refactor: /opt/backup/ vault for .env + certs, clean destroy flow
This commit is contained in:
parent
b0a3cd3206
commit
2e7a0e3645
3 changed files with 88 additions and 225 deletions
293
deploy.sh
293
deploy.sh
|
|
@ -3,22 +3,27 @@ set -euo pipefail
|
|||
|
||||
REPO_DIR="/opt/NextWks"
|
||||
TARGET_DIR="/opt/nextworkspace"
|
||||
BACKUP_DIR="/opt/backup"
|
||||
SERVICE_NAME="nextworkspace"
|
||||
BINARY_NAME="nextworkspace"
|
||||
HEALTH_CHECK_RETRIES=10
|
||||
HEALTH_CHECK_INTERVAL=2
|
||||
|
||||
# --- Load .env from runtime root ---
|
||||
ENV_FILE="$TARGET_DIR/.env"
|
||||
if [ -f "$ENV_FILE" ]; then
|
||||
# --- Load .env from backup vault (written by install.sh) ---
|
||||
if [ -f "$BACKUP_DIR/.env" ]; then
|
||||
set -a
|
||||
source "$ENV_FILE"
|
||||
source "$BACKUP_DIR/.env"
|
||||
set +a
|
||||
DOMAIN="${DOMAIN:-nextwks.eu}"
|
||||
elif [ -f "$TARGET_DIR/.env" ]; then
|
||||
set -a
|
||||
source "$TARGET_DIR/.env"
|
||||
set +a
|
||||
DOMAIN="${DOMAIN:-nextwks.eu}"
|
||||
else
|
||||
DOMAIN="${DOMAIN:-nextwks.eu}"
|
||||
fi
|
||||
|
||||
# Default domain if .env wasn't loaded
|
||||
DOMAIN="${DOMAIN:-nextwks.eu}"
|
||||
|
||||
# --- Mode detection ---
|
||||
GREENFIELD=false
|
||||
if [ "${1:-}" = "--destroy" ]; then
|
||||
|
|
@ -40,7 +45,6 @@ echo "[2/6] Building binary and helper tool..."
|
|||
export PATH=$PATH:/usr/local/go/bin
|
||||
go build -o "$BINARY_NAME" .
|
||||
|
||||
# Build helper tool for cert management
|
||||
TOOL_DIR="$REPO_DIR/tools/nextwks-tool"
|
||||
TOOL_BIN="/tmp/nextwks-tool"
|
||||
if [ -d "$TOOL_DIR" ]; then
|
||||
|
|
@ -49,121 +53,81 @@ if [ -d "$TOOL_DIR" ]; then
|
|||
cd "$REPO_DIR"
|
||||
fi
|
||||
|
||||
# --- Certificate management via helper tool ---
|
||||
if [ -f "$TOOL_BIN" ]; then
|
||||
echo "[*] Managing LE certificates..."
|
||||
mkdir -p /opt/backup/certs
|
||||
# --- Greenfield path ---
|
||||
if [ "$GREENFIELD" = true ]; then
|
||||
|
||||
# Step 3: Stop service and wipe
|
||||
echo "[3/6] Stopping service and cleaning production directory..."
|
||||
systemctl stop $SERVICE_NAME 2>/dev/null || true
|
||||
if [ -d "$TARGET_DIR" ]; then
|
||||
chattr -R -i "$TARGET_DIR" 2>/dev/null || true
|
||||
rm -rf "$TARGET_DIR"
|
||||
fi
|
||||
|
||||
# Step 4: Run helper tool — checks /opt/backup/certs/, issues LE if missing
|
||||
echo "[4/6] Checking certificates..."
