refactor: /opt/backup/ vault for .env + certs, clean destroy flow

deploy.sh

@@ -3,22 +3,27 @@ set -euo pipefail
 
 REPO_DIR="/opt/NextWks"
 TARGET_DIR="/opt/nextworkspace"
+BACKUP_DIR="/opt/backup"
 SERVICE_NAME="nextworkspace"
 BINARY_NAME="nextworkspace"
 HEALTH_CHECK_RETRIES=10
 HEALTH_CHECK_INTERVAL=2
 
-# --- Load .env from runtime root ---
+# --- Load .env from backup vault (written by install.sh) ---
-ENV_FILE="$TARGET_DIR/.env"
+if [ -f "$BACKUP_DIR/.env" ]; then
-if [ -f "$ENV_FILE" ]; then
     set -a
-    source "$ENV_FILE"
+    source "$BACKUP_DIR/.env"
     set +a
+    DOMAIN="${DOMAIN:-nextwks.eu}"
+elif [ -f "$TARGET_DIR/.env" ]; then
+    set -a
+    source "$TARGET_DIR/.env"
+    set +a
+    DOMAIN="${DOMAIN:-nextwks.eu}"
+else
+    DOMAIN="${DOMAIN:-nextwks.eu}"
 fi
 
-# Default domain if .env wasn't loaded
-DOMAIN="${DOMAIN:-nextwks.eu}"
-
 # --- Mode detection ---
 GREENFIELD=false
 if [ "${1:-}" = "--destroy" ]; then
@@ -40,7 +45,6 @@ echo "[2/6] Building binary and helper tool..."
 export PATH=$PATH:/usr/local/go/bin
 go build -o "$BINARY_NAME" .
 
-# Build helper tool for cert management
 TOOL_DIR="$REPO_DIR/tools/nextwks-tool"
 TOOL_BIN="/tmp/nextwks-tool"
 if [ -d "$TOOL_DIR" ]; then
@@ -49,121 +53,81 @@ if [ -d "$TOOL_DIR" ]; then
     cd "$REPO_DIR"
 fi
 
-# --- Certificate management via helper tool ---
-if [ -f "$TOOL_BIN" ]; then
-    echo "[*] Managing LE certificates..."
-    mkdir -p /opt/backup/certs
-
-    "$TOOL_BIN" cert \
-        --domains "app.${DOMAIN},dns.${DOMAIN},www.${DOMAIN}" \
-        --email "${TLS_EMAIL:-admin@${DOMAIN}}" \
-        --backup-dir /opt/backup/certs 2>&1 || true
-fi
-
 # --- Greenfield path ---
 if [ "$GREENFIELD" = true ]; then
-    echo "[3/6] Removing old deployment..."
 
-    # Unlock immutable files (chattr +i from previous deploy) before removing
+    # Step 3: Stop service and wipe
+    echo "[3/6] Stopping service and cleaning production directory..."
+    systemctl stop $SERVICE_NAME 2>/dev/null || true
     if [ -d "$TARGET_DIR" ]; then
         chattr -R -i "$TARGET_DIR" 2>/dev/null || true
+        rm -rf "$TARGET_DIR"
     fi
 
-    # Preserve .env and Zoraxy certs across greenfield destroy
+    # Step 4: Run helper tool — checks /opt/backup/certs/, issues LE if missing
-    if [ -f "$TARGET_DIR/.env" ]; then
+    echo "[4/6] Checking certificates..."
-        cp "$TARGET_DIR/.env" /tmp/nextworkspace.env.bak
+    mkdir -p "$BACKUP_DIR/certs"
-        echo "[INFO] Preserved .env"
+    if [ -f "$TOOL_BIN" ]; then
-    fi
+        "$TOOL_BIN" cert \
-    if [ -d "$TARGET_DIR/config/zoraxy/conf/certs" ]; then
+            --domains "app.${DOMAIN},dns.${DOMAIN},www.${DOMAIN}" \
-        cp -r "$TARGET_DIR/config/zoraxy" /tmp/nextworkspace.zoraxy.bak
+            --email "${TLS_EMAIL:-admin@${DOMAIN}}" \
-        echo "[INFO] Preserved Zoraxy config + certs"
+            --backup-dir "$BACKUP_DIR/certs" 2>&1 || true
     fi
 
