hantim/hantim-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

split setup.sh into bootstrap.sh and configure.sh
Provision server / provision (push) Failing after 2s
Details

Browse Source 
bootstrap.sh handles first-time setup (manual, Bitwarden).
configure.sh handles idempotent config (CI-safe).
Add provision workflow, deploy-garage workflow, new-service.sh.
Remove git-crypt references and empty .gitattributes.
This commit is contained in:
Timothy Kim
2026-03-18 14:51:19 -04:00
parent 3b4ff1f291
commit 919c5353bc
12 changed files with 359 additions and 209 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+24 -17
View File
@@ -14,10 +14,15 @@ docker/
compose.yml
timothykim.net/ # timothykim.net static site
compose.yml
garage/ # Garage S3-compatible object storage
compose.yml
garage.toml.template
scripts/
deploy.sh # Deploy + cert issuance script (called via SSH)
new-app.sh # Scaffolding script to add a new app
setup.sh # Server provisioning script (idempotent)
bootstrap.sh # First-time server setup (manual, uses Bitwarden)
configure.sh # Idempotent server config (CI-safe)
deploy.sh # Deploy + cert issuance + provision (called via SSH)
new-app.sh # Scaffolding script to add a new static site
new-service.sh # Scaffolding script to add a new Docker service
.gitea/workflows/ # Per-app deploy workflows triggered by path changes
```
@@ -28,23 +33,26 @@ On a fresh Rocky Linux 9 install:
```bash
dnf install -y git
git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
bash /opt/hantim/setup.sh
bash /opt/hantim/scripts/bootstrap.sh
```
`setup.sh` is fully automated and idempotent. It:
`bootstrap.sh` runs once manually. It:
1. Installs system dependencies (git-crypt, jq, certbot, Node.js 20, Docker)
1. Installs system dependencies (jq, certbot, Node.js 20, Docker)
2. Installs and authenticates the Bitwarden CLI
3. Unlocks git-crypt using a key stored in Bitwarden
4. Fetches the Docker registry token and deploy SSH public key from Bitwarden
5. Logs into the Gitea Docker registry
6. Creates the `deploy` user with restricted SSH access and sudo
7. Opens firewall ports (HTTP/HTTPS)
8. Issues SSL certificates via certbot for all configured domains
9. Starts all services (nginx first, then all apps)
3. Fetches the Docker registry token and deploy SSH public key from Bitwarden
4. Logs into the Gitea Docker registry
5. Creates the `deploy` user with restricted SSH access and sudo
6. Runs `configure.sh` (firewall, certbot, start services)
`configure.sh` is idempotent and CI-safe. It:
1. Opens firewall ports (HTTP, HTTPS, Garage RPC)
2. Sets up certbot and issues SSL certificates for all configured domains
3. Starts all services (nginx first, then all apps)
**Prerequisites**: DNS for all configured domains must point to the server
before running setup.
before running bootstrap.
## Adding a new app
@@ -85,18 +93,17 @@ git add . && git commit -m "initial content" && git push
## Restoring from backup
Run the same three commands as provisioning. `setup.sh` is idempotent:
Run the same three commands as provisioning. `bootstrap.sh` is idempotent:
- Existing packages are skipped
- Existing certs are skipped (or re-issued if the server is new)
- All services are started
## Secrets
The following are stored in Bitwarden and fetched automatically by `setup.sh`:
The following are stored in Bitwarden and fetched automatically by `bootstrap.sh`:
| Bitwarden item | Type | Purpose |
|---|---|---|
| `hantim-git-crypt-key` | Secure Note | git-crypt symmetric key (base64) |
| `hantim-ci-registry-push` | Secure Note | Gitea token for Docker registry |
| `hantim-server-deploy` | SSH Key | Deploy user's SSH key |