|
||||
mkdir -p "$BACKUP_DIR/certs"
|
||||
if [ -f "$TOOL_BIN" ]; then
|
||||
"$TOOL_BIN" cert \
|
||||
--domains "app.${DOMAIN},dns.${DOMAIN},www.${DOMAIN}" \
|
||||
--email "${TLS_EMAIL:-admin@${DOMAIN}}" \
|
||||
--backup-dir /opt/backup/certs 2>&1 || true
|
||||
fi
|
||||
|
||||
# --- Greenfield path ---
|
||||
if [ "$GREENFIELD" = true ]; then
|
||||
echo "[3/6] Removing old deployment..."
|
||||
|
||||
# Unlock immutable files (chattr +i from previous deploy) before removing
|
||||
if [ -d "$TARGET_DIR" ]; then
|
||||
chattr -R -i "$TARGET_DIR" 2>/dev/null || true
|
||||
--backup-dir "$BACKUP_DIR/certs" 2>&1 || true
|
||||
fi
|
||||
|
||||
# Preserve .env and Zoraxy certs across greenfield destroy
|
||||
if [ -f "$TARGET_DIR/.env" ]; then
|
||||
cp "$TARGET_DIR/.env" /tmp/nextworkspace.env.bak
|
||||
echo "[INFO] Preserved .env"
|
||||
fi
|
||||
if [ -d "$TARGET_DIR/config/zoraxy/conf/certs" ]; then
|
||||
cp -r "$TARGET_DIR/config/zoraxy" /tmp/nextworkspace.zoraxy.bak
|
||||
echo "[INFO] Preserved Zoraxy config + certs"
|
||||
fi
|
||||
|
||||
rm -rf "$TARGET_DIR"
|
||||
|
||||
echo "[4/6] Creating target directories..."
|
||||
# Step 5: Build production directory structure
|
||||
echo "[5/6] Building production directory structure..."
|
||||
mkdir -p "$TARGET_DIR/config/nextworkspace"
|
||||
mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
|
||||
mkdir -p "$TARGET_DIR/config/zoraxy/conf/certs"
|
||||
mkdir -p "$TARGET_DIR/config/zoraxy/www/html"
|
||||
mkdir -p "$TARGET_DIR/data/zoraxy"
|
||||
mkdir -p "$TARGET_DIR/compose"
|
||||
mkdir -p "$TARGET_DIR/logs"
|
||||
|
||||
# Restore preserved .env and Zoraxy config+certs
|
||||
if [ -f /tmp/nextworkspace.env.bak ]; then
|
||||
mv /tmp/nextworkspace.env.bak "$TARGET_DIR/.env"
|
||||
# Copy .env from backup vault
|
||||
if [ -f "$BACKUP_DIR/.env" ]; then
|
||||
cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
|
||||
chmod 600 "$TARGET_DIR/.env"
|
||||
echo "[INFO] Restored .env"
|
||||
fi
|
||||
if [ -d /tmp/nextworkspace.zoraxy.bak ]; then
|
||||
cp -r /tmp/nextworkspace.zoraxy.bak/* "$TARGET_DIR/config/zoraxy/"
|
||||
rm -rf /tmp/nextworkspace.zoraxy.bak
|
||||
echo "[INFO] Restored Zoraxy config + certs"
|
||||
echo "[INFO] .env deployed from backup"
|
||||
fi
|
||||
|
||||
echo "[5/6] Copying binary..."
|
||||
# Copy certificates from backup vault to Zoraxy cert dir
|
||||
for DOMAIN_SUB in app dns www; do
|
||||
CERT_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/fullchain.pem"
|
||||
KEY_SRC="$BACKUP_DIR/certs/${DOMAIN_SUB}.${DOMAIN}/privkey.pem"
|
||||
if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
|
||||
cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.crt"
|
||||
cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${DOMAIN_SUB}.${DOMAIN}.key"
|
||||
echo "[INFO] Cert deployed: ${DOMAIN_SUB}.${DOMAIN}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Copy binary
|
||||
echo "[6/6] Deploying..."
