OpenCoperLock/scripts/setup-wizard.sh at vtest · softpython2884/OpenCoperLock · GitHub

History

executable file

493 lines (458 loc) · 25.1 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

#!/usr/bin/env bash

# ─────────────────────────────────────────────────────────────────────────────

# OpenCoperLock — interactive setup wizard for a dedicated Linux server.

# Walks you through a full bare-metal install:

# prerequisites (Node/pnpm/PM2) → PostgreSQL → .env (with generated secrets)

# → build/migrate/seed → PM2 → nginx reverse proxy → Let's Encrypt TLS (certbot).

# Designed for Debian/Ubuntu. Run from the repository root:

# bash scripts/setup-wizard.sh

# It asks before doing anything privileged and is safe to re-run.

set -euo pipefail

# ── pretty output ────────────────────────────────────────────────────────────

if [[ -t 1 ]]; then

BOLD=$'\e[1m'; DIM=$'\e[2m'; RED=$'\e[31m'; GRN=$'\e[32m'; YLW=$'\e[33m'; BLU=$'\e[34m'; RST=$'\e[0m'

else

BOLD=''; DIM=''; RED=''; GRN=''; YLW=''; BLU=''; RST=''

say() { printf '%s\n' "${*}"; }

info() { printf '%s==>%s %s\n' "$BLU$BOLD" "$RST" "$*"; }

ok() { printf '%s ✓ %s%s\n' "$GRN" "$*" "$RST"; }

warn() { printf '%s ! %s%s\n' "$YLW" "$*" "$RST"; }

die() { printf '%s ✗ %s%s\n' "$RED$BOLD" "$*" "$RST" >&2; exit 1; }

hr() { printf '%s────────────────────────────────────────────────────────%s\n' "$DIM" "$RST"; }

# ── prompt helpers ───────────────────────────────────────────────────────────

ask() { # ask "Question" "default" -> echoes answer

local q="$1" def="${2:-}" ans

if [[ -n "$def" ]]; then read -r -p "$(printf '%s%s%s [%s]: ' "$BOLD" "$q" "$RST" "$def")" ans || true

else read -r -p "$(printf '%s%s%s: ' "$BOLD" "$q" "$RST")" ans || true; fi

printf '%s' "${ans:-$def}"

}

ask_secret() { # ask_secret "Question" -> echoes typed value (hidden)

local q="$1" ans

read -r -s -p "$(printf '%s%s%s: ' "$BOLD" "$q" "$RST")" ans || true; printf '\n' >&2

printf '%s' "$ans"

}

ask_yn() { # ask_yn "Question" "Y|N" -> returns 0 for yes

local q="$1" def="${2:-Y}" ans

local hint='[Y/n]'; [[ "$def" =~ ^[Nn]$ ]] && hint='[y/N]'

read -r -p "$(printf '%s%s%s %s ' "$BOLD" "$q" "$RST" "$hint")" ans || true

ans="${ans:-$def}"; [[ "$ans" =~ ^[Yy]$ ]]

}

# ── sudo wrapper ─────────────────────────────────────────────────────────────

SUDO=''

need_sudo() {

if [[ $EUID -ne 0 ]]; then

command -v sudo >/dev/null 2>&1 || die "This step needs root and 'sudo' is not installed. Re-run as root."

SUDO='sudo'

}

ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"

cd "$ROOT_DIR"

[[ -f package.json && -d apps/api ]] || die "Run this from the OpenCoperLock repository root."

# ── 0. distro detection ──────────────────────────────────────────────────────

PKG=''

if command -v apt-get >/dev/null 2>&1; then PKG='apt'; fi

ID_LIKE=''; [[ -f /etc/os-release ]] && ID_LIKE="$(. /etc/os-release; echo "${ID:-} ${ID_LIKE:-}")"

clear || true

say "${BOLD}${BLU}"

say " ____ ____ __ __ "

say " / __ \\\\ ___ ___ ___ / ___\\\\___ ___ ___ ____ / / ___ ____ ___ / /__"

say " / /_/ // _ \\\\/ -_)/ _ \\\\ / /__ / _ \\\\/ _ \\\\/ -_) __/ / /__/ _ \\\\/ __// _ // / -_)"

say " \\\\____// .__/\\\\__//_//_/ \\\\___/ \\\\___/ .__/\\\\__/_/ /____/\\\\___/\\\\__/ \\\\_,_//_/\\\\__/ "

say " /_/ /_/ "

say "${RST}"

say "${BOLD}OpenCoperLock setup wizard${RST} — dedicated-server install (PM2 + nginx + TLS)"

[[ "$PKG" == apt ]] || warn "Non-Debian system detected ($ID_LIKE). Package installs are skipped; install prerequisites yourself."

