282 lines
6.8 KiB
Bash
282 lines
6.8 KiB
Bash
#!/bin/bash
|
|
|
|
# ==========================================
|
|
# VPS Setup Script for XFlow Server
|
|
# Run this on your fresh VPS
|
|
# ==========================================
|
|
|
|
set -e
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
log() { echo -e "${BLUE}[SETUP]${NC} $1"; }
|
|
success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
|
|
warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
|
|
error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
|
|
|
# ==========================================
|
|
# Configuration
|
|
# ==========================================
|
|
DEPLOY_DIR="/opt/xflow-server"
|
|
REPO_URL="" # Will be set interactively
|
|
DOMAIN="" # Will be set interactively
|
|
|
|
# ==========================================
|
|
# System Update
|
|
# ==========================================
|
|
update_system() {
|
|
log "Updating system packages..."
|
|
apt update && apt upgrade -y
|
|
apt install -y curl wget git nano htop ufw fail2ban
|
|
success "System updated"
|
|
}
|
|
|
|
# ==========================================
|
|
# Install Docker
|
|
# ==========================================
|
|
install_docker() {
|
|
log "Installing Docker..."
|
|
|
|
if command -v docker &> /dev/null; then
|
|
warning "Docker already installed, skipping"
|
|
return
|
|
fi
|
|
|
|
curl -fsSL https://get.docker.com -o get-docker.sh
|
|
sh get-docker.sh
|
|
rm get-docker.sh
|
|
|
|
usermod -aG docker $USER
|
|
|
|
success "Docker installed"
|
|
}
|
|
|
|
# ==========================================
|
|
# Setup Firewall
|
|
# ==========================================
|
|
setup_firewall() {
|
|
log "Configuring firewall..."
|
|
|
|
ufw default deny incoming
|
|
ufw default allow outgoing
|
|
|
|
ufw allow ssh
|
|
ufw allow 80/tcp
|
|
ufw allow 443/tcp
|
|
ufw allow 3000/tcp # Gitea
|
|
ufw allow 8080/tcp # API
|
|
ufw allow 222/tcp # Gitea SSH
|
|
|
|
ufw --force enable
|
|
|
|
success "Firewall configured"
|
|
}
|
|
|
|
# ==========================================
|
|
# Setup Fail2Ban
|
|
# ==========================================
|
|
setup_fail2ban() {
|
|
log "Configuring Fail2Ban..."
|
|
|
|
cat > /etc/fail2ban/jail.local << 'EOF'
|
|
[DEFAULT]
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 3
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
EOF
|
|
|
|
systemctl restart fail2ban
|
|
success "Fail2Ban configured"
|
|
}
|
|
|
|
# ==========================================
|
|
# Setup Deployment Directory
|
|
# ==========================================
|
|
setup_deploy_dir() {
|
|
log "Setting up deployment directory..."
|
|
|
|
mkdir -p "$DEPLOY_DIR"
|
|
cd "$DEPLOY_DIR"
|
|
|
|
# Clone repository
|
|
if [ -n "$REPO_URL" ]; then
|
|
git clone "$REPO_URL" .
|
|
fi
|
|
|
|
# Create necessary directories
|
|
mkdir -p backups logs
|
|
|
|
success "Deployment directory ready"
|
|
}
|
|
|
|
# ==========================================
|
|
# Setup SSL with Let's Encrypt
|
|
# ==========================================
|
|
setup_ssl() {
|
|
log "Setting up SSL certificates..."
|
|
|
|
if [ -z "$DOMAIN" ]; then
|
|
warning "No domain specified, skipping SSL setup"
|
|
return
|
|
fi
|
|
|
|
apt install -y certbot
|
|
|
|
# Obtain certificates
|
|
certbot certonly --standalone -d "$DOMAIN" --agree-tos --non-interactive --email admin@$DOMAIN || {
|
|
warning "SSL setup failed, continuing without SSL"
|
|
return
|
|
}
|
|
|
|
# Auto-renewal cron job
|
|
(crontab -l 2>/dev/null; echo "0 12 * * * /usr/bin/certbot renew --quiet") | crontab -
|
|
|
|
success "SSL certificates configured"
|
|
}
|
|
|
|
# ==========================================
|
|
# Create Environment File
|
|
# ==========================================
|
|
setup_env() {
|
|
log "Creating environment configuration..."