|
||||
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
||||
|
||||
if [ -f "$REPO_DIR/VERSION" ]; then
|
||||
cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
|
||||
echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)"
|
||||
fi
|
||||
|
||||
echo "[6/6] Deploying Zoraxy..."
|
||||
# Deploy Zoraxy
|
||||
cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
|
||||
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)"
|
||||
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues"
|
||||
|
||||
# Generate Zoraxy proxy configs with full schema (prevents Zoraxy from clearing OriginIpOrDomain on expand)
|
||||
# Generate Zoraxy proxy configs
|
||||
echo "[*] Generating Zoraxy proxy configs..."
|
||||
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
|
||||
{
|
||||
"ProxyType": 1,
|
||||
"RootOrMatchingDomain": "app.$DOMAIN",
|
||||
"MatchingDomainAlias": [],
|
||||
"ActiveOrigins": [
|
||||
{
|
||||
"ActiveOrigins": [{
|
||||
"OriginIpOrDomain": "127.0.0.1:9000",
|
||||
"RequireTLS": false,
|
||||
"SkipCertValidations": false,
|
||||
"SkipWebSocketOriginCheck": false,
|
||||
"Weight": 1,
|
||||
"MaxConn": 0,
|
||||
"RespTimeout": 0
|
||||
}
|
||||
],
|
||||
"InactiveOrigins": [],
|
||||
"UseStickySession": false,
|
||||
"UseActiveLoadBalance": false,
|
||||
"MaxConn": 0
|
||||
}],
|
||||
"Disabled": false,
|
||||
"BypassGlobalTLS": false,
|
||||
"VirtualDirectories": [],
|
||||
"HeaderRewriteRules": {
|
||||
"UserDefinedHeaders": null,
|
||||
"RequestHostOverwrite": "",
|
||||
"HSTSMaxAge": 0,
|
||||
"EnablePermissionPolicyHeader": false,
|
||||
"PermissionPolicy": null,
|
||||
"DisableHopByHopHeaderRemoval": false
|
||||
},
|
||||
"EnableWebsocketCustomHeaders": false,
|
||||
"AuthenticationProvider": {
|
||||
"AuthMethod": 0,
|
||||
"BasicAuthCredentials": null,
|
||||
"BasicAuthExceptionRules": null,
|
||||
"BasicAuthGroupIDs": [],
|
||||
"ForwardAuthURL": "",
|
||||
"ForwardAuthResponseHeaders": [],
|
||||
"ForwardAuthResponseClientHeaders": [],
|
||||
"ForwardAuthRequestHeaders": [],
|
||||
"ForwardAuthRequestExcludedCookies": []
|
||||
},
|
||||
"RequireRateLimit": false,
|
||||
"RateLimit": 0,
|
||||
"DisableUptimeMonitor": false,
|
||||
"AccessFilterUUID": "",
|
||||
"DefaultSiteOption": 0,
|
||||
"DefaultSiteValue": "",
|
||||
"Tags": []
|
||||
"AuthenticationProvider": {"AuthMethod": 0}
|
||||
}
|
||||
ZORAXY_APP
|
||||
|
||||
|
|
@ -171,55 +135,17 @@ ZORAXY_APP
|
|||
{
|
||||
"ProxyType": 1,
|
||||
"RootOrMatchingDomain": "dns.$DOMAIN",
|
||||
"MatchingDomainAlias": [],
|
||||
"ActiveOrigins": [
|
||||
{
|
||||
"ActiveOrigins": [{
|
||||
"OriginIpOrDomain": "127.0.0.1:8000",
|
||||
"RequireTLS": false,
|
||||
"SkipCertValidations": false,
|
||||
"SkipWebSocketOriginCheck": false,
|
||||
"Weight": 1,
|
||||
"MaxConn": 0,
|
||||
