117 lines
3.7 KiB
Bash
Executable File
117 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# First-time server setup for a fresh Rocky Linux 9 (or compatible) install.
|
|
# Run as root after cloning the repo to /opt/hantim.
|
|
# Calls configure.sh at the end.
|
|
#
|
|
# Usage:
|
|
# 1. dnf install -y git
|
|
# 2. git clone https://git.timothykim.net/hantim/hantim-server.git /opt/hantim
|
|
# 3. bash /opt/hantim/scripts/bootstrap.sh
|
|
#
|
|
# Prerequisites:
|
|
# - Bitwarden Secrets Manager access token for the hantim-server machine account
|
|
|
|
REPO_DIR="/opt/hantim"
|
|
BWS_TOKEN_FILE="/etc/bws-token"
|
|
BWS_VERSION="2.0.0"
|
|
|
|
# Secret IDs (Bitwarden Secrets Manager)
|
|
SECRET_REGISTRY_TOKEN="43f4a77d-7bb4-49ad-8044-b411016c5c6e" # hantim-ci-registry-push
|
|
SECRET_DEPLOY_PUBKEY="945760dd-90e2-46e5-98ad-b411016e3f3b" # hantim-deploy-ssh-public-key
|
|
|
|
# --- Prerequisites ---
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "ERROR: Not running as root."
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$(dirname "$(dirname "$(readlink -f "$0")")")" != "$REPO_DIR" ]; then
|
|
echo "ERROR: Repo does not appear to be cloned to $REPO_DIR."
|
|
echo " git clone https://git.timothykim.net/hantim/hantim-server.git $REPO_DIR"
|
|
exit 1
|
|
fi
|
|
|
|
# --- Install dependencies ---
|
|
|
|
echo "==> Upgrading system packages..."
|
|
dnf upgrade -y
|
|
|
|
echo "==> Installing dependencies..."
|
|
dnf install -y jq epel-release unzip
|
|
dnf install -y certbot
|
|
|
|
# --- Install bws CLI ---
|
|
|
|
if ! command -v bws &>/dev/null; then
|
|
echo "==> Installing Bitwarden Secrets Manager CLI..."
|
|
curl -sL "https://github.com/bitwarden/sdk-sm/releases/download/bws-v${BWS_VERSION}/bws-x86_64-unknown-linux-gnu-${BWS_VERSION}.zip" -o /tmp/bws.zip
|
|
unzip -o /tmp/bws.zip -d /usr/bin
|
|
chmod +x /usr/bin/bws
|
|
rm /tmp/bws.zip
|
|
fi
|
|
|
|
# --- Set up access token ---
|
|
|
|
if [ ! -f "$BWS_TOKEN_FILE" ]; then
|
|
echo "==> Bitwarden Secrets Manager access token required."
|
|
echo " Generate one for the hantim-server machine account at:"
|
|
echo " https://vault.bitwarden.com/#/sm/machine-accounts"
|
|
read -rp " Paste access token: " BWS_TOKEN
|
|
if [ -z "$BWS_TOKEN" ]; then
|
|
echo "ERROR: Access token cannot be empty."
|
|
exit 1
|
|
fi
|
|
echo "$BWS_TOKEN" > "$BWS_TOKEN_FILE"
|
|
chmod 600 "$BWS_TOKEN_FILE"
|
|
fi
|
|
export BWS_ACCESS_TOKEN
|
|
BWS_ACCESS_TOKEN=$(cat "$BWS_TOKEN_FILE")
|
|
|
|
# --- Fetch secrets ---
|
|
|
|
echo "==> Fetching secrets from Bitwarden Secrets Manager..."
|
|
REGISTRY_TOKEN=$(bws secret get "$SECRET_REGISTRY_TOKEN" | jq -r .value)
|
|
DEPLOY_PUBKEY=$(bws secret get "$SECRET_DEPLOY_PUBKEY" | jq -r .value)
|
|
|
|
# --- Install Docker ---
|
|
|
|
if ! command -v docker &>/dev/null; then
|
|
echo "==> Installing Docker..."
|
|
dnf install -y dnf-plugins-core
|
|
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
|
|
dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
fi
|
|
systemctl enable --now docker
|
|
|
|
echo "==> Logging into Gitea Docker registry..."
|
|
echo "$REGISTRY_TOKEN" | docker login git.timothykim.net -u timothykim --password-stdin
|
|
|
|
# --- Create deploy user ---
|
|
|
|
if ! id deploy &>/dev/null; then
|
|
echo "==> Creating deploy user..."
|
|
useradd -r -s /usr/sbin/nologin deploy
|
|
fi
|
|
usermod -aG docker deploy
|
|
|
|
echo "==> Setting up deploy SSH key..."
|
|
mkdir -p /home/deploy/.ssh
|
|
chmod 700 /home/deploy/.ssh
|
|
echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
|
|
chmod 600 /home/deploy/.ssh/authorized_keys
|
|
chown -R deploy:deploy /home/deploy/.ssh
|
|
|
|
echo "==> Configuring sudo for deploy user..."
|
|
cat > /etc/sudoers.d/deploy <<SUDOERS
|
|
deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy.sh
|
|
SUDOERS
|
|
chmod 440 /etc/sudoers.d/deploy
|
|
|
|
# --- Run configure ---
|
|
|
|
echo "==> Running configure.sh..."
|
|
bash "$REPO_DIR/scripts/configure.sh"
|