# 1. COLLECT ANSWERS (everything up front; the API URL must be known before build)

info "Step 1 / 8 — Configuration questions"

say "${DIM}Press Enter to accept the [default].${RST}"

say ""

# Topology

say "How should this be exposed?"

say " 1) Two subdomains — e.g. copper.forgenet.fr (app) + api.copper.forgenet.fr"

say " 2) Single domain + path — e.g. copper.forgenet.fr (app at /, API at /api)"

say " 3) Local only — no nginx/TLS, bind to localhost ports (dev / behind own proxy)"

TOPO="$(ask 'Choose 1, 2 or 3' '1')"

WEB_DOMAIN=''; API_DOMAIN=''; APP_URL=''; NEXT_PUBLIC_API_URL=''

SETUP_NGINX=false; SETUP_TLS=false

case "$TOPO" in

WEB_DOMAIN="$(ask 'App domain' 'copper.forgenet.fr')"

API_DOMAIN="$(ask 'API domain' "api.${WEB_DOMAIN}")"

APP_URL="https://${WEB_DOMAIN}"

NEXT_PUBLIC_API_URL="https://${API_DOMAIN}"

SETUP_NGINX=true; SETUP_TLS=true ;;

WEB_DOMAIN="$(ask 'Domain' 'copper.forgenet.fr')"

APP_URL="https://${WEB_DOMAIN}"

NEXT_PUBLIC_API_URL="https://${WEB_DOMAIN}/api"

SETUP_NGINX=true; SETUP_TLS=true ;;

APP_URL="http://localhost:3000"

NEXT_PUBLIC_API_URL="http://localhost:4000" ;;

*) die "Invalid choice: $TOPO" ;;

esac

# Ports

WEB_PORT="$(ask 'Web port (internal)' '3000')"

API_PORT="$(ask 'API port (internal)' '4000')"

# Admin

say ""; info "First administrator account"

ADMIN_EMAIL="$(ask 'Admin email' "${USER:-admin}@${WEB_DOMAIN:-example.com}")"

ADMIN_PASSWORD=''

while [[ -z "$ADMIN_PASSWORD" ]]; do

ADMIN_PASSWORD="$(ask_secret 'Admin password (min 12 chars)')"

if [[ ${#ADMIN_PASSWORD} -lt 12 ]]; then warn 'Too short.'; ADMIN_PASSWORD='';

elif [[ "$ADMIN_PASSWORD" == *'"'* ]]; then warn 'Please avoid the double-quote (") character.'; ADMIN_PASSWORD=''; fi

done

# Database

say ""; info "PostgreSQL"

say " 1) Project-local DB — runs inside the project on a random free port, supervised"

say " by PM2. Best when the usual ports are already taken."

say " 2) System PostgreSQL — create a database/user on the host's PostgreSQL service."

say " 3) Existing DATABASE_URL — point at a database you already have."

DB_CHOICE="$(ask 'Choose 1, 2 or 3' '1')"

DATABASE_URL=''; DB_PROVISION='local'

DB_NAME='opencoperlock'; DB_USER='opencoperlock'; DB_PASS=''

case "$DB_CHOICE" in

DB_PROVISION='local'

DB_NAME="$(ask 'Database name' 'opencoperlock')"

DB_USER="$(ask 'Database user' 'opencoperlock')"

[[ "$DB_NAME" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || die "Invalid database name (letters, digits, underscore)."

[[ "$DB_USER" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || die "Invalid database user (letters, digits, underscore)."

DB_PASS="$(openssl rand -hex 16)"

# The project-local cluster must be OWNED and RUN by a non-root account (PostgreSQL — and

# so PM2/deploy.sh while they supervise it — refuse to run as root). When the wizard runs

# as root we need a separate account; otherwise the cluster belongs to the current user.

if [[ $EUID -eq 0 ]]; then

APP_USER="$(ask 'Unprivileged system user to own & run the database' "${SUDO_USER:-opencoperlock}")"

[[ "$APP_USER" != root ]] || die 'The project-local database cannot be owned by root — pick another user.'

else

APP_USER="$(id -un)"

# The port (and thus DATABASE_URL) is chosen at provisioning time (Step 3).

;;

DB_PROVISION='system'

DB_NAME="$(ask 'Database name' 'opencoperlock')"

DB_USER="$(ask 'Database user' 'opencoperlock')"

[[ "$DB_NAME" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || die "Invalid database name (letters, digits, underscore)."

