMESSAGE_API_PORT|g" \
-	-e "s|\(apienabled = \).*|\1True|g" \
-	-e "s|\(ttl = \).*|\1$BITMESSAGE_TTL|g" \
-	-e "s|\(stopresendingafterxdays = \).*|\1$BITMESSAGE_STOPRESENDINGAFTERXDAYS|g" \
-	-e "s|\(udp = \).*|\1False|g" keys.dat
+# this command must be run as root (for bind mounts to container)
+if [ -f keys.dat ]
+then
+	chown bitmessage:bitmessage keys.dat
+	chmod 600 keys.dat
+fi
+
+# Set config values. Every expression is anchored to the start of the line and
+# names its key in the replacement, so no backreference is involved and nothing
+# in another section can match. With set -e a failure here now stops the
+# container instead of leaving the daemon on its previous settings unnoticed --
+# including the case of a bind mount with no keys.dat at all.
+gosu bitmessage sed -i \
+	-e "s|^apiinterface = .*|apiinterface = 0.0.0.0|" \
+	-e "s|^apivariant = .*|apivariant = $(esc "$BITMESSAGE_APIVARIANT")|" \
+	-e "s|^apiusername = .*|apiusername = $(esc "$BITMESSAGE_API_USER")|" \
+	-e "s|^apipassword = .*|apipassword = $(esc "$BITMESSAGE_API_PASSWORD")|" \
+	-e "s|^apiport = .*|apiport = $(esc "$BITMESSAGE_API_PORT")|" \
+	-e "s|^apienabled = .*|apienabled = True|" \
+	-e "s|^ttl = .*|ttl = $(esc "$BITMESSAGE_TTL")|" \
+	-e "s|^stopresendingafterxdays = .*|stopresendingafterxdays = $(esc "$BITMESSAGE_STOPRESENDINGAFTERXDAYS")|" \
+	-e "s|^udp = .*|udp = False|" keys.dat
 
 # generate address from seed
-test "$BITMESSAGE_SEED_ADDRESSES" -gt 0 && for i in {1..4}
-do
-	sleep 15
-	gosu bitmessage /usr/bin/python /usr/local/bin/seed_addr_gen.py
-done &
+if [ "$BITMESSAGE_SEED_ADDRESSES" -gt 0 ]
+then
+	# Four attempts, not a bash {1..4}: this runs under dash, where brace
+	# expansion is literal and the loop would have run once. The call is
+	# idempotent (createDeterministicAddresses returns nothing for an address
+	# that already exists), so these are retries while the API comes up.
+	for i in 1 2 3 4
+	do
+		sleep 15
+		gosu bitmessage /usr/bin/python /usr/local/bin/seed_addr_gen.py
+	done &
+fi
 
 exec gosu bitmessage pybitmessage -d
-