fix(installer): create dedicated nextwks service user, chown deployed files
This commit is contained in:
parent
e978e08424
commit
7b3ba23c82
1 changed files with 28 additions and 26 deletions
52
install.sh
52
install.sh
|
|
@ -13,17 +13,20 @@ warn() { echo -e "${YELLOW}$1${NC}"; }
|
|||
header() { echo -e "\n${BOLD}${CYAN}$1${NC}"; }
|
||||
|
||||
# ============================================================
|
||||
# USER & SUDO
|
||||
# SERVICE USER
|
||||
# ============================================================
|
||||
SYS_USER="${SUDO_USER:-$USER}"
|
||||
SYS_HOME=$(eval echo "~$SYS_USER")
|
||||
[ "$EUID" -eq 0 ] && SUDO="" || SUDO="sudo"
|
||||
SVC_USER="nextwks"
|
||||
SYS_HOME="/home/${SVC_USER}"
|
||||
|
||||
if [ -z "$SUDO" ] && [ "$EUID" -ne 0 ]; then
|
||||
error "This script needs root for /opt/ and systemd. Use: sudo bash install.sh"
|
||||
exit 1
|
||||
# Create service user if needed
|
||||
if ! id "$SVC_USER" &>/dev/null; then
|
||||
info "Creating service user: $SVC_USER"
|
||||
useradd -r -s /usr/sbin/nologin -d /nonexistent "$SVC_USER" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Sudo only if not root
|
||||
[ "$EUID" -eq 0 ] && SUDO="" || SUDO="sudo"
|
||||
|
||||
# ============================================================
|
||||
# PATHS
|
||||
# ============================================================
|
||||
|
|
@ -33,7 +36,7 @@ BIN_DIR="${INSTALL_DIR}/bin"
|
|||
DATA_DIR="${INSTALL_DIR}/data"
|
||||
STATIC_DIR="${INSTALL_DIR}/static"
|
||||
CONFIG_FILE="${INSTALL_DIR}/config.yaml"
|
||||
ENV_FILE="${SYS_HOME}/.nextwks-env"
|
||||
ENV_FILE="${REPO_DIR}/.env"
|
||||
AUTHELIA_DIR="/opt/authelia"
|
||||
AUTHELIA_CONFIG="${AUTHELIA_DIR}/configuration.yml"
|
||||
SERVICE_FILE="/etc/systemd/system/nextwks.service"
|
||||
|
|
@ -55,15 +58,13 @@ PROXY_IP_DEFAULT="172.16.0.10"
|
|||
# ============================================================
|
||||
REPO_URL="https://git.lohmar.co.uk/lexton-it/NextWks.git"
|
||||
|
||||
# Detect if stdin is piped (curl|bash) — save to file and re-exec
|
||||
if [ ! -t 0 ] && [ -z "${NEXTWKS_REEXEC:-}" ]; then
|
||||
# If piped from curl (no script file), save and exit
|
||||
if [ ! -t 0 ] && [ ! -f "${BASH_SOURCE[0]}" ]; then
|
||||
SCRIPT_FILE="/tmp/nextwks-install.sh"
|
||||
cat > "$SCRIPT_FILE"
|
||||
chmod +x "$SCRIPT_FILE"
|
||||
echo ""
|
||||
echo "Script saved to $SCRIPT_FILE"
|
||||
echo "Run: bash $SCRIPT_FILE"
|
||||
echo ""
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
|
@ -76,7 +77,6 @@ if [ ! -f "$REPO_DIR/src/main.go" ]; then
|
|||
CLONE_DIR="${SYS_HOME}/nextwks"
|
||||
rm -rf "$CLONE_DIR" 2>/dev/null
|
||||
git clone --depth 1 "$REPO_URL" "$CLONE_DIR"
|
||||
chown -R "$SYS_USER:$SYS_USER" "$CLONE_DIR" 2>/dev/null || true
|
||||
REPO_DIR="$CLONE_DIR"
|
||||
success "Cloned to $REPO_DIR"
|
||||
fi
|
||||
|
|
@ -91,13 +91,6 @@ FROM_ENV=false
|
|||
# INTERACTIVE WIZARD
|
||||
# ============================================================
|
