211 lines
7.7 KiB
Bash
Executable file
211 lines
7.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_DIR="/opt/NextWks"
|
|
TARGET_DIR="/opt/nextworkspace"
|
|
BACKUP_DIR="/opt/backup"
|
|
SERVICE_NAME="nextworkspace"
|
|
BINARY_NAME="nextworkspace"
|
|
HEALTH_CHECK_RETRIES=10
|
|
HEALTH_CHECK_INTERVAL=2
|
|
|
|
# --- Load .env ---
|
|
if [ -f "$BACKUP_DIR/.env" ]; then
|
|
set -a; source "$BACKUP_DIR/.env"; set +a
|
|
elif [ -f "$TARGET_DIR/.env" ]; then
|
|
set -a; source "$TARGET_DIR/.env"; set +a
|
|
fi
|
|
DOMAIN="${DOMAIN:-nextwks.eu}"
|
|
APP_SUB="${APP_SUB:-app}"
|
|
|
|
# --- Mode ---
|
|
GREENFIELD=false
|
|
if [ "${1:-}" = "--destroy" ]; then GREENFIELD=true; echo "[MODE] Greenfield deploy (--destroy)"
|
|
elif [ ! -d "$TARGET_DIR" ]; then GREENFIELD=true; echo "[MODE] Greenfield deploy (target missing)"
|
|
else echo "[MODE] Smart update (target exists)"; fi
|
|
|
|
# --- Pull + build ---
|
|
cd "$REPO_DIR"
|
|
echo "[1/5] Pulling latest code..."
|
|
git pull 2>/dev/null || true
|
|
|
|
echo "[2/5] Building binary..."
|
|
export PATH=$PATH:/usr/local/go/bin
|
|
go build -o "$BINARY_NAME" .
|
|
|
|
# --- Greenfield ---
|
|
if [ "$GREENFIELD" = true ]; then
|
|
echo "[3/5] Full teardown..."
|
|
systemctl stop $SERVICE_NAME 2>/dev/null || true
|
|
systemctl disable $SERVICE_NAME 2>/dev/null || true
|
|
rm -f /etc/systemd/system/$SERVICE_NAME.service
|
|
systemctl daemon-reload
|
|
|
|
# Backup Caddy certs before destroying
|
|
CADDY_CERTS="$TARGET_DIR/data/caddy/caddy/certificates"
|
|
if [ -d "$CADDY_CERTS" ]; then
|
|
mkdir -p "$BACKUP_DIR/certificates"
|
|
cp -r "$CADDY_CERTS"/* "$BACKUP_DIR/certificates/" 2>/dev/null || true
|
|
echo "[INFO] Caddy certificates backed up"
|
|
fi
|
|
|
|
sudo -u master podman rm -f caddy authelia 2>/dev/null || true
|
|
sudo -u master podman pod rm -f caddy authelia 2>/dev/null || true
|
|
|
|
if [ -d "$TARGET_DIR" ]; then
|
|
chattr -R -i "$TARGET_DIR" 2>/dev/null || true
|
|
rm -rf "$TARGET_DIR"
|
|
fi
|
|
|
|
echo "[4/5] Building production directories..."
|
|
mkdir -p "$TARGET_DIR/config/caddy"
|
|
mkdir -p "$TARGET_DIR/config/authelia"
|
|
mkdir -p "$TARGET_DIR/data/caddy"
|
|
mkdir -p "$TARGET_DIR/data/authelia"
|
|
mkdir -p "$TARGET_DIR/www"
|
|
mkdir -p "$TARGET_DIR/config/nextworkspace"
|
|
mkdir -p "$TARGET_DIR/logs/caddy"
|
|
# Ensure data dirs are owned by the runtime user
|
|
chown -R master:master "$TARGET_DIR/data/caddy" 2>/dev/null || true
|
|
chown -R master:master "$TARGET_DIR/logs/caddy" 2>/dev/null || true
|
|
|
|
# Copy .env from backup
|
|
if [ -f "$BACKUP_DIR/.env" ]; then
|
|
cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
|
|
chmod 600 "$TARGET_DIR/.env"
|
|
fi
|
|
|
|
# Generate secrets if missing
|
|
JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
|
|
SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
|
|
ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
|
|
|
|
# Generate bcrypt password hash for Authelia
|
|
HASH_TOOL="$(dirname "$0")/tools/hash-password/main.go"
|
|
if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ] && [ -f "$HASH_TOOL" ]; then
|
|
ADMIN_PASSWORD_HASH=$(cd "$(dirname "$0")" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
|
|
if [ -n "$ADMIN_PASSWORD_HASH" ] && [ -f "$BACKUP_DIR/.env" ]; then
|
|
echo "ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'" >> "$BACKUP_DIR/.env"
|
|
fi
|
|
fi
|
|
|
|
# Generate Caddyfile (using | delimiter to avoid conflicts with / and @)
|
|
sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
|
|
"$SCRIPT_DIR/config/caddy/Caddyfile" > "$TARGET_DIR/config/caddy/Caddyfile"
|
|
|
|
# Generate Authelia config
|
|
sed -e "s|{DOMAIN}|$DOMAIN|g" \
|
|
-e "s|{JWT_SECRET}|$JWT_SECRET|g" \
|
|
-e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
|
|
-e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
|
|
-e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
|
|
