73 lines
2.5 KiB
Bash
Executable File
73 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Idempotent server configuration. Safe to run from CI or manually.
|
|
# Delegates service deployment (including .env generation) to deploy.sh.
|
|
|
|
REPO_DIR="/opt/hantim"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "ERROR: Not running as root."
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Making scripts executable..."
|
|
chmod +x "$REPO_DIR/scripts/"*.sh
|
|
|
|
echo "==> Opening firewall ports..."
|
|
firewall-cmd --permanent --add-service=http
|
|
firewall-cmd --permanent --add-service=https
|
|
firewall-cmd --permanent --add-port=3901/tcp
|
|
firewall-cmd --reload
|
|
|
|
echo "==> Setting up certbot..."
|
|
mkdir -p "$REPO_DIR/docker/nginx/certbot/www"
|
|
mkdir -p /etc/letsencrypt/renewal-hooks/deploy
|
|
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
|
|
#!/bin/bash
|
|
docker exec nginx nginx -s reload
|
|
HOOK
|
|
chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
|
|
if systemctl list-unit-files certbot-renew.timer 2>/dev/null | grep -q certbot-renew; then
|
|
systemctl enable --now certbot-renew.timer
|
|
else
|
|
echo "0 3 * * * root certbot renew --quiet --deploy-hook 'docker exec nginx nginx -s reload' 2>&1 | logger -t certbot" > /etc/cron.d/certbot-renew
|
|
fi
|
|
|
|
echo "==> Deploying services..."
|
|
# Deploy nginx first (creates the shared network)
|
|
bash "$REPO_DIR/scripts/deploy.sh" deploy-nginx
|
|
|
|
# Self-heal renewal config drift: certs issued by the old --standalone flow
|
|
# (removed in de1d60b) can never renew because nginx now holds port 80. Reissue
|
|
# any such cert via the canonical webroot path. nginx must be up (above) to
|
|
# serve the ACME challenge. Best-effort: a single failure warns but does not
|
|
# block the rest of the provision.
|
|
echo "==> Healing standalone cert renewal configs..."
|
|
heal_failed=false
|
|
for conf in /etc/letsencrypt/renewal/*.conf; do
|
|
[ -e "$conf" ] || continue
|
|
grep -q '^authenticator = standalone' "$conf" || continue
|
|
cert_name=$(basename "$conf" .conf)
|
|
echo " $cert_name uses standalone; reissuing via webroot..."
|
|
if ! bash "$REPO_DIR/scripts/deploy.sh" "cert-$cert_name"; then
|
|
echo " WARNING: failed to reissue $cert_name; leaving standalone config in place"
|
|
heal_failed=true
|
|
fi
|
|
done
|
|
|
|
# Deploy all other apps
|
|
for app in "$REPO_DIR"/docker/*/; do
|
|
app_name=$(basename "$app")
|
|
[ "$app_name" = "nginx" ] && continue
|
|
echo " Deploying $app_name..."
|
|
bash "$REPO_DIR/scripts/deploy.sh" "deploy-$app_name"
|
|
done
|
|
|
|
echo "==> Done."
|
|
|
|
if [ "$heal_failed" = true ]; then
|
|
echo "ERROR: one or more standalone certs could not be reissued (see warnings above)."
|
|
exit 1
|
|
fi
|