|
|
|
|
cd "$DEPLOY_DIR/server"
|
|
|
|
# Generate secrets
|
|
JWT_SECRET=$(openssl rand -base64 32)
|
|
POSTGRES_PASSWORD=$(openssl rand -base64 24)
|
|
GITEA_SECRET_KEY=$(openssl rand -base64 32)
|
|
WEBDAV_PASSWORD=$(openssl rand -base64 16)
|
|
|
|
cat > .env << EOF
|
|
# Domain configuration
|
|
GITEA_DOMAIN=${DOMAIN:-localhost}
|
|
|
|
# Gitea Configuration
|
|
GITEA_TOKEN=
|
|
GITEA_SECRET_KEY=$GITEA_SECRET_KEY
|
|
|
|
# Security
|
|
JWT_SECRET=$JWT_SECRET
|
|
|
|
# WebDAV
|
|
WEBDAV_USER=admin
|
|
WEBDAV_PASSWORD=$WEBDAV_PASSWORD
|
|
|
|
# Database
|
|
POSTGRES_PASSWORD=$POSTGRES_PASSWORD
|
|
|
|
# API Configuration
|
|
API_PORT=8080
|
|
EOF
|
|
|
|
success "Environment file created"
|
|
warning "Please edit .env file and add your GITEA_TOKEN after first Gitea setup"
|
|
}
|
|
|
|
# ==========================================
|
|
# Create Systemd Service
|
|
# ==========================================
|
|
setup_systemd() {
|
|
log "Creating systemd service..."
|
|
|
|
cat > /etc/systemd/system/xflow-server.service << EOF
|
|
[Unit]
|
|
Description=XFlow Server
|
|
Requires=docker.service
|
|
After=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
WorkingDirectory=$DEPLOY_DIR/server
|
|
ExecStart=/usr/bin/docker compose -f docker-compose.prod.yml up -d
|
|
ExecStop=/usr/bin/docker compose -f docker-compose.prod.yml down
|
|
TimeoutStartSec=0
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable xflow-server.service
|
|
|
|
success "Systemd service created"
|
|
}
|
|
|
|
# ==========================================
|
|
# Interactive Setup
|
|
# ==========================================
|
|
interactive_setup() {
|
|
echo ""
|
|
echo "======================================"
|
|
echo "XFlow Server VPS Setup"
|
|
echo "======================================"
|
|
echo ""
|
|
|
|
read -p "Enter your GitHub repository URL (or leave empty to skip clone): " REPO_URL
|
|
read -p "Enter your domain name (or leave empty for local setup): " DOMAIN
|
|
|
|
echo ""
|
|
log "Starting setup with:"
|
|
log " Repository: ${REPO_URL:-None}"
|
|
log " Domain: ${DOMAIN:-localhost}"
|
|
echo ""
|
|
read -p "Continue? (y/n): " confirm
|
|
|
|
if [ "$confirm" != "y" ]; then
|
|
error "Setup cancelled"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# ==========================================
|
|
# Main
|
|
# ==========================================
|
|
main() {
|
|
interactive_setup
|
|
|
|
log "Starting VPS setup..."
|
|
|
|
update_system
|
|
install_docker
|
|
setup_firewall
|
|
setup_fail2ban
|
|
setup_deploy_dir
|
|
setup_ssl
|
|
setup_env
|
|
setup_systemd
|
|
|
|
echo ""
|
|
success "======================================"
|
|
success "VPS Setup Complete!"
|
|
success "======================================"
|
|
echo ""
|
|
log "Next steps:"
|
|
echo " 1. Edit $DEPLOY_DIR/server/.env with your settings"
|
|
echo " 2. Run: cd $DEPLOY_DIR/server && docker compose -f docker-compose.prod.yml up -d"
|
|
echo " 3. Open Gitea at http://${DOMAIN:-your-server-ip}:3000"
|
|
echo " 4. Create admin account and API token"
|
|
echo " 5. Add GITEA_TOKEN to .env file"
|
|
echo " 6. Restart: systemctl restart xflow-server"
|
|
echo ""
|
|
log "Useful commands:"
|
|
echo " - View logs: docker compose -f docker-compose.prod.yml logs -f"
|
|
echo " - Restart: systemctl restart xflow-server"
|
|
echo " - Update: cd $DEPLOY_DIR && git pull && systemctl restart xflow-server"
|
|
echo ""
|
|
}
|
|
|
|
main "$@"
|