||||
gather_inputs() {
|
||||
# Load from .env if --from-env
|
||||
if [ "$FROM_ENV" = true ] && [ -f "$ENV_FILE" ]; then
|
||||
source "$ENV_FILE"
|
||||
success "Loaded configuration from $ENV_FILE"
|
||||
return
|
||||
fi
|
||||
|
||||
echo ""
|
||||
header "┌─────────────────────────────────────────┐"
|
||||
header "│ Next Workspace — Setup Wizard │"
|
||||
|
|
@ -171,7 +164,13 @@ ENVEOF
|
|||
success "Settings saved to $ENV_FILE"
|
||||
}
|
||||
|
||||
# Load env if --from-env, otherwise run interactive wizard
|
||||
if [ "$FROM_ENV" = true ] && [ -f "$ENV_FILE" ]; then
|
||||
source "$ENV_FILE"
|
||||
success "Loaded configuration from $ENV_FILE"
|
||||
else
|
||||
gather_inputs
|
||||
fi
|
||||
|
||||
# Derive domains from URLs (needed even when --from-env)
|
||||
NEXTWKS_DOMAIN=$(echo "$NEXTWKS_URL" | sed 's|https\?://||;s|/.*||')
|
||||
|
|
@ -211,7 +210,7 @@ header "── Installing ──"
|
|||
$SUDO mkdir -p "$BIN_DIR" "$DATA_DIR" "$STATIC_DIR"
|
||||
$SUDO cp "$REPO_DIR/app/core" "$BIN_DIR/core"
|
||||
$SUDO chmod 755 "$BIN_DIR/core"
|
||||
$SUDO chown -R "$SYS_USER:$SYS_USER" "$DATA_DIR" 2>/dev/null || true
|
||||
$SUDO chown -R "$SVC_USER:$SVC_USER" "$DATA_DIR" 2>/dev/null || true
|
||||
[ -d "$REPO_DIR/app/static" ] && $SUDO cp -r "$REPO_DIR/app/static"/* "$STATIC_DIR/"
|
||||
success "Copied files to $INSTALL_DIR/"
|
||||
|
||||
|
|
@ -253,8 +252,8 @@ session:
|
|||
expiry_minutes: 60
|
||||
CONFIGEOF
|
||||
$SUDO chmod 600 "$CONFIG_FILE"
|
||||
$SUDO chown "$SYS_USER:$SYS_USER" "$CONFIG_FILE"
|
||||
$SUDO chown -R "$SYS_USER:$SYS_USER" "$DATA_DIR"
|
||||
$SUDO chown "$SVC_USER:$SVC_USER" "$CONFIG_FILE"
|
||||
$SUDO chown -R "$SVC_USER:$SVC_USER" "$DATA_DIR"
|
||||
success "Config: $CONFIG_FILE"
|
||||
|
||||
# ============================================================
|
||||
|
|
@ -269,7 +268,7 @@ Wants=authelia.service
|
|||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=${SYS_USER}
|
||||
User=${SVC_USER}
|
||||
WorkingDirectory=${INSTALL_DIR}
|
||||
ExecStart=${BIN_DIR}/core -config ${CONFIG_FILE}
|
||||
Restart=always
|
||||
|
|
@ -393,6 +392,9 @@ $(echo "$OIDC_KEY" | sed 's/^/ /')
|
|||
userinfo_signed_response_alg: "none"
|
||||
AUTHEOF
|
||||
$SUDO chmod 600 "$AUTHELIA_CONFIG"
|
||||
$SUDO chown "$SVC_USER:$SVC_USER" "$AUTHELIA_CONFIG" "${AUTHELIA_DIR}/users_database.yml" "${AUTHELIA_DIR}/db.sqlite3" 2>/dev/null || true
|
||||
# Clean up files from Authelia tar
|
||||
$SUDO rm -f "${AUTHELIA_DIR}/authelia.service" "${AUTHELIA_DIR}/config.template.yml" 2>/dev/null || true
|
||||
|
||||
# Create initial users database
|
||||
if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
|
||||
|
|
@ -416,7 +418,7 @@ After=network.target
|
|||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=${SYS_USER}
|
||||
User=${SVC_USER}
|
||||
WorkingDirectory=${AUTHELIA_DIR}
|
||||
ExecStart=${AUTHELIA_DIR}/authelia --config ${AUTHELIA_CONFIG}
|
||||
Restart=always
|
||||
|
|
|
|||
Loading…
Reference in a new issue