hantim/hantim-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

automate deploy key and registry login via Bitwarden in setup.sh

Browse Source
This commit is contained in:
Timothy Kim
2026-03-15 22:56:11 -04:00
parent 91d549c9ba
commit 9337045114
1 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup.sh
+12 -13
View File
@@ -32,7 +32,7 @@ echo "==> Upgrading system packages..."
dnf upgrade -y dnf upgrade -y
echo "==> Installing dependencies..." echo "==> Installing dependencies..."
dnf install -y git-crypt dnf install -y git-crypt jq
dnf module reset -y nodejs dnf module reset -y nodejs
dnf module install -y nodejs:20/common dnf module install -y nodejs:20/common
@@ -59,6 +59,10 @@ BW_SESSION=$("$BW_CLI" unlock --raw)
cd "$REPO_DIR" cd "$REPO_DIR"
git-crypt unlock /tmp/git-crypt-key git-crypt unlock /tmp/git-crypt-key
rm /tmp/git-crypt-key rm /tmp/git-crypt-key
echo "==> Fetching secrets from Bitwarden..."
REGISTRY_TOKEN=$("$BW_CLI" get password hantim-ci-registry-push --session "$BW_SESSION")
DEPLOY_PUBKEY=$("$BW_CLI" get item hantim-server-deploy --session "$BW_SESSION" | jq -r '.sshKey.publicKey')
"$BW_CLI" lock "$BW_CLI" lock
# --- Install Docker --- # --- Install Docker ---
@@ -71,6 +75,9 @@ if ! command -v docker &>/dev/null; then
fi fi
systemctl enable --now docker systemctl enable --now docker
echo "==> Logging into Gitea Docker registry..."
echo "$REGISTRY_TOKEN" | docker login git.timothykim.net -u timothykim --password-stdin
# --- Create deploy user --- # --- Create deploy user ---
if ! id deploy &>/dev/null; then if ! id deploy &>/dev/null; then
@@ -82,11 +89,8 @@ usermod -aG docker deploy
echo "==> Setting up deploy SSH key..." echo "==> Setting up deploy SSH key..."
mkdir -p /home/deploy/.ssh mkdir -p /home/deploy/.ssh
chmod 700 /home/deploy/.ssh chmod 700 /home/deploy/.ssh
if [ ! -f /home/deploy/.ssh/authorized_keys ]; then echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
echo "WARNING: Add the CI public key manually:" chmod 600 /home/deploy/.ssh/authorized_keys
echo ' command="sudo /opt/hantim/scripts/deploy.sh $SSH_ORIGINAL_COMMAND",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
echo " into /home/deploy/.ssh/authorized_keys"
fi
chown -R deploy:deploy /home/deploy/.ssh chown -R deploy:deploy /home/deploy/.ssh
echo "==> Configuring sudo for deploy user..." echo "==> Configuring sudo for deploy user..."
@@ -100,9 +104,6 @@ chmod 440 /etc/sudoers.d/deploy
echo "==> Making scripts executable..." echo "==> Making scripts executable..."
chmod +x "$REPO_DIR/scripts/"*.sh chmod +x "$REPO_DIR/scripts/"*.sh
echo "==> Logging into Gitea registry..."
echo "Run manually: docker login git.timothykim.net"
echo "==> Starting services..." echo "==> Starting services..."
cd "$REPO_DIR/docker/nginx" cd "$REPO_DIR/docker/nginx"
docker compose up -d docker compose up -d
@@ -110,7 +111,5 @@ cd "$REPO_DIR/docker/timothykim.net"
docker compose up -d docker compose up -d
echo "==> Done. Don't forget to:" echo "==> Done. Don't forget to:"
echo " 1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys" echo " 1. Configure Nginx Proxy Manager at http://<server-ip>:81"
echo " 2. Log into the Gitea Docker registry: docker login git.timothykim.net" echo " 2. Restore NPM data/certs backup if migrating"
echo " 3. Configure Nginx Proxy Manager at http://<server-ip>:81"
echo " 4. Restore NPM data/certs backup if migrating"