50 lines
1.8 KiB
Bash
50 lines
1.8 KiB
Bash
#!/usr/bin/env bash
|
|
# One-time server setup for mediator on Ubuntu. Run as root ON THE SERVER,
|
|
# from a directory containing mediator.service and mediator.nginx.conf:
|
|
#
|
|
# sudo ./setup-server.sh <deploy-user> <domain>
|
|
#
|
|
# <deploy-user> the account you ssh in as; it gets write access to
|
|
# /opt/mediator and passwordless `systemctl restart mediator`
|
|
# <domain> the public hostname nginx should answer on
|
|
set -euo pipefail
|
|
|
|
DEPLOY_USER="${1:?usage: setup-server.sh <deploy-user> <domain>}"
|
|
DOMAIN="${2:?usage: setup-server.sh <deploy-user> <domain>}"
|
|
APP_DIR=/opt/mediator
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
id -u "$DEPLOY_USER" >/dev/null
|
|
|
|
# Unprivileged system user the service runs as.
|
|
id -u mediator >/dev/null 2>&1 ||
|
|
useradd --system --home "$APP_DIR" --shell /usr/sbin/nologin mediator
|
|
|
|
# Deploy user owns the app dir (to replace the binary); the service user
|
|
# owns only the data dir (the single thing it writes).
|
|
mkdir -p "$APP_DIR/data"
|
|
chown "$DEPLOY_USER" "$APP_DIR"
|
|
chmod 755 "$APP_DIR"
|
|
chown mediator:mediator "$APP_DIR/data"
|
|
chmod 750 "$APP_DIR/data"
|
|
|
|
install -m 644 "$SCRIPT_DIR/mediator.service" /etc/systemd/system/mediator.service
|
|
|
|
sed "s/mediator\.example\.com/$DOMAIN/" "$SCRIPT_DIR/mediator.nginx.conf" \
|
|
> /etc/nginx/sites-available/mediator
|
|
ln -sf /etc/nginx/sites-available/mediator /etc/nginx/sites-enabled/mediator
|
|
|
|
# Let the deploy user restart the service without a sudo password,
|
|
# so deploy.sh needs exactly one (ssh) password prompt.
|
|
printf '%s ALL=(root) NOPASSWD: /usr/bin/systemctl restart mediator\n' "$DEPLOY_USER" \
|
|
> /etc/sudoers.d/mediator-deploy
|
|
chmod 440 /etc/sudoers.d/mediator-deploy
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable mediator
|
|
nginx -t
|
|
systemctl reload nginx
|
|
|
|
echo "Setup done. Now push a binary from your machine: ./deploy/deploy.sh"
|
|
echo "For HTTPS: certbot --nginx -d $DOMAIN"
|