91 lines
2.9 KiB
Bash
91 lines
2.9 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Server setup script for a fresh Rocky Linux 9 (or compatible) install.
|
|
# Run as root after cloning the repo to /opt/.
|
|
#
|
|
# Usage:
|
|
# 1. dnf install -y git git-crypt
|
|
# 2. git clone <repo-url> /opt
|
|
# 3. git-crypt unlock /path/to/git-crypt-key
|
|
# 4. /opt/setup.sh
|
|
#
|
|
|
|
errors=()
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
errors+=("Not running as root. Please run this script as root.")
|
|
fi
|
|
|
|
if ! command -v git &>/dev/null; then
|
|
errors+=("git is not installed. Run: dnf install -y git git-crypt")
|
|
fi
|
|
|
|
if ! command -v git-crypt &>/dev/null; then
|
|
errors+=("git-crypt is not installed. Run: dnf install -y git git-crypt")
|
|
fi
|
|
|
|
if [ "$(pwd)" != "/opt" ] && [ "$(dirname "$(readlink -f "$0")")" != "/opt" ]; then
|
|
errors+=("Repo does not appear to be cloned to /opt. Run: git clone <repo-url> /opt")
|
|
fi
|
|
|
|
if git-crypt status &>/dev/null && git-crypt status 2>/dev/null | grep -q '^\*\*\*ENCRYPTED\*\*\*'; then
|
|
errors+=("git-crypt has not been unlocked. Run: git-crypt unlock /path/to/git-crypt-key")
|
|
fi
|
|
|
|
if [ ${#errors[@]} -gt 0 ]; then
|
|
echo "ERROR: Prerequisites not met."
|
|
echo ""
|
|
echo "Please complete the initial setup before running this script:"
|
|
echo " 1. dnf install -y git git-crypt"
|
|
echo " 2. git clone <repo-url> /opt"
|
|
echo " 3. git-crypt unlock /path/to/git-crypt-key"
|
|
echo " 4. /opt/setup.sh"
|
|
echo ""
|
|
echo "Issues found:"
|
|
for err in "${errors[@]}"; do
|
|
echo " - $err"
|
|
done
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Installing Docker..."
|
|
dnf install -y dnf-plugins-core
|
|
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
|
|
dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
systemctl enable --now docker
|
|
|
|
echo "==> Creating deploy user..."
|
|
useradd -r -s /usr/sbin/nologin deploy
|
|
usermod -aG docker deploy
|
|
|
|
echo "==> Setting up deploy SSH key..."
|
|
mkdir -p /home/deploy/.ssh
|
|
chmod 700 /home/deploy/.ssh
|
|
if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
|
|
echo "WARNING: Add the CI public key manually:"
|
|
echo ' command="/opt/scripts/deploy-dispatch.sh",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
|
|
echo " into /home/deploy/.ssh/authorized_keys"
|
|
fi
|
|
chown -R deploy:deploy /home/deploy/.ssh
|
|
|
|
echo "==> Making scripts executable..."
|
|
chmod +x /opt/scripts/*.sh
|
|
|
|
echo "==> Creating shared Docker network..."
|
|
docker network create shared || true
|
|
|
|
echo "==> Logging into Gitea registry..."
|
|
echo "Run manually: docker login git.timothykim.net"
|
|
|
|
echo "==> Starting services..."
|
|
cd /opt/docker/nginx && docker compose up -d
|
|
cd /opt/docker/timothykim.net && docker compose up -d
|
|
|
|
echo "==> Done. Don't forget to:"
|
|
echo " 1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys"
|
|
echo " 2. Log into the Gitea Docker registry: docker login git.timothykim.net"
|
|
echo " 3. Configure Nginx Proxy Manager at http://<server-ip>:81"
|
|
echo " 4. Restore NPM data/certs backup if migrating"
|
|
|