264 lines
8.6 KiB
Bash
Executable file
264 lines
8.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="/opt/NextWks"
|
|
TARGET_DIR="/opt/nextworkspace"
|
|
SERVICE_NAME="nextworkspace"
|
|
BINARY_NAME="nextworkspace"
|
|
HEALTH_CHECK_RETRIES=10
|
|
HEALTH_CHECK_INTERVAL=2
|
|
|
|
# --- Load .env from runtime root ---
|
|
ENV_FILE="$TARGET_DIR/.env"
|
|
if [ -f "$ENV_FILE" ]; then
|
|
set -a
|
|
source "$ENV_FILE"
|
|
set +a
|
|
fi
|
|
|
|
# Default domain if .env wasn't loaded
|
|
DOMAIN="${DOMAIN:-nextwks.eu}"
|
|
|
|
# --- Mode detection ---
|
|
GREENFIELD=false
|
|
if [ "${1:-}" = "--destroy" ]; then
|
|
GREENFIELD=true
|
|
echo "[MODE] Greenfield deploy (--destroy)"
|
|
elif [ ! -d "$TARGET_DIR" ]; then
|
|
GREENFIELD=true
|
|
echo "[MODE] Greenfield deploy (target missing)"
|
|
else
|
|
echo "[MODE] Smart update (target exists)"
|
|
fi
|
|
|
|
# --- Common: pull + build ---
|
|
cd "$REPO_DIR"
|
|
echo "[1/8] Pulling latest code..."
|
|
git pull
|
|
|
|
echo "[2/8] Building binary..."
|
|
export PATH=$PATH:/usr/local/go/bin
|
|
go build -o "$BINARY_NAME" .
|
|
|
|
# --- Greenfield path ---
|
|
if [ "$GREENFIELD" = true ]; then
|
|
echo "[3/8] Removing old deployment..."
|
|
rm -rf "$TARGET_DIR"
|
|
|
|
echo "[4/8] Creating target directories..."
|
|
mkdir -p "$TARGET_DIR/config/nextworkspace"
|
|
mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
|
|
mkdir -p "$TARGET_DIR/data/zoraxy"
|
|
mkdir -p "$TARGET_DIR/compose"
|
|
mkdir -p "$TARGET_DIR/logs"
|
|
|
|
echo "[5/8] Copying binary..."
|
|
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
|
|
|
echo "[6/8] Deploying Zoraxy..."
|
|
cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
|
|
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)"
|
|
|
|
# Generate Zoraxy proxy configs with actual domain
|
|
echo "[*] Generating Zoraxy proxy configs..."
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
|
|
{
|
|
"ProxyType": 1,
|
|
"RootOrMatchingDomain": "app.$DOMAIN",
|
|
"ActiveOrigins": [{
|
|
"OriginIpOrDomain": "127.0.0.1:9000",
|
|
"RequireTLS": false,
|
|
"Weight": 1,
|
|
"MaxConn": 0
|
|
}],
|
|
"Disabled": false,
|
|
"AuthenticationProvider": {"AuthMethod": 4}
|
|
}
|
|
ZORAXY_APP
|
|
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/dns.$DOMAIN.config" <<ZORAXY_DNS
|
|
{
|
|
"ProxyType": 1,
|
|
"RootOrMatchingDomain": "dns.$DOMAIN",
|
|
"ActiveOrigins": [{
|
|
"OriginIpOrDomain": "127.0.0.1:8000",
|
|
"RequireTLS": false,
|
|
"Weight": 1,
|
|
"MaxConn": 0
|
|
}],
|
|
"Disabled": false,
|
|
"AuthenticationProvider": {"AuthMethod": 0}
|
|
}
|
|
ZORAXY_DNS
|
|
|
|
# Copy launcher config files
|
|
cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
|
|
|
|
# Create Zoraxy admin account
|
|
echo "[*] Creating Zoraxy admin account..."
|
|
ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"
|
|
|
|
# Wait for Zoraxy to be ready
|
|
for i in $(seq 1 15); do
|
|
if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
|
|
break
|
|
fi
|
|
echo " Waiting for Zoraxy... ($i/15)"
|
|
sleep 2
|
|
done
|
|
|
|
# Fetch CSRF token AND session cookie from Zoraxy login page (follow redirect)
|
|
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
|
rm -f "$COOKIE_JAR"
|
|
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
|
|
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
|
if [ -z "$CSRF_TOKEN" ]; then
|
|
echo "[WARN] Could not fetch CSRF token, trying without it..."
|
|
ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
|
|
-d "username=${ADMIN_USERNAME:-admin}" \
|
|
-d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
|
|
else
|
|
echo "[OK] CSRF token acquired"
|
|
ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
|
|
-H "X-CSRF-Token: $CSRF_TOKEN" \
|
|
-d "username=${ADMIN_USERNAME:-master}" \
|
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
|
fi
|
|
|
|
if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then
|
|
echo "[OK] Zoraxy admin account created"
|
|
elif echo "$ADMIN_CREATE" | grep -qi '"error'; then
|
|
echo "[WARN] Admin account create issue: $ADMIN_CREATE"
|
|
else
|
|
echo "[INFO] Admin API response: $ADMIN_CREATE"
|
|
fi
|
|
|
|
# --- Login to Zoraxy API for authenticated operations ---
|
|
echo "[*] Logging in to Zoraxy API..."
