393 lines
12 KiB
Bash
Executable file
393 lines
12 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="/opt/NextWks"
|
|
REPO_URL="https://git.lohmar.co.uk/lexton-it/NextWks.git"
|
|
TARGET_DIR="/opt/nextworkspace"
|
|
BACKUP_DIR="/opt/backup"
|
|
SERVICE_NAME="nextworkspace"
|
|
BINARY_NAME="nextworkspace"
|
|
HEALTH_CHECK_RETRIES=10
|
|
HEALTH_CHECK_INTERVAL=2
|
|
|
|
# --- Load .env from backup vault (written by install.sh) ---
|
|
if [ -f "$BACKUP_DIR/.env" ]; then
|
|
set -a
|
|
source "$BACKUP_DIR/.env"
|
|
set +a
|
|
DOMAIN="${DOMAIN:-nextwks.eu}"
|
|
elif [ -f "$TARGET_DIR/.env" ]; then
|
|
set -a
|
|
source "$TARGET_DIR/.env"
|
|
set +a
|
|
DOMAIN="${DOMAIN:-nextwks.eu}"
|
|
else
|
|
DOMAIN="${DOMAIN:-nextwks.eu}"
|
|
fi
|
|
|
|
# Subdomain prefixes (hardcoded — change here if needed)
|
|
APP_SUB="hub"
|
|
DNS_SUB="noc"
|
|
WWW_SUB="www"
|
|
AUTH_SUB="auth"
|
|
|
|
# --- Mode detection ---
|
|
GREENFIELD=false
|
|
if [ "${1:-}" = "--destroy" ]; then
|
|
GREENFIELD=true
|
|
echo "[MODE] Greenfield deploy (--destroy)"
|
|
elif [ ! -d "$TARGET_DIR" ]; then
|
|
GREENFIELD=true
|
|
echo "[MODE] Greenfield deploy (target missing)"
|
|
else
|
|
echo "[MODE] Smart update (target exists)"
|
|
fi
|
|
|
|
# --- Common: ensure repo exists, pull + build ---
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
if [ ! -d "$REPO_DIR" ]; then
|
|
echo "[1/6] Cloning repository..."
|
|
git clone "$REPO_URL" "$REPO_DIR"
|
|
elif [ -d "$REPO_DIR/.git" ]; then
|
|
echo "[1/6] Pulling latest code..."
|
|
cd "$REPO_DIR" && git pull
|
|
else
|
|
echo "[1/6] Using existing code..."
|
|
fi
|
|
cd "$REPO_DIR" 2>/dev/null || mkdir -p "$REPO_DIR"
|
|
|
|
echo "[2/6] Building binary and helper tool..."
|
|
export PATH=$PATH:/usr/local/go/bin
|
|
go build -o "$BINARY_NAME" .
|
|
|
|
# Build helper tool from script directory (has correct go.mod with all deps)
|
|
TOOL_BIN="/tmp/nextwks-tool"
|
|
TOOL_SRC="$SCRIPT_DIR/tools/nextwks-tool"
|
|
if [ -d "$TOOL_SRC" ]; then
|
|
cd "$TOOL_SRC"
|
|
go build -o "$TOOL_BIN" . 2>&1 && echo "[OK] Helper tool built" || echo "[WARN] Helper tool build failed"
|
|
cd "$REPO_DIR"
|
|
fi
|
|
|
|
# Install lego if not present (for LE certificate management)
|
|
if ! command -v lego &>/dev/null && [ -f "$TOOL_BIN" ]; then
|
|
echo "[*] Installing lego ACME client..."
|
|
"$TOOL_BIN" install-lego 2>&1 || echo "[WARN] Lego install failed"
|
|
fi
|
|
|
|
# --- Greenfield path ---
|
|
if [ "$GREENFIELD" = true ]; then
|
|
|
|
# Step 3: Full teardown — stop, disable, remove all services
|
|
echo "[3/6] Full service teardown..."
