From 8d2ffb503ad6d91ca71da94c4165395220ff94a4 Mon Sep 17 00:00:00 2001 From: cclohmar Date: Fri, 10 Jul 2026 16:13:57 +0100 Subject: [PATCH] fix: all 3 containers on internal network, NO host networking --- deploy.sh | 70 +++++++++++++++++-------------------------------------- 1 file changed, 22 insertions(+), 48 deletions(-) diff --git a/deploy.sh b/deploy.sh index e78d872..80e0715 100755 --- a/deploy.sh +++ b/deploy.sh @@ -6,7 +6,6 @@ REPO_DIR="/opt/NextWks" TARGET_DIR="/opt/nextworkspace" BACKUP_DIR="/opt/backup" NETWORK_NAME="nextwks-net" -BINARY_NAME="nextworkspace" HEALTH_CHECK_RETRIES=10 HEALTH_CHECK_INTERVAL=2 @@ -26,34 +25,29 @@ else echo "[MODE] Smart update (target exists)"; fi # --- Pull + build --- cd "$REPO_DIR" -echo "[1/6] Pulling latest code..." +echo "[1/5] Pulling latest code..." git pull 2>/dev/null || true -echo "[2/6] Building binary (static)..." +echo "[2/5] Building binary (static)..." export PATH=$PATH:/usr/local/go/bin CGO_ENABLED=0 go build -o nextworkspace . # --- Greenfield --- if [ "$GREENFIELD" = true ]; then - echo "[3/6] Full teardown..." - # Stop systemd service if still running + echo "[3/5] Full teardown..." systemctl stop nextworkspace 2>/dev/null || true systemctl disable nextworkspace 2>/dev/null || true rm -f /etc/systemd/system/nextworkspace.service systemctl daemon-reload - # Remove containers (both root and master user) podman rm -f caddy authelia launcher 2>/dev/null || true - sudo -u master podman rm -f caddy authelia launcher 2>/dev/null || true - # Remove old network - podman network rm nextwks-net 2>/dev/null || true - sudo -u master podman network rm nextwks-net 2>/dev/null || true + podman network rm "$NETWORK_NAME" 2>/dev/null || true if [ -d "$TARGET_DIR" ]; then chattr -R -i "$TARGET_DIR" 2>/dev/null || true rm -rf "$TARGET_DIR" fi - echo "[4/6] Building directories..." + echo "[4/5] Building directories..." mkdir -p "$TARGET_DIR/config/caddy" mkdir -p "$TARGET_DIR/config/authelia" mkdir -p "$TARGET_DIR/data/caddy" @@ -61,11 +55,10 @@ if [ "$GREENFIELD" = true ]; then mkdir -p "$TARGET_DIR/compose" mkdir -p "$TARGET_DIR/www" mkdir -p "$TARGET_DIR/config/nextworkspace" - mkdir -p "$TARGET_DIR/logs/caddy" + mkdir -p "$TARGET_DIR/logs" chown -R master:master "$TARGET_DIR/data/caddy" 2>/dev/null || true - chown -R master:master "$TARGET_DIR/logs/caddy" 2>/dev/null || true + chown -R master:master "$TARGET_DIR/logs" 2>/dev/null || true - # Copy .env from backup if [ -f "$BACKUP_DIR/.env" ]; then cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env" chmod 600 "$TARGET_DIR/.env" @@ -75,66 +68,48 @@ if [ "$GREENFIELD" = true ]; then sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \ "$SCRIPT_DIR/config/caddy/Caddyfile" > "$TARGET_DIR/config/caddy/Caddyfile" - # Generate Authelia config (minimal — deploy.sh fills secrets) + # Generate Authelia config JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}" SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}" - sed -e "s|{DOMAIN}|$DOMAIN|g" \ - -e "s|{JWT_SECRET}|$JWT_SECRET|g" \ + sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \ -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \ -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \ -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \ - -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \ - -e "s|{SMTP_PASS}|$SMTP_PASS|g" \ + -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" -e "s|{SMTP_PASS}|$SMTP_PASS|g" \ "$SCRIPT_DIR/config/authelia/configuration.yml" > "$TARGET_DIR/config/authelia/configuration.yml" - # Generate users database ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}" if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ] && [ -f "$SCRIPT_DIR/tools/hash-password/main.go" ]; then ADMIN_PASSWORD_HASH=$(cd "$SCRIPT_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "") fi - sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \ - -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \ + sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \ "$SCRIPT_DIR/config/authelia/users_database.yml" > "$TARGET_DIR/config/authelia/users_database.yml" - # Copy compose files + binary + # Copy files cp "$SCRIPT_DIR/compose/caddy.yaml" "$TARGET_DIR/compose/caddy.yaml" cp "$SCRIPT_DIR/compose/authelia.yaml" "$TARGET_DIR/compose/authelia.yaml" cp "$SCRIPT_DIR/compose/launcher.yaml" "$TARGET_DIR/compose/launcher.yaml" - cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME" - if [ -f "$REPO_DIR/VERSION" ]; then - cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION" - fi - - # Copy landing page - if [ -d "$SCRIPT_DIR/config/www" ]; then - cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/" - fi - - # Copy launcher config + cp nextworkspace "$TARGET_DIR/nextworkspace" + if [ -f "$REPO_DIR/VERSION" ]; then cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"; fi + if [ -d "$SCRIPT_DIR/config/www" ]; then cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"; fi cp -r "$SCRIPT_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/" 2>/dev/null || true - # Create podman network (no subnet — auto-assign) - echo "[5/6] Creating podman network..." - podman network create "$NETWORK_NAME" 2>&1 || echo "[WARN] Network create failed (may already exist)" - - # Deploy all containers - echo "[6/6] Deploying containers..." + # Podman network + deploy all 3 containers + echo "[5/5] Deploying containers on $NETWORK_NAME..." + podman network create "$NETWORK_NAME" 2>/dev/null || true podman-compose -f "$TARGET_DIR/compose/launcher.yaml" up -d 2>&1 || echo "[WARN] Launcher deploy had issues" podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || echo "[WARN] Authelia deploy had issues" podman-compose -f "$TARGET_DIR/compose/caddy.yaml" up -d 2>&1 || echo "[WARN] Caddy deploy had issues" - # Extract Authelia secret sleep 3 AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "") - if [ -n "$AUTHELIA_SECRET" ]; then - if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then - echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env" - fi + if [ -n "$AUTHELIA_SECRET" ] && ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then + echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env" fi # --- Smart update --- else - echo "[3/6] Redeploying containers..." + echo "[3/5] Redeploying containers..." podman-compose -f "$TARGET_DIR/compose/launcher.yaml" up -d 2>&1 || true podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || true podman-compose -f "$TARGET_DIR/compose/caddy.yaml" restart 2>&1 || true @@ -143,8 +118,7 @@ fi # --- Health check --- echo "[*] Running health check..." for i in $(seq 1 $HEALTH_CHECK_RETRIES); do - HEALTH=$(podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || \ - sudo -u master podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || echo "") + HEALTH=$(podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || echo "") if [ "$HEALTH" = "OK" ]; then echo "[OK] NextWorkspace launcher is healthy" exit 0