hantim/hantim-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate bootstrap.sh from bw to bws, update docs

Browse Source
This commit is contained in:
Timothy Kim
2026-03-18 19:04:22 -04:00
parent 00ab7d1b8d
commit ef7fe7677c
5 changed files with 92 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+20 -20
View File
@@ -38,12 +38,13 @@ bash /opt/hantim/scripts/bootstrap.sh
`bootstrap.sh` runs once manually. It:
1. Installs system dependencies (jq, certbot, Node.js 20, Docker)
2. Installs and authenticates the Bitwarden CLI
3. Fetches the Docker registry token and deploy SSH public key from Bitwarden
4. Logs into the Gitea Docker registry
5. Creates the `deploy` user with restricted SSH access and sudo
6. Runs `configure.sh` (firewall, certbot, start services)
1. Installs system dependencies (jq, certbot, unzip, Docker)
2. Installs the `bws` CLI (Bitwarden Secrets Manager)
3. Prompts for a Bitwarden Secrets Manager access token (saved to `/etc/bws-token`)
4. Fetches the Docker registry token and deploy SSH public key via `bws`
5. Logs into the Gitea Docker registry
6. Creates the `deploy` user with restricted SSH access and sudo
7. Runs `configure.sh` (firewall, certbot, start services)
`configure.sh` is idempotent and CI-safe. It:
@@ -51,8 +52,9 @@ bash /opt/hantim/scripts/bootstrap.sh
2. Sets up certbot and issues SSL certificates for all configured domains
3. Starts all services (nginx first, then all apps)
**Prerequisites**: DNS for all configured domains must point to the server
before running bootstrap.
**Prerequisites**:
- DNS for all configured domains must point to the server
- Bitwarden Secrets Manager access token for the `hantim-server` machine account
## Adding a new app
@@ -100,24 +102,22 @@ Run the same three commands as provisioning. `bootstrap.sh` is idempotent:
## Secrets
The following are stored in Bitwarden and fetched automatically by `bootstrap.sh`:
Bitwarden Secrets Manager (project: `hantim`, fetched via `bws` CLI on the server):
| Bitwarden item | Type | Purpose |
| Secret | Purpose | Used by |
|---|---|---|
| `hantim-ci-registry-push` | Secure Note | Gitea token for Docker registry |
| `hantim-server-deploy` | SSH Key | Deploy user's SSH key |
| `hantim-ci-registry-push` | Gitea token for Docker registry | `bootstrap.sh` |
| `hantim-deploy-ssh-public-key` | Deploy user's SSH public key | `bootstrap.sh` |
| `hantim-deploy-ssh-private-key` | Deploy user's SSH private key | `new-app.sh` |
| `hantim-new-app-script` | Gitea API token for creating repos | `new-app.sh` |
| `hantim-vultr-api-key` | Vultr API key for DNS management | `new-app.sh` |
The following are configured in the `hantim` Gitea org settings:
Machine accounts: `hantim-server` (token at `/etc/bws-token`), `hantim-ci` (reserved).
Gitea org-level (`hantim`) secrets/variables:
| Name | Type | Purpose |
|---|---|---|
| `DEPLOY_HOST` | Variable | Server IP or hostname |
| `DEPLOY_SSH_KEY` | Secret | SSH private key for the deploy user |
| `CI_REGISTRY_TOKEN` | Secret | Gitea token for Docker registry login |
The following are stored in Bitwarden and used by `new-app.sh`:
| Bitwarden item | Type | Purpose |
|---|---|---|
| `hantim-new-app-script` | Secure Note | Gitea API token for creating repos |
| `hantim-vultr-api-key` | Secure Note | Vultr API key for DNS management |