|
|
systemctl stop $SERVICE_NAME 2>/dev/null || true
|
|
systemctl disable $SERVICE_NAME 2>/dev/null || true
|
|
rm -f /etc/systemd/system/$SERVICE_NAME.service
|
|
systemctl daemon-reload
|
|
podman rm -f zoraxy 2>/dev/null || true
|
|
# Wait for port 80 to be released
|
|
for i in $(seq 1 10); do
|
|
if ! ss -tlnp | grep -q ':80 '; then
|
|
break
|
|
fi
|
|
echo " Waiting for port 80 to be released... ($i/10)"
|
|
sleep 1
|
|
done
|
|
|
|
# Wipe production directory
|
|
if [ -d "$TARGET_DIR" ]; then
|
|
chattr -R -i "$TARGET_DIR" 2>/dev/null || true
|
|
rm -rf "$TARGET_DIR"
|
|
fi
|
|
|
|
# Step 4: Run helper tool — port 80 is free, can obtain LE certs via HTTP-01
|
|
echo "[4/6] Checking certificates..."
|
|
mkdir -p "$BACKUP_DIR/certificates"
|
|
if [ -f "$TOOL_BIN" ]; then
|
|
DRY=""
|
|
[ "${LE_DRY_RUN:-false}" = "true" ] && DRY="--dry-run"
|
|
"$TOOL_BIN" cert \
|
|
--domains "${APP_SUB}.${DOMAIN},${DNS_SUB}.${DOMAIN},${WWW_SUB}.${DOMAIN}" \
|
|
--email "${TLS_EMAIL:-admin@${DOMAIN}}" \
|
|
--backup-dir "$BACKUP_DIR/certificates" $DRY 2>&1 || true
|
|
fi
|
|
|
|
# Step 5: Build production directory structure
|
|
echo "[5/6] Building production directory structure..."
|
|
mkdir -p "$TARGET_DIR/config/nextworkspace"
|
|
mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
|
|
mkdir -p "$TARGET_DIR/config/zoraxy/conf/certs"
|
|
mkdir -p "$TARGET_DIR/config/zoraxy/www/html"
|
|
mkdir -p "$TARGET_DIR/data/zoraxy"
|
|
mkdir -p "$TARGET_DIR/compose"
|
|
mkdir -p "$TARGET_DIR/logs"
|
|
|
|
# Copy .env from backup vault
|
|
if [ -f "$BACKUP_DIR/.env" ]; then
|
|
cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
|
|
chmod 600 "$TARGET_DIR/.env"
|
|
echo "[INFO] .env deployed from backup"
|
|
fi
|
|
|
|
# Copy certificates from backup vault to Zoraxy cert dir
|
|
for DOMAIN_SUB in $APP_SUB $DNS_SUB $WWW_SUB; do
|
|
FQDN="${DOMAIN_SUB}.${DOMAIN}"
|
|
CERT_SRC="$BACKUP_DIR/certificates/${FQDN}/fullchain.pem"
|
|
KEY_SRC="$BACKUP_DIR/certificates/${FQDN}/privkey.pem"
|
|
if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
|
|
cp "$CERT_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.crt"
|
|
cp "$KEY_SRC" "$TARGET_DIR/config/zoraxy/conf/certs/${FQDN}.key"
|
|
echo "[INFO] Cert deployed: ${FQDN}"
|
|
fi
|
|
done
|
|
|
|
# Copy binary
|
|
echo "[6/6] Deploying..."
|
|
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
|
if [ -f "$REPO_DIR/VERSION" ]; then
|
|
cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
|
|
echo "[INFO] Version: $(cat $TARGET_DIR/VERSION)"
|
|
fi
|
|
|
|
# Write configs before starting Zoraxy (BoltDB must not be locked)
|
|
echo "[*] Writing configuration files..."
|
|
|
|
# Write ACME config
|
|
mkdir -p "$TARGET_DIR/config/zoraxy/conf"
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/acme_conf.json" <<EOF
|
|
{
|
|
"Enabled": true,
|
|
"Email": "${TLS_EMAIL}",
|
|
"RenewAll": true,
|
|
"FilesToRenew": [],
|
|
"DNSServers": ""
|
|
}
|
|
EOF
|
|
|
|
# Write admin + ZorxAuth to BoltDB (Zoraxy not running, db not locked)
|
|
if [ -f "$TOOL_BIN" ]; then
|
|
# Create the data directory and an empty database
|
|
mkdir -p "$TARGET_DIR/data/zoraxy"
|
|
touch "$TARGET_DIR/data/zoraxy/sys.db"
|
|
"$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
|
|
--set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
|
|
"$TOOL_BIN" db --db "$TARGET_DIR/data/zoraxy/sys.db" \
|
|
--set "zorxauth:options:{\"enable_auth_gateway\":true,\"sso_redirect_url\":\"https://app.${DOMAIN}/\"}" 2>&1 || true
|
|
echo " [OK] Admin + ZorxAuth written to BoltDB"
|
|
fi
|
|
|
|
# Deploy Zoraxy
|
|
cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
|
|
podman rm -f zoraxy 2>/dev/null || true
|
|
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues"
|
|
|
|
# Generate Zoraxy proxy configs
|
|
echo "[*] Generating Zoraxy proxy configs..."