"RespTimeout": 0
|
||||
}
|
||||
],
|
||||
"InactiveOrigins": [],
|
||||
"UseStickySession": false,
|
||||
"UseActiveLoadBalance": false,
|
||||
"MaxConn": 0
|
||||
}],
|
||||
"Disabled": false,
|
||||
"BypassGlobalTLS": true,
|
||||
"VirtualDirectories": [],
|
||||
"HeaderRewriteRules": {
|
||||
"UserDefinedHeaders": null,
|
||||
"RequestHostOverwrite": "",
|
||||
"HSTSMaxAge": 0,
|
||||
"EnablePermissionPolicyHeader": false,
|
||||
"PermissionPolicy": null,
|
||||
"DisableHopByHopHeaderRemoval": false
|
||||
},
|
||||
"EnableWebsocketCustomHeaders": false,
|
||||
"AuthenticationProvider": {
|
||||
"AuthMethod": 0,
|
||||
"BasicAuthCredentials": null,
|
||||
"BasicAuthExceptionRules": null,
|
||||
"BasicAuthGroupIDs": [],
|
||||
"ForwardAuthURL": "",
|
||||
"ForwardAuthResponseHeaders": [],
|
||||
"ForwardAuthResponseClientHeaders": [],
|
||||
"ForwardAuthRequestHeaders": [],
|
||||
"ForwardAuthRequestExcludedCookies": []
|
||||
},
|
||||
"RequireRateLimit": false,
|
||||
"RateLimit": 0,
|
||||
"DisableUptimeMonitor": false,
|
||||
"AccessFilterUUID": "",
|
||||
"DefaultSiteOption": 0,
|
||||
"DefaultSiteValue": "",
|
||||
"Tags": []
|
||||
"AuthenticationProvider": {"AuthMethod": 0}
|
||||
}
|
||||
ZORAXY_DNS
|
||||
|
||||
# Generate www subdomain config (proxied to binary for landing page + ACME support)
|
||||
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/www.$DOMAIN.config" <<ZORAXY_WWW
|
||||
{
|
||||
"ProxyType": 1,
|
||||
|
|
@ -235,11 +161,6 @@ ZORAXY_DNS
|
|||
}
|
||||
ZORAXY_WWW
|
||||
|
||||
# Copy www landing page
|
||||
cp -r config/www/* "$TARGET_DIR/config/zoraxy/www/html/"
|
||||
|
||||
# Generate auth subdomain config (handled by Zoraxy Auth on port 5489)
|
||||
echo "[*] Generating auth subdomain config..."
|
||||
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/auth.$DOMAIN.config" <<ZORAXY_AUTH
|
||||
{
|
||||
"ProxyType": 1,
|
||||
|
|
@ -255,14 +176,15 @@ ZORAXY_WWW
|
|||
}
|
||||
ZORAXY_AUTH
|
||||
|
||||
# Lock proxy configs so Zoraxy cannot rewrite them (clearing OriginIpOrDomain)
|
||||
echo "[*] Locking proxy configs (chattr +i)..."
|
||||
chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
||||
|
||||
# Copy launcher config files
|
||||
# Copy landing page
|
||||
cp -r config/www/* "$TARGET_DIR/config/zoraxy/www/html/"
|
||||
|
||||
# Copy launcher config
|
||||
cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
|
||||
|
||||
# Generate launcher apps.yaml with path-based URLs
|
||||
# Generate apps.yaml
|
||||
echo "[*] Generating apps.yaml..."
|
||||
cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
|
||||
apps:
|
||||
|
|
@ -308,66 +230,28 @@ apps:
|
|||
icon: "admin"
|
||||
EOF
|
||||
|
||||
# --- Configure Zoraxy admin + LE via API ---
|
||||
# Configure Zoraxy admin + LE via API
|
||||
echo "[*] Configuring Zoraxy..."