-    rm -rf "$TARGET_DIR"
+    # Step 5: Build production directory structure
-
+    echo "[5/6] Building production directory structure..."
-    echo "[4/6] Creating target directories..."
     mkdir -p "$TARGET_DIR/config/nextworkspace"
     mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
+    mkdir -p "$TARGET_DIR/config/zoraxy/conf/certs"
     mkdir -p "$TARGET_DIR/config/zoraxy/www/html"
     mkdir -p "$TARGET_DIR/data/zoraxy"
     mkdir -p "$TARGET_DIR/compose"
     mkdir -p "$TARGET_DIR/logs"
 
-    # Restore preserved .env and Zoraxy config+certs
+    # Copy .env from backup vault
-    if [ -f /tmp/nextworkspace.env.bak ]; then
+    if [ -f "$BACKUP_DIR/.env" ]; then
-        mv /tmp/nextworkspace.env.bak "$TARGET_DIR/.env"
+        cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
         chmod 600 "$TARGET_DIR/.env"
-        echo "[INFO] Restored .env"
+        echo "[INFO] .env deployed from backup"
-    fi
-    if [ -d /tmp/nextworkspace.zoraxy.bak ]; then
-        cp -r /tmp/nextworkspace.zoraxy.bak/* "$TARGET_DIR/config/zoraxy/"
-        rm -rf /tmp/nextworkspace.zoraxy.bak
-        echo "[INFO] Restored Zoraxy config + certs"
     fi
 
-    echo "[5/6] Copying binary..."
+    # Copy certificates from backup vault to Zoraxy cert dir
+    for DOMAIN_SUB in app dns www; do
+        CERT_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/fullchain.pem"
+        KEY_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/privkey.pem"
+        if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
+            cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.crt"
+            cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.key"
+            echo "[INFO] Cert deployed: ${DOMAIN_SUB}.${DOMAIN}"
+        fi
+    done
+
+    # Copy binary
+    echo "[6/6] Deploying..."
     cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
-
     if [ -f "$REPO_DIR/VERSION" ]; then
         cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
         echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)"
     fi
 
-    echo "[6/6] Deploying Zoraxy..."
+    # Deploy Zoraxy
     cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
-    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)"
+    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues"
 
-    # Generate Zoraxy proxy configs with full schema (prevents Zoraxy from clearing OriginIpOrDomain on expand)
+    # Generate Zoraxy proxy configs
     echo "[*] Generating Zoraxy proxy configs..."
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
 {
     "ProxyType": 1,
     "RootOrMatchingDomain": "app.$DOMAIN",
-    "MatchingDomainAlias": [],
+    "ActiveOrigins": [{
-    "ActiveOrigins": [
+        "OriginIpOrDomain": "127.0.0.1:9000",
-        {
+        "RequireTLS": false,
-            "OriginIpOrDomain": "127.0.0.1:9000",
+        "Weight": 1,
-            "RequireTLS": false,
+        "MaxConn": 0
-            "SkipCertValidations": false,
+    }],
-            "SkipWebSocketOriginCheck": false,
-            "Weight": 1,
-            "MaxConn": 0,
-            "RespTimeout": 0
-        }
-    ],
-    "InactiveOrigins": [],
-    "UseStickySession": false,
-    "UseActiveLoadBalance": false,
     "Disabled": false,
-    "BypassGlobalTLS": false,
+    "AuthenticationProvider": {"AuthMethod": 0}
-    "VirtualDirectories": [],
-    "HeaderRewriteRules": {
-        "UserDefinedHeaders": null,
-        "RequestHostOverwrite": "",
-        "HSTSMaxAge": 0,
-        "EnablePermissionPolicyHeader": false,
-        "PermissionPolicy": null,
-        "DisableHopByHopHeaderRemoval": false
-    },
-    "EnableWebsocketCustomHeaders": false,
-    "AuthenticationProvider": {
-        "AuthMethod": 0,
-        "BasicAuthCredentials": null,
-        "BasicAuthExceptionRules": null,
-        "BasicAuthGroupIDs": [],
-        "ForwardAuthURL": "",
-        "ForwardAuthResponseHeaders": [],
-        "ForwardAuthResponseClientHeaders": [],
-        "ForwardAuthRequestHeaders": [],
-        "ForwardAuthRequestExcludedCookies": []
-    },
-    "RequireRateLimit": false,
-    "RateLimit": 0,
-    "DisableUptimeMonitor": false,
-    "AccessFilterUUID": "",
-    "DefaultSiteOption": 0,
-    "DefaultSiteValue": "",
-    "Tags": []
 }
 ZORAXY_APP
 