[[ "$DB_USER" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || die "Invalid database user (letters, digits, underscore)."

DB_PASS="$(openssl rand -hex 16)"

DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@localhost:5432/${DB_NAME}"

;;

DB_PROVISION='existing'

while [[ -z "$DATABASE_URL" ]]; do DATABASE_URL="$(ask 'Existing DATABASE_URL')"; done

;;

*) die "Invalid choice: $DB_CHOICE" ;;

esac

# Storage

say ""; info "Storage & limits"

DEFAULT_STORAGE="/var/lib/opencoperlock"

STORAGE_BASE="$(ask 'Base directory for encrypted file storage' "$DEFAULT_STORAGE")"

STORAGE_PATH="${STORAGE_BASE%/}/storage"

QUARANTINE_PATH="${STORAGE_BASE%/}/quarantine"

QUOTA_GB="$(ask 'Default per-user quota in GiB (0 = unlimited)' '10')"

CAP_GB="$(ask 'Global storage cap in GiB (0 = unlimited)' '0')"

DEFAULT_USER_QUOTA_BYTES=$(( QUOTA_GB * 1024 * 1024 * 1024 ))

GLOBAL_STORAGE_CAP_BYTES=$(( CAP_GB * 1024 * 1024 * 1024 ))

# Antivirus

say ""; info "Security extras"

CLAMAV_ENABLED=false

if ask_yn 'Enable ClamAV antivirus scanning on upload?' 'N'; then CLAMAV_ENABLED=true; fi

VIRUSTOTAL_API_KEY="$(ask 'VirusTotal API key (optional, blank to skip)' '')"

# TLS email

CERTBOT_EMAIL=''

if $SETUP_TLS; then

if ask_yn 'Obtain a free Let'\''s Encrypt certificate with certbot?' 'Y'; then

CERTBOT_EMAIL="$(ask 'Email for Let'\''s Encrypt notices' "$ADMIN_EMAIL")"

else SETUP_TLS=false; fi

# Secrets

MASTER_KEY="$(openssl rand -base64 32)"

SESSION_SECRET="$(openssl rand -base64 32)"

# ── Summary & confirm ────────────────────────────────────────────────────────

say ""; hr; info "Review"

say " Topology : $([[ $TOPO == 1 ]] && echo 'two subdomains' || { [[ $TOPO == 2 ]] && echo 'single domain + /api' || echo 'local only'; })"

[[ -n "$WEB_DOMAIN" ]] && say " App URL : ${APP_URL}"

say " API URL (browser) : ${NEXT_PUBLIC_API_URL}"

say " Web / API ports : ${WEB_PORT} / ${API_PORT}"

say " Admin email : ${ADMIN_EMAIL}"

say " Database : $(case $DB_PROVISION in local) echo "project-local '${DB_NAME}' (random port, PM2)";; system) echo "system PostgreSQL '${DB_NAME}'";; *) echo 'existing (provided URL)';; esac)"

say " Storage path : ${STORAGE_PATH}"

say " Per-user quota : ${QUOTA_GB} GiB Global cap: ${CAP_GB} GiB"

say " ClamAV / VirusTotal : $([[ $CLAMAV_ENABLED == true ]] && echo on || echo off) / $([[ -n $VIRUSTOTAL_API_KEY ]] && echo set || echo off)"

say " nginx / TLS : $([[ $SETUP_NGINX == true ]] && echo yes || echo no) / $([[ $SETUP_TLS == true ]] && echo yes || echo no)"

ask_yn 'Proceed with these settings?' 'Y' || die 'Aborted by user.'

