split setup.sh into bootstrap.sh and configure.sh
Provision server / provision (push) Failing after 2s
Provision server / provision (push) Failing after 2s
bootstrap.sh handles first-time setup (manual, Bitwarden). configure.sh handles idempotent config (CI-safe). Add provision workflow, deploy-garage workflow, new-service.sh. Remove git-crypt references and empty .gitattributes.
This commit is contained in:
@@ -0,0 +1,96 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# First-time server setup for a fresh Rocky Linux 9 (or compatible) install.
|
||||
# Run as root after cloning the repo to /opt/hantim.
|
||||
# Calls configure.sh at the end.
|
||||
#
|
||||
# Usage:
|
||||
# 1. dnf install -y git
|
||||
# 2. git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
|
||||
# 3. bash /opt/hantim/scripts/bootstrap.sh
|
||||
#
|
||||
|
||||
REPO_DIR="/opt/hantim"
|
||||
|
||||
# --- Prerequisites ---
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "ERROR: Not running as root."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$(dirname "$(dirname "$(readlink -f "$0")")")" != "$REPO_DIR" ]; then
|
||||
echo "ERROR: Repo does not appear to be cloned to $REPO_DIR."
|
||||
echo " git clone https://git.timothykim.net/hantim/hantim-server.git $REPO_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# --- Install dependencies ---
|
||||
|
||||
echo "==> Upgrading system packages..."
|
||||
dnf upgrade -y
|
||||
|
||||
echo "==> Installing dependencies..."
|
||||
dnf install -y jq epel-release
|
||||
dnf install -y certbot
|
||||
dnf module reset -y nodejs
|
||||
dnf module install -y nodejs:20/common
|
||||
|
||||
BW_CLI="$(npm config get prefix)/bin/bw"
|
||||
if [ ! -x "$BW_CLI" ]; then
|
||||
echo "==> Installing Bitwarden CLI..."
|
||||
npm install -g @bitwarden/cli
|
||||
fi
|
||||
|
||||
# --- Fetch secrets from Bitwarden ---
|
||||
|
||||
echo "==> Fetching secrets from Bitwarden..."
|
||||
echo " Log in to Bitwarden when prompted."
|
||||
if "$BW_CLI" status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
|
||||
"$BW_CLI" login
|
||||
fi
|
||||
BW_SESSION=$("$BW_CLI" unlock --raw)
|
||||
"$BW_CLI" sync --session "$BW_SESSION"
|
||||
REGISTRY_TOKEN=$("$BW_CLI" get notes hantim-ci-registry-push --session "$BW_SESSION")
|
||||
DEPLOY_PUBKEY=$("$BW_CLI" get item hantim-server-deploy --session "$BW_SESSION" | jq -r '.sshKey.publicKey')
|
||||
"$BW_CLI" lock
|
||||
|
||||
# --- Install Docker ---
|
||||
|
||||
if ! command -v docker &>/dev/null; then
|
||||
echo "==> Installing Docker..."
|
||||
dnf install -y dnf-plugins-core
|
||||
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
|
||||
dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
||||
fi
|
||||
systemctl enable --now docker
|
||||
|
||||
echo "==> Logging into Gitea Docker registry..."
|
||||
echo "$REGISTRY_TOKEN" | docker login git.timothykim.net -u timothykim --password-stdin
|
||||
|
||||
# --- Create deploy user ---
|
||||
|
||||
if ! id deploy &>/dev/null; then
|
||||
echo "==> Creating deploy user..."
|
||||
useradd -r -s /usr/sbin/nologin deploy
|
||||
fi
|
||||
usermod -aG docker deploy
|
||||
|
||||
echo "==> Setting up deploy SSH key..."
|
||||
mkdir -p /home/deploy/.ssh
|
||||
chmod 700 /home/deploy/.ssh
|
||||
echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
|
||||
chmod 600 /home/deploy/.ssh/authorized_keys
|
||||
chown -R deploy:deploy /home/deploy/.ssh
|
||||
|
||||
echo "==> Configuring sudo for deploy user..."
|
||||
cat > /etc/sudoers.d/deploy <<SUDOERS
|
||||
deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy.sh
|
||||
SUDOERS
|
||||
chmod 440 /etc/sudoers.d/deploy
|
||||
|
||||
# --- Run configure ---
|
||||
|
||||
echo "==> Running configure.sh..."
|
||||
bash "$REPO_DIR/scripts/configure.sh"
|
||||
@@ -0,0 +1,76 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# Idempotent server configuration. Safe to run from CI or manually.
|
||||
# No secrets required — only configures firewall, certbot, and starts services.
|
||||
|
||||
REPO_DIR="/opt/hantim"
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "ERROR: Not running as root."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "==> Making scripts executable..."
|
||||
chmod +x "$REPO_DIR/scripts/"*.sh
|
||||
|
||||
echo "==> Opening firewall ports..."
|
||||
firewall-cmd --permanent --add-service=http
|
||||
firewall-cmd --permanent --add-service=https
|
||||
firewall-cmd --permanent --add-port=3901/tcp
|
||||
firewall-cmd --reload
|
||||
|
||||
echo "==> Setting up certbot..."
