From 2e7a0e3645938adb6ffbbd840ff2aba3cb744ac5 Mon Sep 17 00:00:00 2001 From: cclohmar Date: Tue, 7 Jul 2026 14:30:48 +0100 Subject: [PATCH] refactor: /opt/backup/ vault for .env + certs, clean destroy flow --- deploy.sh | 299 ++++++++++--------------------------- install.sh | 8 +- tools/nextwks-tool/main.go | 6 +- 3 files changed, 88 insertions(+), 225 deletions(-) diff --git a/deploy.sh b/deploy.sh index 04acb03..425526f 100755 --- a/deploy.sh +++ b/deploy.sh @@ -3,22 +3,27 @@ set -euo pipefail REPO_DIR="/opt/NextWks" TARGET_DIR="/opt/nextworkspace" +BACKUP_DIR="/opt/backup" SERVICE_NAME="nextworkspace" BINARY_NAME="nextworkspace" HEALTH_CHECK_RETRIES=10 HEALTH_CHECK_INTERVAL=2 -# --- Load .env from runtime root --- -ENV_FILE="$TARGET_DIR/.env" -if [ -f "$ENV_FILE" ]; then +# --- Load .env from backup vault (written by install.sh) --- +if [ -f "$BACKUP_DIR/.env" ]; then set -a - source "$ENV_FILE" + source "$BACKUP_DIR/.env" set +a + DOMAIN="${DOMAIN:-nextwks.eu}" +elif [ -f "$TARGET_DIR/.env" ]; then + set -a + source "$TARGET_DIR/.env" + set +a + DOMAIN="${DOMAIN:-nextwks.eu}" +else + DOMAIN="${DOMAIN:-nextwks.eu}" fi -# Default domain if .env wasn't loaded -DOMAIN="${DOMAIN:-nextwks.eu}" - # --- Mode detection --- GREENFIELD=false if [ "${1:-}" = "--destroy" ]; then @@ -40,7 +45,6 @@ echo "[2/6] Building binary and helper tool..." export PATH=$PATH:/usr/local/go/bin go build -o "$BINARY_NAME" . -# Build helper tool for cert management TOOL_DIR="$REPO_DIR/tools/nextwks-tool" TOOL_BIN="/tmp/nextwks-tool" if [ -d "$TOOL_DIR" ]; then @@ -49,121 +53,81 @@ if [ -d "$TOOL_DIR" ]; then cd "$REPO_DIR" fi -# --- Certificate management via helper tool --- -if [ -f "$TOOL_BIN" ]; then - echo "[*] Managing LE certificates..." - mkdir -p /opt/backup/certs - - "$TOOL_BIN" cert \ - --domains "app.${DOMAIN},dns.${DOMAIN},www.${DOMAIN}" \ - --email "${TLS_EMAIL:-admin@${DOMAIN}}" \ - --backup-dir /opt/backup/certs 2>&1 || true -fi - # --- Greenfield path --- if [ "$GREENFIELD" = true ]; then - echo "[3/6] Removing old deployment..." - # Unlock immutable files (chattr +i from previous deploy) before removing + # Step 3: Stop service and wipe + echo "[3/6] Stopping service and cleaning production directory..." + systemctl stop $SERVICE_NAME 2>/dev/null || true if [ -d "$TARGET_DIR" ]; then chattr -R -i "$TARGET_DIR" 2>/dev/null || true + rm -rf "$TARGET_DIR" fi - # Preserve .env and Zoraxy certs across greenfield destroy - if [ -f "$TARGET_DIR/.env" ]; then - cp "$TARGET_DIR/.env" /tmp/nextworkspace.env.bak - echo "[INFO] Preserved .env" - fi - if [ -d "$TARGET_DIR/config/zoraxy/conf/certs" ]; then - cp -r "$TARGET_DIR/config/zoraxy" /tmp/nextworkspace.zoraxy.bak - echo "[INFO] Preserved Zoraxy config + certs" + # Step 4: Run helper tool — checks /opt/backup/certs/, issues LE if missing + echo "[4/6] Checking certificates..." + mkdir -p "$BACKUP_DIR/certs" + if [ -f "$TOOL_BIN" ]; then + "$TOOL_BIN" cert \ + --domains "app.${DOMAIN},dns.${DOMAIN},www.${DOMAIN}" \ + --email "${TLS_EMAIL:-admin@${DOMAIN}}" \ + --backup-dir "$BACKUP_DIR/certs" 2>&1 || true fi - rm -rf "$TARGET_DIR" - - echo "[4/6] Creating target directories..." + # Step 5: Build production directory structure + echo "[5/6] Building production directory structure..." mkdir -p "$TARGET_DIR/config/nextworkspace" mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy" + mkdir -p "$TARGET_DIR/config/zoraxy/conf/certs" mkdir -p "$TARGET_DIR/config/zoraxy/www/html" mkdir -p "$TARGET_DIR/data/zoraxy" mkdir -p "$TARGET_DIR/compose" mkdir -p "$TARGET_DIR/logs" - # Restore preserved .env and Zoraxy config+certs - if [ -f /tmp/nextworkspace.env.bak ]; then - mv /tmp/nextworkspace.env.bak "$TARGET_DIR/.env" + # Copy .env from backup vault + if [ -f "$BACKUP_DIR/.env" ]; then + cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env" chmod 600 "$TARGET_DIR/.env" - echo "[INFO] Restored .env" - fi - if [ -d /tmp/nextworkspace.zoraxy.bak ]; then - cp -r /tmp/nextworkspace.zoraxy.bak/* "$TARGET_DIR/config/zoraxy/" - rm -rf /tmp/nextworkspace.zoraxy.bak - echo "[INFO] Restored Zoraxy config + certs" + echo "[INFO] .env deployed from backup" fi - echo "[5/6] Copying binary..." + # Copy certificates from backup vault to Zoraxy cert dir + for DOMAIN_SUB in app dns www; do + CERT_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/fullchain.pem" + KEY_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/privkey.pem" + if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then + cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.crt" + cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.key" + echo "[INFO] Cert deployed: ${DOMAIN_SUB}.${DOMAIN}" + fi + done + + # Copy binary + echo "[6/6] Deploying..." cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME" - if [ -f "$REPO_DIR/VERSION" ]; then cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION" echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)" fi - echo "[6/6] Deploying Zoraxy..." + # Deploy Zoraxy cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml" - podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)" + podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues" - # Generate Zoraxy proxy configs with full schema (prevents Zoraxy from clearing OriginIpOrDomain on expand) + # Generate Zoraxy proxy configs echo "[*] Generating Zoraxy proxy configs..." cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" < "$TARGET_DIR/config/zoraxy/conf/proxy/www.$DOMAIN.config" < "$TARGET_DIR/config/zoraxy/conf/proxy/auth.$DOMAIN.config" </dev/null || true - # Copy launcher config files + # Copy landing page + cp -r config/www/* "$TARGET_DIR/config/zoraxy/www/html/" + + # Copy launcher config cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/" - # Generate launcher apps.yaml with path-based URLs + # Generate apps.yaml echo "[*] Generating apps.yaml..." cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" < /dev/null 2>&1; then break fi - echo " Waiting for Zoraxy... ($i/15)" sleep 2 done sleep 1 - # Zoraxy API helper — uses direct /login.html to avoid redirect CSRF issues COOKIE_JAR="/tmp/zoraxy_cookies.txt" rm -f "$COOKIE_JAR" - fetch_csrf() { - # Fetch /login.html directly (no redirect), save cookies, extract token - local page - page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1) - local token - token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' | head -1) - echo "$token" + curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' } - zoraxy_post() { - local path="$1" data="$2" - local csrf - csrf=$(fetch_csrf) - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000${path}" \ - -H "X-CSRF-Token: ${csrf}" -d "${data}" - } - - zoraxy_get() { - local path="$1" data="$2" - local csrf - csrf=$(fetch_csrf) - curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000${path}" \ - -H "X-CSRF-Token: ${csrf}" -G ${data:+-d "$data"} - } - - # Step 1: Create admin account - echo " Creating admin account..." CSRF=$(fetch_csrf) - ADMIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \ + curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \ -H "X-CSRF-Token: ${CSRF}" \ -d "username=${ADMIN_USERNAME:-master}" \ - -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) + -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null 2>&1 || true - if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then - echo " [OK] Admin account created: $ADMIN_USERNAME" - elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then - echo " [OK] Admin account already exists" - else - echo " [INFO] Admin registration: $ADMIN_RESULT" - fi - - # Step 2: Login (saves session cookie in $COOKIE_JAR) - echo " Logging in for LE configuration..." CSRF=$(fetch_csrf) LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \ -H "X-CSRF-Token: ${CSRF}" \ @@ -377,58 +261,38 @@ EOF if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then echo " [OK] Logged in as $ADMIN_USERNAME" - # Set LE email - echo " Setting Let's Encrypt email: ${TLS_EMAIL}" - zoraxy_post "/api/acme/autoRenew/email" "set=${TLS_EMAIL}" > /dev/null + CSRF=$(fetch_csrf) + curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \ + -H "X-CSRF-Token: ${CSRF}" -d "set=${TLS_EMAIL}" > /dev/null - # Obtain certificates for all subdomains - LE_CA="Let%27s%20Encrypt" - for SUB in app dns www; do - echo " Requesting LE certificate for ${SUB}.${DOMAIN}..." - CERT_RESULT=$(curl -s --max-time 60 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \ - -H "X-CSRF-Token: $(fetch_csrf)" \ - -G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \ - -d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1) - if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed\|true'; then - echo " [OK] Certificate obtained for ${SUB}.${DOMAIN}" - else - echo " [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)" - fi - done - - # Enable auto-renew - echo " Enabling auto-renew..." - zoraxy_post "/api/acme/autoRenew/enable" "enable=true" > /dev/null + CSRF=$(fetch_csrf) + curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \ + -H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null echo " [OK] LE auto-renew enabled" - # Configure Zoraxy Auth gateway in BoltDB - echo " Configuring Zoraxy Auth gateway..." + # BoltDB Zoraxy Auth gateway SYS_DB="$TARGET_DIR/data/zoraxy/sys.db" if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then "$TOOL_BIN" db \ --db "$SYS_DB" \ --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true - echo " [OK] Zoraxy Auth gateway configured" fi - else - echo " [WARN] Login failed: $LOGIN_RESULT" fi # Restart Zoraxy to pick up configs - echo "[*] Restarting Zoraxy to apply configs..." podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true sleep 2 - # Write systemd service with EnvironmentFile for .env vars + # Write systemd service echo "[*] Writing systemd service..." cat > /etc/systemd/system/$SERVICE_NAME.service </dev/null || true cp config/zoraxy/conf/proxy/* "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true - chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true fi echo "[6/6] Restarting Zoraxy and launcher..." diff --git a/install.sh b/install.sh index 38399c6..c2a5db5 100755 --- a/install.sh +++ b/install.sh @@ -5,9 +5,11 @@ set -euo pipefail # Idempotent: safe to run multiple times. TARGET_DIR="/opt/nextworkspace" +BACKUP_DIR="/opt/backup" -# --- Create runtime directory structure --- +# --- Create backup vault and runtime directories --- echo "=== NextWorkspace Setup ===" +mkdir -p "$BACKUP_DIR/certs" mkdir -p "$TARGET_DIR/config/nextworkspace" mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy" mkdir -p "$TARGET_DIR/config/zoraxy/www/html" @@ -38,8 +40,8 @@ echo " Save this password — it won't be shown again!" echo "========================================" echo "" -# Write .env file at runtime root -ENV_FILE="$TARGET_DIR/.env" +# Write .env file in backup vault (deploy.sh copies it to production) +ENV_FILE="$BACKUP_DIR/.env" cat > "$ENV_FILE" <