# 2. PREREQUISITES

say ""; info "Step 2 / 8 — Prerequisites"

apt_install() { need_sudo; $SUDO apt-get update -qq; $SUDO apt-get install -y -qq "$@"; }

# Node.js (>=20)

if ! command -v node >/dev/null 2>&1 || [[ "$(node -p 'process.versions.node.split(".")[0]')" -lt 20 ]]; then

if [[ "$PKG" == apt ]] && ask_yn 'Node.js 20+ not found. Install it via NodeSource?' 'Y'; then

need_sudo

curl -fsSL https://deb.nodesource.com/setup_22.x | $SUDO -E bash -

apt_install nodejs

else warn 'Install Node.js 20+ manually, then re-run.'; fi

command -v node >/dev/null 2>&1 && ok "node $(node -v)"

# pnpm via corepack

if ! command -v pnpm >/dev/null 2>&1; then

corepack enable >/dev/null 2>&1 || true

corepack prepare pnpm@latest --activate >/dev/null 2>&1 || $SUDO npm i -g pnpm

command -v pnpm >/dev/null 2>&1 && ok "pnpm $(pnpm -v)"

# PM2

if ! command -v pm2 >/dev/null 2>&1; then

if ask_yn 'PM2 not found. Install globally with npm?' 'Y'; then need_sudo; $SUDO npm i -g pm2; fi

command -v pm2 >/dev/null 2>&1 && ok "pm2 $(pm2 -v 2>/dev/null | head -1)"

# OpenSSL

command -v openssl >/dev/null 2>&1 || { [[ "$PKG" == apt ]] && apt_install openssl; }

# ClamAV

if $CLAMAV_ENABLED && ! command -v clamdscan >/dev/null 2>&1; then

if [[ "$PKG" == apt ]] && ask_yn 'Install clamav-daemon?' 'Y'; then

apt_install clamav clamav-daemon

$SUDO systemctl enable --now clamav-freshclam 2>/dev/null || true

$SUDO systemctl enable --now clamav-daemon 2>/dev/null || true

warn 'ClamAV is downloading signatures; first scans may report "unscanned" until ready.'

# PostgreSQL binaries (needed for system provisioning and for a project-local cluster).

if [[ "$DB_PROVISION" != existing ]] && ! command -v initdb >/dev/null 2>&1 \

&& ! ls /usr/lib/postgresql/*/bin/initdb >/dev/null 2>&1; then

if [[ "$PKG" == apt ]] && ask_yn 'PostgreSQL is not installed. Install it?' 'Y'; then

apt_install postgresql postgresql-contrib

# The project-local cluster does not use the system service; stop it to free port 5432

# if the operator wants, but leave it as-is by default.

[[ "$DB_PROVISION" == system ]] && $SUDO systemctl enable --now postgresql || true

# A project-local cluster needs an unprivileged owner. When running as root, create the

# account if it is missing so Step 3 (and later PM2) can drop privileges to it.

if [[ "$DB_PROVISION" == local && $EUID -eq 0 ]] && ! id -u "$APP_USER" >/dev/null 2>&1; then

if ask_yn "System user '$APP_USER' does not exist. Create it?" 'Y'; then

useradd --system --create-home --shell /usr/sbin/nologin "$APP_USER" \

|| die "Could not create system user '$APP_USER'."

ok "Created system user '$APP_USER'"

else

die "Choose an existing unprivileged user for the project-local database, then re-run."

# nginx + certbot

if $SETUP_NGINX && ! command -v nginx >/dev/null 2>&1 && [[ "$PKG" == apt ]]; then apt_install nginx; fi

if $SETUP_TLS && ! command -v certbot >/dev/null 2>&1 && [[ "$PKG" == apt ]]; then apt_install certbot python3-certbot-nginx; fi

# 3. DATABASE PROVISIONING

case "$DB_PROVISION" in

local)

say ""; info "Step 3 / 8 — Creating a project-local PostgreSQL (random port)"

# postgres-local.sh must run as the unprivileged app user; it prints the DATABASE_URL.

# Pre-create .postgres/ owned by that account so a root wizard can hand the cluster off

# (the script re-execs itself as PG_RUN_USER when invoked as root).

mkdir -p "$ROOT_DIR/.postgres"

[[ $EUID -eq 0 ]] && chown "$APP_USER:$(id -gn "$APP_USER")" "$ROOT_DIR/.postgres"

DATABASE_URL="$(PG_RUN_USER="$APP_USER" DB_NAME="$DB_NAME" DB_USER="$DB_USER" DB_PASS="$DB_PASS" ./scripts/postgres-local.sh init)"

[[ -n "$DATABASE_URL" ]] || die 'Project-local database provisioning failed.'

ok "Project-local PostgreSQL ready (${DATABASE_URL##*@})"

;;

system)

say ""; info "Step 3 / 8 — Creating PostgreSQL database & user on the system service"

need_sudo

$SUDO -u postgres psql -v ON_ERROR_STOP=1 <<SQL || die 'Database provisioning failed.'