|
||||
mkdir -p "$REPO_DIR/docker/nginx/certbot/www"
|
||||
mkdir -p /etc/letsencrypt/renewal-hooks/deploy
|
||||
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
|
||||
#!/bin/bash
|
||||
docker exec nginx nginx -s reload
|
||||
HOOK
|
||||
chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
|
||||
if systemctl list-unit-files certbot-renew.timer 2>/dev/null | grep -q certbot-renew; then
|
||||
systemctl enable --now certbot-renew.timer
|
||||
else
|
||||
echo "0 3 * * * root certbot renew --quiet" > /etc/cron.d/certbot-renew
|
||||
fi
|
||||
|
||||
echo "==> Issuing SSL certificates..."
|
||||
# Stop nginx if running so certbot can bind to port 80
|
||||
docker stop nginx 2>/dev/null || true
|
||||
for conf in "$REPO_DIR"/docker/nginx/conf.d/*.conf; do
|
||||
# Derive cert name from config filename (e.g. timothykim.net.conf -> timothykim.net)
|
||||
cert_name=$(basename "$conf" .conf)
|
||||
domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u)
|
||||
if [ -z "$domains" ]; then
|
||||
continue
|
||||
fi
|
||||
if [ -d "/etc/letsencrypt/live/$cert_name" ]; then
|
||||
echo " Cert for $cert_name already exists, skipping."
|
||||
continue
|
||||
fi
|
||||
domain_args=""
|
||||
for d in $domains; do
|
||||
domain_args="$domain_args -d $d"
|
||||
done
|
||||
echo " Issuing cert for: $cert_name ($domains)"
|
||||
certbot certonly --standalone --non-interactive --agree-tos --register-unsafely-without-email --cert-name "$cert_name" $domain_args
|
||||
done
|
||||
|
||||
echo "==> Starting services..."
|
||||
# Start nginx first (creates the shared network)
|
||||
cd "$REPO_DIR/docker/nginx"
|
||||
docker compose up -d
|
||||
# Start all other apps
|
||||
for app in "$REPO_DIR"/docker/*/; do
|
||||
if [ "$(basename "$app")" = "nginx" ]; then
|
||||
continue
|
||||
fi
|
||||
app_name=$(basename "$app")
|
||||
echo " Starting $app_name..."
|
||||
cd "$app"
|
||||
if ! docker compose up -d; then
|
||||
echo " WARNING: Failed to start $app_name (image may not exist yet). It will start on first deploy."
|
||||
fi
|
||||
done
|
||||
|
||||
echo "==> Done."
|
||||
@@ -32,6 +32,13 @@ NGINXCONF
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$CMD" = "provision" ]; then
|
||||
cd /opt/hantim
|
||||
git pull
|
||||
bash scripts/configure.sh
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if ! [[ "$CMD" =~ ^deploy-[a-zA-Z0-9._-]+$ ]]; then
|
||||
echo "Unknown command: $CMD"
|
||||
exit 1
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z "${1:-}" ]; then
|
||||
echo "Usage: ./scripts/new-service.sh <name>"
|
||||
echo " Example: ./scripts/new-service.sh garage"
|
||||
echo ""
|
||||
echo "Creates docker/<name>/compose.yml and .gitea/workflows/deploy-<name>.yml"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
APP="$1"
|
||||
|
||||
if ! [[ "$APP" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]; then
|
||||
echo "Error: name must be alphanumeric (hyphens, dots, underscores allowed)."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
|
||||
if [ -d "$REPO_ROOT/docker/$APP" ]; then
|
||||
echo "Error: docker/$APP already exists."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Creating docker/$APP/compose.yml..."
|
||||
mkdir -p "$REPO_ROOT/docker/$APP"
|
||||
cat > "$REPO_ROOT/docker/$APP/compose.yml" <<EOF
|
||||
services:
|
||||
$APP:
|
||||
image: TODO
|
||||
restart: unless-stopped
|
||||
container_name: $APP
|
||||
networks:
|
||||
- shared
|
||||
|
||||
networks:
|
||||
shared:
|
||||
external: true
|
||||
EOF
|
||||
|
||||
echo "Creating .gitea/workflows/deploy-$APP.yml..."
|
||||
mkdir -p "$REPO_ROOT/.gitea/workflows"
|
||||
cat > "$REPO_ROOT/.gitea/workflows/deploy-$APP.yml" <<'OUTER'
|
||||
name: Deploy APP_PLACEHOLDER
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- 'docker/APP_PLACEHOLDER/**'
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Deploy via SSH
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
|
||||
chmod 600 ~/.ssh/deploy_key
|
||||
ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-APP_PLACEHOLDER
|
||||
OUTER
|
||||
sed -i "s/APP_PLACEHOLDER/$APP/g" "$REPO_ROOT/.gitea/workflows/deploy-$APP.yml"
|
||||
|
||||
echo "Done. Edit docker/$APP/compose.yml, then commit and push."
|
||||
Reference in New Issue
Block a user