|
||||
|
||||
# Wait for Zoraxy to be ready
|
||||
for i in $(seq 1 15); do
|
||||
if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
echo " Waiting for Zoraxy... ($i/15)"
|
||||
sleep 2
|
||||
done
|
||||
sleep 1
|
||||
|
||||
# Zoraxy API helper — uses direct /login.html to avoid redirect CSRF issues
|
||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||
rm -f "$COOKIE_JAR"
|
||||
|
||||
fetch_csrf() {
|
||||
# Fetch /login.html directly (no redirect), save cookies, extract token
|
||||
local page
|
||||
page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
|
||||
local token
|
||||
token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' | head -1)
|
||||
echo "$token"
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//'
|
||||
}
|
||||
|
||||
zoraxy_post() {
|
||||
local path="$1" data="$2"
|
||||
local csrf
|
||||
csrf=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000${path}" \
|
||||
-H "X-CSRF-Token: ${csrf}" -d "${data}"
|
||||
}
|
||||
|
||||
zoraxy_get() {
|
||||
local path="$1" data="$2"
|
||||
local csrf
|
||||
csrf=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000${path}" \
|
||||
-H "X-CSRF-Token: ${csrf}" -G ${data:+-d "$data"}
|
||||
}
|
||||
|
||||
# Step 1: Create admin account
|
||||
echo " Creating admin account..."
|
||||
CSRF=$(fetch_csrf)
|
||||
ADMIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" > /dev/null 2>&1 || true
|
||||
|
||||
if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
||||
elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
|
||||
echo " [OK] Admin account already exists"
|
||||
else
|
||||
echo " [INFO] Admin registration: $ADMIN_RESULT"
|
||||
fi
|
||||
|
||||
# Step 2: Login (saves session cookie in $COOKIE_JAR)
|
||||
echo " Logging in for LE configuration..."
|
||||
CSRF=$(fetch_csrf)
|
||||
LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
|
|
@ -377,58 +261,38 @@ EOF
|
|||
if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
|
||||
echo " [OK] Logged in as $ADMIN_USERNAME"
|
||||
|
||||
# Set LE email
|
||||
echo " Setting Let's Encrypt email: ${TLS_EMAIL}"
|
||||
zoraxy_post "/api/acme/autoRenew/email" "set=${TLS_EMAIL}" > /dev/null
|
||||
CSRF=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
||||
-H "X-CSRF-Token: ${CSRF}" -d "set=${TLS_EMAIL}" > /dev/null
|
||||
|
||||
# Obtain certificates for all subdomains
|
||||
LE_CA="Let%27s%20Encrypt"
|
||||
for SUB in app dns www; do
|
||||
echo " Requesting LE certificate for ${SUB}.${DOMAIN}..."
|
||||
CERT_RESULT=$(curl -s --max-time 60 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||
-H "X-CSRF-Token: $(fetch_csrf)" \
|
||||
-G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
|
||||
-d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
|
||||
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed\|true'; then
|
||||
echo " [OK] Certificate obtained for ${SUB}.${DOMAIN}"
|
||||
else
|
||||
echo " [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
|
||||
fi
|
||||
done
|
||||
|
||||
# Enable auto-renew
|
||||
echo " Enabling auto-renew..."
|
||||
zoraxy_post "/api/acme/autoRenew/enable" "enable=true" > /dev/null
|
||||
CSRF=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
||||
-H "X-CSRF-Token: ${CSRF}" -d "enable=true" > /dev/null
|
||||
echo " [OK] LE auto-renew enabled"
|
||||
|
||||
# Configure Zoraxy Auth gateway in BoltDB
|
||||
echo " Configuring Zoraxy Auth gateway..."
|
||||
# BoltDB Zoraxy Auth gateway
|
||||
SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
|
||||
if [ -f "$SYS_DB" ] && [ -f "$TOOL_BIN" ]; then
|
||||
"$TOOL_BIN" db \
|
||||
--db "$SYS_DB" \
|
||||
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
|
||||
echo " [OK] Zoraxy Auth gateway configured"
|
||||
fi
|
||||
else
|
||||
echo " [WARN] Login failed: $LOGIN_RESULT"
|
||||
fi
|
||||
|
||||
# Restart Zoraxy to pick up configs
|
||||
echo "[*] Restarting Zoraxy to apply configs..."