DO \$\$ BEGIN

IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${DB_USER}') THEN

CREATE ROLE "${DB_USER}" LOGIN PASSWORD '${DB_PASS}';

ELSE

ALTER ROLE "${DB_USER}" WITH PASSWORD '${DB_PASS}';

END IF;

END \$\$;

SELECT 'CREATE DATABASE "${DB_NAME}" OWNER "${DB_USER}"'

WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_NAME}')\gexec

SQL

ok "Database '${DB_NAME}' ready"

;;

say ""; info "Step 3 / 8 — Using existing database (skipped provisioning)"

;;

esac

# 4. STORAGE DIRECTORIES

say ""; info "Step 4 / 8 — Storage directories"

if mkdir -p "$STORAGE_PATH" "$QUARANTINE_PATH" 2>/dev/null; then

ok "Created $STORAGE_PATH"

else

need_sudo

$SUDO mkdir -p "$STORAGE_PATH" "$QUARANTINE_PATH"

$SUDO chown -R "$(id -u):$(id -g)" "$STORAGE_BASE"

ok "Created $STORAGE_PATH (chown to $(id -un))"

# 5. WRITE .env

say ""; info "Step 5 / 8 — Writing .env"

if [[ -f .env ]]; then

cp .env ".env.backup.$(date +%s)"; warn 'Existing .env backed up.'

# Write each line with printf %s so values are stored LITERALLY — no shell expansion

# or command substitution. Free-text secrets are double-quoted and escaped so that

# dotenv (Node) preserves them exactly (e.g. a '#' won't be read as an inline comment).

WEB_HOST_VAL=$([[ $SETUP_NGINX == true ]] && echo 127.0.0.1 || echo 0.0.0.0)

emit_secret() { # key value -> KEY="value"

# dotenv keeps a double-quoted value verbatim (only \n/\r are special) and does NOT

# decode \" — so we quote without escaping. Values must not contain a literal " (the

# admin password is validated above; generated keys and the VT key never contain one).

printf '%s="%s"\n' "$1" "$2"

}

umask 077

{

printf '# Generated by scripts/setup-wizard.sh on %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"

printf 'NODE_ENV=production\n'

printf 'APP_URL=%s\n' "$APP_URL"

printf 'WEB_PORT=%s\n' "$WEB_PORT"

printf 'API_PORT=%s\n' "$API_PORT"

printf 'NEXT_PUBLIC_API_URL=%s\n' "$NEXT_PUBLIC_API_URL"

printf 'WEB_HOST=%s\n' "$WEB_HOST_VAL"

# Behind nginx: bind the API to localhost and trust one proxy hop so req.ip is the real

# client (used by rate limiting, session IP tracking and audit logs). Otherwise no trust.

if [[ $SETUP_NGINX == true ]]; then

printf 'API_HOST=127.0.0.1\n'

printf 'TRUST_PROXY=1\n\n'

else

printf 'API_HOST=0.0.0.0\n'

printf 'TRUST_PROXY=false\n\n'

printf 'DATABASE_URL=%s\n\n' "$DATABASE_URL"

emit_secret MASTER_KEY "$MASTER_KEY"

emit_secret SESSION_SECRET "$SESSION_SECRET"

printf '\n'

printf 'ADMIN_EMAIL=%s\n' "$ADMIN_EMAIL"

emit_secret ADMIN_PASSWORD "$ADMIN_PASSWORD"

printf '\n'

printf 'STORAGE_DRIVER=local\n'

printf 'STORAGE_PATH=%s\n' "$STORAGE_PATH"

printf 'QUARANTINE_PATH=%s\n' "$QUARANTINE_PATH"

printf 'DEFAULT_USER_QUOTA_BYTES=%s\n' "$DEFAULT_USER_QUOTA_BYTES"

printf 'GLOBAL_STORAGE_CAP_BYTES=%s\n' "$GLOBAL_STORAGE_CAP_BYTES"

printf 'REMOTE_UPLOAD_MAX_BYTES=2147483648\n\n'

printf 'CLAMAV_ENABLED=%s\n' "$CLAMAV_ENABLED"

printf 'CLAMAV_HOST=127.0.0.1\n'

printf 'CLAMAV_PORT=3310\n\n'

emit_secret VIRUSTOTAL_API_KEY "$VIRUSTOTAL_API_KEY"

} > .env

umask 022

ok ".env written (mode 600). Keep MASTER_KEY safe — losing it loses all server-side files."