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
|
|
{
|
|
"ProxyType": 1,
|
|
"RootOrMatchingDomain": "${APP_SUB}.$DOMAIN",
|
|
"ActiveOrigins": [{
|
|
"OriginIpOrDomain": "127.0.0.1:9000",
|
|
"RequireTLS": false,
|
|
"Weight": 1,
|
|
"MaxConn": 0
|
|
}],
|
|
"Disabled": false,
|
|
"AuthenticationProvider": {"AuthMethod": 0}
|
|
}
|
|
ZORAXY_APP
|
|
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/$DNS_SUB.$DOMAIN.config" <<ZORAXY_DNS
|
|
{
|
|
"ProxyType": 1,
|
|
"RootOrMatchingDomain": "${DNS_SUB}.$DOMAIN",
|
|
"ActiveOrigins": [{
|
|
"OriginIpOrDomain": "127.0.0.1:8000",
|
|
"RequireTLS": false,
|
|
"Weight": 1,
|
|
"MaxConn": 0
|
|
}],
|
|
"Disabled": false,
|
|
"AuthenticationProvider": {"AuthMethod": 0}
|
|
}
|
|
ZORAXY_DNS
|
|
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/$WWW_SUB.$DOMAIN.config" <<ZORAXY_WWW
|
|
{
|
|
"ProxyType": 1,
|
|
"RootOrMatchingDomain": "${WWW_SUB}.$DOMAIN",
|
|
"ActiveOrigins": [{
|
|
"OriginIpOrDomain": "127.0.0.1:9000",
|
|
"RequireTLS": false,
|
|
"Weight": 1,
|
|
"MaxConn": 0
|
|
}],
|
|
"Disabled": false,
|
|
"AuthenticationProvider": {"AuthMethod": 0}
|
|
}
|
|
ZORAXY_WWW
|
|
|
|
cat > "$TARGET_DIR/config/zoraxy/conf/proxy/auth.$DOMAIN.config" <<ZORAXY_AUTH
|
|
{
|
|
"ProxyType": 1,
|
|
"RootOrMatchingDomain": "${AUTH_SUB}.$DOMAIN",
|
|
"ActiveOrigins": [{
|
|
"OriginIpOrDomain": "127.0.0.1:5489",
|
|
"RequireTLS": false,
|
|
"Weight": 1,
|
|
"MaxConn": 0
|
|
}],
|
|
"Disabled": false,
|
|
"AuthenticationProvider": {"AuthMethod": 0}
|
|
}
|
|
ZORAXY_AUTH
|
|
|
|
chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
|
|
|
# Copy landing page
|
|
cp -r config/www/* "$TARGET_DIR/config/zoraxy/www/html/"
|
|
|
|
# Copy launcher config
|
|
cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"
|
|
|
|
# Generate apps.yaml
|
|
echo "[*] Generating apps.yaml..."
|
|
cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
|
|
apps:
|
|
- name: "OpenCloud"
|
|
subtitle: "File Storage"
|
|
path: "/cloud"
|
|
upstream: "http://127.0.0.1:9100"
|
|
icon: "cloud"
|
|
- name: "Euro Office"
|
|
subtitle: "Collaborative Suite"
|
|
path: "/office"
|
|
upstream: "http://127.0.0.1:9200"
|
|
icon: "office"
|
|
- name: "ERPNext"
|
|
subtitle: "Enterprise ERP"
|
|
path: "/erp"
|
|
upstream: "http://127.0.0.1:9300"
|
|
icon: "erp"
|
|
- name: "Matrix Chat"
|
|
subtitle: "Team Communication"
|
|
path: "/chat"
|
|
upstream: "http://127.0.0.1:9400"
|
|
icon: "chat"
|
|
- name: "Jitsi"
|
|
subtitle: "Video Conferencing"
|
|
path: "/meet"
|
|
upstream: "http://127.0.0.1:9500"
|
|
icon: "video"
|
|
- name: "Webmail"
|
|
subtitle: "Email Client"
|
|
path: "/mail"
|
|
upstream: "http://127.0.0.1:9600"
|
|
icon: "mail"
|
|
- name: "AI Chat"
|
|
subtitle: "Open WebUI"
|
|
path: "/ai"
|
|
upstream: "http://127.0.0.1:9700"
|
|
icon: "bot"
|
|
- name: "Portainer"
|
|
subtitle: "Container Management"
|
|
path: "/admin"
|
|
upstream: "http://127.0.0.1:9800"
|
|
icon: "admin"
|
|
EOF
|
|
|
|
# Upload certs to Zoraxy via API (needed to register them in sys.db)
|
|
echo "[*] Registering certificates in Zoraxy..."