|
|
# Re-fetch CSRF token with fresh cookies for login
|
|
LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
|
|
CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
|
LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
|
-H "X-CSRF-Token: ${CSRF_TOKEN}" \
|
|
-d "username=${ADMIN_USERNAME:-master}" \
|
|
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}")
|
|
|
|
if echo "$LOGIN_RESPONSE" | grep -qi '"success"\|"ok"'; then
|
|
echo "[OK] Logged in as $ADMIN_USERNAME"
|
|
else
|
|
echo "[WARN] Login response: $LOGIN_RESPONSE"
|
|
fi
|
|
|
|
# --- Configure Let's Encrypt ---
|
|
echo "[*] Setting Let's Encrypt email..."
|
|
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
|
-d "set=${TLS_EMAIL}" > /dev/null
|
|
|
|
echo "[*] Obtaining certificates for app.${DOMAIN}..."
|
|
OBTAIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
|
-G \
|
|
-d "domains=app.${DOMAIN}" \
|
|
-d "filename=app.${DOMAIN}" \
|
|
-d "email=${TLS_EMAIL}" \
|
|
-d "ca=Let's Encrypt" \
|
|
-d "dns=false" 2>&1)
|
|
|
|
if echo "$OBTAIN_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
|
|
echo "[OK] Let's Encrypt certificate obtained for app.${DOMAIN}"
|
|
else
|
|
echo "[INFO] Certificate result: $OBTAIN_RESULT"
|
|
echo "[INFO] This may fail in dev if DNS doesn't point here — auto-renew will retry."
|
|
fi
|
|
|
|
echo "[*] Enabling auto-renew..."
|
|
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
|
-d "enable=true" > /dev/null
|
|
|
|
# --- Configure ZorxAuth SSO ---
|
|
echo "[*] Configuring ZorxAuth SSO..."
|
|
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/sso/zorxauth/provider" \
|
|
-d "enable=true" \
|
|
-d "name=NextWorkspace" \
|
|
-d "admin=${ADMIN_USERNAME}" > /dev/null
|
|
|
|
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/sso/zorxauth/gateway" \
|
|
-d "redirect=https://app.${DOMAIN}/" > /dev/null
|
|
|
|
echo "[OK] ZorxAuth SSO configured"
|
|
|
|
# --- Generate launcher apps.yaml with actual domain ---
|
|
cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
|
|
apps:
|
|
- name: "NextWorkspace"
|
|
subtitle: "Your Workspace"
|
|
url: "https://app.${DOMAIN}/"
|
|
icon: "home"
|
|
- name: "Admin"
|
|
subtitle: "Zoraxy Settings"
|
|
url: "https://dns.${DOMAIN}/"
|
|
icon: "settings"
|
|
EOF
|
|
|
|
# --- Restart Zoraxy to apply config changes ---
|
|
echo "[*] Restarting Zoraxy to apply configs..."
|
|
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
|
sleep 2
|
|
|
|
# Write systemd service and start launcher
|
|
echo "[7/8] Writing systemd service and starting launcher..."
|
|
cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
|
|
[Unit]
|
|
Description=NextWorkspace Launcher
|
|
After=network.target
|
|
|
|
[Service]
|
|
Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
|
|
ExecStart=$TARGET_DIR/$BINARY_NAME
|
|
WorkingDirectory=$TARGET_DIR
|
|
Restart=always
|
|
User=root
|
|
Group=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now $SERVICE_NAME
|
|
|
|
# --- Smart update path ---
|
|
else
|
|
echo "[3/8] Stopping launcher..."
|
|
systemctl stop $SERVICE_NAME 2>/dev/null || true
|
|
|
|
echo "[4/8] Swapping binary..."
|
|
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
|
|
|
echo "[5/8] Refreshing configs..."
|
|
if [ -f config/nextworkspace/apps.yaml ]; then
|
|
cp config/nextworkspace/apps.yaml "$TARGET_DIR/config/nextworkspace/apps.yaml"
|
|
fi
|
|
if [ -d config/zoraxy/conf/proxy ]; then
|
|
cp config/zoraxy/conf/proxy/* "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
|
fi
|
|
|
|
echo "[6/8] Restarting Zoraxy..."
|
|
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
|
|
|
echo "[7/8] Starting launcher..."
|
|
systemctl restart $SERVICE_NAME
|
|
fi
|
|
|
|
# --- Health check ---
|
|
echo "[*] Running health check..."
|
|
for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
|
|
if curl -sf http://127.0.0.1:9000/health > /dev/null 2>&1; then
|
|
echo "[OK] NextWorkspace launcher is healthy on http://127.0.0.1:9000/"
|
|
exit 0
|
|
fi
|
|
echo " Attempt $i/$HEALTH_CHECK_RETRIES — not ready yet..."
|
|
sleep $HEALTH_CHECK_INTERVAL
|
|
done
|
|
|
|
echo "[FAIL] Health check failed — launcher did not respond on port 9000"
|
|
exit 1
|