@@ -171,55 +135,17 @@ ZORAXY_APP
 {
     "ProxyType": 1,
     "RootOrMatchingDomain": "dns.$DOMAIN",
-    "MatchingDomainAlias": [],
+    "ActiveOrigins": [{
-    "ActiveOrigins": [
+        "OriginIpOrDomain": "127.0.0.1:8000",
-        {
+        "RequireTLS": false,
-            "OriginIpOrDomain": "127.0.0.1:8000",
+        "Weight": 1,
-            "RequireTLS": false,
+        "MaxConn": 0
-            "SkipCertValidations": false,
+    }],
-            "SkipWebSocketOriginCheck": false,
-            "Weight": 1,
-            "MaxConn": 0,
-            "RespTimeout": 0
-        }
-    ],
-    "InactiveOrigins": [],
-    "UseStickySession": false,
-    "UseActiveLoadBalance": false,
     "Disabled": false,
-    "BypassGlobalTLS": true,
+    "AuthenticationProvider": {"AuthMethod": 0}
-    "VirtualDirectories": [],
-    "HeaderRewriteRules": {
-        "UserDefinedHeaders": null,
-        "RequestHostOverwrite": "",
-        "HSTSMaxAge": 0,
-        "EnablePermissionPolicyHeader": false,
-        "PermissionPolicy": null,
-        "DisableHopByHopHeaderRemoval": false
-    },
-    "EnableWebsocketCustomHeaders": false,
-    "AuthenticationProvider": {
-        "AuthMethod": 0,
-        "BasicAuthCredentials": null,
-        "BasicAuthExceptionRules": null,
-        "BasicAuthGroupIDs": [],
-        "ForwardAuthURL": "",
-        "ForwardAuthResponseHeaders": [],
-        "ForwardAuthResponseClientHeaders": [],
-        "ForwardAuthRequestHeaders": [],
-        "ForwardAuthRequestExcludedCookies": []
-    },
-    "RequireRateLimit": false,
-    "RateLimit": 0,
-    "DisableUptimeMonitor": false,
-    "AccessFilterUUID": "",
-    "DefaultSiteOption": 0,
-    "DefaultSiteValue": "",
-    "Tags": []
 }
 ZORAXY_DNS
 
-    # Generate www subdomain config (proxied to binary for landing page + ACME support)
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/www.$DOMAIN.config" <<ZORAXY_WWW
 {
     "ProxyType": 1,
@@ -235,11 +161,6 @@ ZORAXY_DNS
 }
 ZORAXY_WWW
 
-    # Copy www landing page
-    cp -r config/www/* "$TARGET_DIR/config/zoraxy/www/html/"
-
-    # Generate auth subdomain config (handled by Zoraxy Auth on port 5489)
-    echo "[*] Generating auth subdomain config..."
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/auth.$DOMAIN.config" <<ZORAXY_AUTH
 {
     "ProxyType": 1,
@@ -255,14 +176,15 @@ ZORAXY_WWW
 }
 ZORAXY_AUTH
 
