65 lines
2.2 KiB
Bash
65 lines
2.2 KiB
Bash
 
|
#!/bin/bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
|
|
site=meweb.arasaka.software
|
||
|
|
names=(meweb.arasaka.software v4.meweb.arasaka.software v6.meweb.arasaka.software)
|
||
|
|
app=/var/www/$site
|
||
|
|
backups=/var/backups/$site
|
||
|
|
etc=/etc/meweb
|
||
|
|
env=$etc/meweb.env
|
||
|
|
unit=/etc/systemd/system/meweb.service
|
||
|
|
sudoers=/etc/sudoers.d/gitea-runner
|
||
|
|
acme=/root/.acme.sh/acme.sh
|
||
|
|
cert=/root/.acme.sh/${site}_ecc/fullchain.cer
|
||
|
|
|
||
|
|
[ "$(id -u)" = 0 ] || { echo "run as root"; exit 1; }
|
||
|
|
|
||
|
|
id meweb >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin meweb
|
||
|
|
install -d -o gitea-runner -g gitea-runner -m 755 "$app" "$backups"
|
||
|
|
install -d -o root -g meweb -m 750 "$etc"
|
||
|
|
if [ ! -f "$env" ]; then
|
||
|
|
printf '%s\n' \
|
||
|
|
'ASPNETCORE_ENVIRONMENT=Production' \
|
||
|
|
'ASPNETCORE_URLS=http://127.0.0.1:5480' \
|
||
|
|
'DOTNET_PRINT_TELEMETRY_MESSAGE=false' \
|
||
|
|
'DOTNET_CLI_TELEMETRY_OPTOUT=1' > "$env"
|
||
|
|
chown root:meweb "$env"
|
||
|
|
chmod 640 "$env"
|
||
|
|
echo "wrote $env"
|
||
|
|
fi
|
||
|
|
|
||
|
|
install -m 644 "$here/meweb.service" "$unit"
|
||
|
|
systemctl daemon-reload
|
||
|
|
systemctl enable meweb.service >/dev/null 2>&1
|
||
|
|
|
||
|
|
line="gitea-runner ALL=(root) NOPASSWD: /usr/bin/systemctl start meweb, /usr/bin/systemctl stop meweb, /usr/bin/systemctl restart meweb, /usr/bin/systemctl is-active meweb, /usr/bin/systemctl show meweb*, /usr/bin/systemctl status meweb*"
|
||
|
|
if ! grep -qF "$line" "$sudoers"; then
|
||
|
|
cp "$sudoers" "$sudoers.new"
|
||
|
|
echo "$line" >> "$sudoers.new"
|
||
|
|
visudo -cf "$sudoers.new" >/dev/null
|
||
|
|
install -m 440 "$sudoers.new" "$sudoers"
|
||
|
|
rm -f "$sudoers.new"
|
||
|
|
echo "sudoers: meweb added for gitea-runner"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ ! -f "$cert" ]; then
|
||
|
|
install -m 644 "$here/nginx/$site.http.conf" "/etc/nginx/sites-enabled/$site.conf"
|
||
|
|
nginx -t
|
||
|
|
systemctl reload nginx
|
||
|
|
args=()
|
||
|
|
for name in "${names[@]}"; do args+=(-d "$name"); done
|
||
|
|
"$acme" --issue --webroot /var/www/acme "${args[@]}" --keylength ec-256 --reloadcmd "systemctl reload nginx"
|
||
|
|
fi
|
||
|
|
|
||
|
|
install -m 644 "$here/nginx/$site.conf" "/etc/nginx/sites-enabled/$site.conf"
|
||
|
|
nginx -t
|
||
|
|
systemctl reload nginx
|
||
|
|
|
||
|
|
if [ -x "$app/MeWeb.Server" ]; then
|
||
|
|
systemctl restart meweb
|
||
|
|
systemctl is-active meweb
|
||
|
|
else
|
||
|
|
echo "no build in $app yet: the release workflow deploys it"
|
||
|
|
fi
|
||
|
|
echo "setup done"
|