-e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
|
|
-e "s|{SMTP_PASS}|${SMTP_PASS}|g" \
|
|
"$SCRIPT_DIR/config/authelia/configuration.yml" > "$TARGET_DIR/config/authelia/configuration.yml"
|
|
|
|
# Generate users database
|
|
sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
|
|
-e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
|
|
"$SCRIPT_DIR/config/authelia/users_database.yml" > "$TARGET_DIR/config/authelia/users_database.yml"
|
|
|
|
# Copy compose files
|
|
cp "$SCRIPT_DIR/compose/caddy.yaml" "$TARGET_DIR/compose/caddy.yaml"
|
|
cp "$SCRIPT_DIR/compose/authelia.yaml" "$TARGET_DIR/compose/authelia.yaml"
|
|
|
|
# Copy binary
|
|
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
|
if [ -f "$REPO_DIR/VERSION" ]; then
|
|
cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
|
|
fi
|
|
|
|
# Copy www landing page
|
|
if [ -d "$SCRIPT_DIR/config/www" ]; then
|
|
cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"
|
|
fi
|
|
|
|
# Deploy Caddy + Authelia
|
|
echo "[5/5] Deploying Caddy and Authelia..."
|
|
mkdir -p "$TARGET_DIR/data/caddy"
|
|
|
|
# Restore Caddy certs from backup if available
|
|
if [ -d "$BACKUP_DIR/certificates/acme-v02" ]; then
|
|
mkdir -p "$CADDY_CERTS"
|
|
cp -r "$BACKUP_DIR/certificates"/* "$CADDY_CERTS/" 2>/dev/null || true
|
|
echo "[INFO] Restored Caddy certificates from backup"
|
|
fi
|
|
|
|
sudo -u master podman-compose -f "$TARGET_DIR/compose/caddy.yaml" up -d 2>&1 || echo "[WARN] Caddy deploy had issues"
|
|
sudo -u master podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || echo "[WARN] Authelia deploy had issues"
|
|
|
|
# Basic launcher config
|
|
cp -r "$SCRIPT_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/" 2>/dev/null || true
|
|
|
|
# Copy apps.yaml template
|
|
cp "$SCRIPT_DIR/config/nextworkspace/apps.yaml" "$TARGET_DIR/config/nextworkspace/apps.yaml" 2>/dev/null || true
|
|
|
|
# Extract Authelia secret for binary
|
|
AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
|
|
if [ -n "$AUTHELIA_SECRET" ]; then
|
|
if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
|
|
echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
|
|
fi
|
|
fi
|
|
|
|
# Write systemd service
|
|
cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
|
|
[Unit]
|
|
Description=NextWorkspace Launcher
|
|
After=network.target caddy.service authelia.service
|
|
Wants=caddy.service authelia.service
|
|
|
|
[Service]
|
|
Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
|
|
EnvironmentFile=$BACKUP_DIR/.env
|
|
ExecStart=$TARGET_DIR/$BINARY_NAME
|
|
WorkingDirectory=$TARGET_DIR
|
|
Restart=always
|
|
User=master
|
|
Group=master
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now $SERVICE_NAME
|
|
|
|
# --- Smart update ---
|
|
else
|
|
echo "[3/5] Stopping launcher..."
|
|
systemctl stop $SERVICE_NAME 2>/dev/null || true
|
|
echo "[4/5] Swapping binary..."
|
|
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
|
|
|
# Ensure AUTHELIA_SECRET is in .env
|
|
AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
|
|
if [ -n "$AUTHELIA_SECRET" ]; then
|
|
if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
|
|
echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
|
|
echo "[INFO] AUTHELIA_SECRET added to .env"
|
|
fi
|
|
fi
|
|
|
|
echo "[5/5] Restarting services..."
|
|
sudo -u master podman restart caddy authelia 2>/dev/null || true
|
|
systemctl restart $SERVICE_NAME
|
|
fi
|
|
|
|
# --- Health check ---
|
|
echo "[*] Running health check..."
|
|
for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
|
|
if curl -sf http://127.0.0.1:9000/health > /dev/null 2>&1; then
|
|
echo "[OK] NextWorkspace launcher is healthy on http://127.0.0.1:9000/"
|
|
exit 0
|
|
fi
|
|
echo " Attempt $i/$HEALTH_CHECK_RETRIES — not ready yet..."
|
|
sleep $HEALTH_CHECK_INTERVAL
|
|
done
|
|
|
|
echo "[FAIL] Health check failed — launcher did not respond on port 9000"
|
|
exit 1
|