-    # Lock proxy configs so Zoraxy cannot rewrite them (clearing OriginIpOrDomain)
-    echo "[*] Locking proxy configs (chattr +i)..."
     chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
 
-    # Copy launcher config files
+    # Copy landing page
+    cp -r config/www/* "$TARGET_DIR/config/zoraxy/www/html/"
+
+    # Copy launcher config
     cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
 
-    # Generate launcher apps.yaml with path-based URLs
+    # Generate apps.yaml
     echo "[*] Generating apps.yaml..."
     cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
 apps:
@@ -308,66 +230,28 @@ apps:
     icon: "admin"
 EOF
 
-    # --- Configure Zoraxy admin + LE via API ---
+    # Configure Zoraxy admin + LE via API
     echo "[*] Configuring Zoraxy..."
-
-    # Wait for Zoraxy to be ready
     for i in $(seq 1 15); do
         if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
             break
         fi
-        echo "  Waiting for Zoraxy... ($i/15)"
         sleep 2
     done
     sleep 1
 
-    # Zoraxy API helper — uses direct /login.html to avoid redirect CSRF issues
     COOKIE_JAR="/tmp/zoraxy_cookies.txt"
     rm -f "$COOKIE_JAR"
-
     fetch_csrf() {
-        # Fetch /login.html directly (no redirect), save cookies, extract token
+        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//'
-        local page
-        page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
-        local token
-        token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' | head -1)
-        echo "$token"
     }
 
-    zoraxy_post() {
-        local path="$1" data="$2"
-        local csrf
-        csrf=$(fetch_csrf)
-        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000${path}" \
-            -H "X-CSRF-Token: ${csrf}" -d "${data}"
-    }
-
-    zoraxy_get() {
-        local path="$1" data="$2"
-        local csrf
-        csrf=$(fetch_csrf)
-        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000${path}" \
-            -H "X-CSRF-Token: ${csrf}" -G ${data:+-d "$data"}
-    }
-
-    # Step 1: Create admin account
-    echo "  Creating admin account..."
     CSRF=$(fetch_csrf)
-    ADMIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
+    curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
         -H "X-CSRF-Token: ${CSRF}" \
         -d "username=${ADMIN_USERNAME:-master}" \
-        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
+        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null 2>&1 || true
 
-    if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
-        echo "  [OK] Admin account created: $ADMIN_USERNAME"
-    elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
-        echo "  [OK] Admin account already exists"
-    else
-        echo "  [INFO] Admin registration: $ADMIN_RESULT"
-    fi
-
-    # Step 2: Login (saves session cookie in $COOKIE_JAR)
-    echo "  Logging in for LE configuration..."
     CSRF=$(fetch_csrf)
     LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
         -H "X-CSRF-Token: ${CSRF}" \
@@ -377,58 +261,38 @@ EOF
     if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
         echo "  [OK] Logged in as $ADMIN_USERNAME"
 
-        # Set LE email
+        CSRF=$(fetch_csrf)
-        echo "  Setting Let's Encrypt email: ${TLS_EMAIL}"
+        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
-        zoraxy_post "/api/acme/autoRenew/email" "set=${TLS_EMAIL}" > /dev/null
+            -H "X-CSRF-Token: ${CSRF}" -d "set=${TLS_EMAIL}" > /dev/null
 
-        # Obtain certificates for all subdomains
+        CSRF=$(fetch_csrf)
-        LE_CA="Let%27s%20Encrypt"
+        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
-        for SUB in app dns www; do
+            -H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null
-            echo "  Requesting LE certificate for ${SUB}.${DOMAIN}..."
-            CERT_RESULT=$(curl -s --max-time 60 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
-                -H "X-CSRF-Token: $(fetch_csrf)" \
-                -G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
-                -d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
-            if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed\|true'; then
-                echo "  [OK] Certificate obtained for ${SUB}.${DOMAIN}"
-            else
-                echo "  [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
-            fi
-        done
-
-        # Enable auto-renew
-        echo "  Enabling auto-renew..."
-        zoraxy_post "/api/acme/autoRenew/enable" "enable=true" > /dev/null
         echo "  [OK] LE auto-renew enabled"
 