|
|
# Wait for Zoraxy to be ready
|
|
for i in $(seq 1 15); do
|
|
if curl -sf --max-time 3 "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
|
|
for SUB in $APP_SUB $DNS_SUB $WWW_SUB; do
|
|
FQDN="${SUB}.${DOMAIN}"
|
|
CRT_FILE="$CERTS_DIR/${FQDN}.crt"
|
|
[ -f "$CRT_FILE" ] || continue
|
|
for TRY in 1 2 3; do
|
|
rm -f /tmp/zc.txt
|
|
C=$(curl -s --max-time 5 -c /tmp/zc.txt "http://127.0.0.1:8000/login.html" 2>&1)
|
|
T=$(echo "$C" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
|
|
if [ -z "$T" ]; then
|
|
echo " Retry $TRY for $FQDN (no CSRF)"
|
|
sleep 2
|
|
continue
|
|
fi
|
|
R=$(curl -s --max-time 5 -b /tmp/zc.txt -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
|
|
-H "X-CSRF-Token: $T" --data-binary "@$CRT_FILE" 2>&1) || true
|
|
if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then
|
|
echo " [OK] Cert registered: $FQDN"
|
|
break
|
|
else
|
|
echo " Retry $TRY for $FQDN: $(echo $R | head -c 80)"
|
|
sleep 2
|
|
fi
|
|
done
|
|
done
|
|
echo " [*] Certificate registration complete"
|
|
|
|
# Write systemd service
|
|
echo "[*] Writing systemd service..."
|
|
cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
|
|
[Unit]
|
|
Description=NextWorkspace Launcher
|
|
After=network.target
|
|
|
|
[Service]
|
|
Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
|
|
EnvironmentFile=$BACKUP_DIR/.env
|
|
ExecStart=$TARGET_DIR/$BINARY_NAME
|
|
WorkingDirectory=$TARGET_DIR
|
|
Restart=always
|
|
User=root
|
|
Group=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now $SERVICE_NAME
|
|
|
|
# --- Smart update path ---
|
|
else
|
|
echo "[3/6] Stopping launcher..."
|
|
systemctl stop $SERVICE_NAME 2>/dev/null || true
|
|
|
|
echo "[4/6] Swapping binary..."
|
|
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
|
|
|
echo "[5/6] Refreshing configs..."
|
|
if [ -f config/nextworkspace/apps.yaml ]; then
|
|
cp config/nextworkspace/apps.yaml "$TARGET_DIR/config/nextworkspace/apps.yaml"
|
|
fi
|
|
if [ -d config/zoraxy/conf/proxy ]; then
|
|
cp config/zoraxy/conf/proxy/* "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
|
|
fi
|
|
|
|
echo "[6/6] Restarting Zoraxy and launcher..."
|
|
podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
|
|
systemctl restart $SERVICE_NAME
|
|
fi
|
|
|
|
# --- Health check ---
|
|
echo "[*] Running health check..."
|
|
for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
|
|
if curl -sf http://127.0.0.1:9000/health > /dev/null 2>&1; then
|
|
echo "[OK] NextWorkspace launcher is healthy on http://127.0.0.1:9000/"
|
|
exit 0
|
|
fi
|
|
echo " Attempt $i/$HEALTH_CHECK_RETRIES — not ready yet..."
|
|
sleep $HEALTH_CHECK_INTERVAL
|
|
done
|
|
|
|
echo "[FAIL] Health check failed — launcher did not respond on port 9000"
|
|
exit 1
|