|
||||
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
||||
sleep 2
|
||||
|
||||
# Write systemd service with EnvironmentFile for .env vars
|
||||
# Write systemd service
|
||||
echo "[*] Writing systemd service..."
|
||||
cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
|
||||
[Unit]
|
||||
Description=NextWorkspace Launcher + Auth Proxy
|
||||
Description=NextWorkspace Launcher
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
|
||||
EnvironmentFile=$TARGET_DIR/.env
|
||||
EnvironmentFile=$BACKUP_DIR/.env
|
||||
ExecStart=$TARGET_DIR/$BINARY_NAME
|
||||
WorkingDirectory=$TARGET_DIR
|
||||
Restart=always
|
||||
|
|
@ -455,10 +319,7 @@ else
|
|||
cp config/nextworkspace/apps.yaml "$TARGET_DIR/config/nextworkspace/apps.yaml"
|
||||
fi
|
||||
if [ -d config/zoraxy/conf/proxy ]; then
|
||||
# Unlock, copy, re-lock to prevent Zoraxy from clearing OriginIpOrDomain
|
||||
chattr -R -i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
||||
cp config/zoraxy/conf/proxy/* "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
||||
chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
echo "[6/6] Restarting Zoraxy and launcher..."
|
||||
|
|
|
|||
|
|
@ -5,9 +5,11 @@ set -euo pipefail
|
|||
# Idempotent: safe to run multiple times.
|
||||
|
||||
TARGET_DIR="/opt/nextworkspace"
|
||||
BACKUP_DIR="/opt/backup"
|
||||
|
||||
# --- Create runtime directory structure ---
|
||||
# --- Create backup vault and runtime directories ---
|
||||
echo "=== NextWorkspace Setup ==="
|
||||
mkdir -p "$BACKUP_DIR/certs"
|
||||
mkdir -p "$TARGET_DIR/config/nextworkspace"
|
||||
mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
|
||||
mkdir -p "$TARGET_DIR/config/zoraxy/www/html"
|
||||
|
|
@ -38,8 +40,8 @@ echo " Save this password — it won't be shown again!"
|
|||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Write .env file at runtime root
|
||||
ENV_FILE="$TARGET_DIR/.env"
|
||||
# Write .env file in backup vault (deploy.sh copies it to production)
|
||||
ENV_FILE="$BACKUP_DIR/.env"
|
||||
cat > "$ENV_FILE" <<EOF
|
||||
# NextWorkspace Configuration
|
||||
# This file is auto-generated by install.sh — do not edit manually
|
||||
|
|
|
|||
|
|
@ -87,15 +87,15 @@ func runCert(args []string) {
|
|||
}
|
||||
}
|
||||
} else {
|
||||
log.Printf("[OK] All certificates found in backup, deploying")
|
||||
log.Printf("[OK] All certificates found in backup (dry-run)")
|
||||
for _, domain := range domains {
|
||||
certFile := filepath.Join(*backupDir, domain, "fullchain.pem")
|
||||
expiry := getCertExpiry(certFile)
|
||||
log.Printf(" %s — expires %s", domain, expiry.Format(time.RFC3339))
|
||||
log.Printf(" %s — expires %s (dry-run, deploy.sh copies from backup)", domain, expiry.Format(time.RFC3339))
|
||||
}
|
||||
}
|
||||
|
||||
// Copy to deploy-dir if specified
|
||||
// Copy to deploy-dir if specified (legacy, not used by deploy.sh)
|
||||
if *deployDir != "" {
|
||||
if err := os.MkdirAll(*deployDir, 0755); err != nil {
|
||||
log.Printf("[WARN] Failed to create deploy dir: %v", err)
|
||||
|
|
|
|||
Loading…
Reference in a new issue