-        # Configure Zoraxy Auth gateway in BoltDB
+        # BoltDB Zoraxy Auth gateway
-        echo "  Configuring Zoraxy Auth gateway..."
         SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
         if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
             "$TOOL_BIN" db \
                 --db "$SYS_DB" \
                 --set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
-            echo "  [OK] Zoraxy Auth gateway configured"
         fi
-    else
-        echo "  [WARN] Login failed: $LOGIN_RESULT"
     fi
 
     # Restart Zoraxy to pick up configs
-    echo "[*] Restarting Zoraxy to apply configs..."
     podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
     sleep 2
 
-    # Write systemd service with EnvironmentFile for .env vars
+    # Write systemd service
     echo "[*] Writing systemd service..."
     cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
 [Unit]
-Description=NextWorkspace Launcher + Auth Proxy
+Description=NextWorkspace Launcher
 After=network.target
 
 [Service]
 Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
-EnvironmentFile=$TARGET_DIR/.env
+EnvironmentFile=$BACKUP_DIR/.env
 ExecStart=$TARGET_DIR/$BINARY_NAME
 WorkingDirectory=$TARGET_DIR
 Restart=always
@@ -455,10 +319,7 @@ else
         cp config/nextworkspace/apps.yaml "$TARGET_DIR/config/nextworkspace/apps.yaml"
     fi
     if [ -d config/zoraxy/conf/proxy ]; then
-        # Unlock, copy, re-lock to prevent Zoraxy from clearing OriginIpOrDomain
-        chattr -R -i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
         cp config/zoraxy/conf/proxy/* "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
-        chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
     fi
 
     echo "[6/6] Restarting Zoraxy and launcher..."

install.sh

@@ -5,9 +5,11 @@ set -euo pipefail
 # Idempotent: safe to run multiple times.
 
 TARGET_DIR="/opt/nextworkspace"
+BACKUP_DIR="/opt/backup"
 
-# --- Create runtime directory structure ---
+# --- Create backup vault and runtime directories ---
 echo "=== NextWorkspace Setup ==="
+mkdir -p "$BACKUP_DIR/certs"
 mkdir -p "$TARGET_DIR/config/nextworkspace"
 mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
 mkdir -p "$TARGET_DIR/config/zoraxy/www/html"
@@ -38,8 +40,8 @@ echo "  Save this password — it won't be shown again!"
 echo "========================================"
 echo ""
 
-# Write .env file at runtime root
+# Write .env file in backup vault (deploy.sh copies it to production)
-ENV_FILE="$TARGET_DIR/.env"
+ENV_FILE="$BACKUP_DIR/.env"
 cat > "$ENV_FILE" <<EOF
 # NextWorkspace Configuration
 # This file is auto-generated by install.sh — do not edit manually

tools/nextwks-tool/main.go

@@ -87,15 +87,15 @@ func runCert(args []string) {
 			}
 		}
 	} else {
-		log.Printf("[OK] All certificates found in backup, deploying")
+		log.Printf("[OK] All certificates found in backup (dry-run)")
 		for _, domain := range domains {
 			certFile := filepath.Join(*backupDir, domain, "fullchain.pem")
 			expiry := getCertExpiry(certFile)
-			log.Printf("  %s — expires %s", domain, expiry.Format(time.RFC3339))
+			log.Printf("  %s — expires %s (dry-run, deploy.sh copies from backup)", domain, expiry.Format(time.RFC3339))
 		}
 	}
 
-	// Copy to deploy-dir if specified
+	// Copy to deploy-dir if specified (legacy, not used by deploy.sh)
 	if *deployDir != "" {
 		if err := os.MkdirAll(*deployDir, 0755); err != nil {
 			log.Printf("[WARN] Failed to create deploy dir: %v", err)