timothykim
9fdee2e54b
Protects against a previous failed run where services started with encrypted/missing files and overwrote them (e.g. NPM database).
106 lines
3.1 KiB
Bash
106 lines
3.1 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Server setup script for a fresh Rocky Linux 9 (or compatible) install.
|
|
# Run as root after cloning the repo to /opt/hantim.
|
|
# Safe to re-run — all steps are idempotent.
|
|
#
|
|
# Usage:
|
|
# 1. dnf install -y git
|
|
# 2. git clone https://git.timothykim.net/timothykim/hantim-server.git /opt/hantim
|
|
# 3. bash /opt/hantim/setup.sh
|
|
#
|
|
|
|
REPO_DIR="/opt/hantim"
|
|
|
|
# --- Prerequisites ---
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "ERROR: Not running as root."
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$(dirname "$(readlink -f "$0")")" != "$REPO_DIR" ]; then
|
|
echo "ERROR: Repo does not appear to be cloned to $REPO_DIR."
|
|
echo " git clone https://git.timothykim.net/timothykim/hantim-server.git $REPO_DIR"
|
|
exit 1
|
|
fi
|
|
|
|
# --- Install dependencies ---
|
|
|
|
echo "==> Upgrading system packages..."
|
|
dnf upgrade -y
|
|
|
|
echo "==> Installing dependencies..."
|
|
dnf install -y git-crypt
|
|
dnf module install -y nodejs:20/common
|
|
|
|
if ! command -v bw &>/dev/null; then
|
|
echo "==> Installing Bitwarden CLI..."
|
|
npm install -g @bitwarden/cli
|
|
fi
|
|
|
|
# --- Unlock git-crypt via Bitwarden ---
|
|
|
|
echo "==> Unlocking git-crypt via Bitwarden..."
|
|
echo " Log in to Bitwarden when prompted."
|
|
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
|
|
bw login
|
|
fi
|
|
BW_SESSION=$(bw unlock --raw)
|
|
bw sync --session "$BW_SESSION"
|
|
bw get notes hantim-git-crypt-key --session "$BW_SESSION" | base64 -d > /tmp/git-crypt-key
|
|
cd "$REPO_DIR"
|
|
git-crypt unlock /tmp/git-crypt-key
|
|
rm /tmp/git-crypt-key
|
|
bw lock
|
|
|
|
# --- Install Docker ---
|
|
|
|
if ! command -v docker &>/dev/null; then
|
|
echo "==> Installing Docker..."
|
|
dnf install -y dnf-plugins-core
|
|
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
|
|
dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
fi
|
|
systemctl enable --now docker
|
|
|
|
# --- Create deploy user ---
|
|
|
|
if ! id deploy &>/dev/null; then
|
|
echo "==> Creating deploy user..."
|
|
useradd -r -s /usr/sbin/nologin deploy
|
|
fi
|
|
usermod -aG docker deploy
|
|
|
|
echo "==> Setting up deploy SSH key..."
|
|
mkdir -p /home/deploy/.ssh
|
|
chmod 700 /home/deploy/.ssh
|
|
if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
|
|
echo "WARNING: Add the CI public key manually:"
|
|
echo ' command="/opt/hantim/scripts/deploy-dispatch.sh",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
|
|
echo " into /home/deploy/.ssh/authorized_keys"
|
|
fi
|
|
chown -R deploy:deploy /home/deploy/.ssh
|
|
|
|
# --- Start services ---
|
|
|
|
echo "==> Making scripts executable..."
|
|
chmod +x "$REPO_DIR/scripts/"*.sh
|
|
|
|
echo "==> Logging into Gitea registry..."
|
|
echo "Run manually: docker login git.timothykim.net"
|
|
|
|
echo "==> Restoring git-tracked files..."
|
|
cd "$REPO_DIR" && git checkout -- .
|
|
|
|
echo "==> Starting services..."
|
|
cd "$REPO_DIR/docker/nginx" && docker compose up -d
|
|
cd "$REPO_DIR/docker/timothykim.net" && docker compose up -d
|
|
|
|
echo "==> Done. Don't forget to:"
|
|
echo " 1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys"
|
|
echo " 2. Log into the Gitea Docker registry: docker login git.timothykim.net"
|
|
echo " 3. Configure Nginx Proxy Manager at http://<server-ip>:81"
|
|
echo " 4. Restore NPM data/certs backup if migrating"
|