# 6. BUILD / MIGRATE / SEED

say ""; info "Step 6 / 8 — Install, build, migrate, seed (this can take a few minutes)"

bash scripts/deploy.sh

# 7. nginx

if $SETUP_NGINX; then

say ""; info "Step 7 / 8 — Configuring nginx"

need_sudo

NGINX_CONF="/etc/nginx/sites-available/opencoperlock.conf"

# Larger client_max_body_size so big uploads aren't rejected by the proxy.

if [[ "$TOPO" == 1 ]]; then

$SUDO tee "$NGINX_CONF" >/dev/null <<NGINX

server {

listen 80;

server_name ${WEB_DOMAIN};

client_max_body_size 0;

location / {

proxy_pass http://127.0.0.1:${WEB_PORT};

proxy_set_header Host \$host;

proxy_set_header X-Real-IP \$remote_addr;

proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto \$scheme;

}

server {

listen 80;

server_name ${API_DOMAIN};

client_max_body_size 0;

proxy_request_buffering off;

location / {

proxy_pass http://127.0.0.1:${API_PORT};

proxy_set_header Host \$host;

proxy_set_header X-Real-IP \$remote_addr;

proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto \$scheme;

}

NGINX

else

$SUDO tee "$NGINX_CONF" >/dev/null <<NGINX

server {

listen 80;

server_name ${WEB_DOMAIN};

client_max_body_size 0;

location /api/ {

proxy_pass http://127.0.0.1:${API_PORT}/;

proxy_request_buffering off;

proxy_set_header Host \$host;

proxy_set_header X-Real-IP \$remote_addr;

proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto \$scheme;

}

location / {

proxy_pass http://127.0.0.1:${WEB_PORT};

proxy_set_header Host \$host;

proxy_set_header X-Real-IP \$remote_addr;

proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto \$scheme;

}

NGINX

$SUDO ln -sf "$NGINX_CONF" /etc/nginx/sites-enabled/opencoperlock.conf

$SUDO nginx -t && $SUDO systemctl reload nginx

ok "nginx configured and reloaded"

# 8. TLS (certbot) + PM2

if $SETUP_TLS; then

say ""; info "Step 8 / 8 — TLS certificate (certbot)"

need_sudo

DOMS=(-d "$WEB_DOMAIN"); [[ "$TOPO" == 1 ]] && DOMS+=(-d "$API_DOMAIN")

if $SUDO certbot --nginx --non-interactive --agree-tos -m "$CERTBOT_EMAIL" "${DOMS[@]}" --redirect; then

ok "HTTPS enabled and auto-renewal scheduled by certbot"

else

warn "certbot failed (DNS not pointed yet?). Re-run later: sudo certbot --nginx ${DOMS[*]}"

else

say ""; info "Step 8 / 8 — Starting services"

info "Starting PM2 processes"

pm2 start ecosystem.config.cjs

pm2 save

warn "To restart OpenCoperLock automatically on reboot, run the command pm2 printed above (pm2 startup)."

# ── Done ─────────────────────────────────────────────────────────────────────

say ""; hr

ok "OpenCoperLock is installed and running."

say ""

say " ${BOLD}URL${RST} : ${APP_URL}"

say " ${BOLD}Admin${RST} : ${ADMIN_EMAIL}"

say " ${BOLD}Logs${RST} : pm2 logs"

say " ${BOLD}Status${RST} : pm2 status"

say " ${BOLD}Redeploy${RST} : git pull && ./scripts/deploy.sh && pm2 reload ecosystem.config.cjs"

say ""

[[ "$TOPO" == 3 ]] && say " ${DIM}Local mode: open http://localhost:${WEB_PORT} (set up your own proxy/TLS for production).${RST}"

$SETUP_TLS || { [[ "$TOPO" != 3 ]] && say " ${YLW}Point your DNS at this server, then run certbot to enable HTTPS.${RST}"; }

OpenCoperLock/scripts/setup-wizard.sh at vtest · softpython2884/OpenCoperLock · GitHub

Expand file tree

Breadcrumbs

setup-wizard.sh

Latest commit

History

Breadcrumbs

setup-wizard.sh

File metadata and controls