123 lines
5.7 KiB
Bash
123 lines
5.7 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
src_dir=${1:-/tmp/xtao-phase03}
|
|
compose_src="$src_dir/compose.yaml"
|
|
traefik_src="$src_dir/nextcloud-traefik.yml"
|
|
runner_src="$src_dir/secret_agent_runner_phase03.py"
|
|
|
|
docker_bin=/usr/local/bin/docker
|
|
compose_bin=/usr/local/bin/docker-compose
|
|
agent=/usr/local/bin/xtao-secret-agent
|
|
ts=$(date -u +%Y%m%dT%H%M%SZ)
|
|
|
|
[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
|
|
[ -r "$compose_src" ] || { echo "FAIL missing_compose_src"; exit 2; }
|
|
[ -r "$traefik_src" ] || { echo "FAIL missing_traefik_src"; exit 2; }
|
|
[ -r "$runner_src" ] || { echo "FAIL missing_runner_src"; exit 2; }
|
|
[ -x "$agent" ] || { echo "FAIL missing_secret_agent"; exit 2; }
|
|
|
|
install -d -m 700 /volume1/xtao-data/nextcloud
|
|
install -d -m 700 /volume1/xtao-data/nextcloud/secrets
|
|
install -d -m 700 /volume1/xtao-data/nextcloud/html
|
|
install -d -m 700 /volume1/xtao-data/nextcloud/data
|
|
install -d -m 700 /volume1/xtao-data/nextcloud/postgres
|
|
install -d -m 700 /volume1/xtao-data/nextcloud/redis
|
|
install -d -m 700 /volume1/xtao-data/nextcloud/backups
|
|
install -d -m 700 /volume1/xtao-data/traefik/dynamic
|
|
|
|
runner_dst=/volume1/xtao-data/secret-agent/bin/secret_agent_runner.py
|
|
[ -f "$runner_dst" ] && cp -p "$runner_dst" "$runner_dst.bak.phase03.$ts"
|
|
install -m 600 "$runner_src" "$runner_dst"
|
|
|
|
"$agent" probe
|
|
"$agent" upsert --entry infra/nextcloud/admin
|
|
"$agent" upsert --entry infra/nextcloud/postgres
|
|
"$agent" upsert --entry infra/nextcloud/redis
|
|
"$agent" check --entry infra/nextcloud/admin
|
|
"$agent" check --entry infra/nextcloud/postgres
|
|
"$agent" check --entry infra/nextcloud/redis
|
|
|
|
tmpdir=$(mktemp -d /volume1/xtao-data/nextcloud/secrets/.tmp.XXXXXX)
|
|
chmod 700 "$tmpdir"
|
|
|
|
postgres_env="$tmpdir/postgres.env"
|
|
nextcloud_env="$tmpdir/nextcloud.env"
|
|
redis_conf="$tmpdir/redis.conf"
|
|
|
|
{
|
|
printf 'POSTGRES_DB='
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field database
|
|
printf '\nPOSTGRES_USER='
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field username
|
|
printf '\nPOSTGRES_PASSWORD='
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field password
|
|
printf '\n'
|
|
} > "$postgres_env"
|
|
|
|
{
|
|
printf 'POSTGRES_HOST=nextcloud-db\n'
|
|
printf 'POSTGRES_DB='
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field database
|
|
printf '\nPOSTGRES_USER='
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field username
|
|
printf '\nPOSTGRES_PASSWORD='
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field password
|
|
printf '\nREDIS_HOST=nextcloud-redis\nREDIS_HOST_PORT=6379\nREDIS_HOST_PASSWORD='
|
|
"$agent" raw-field --entry infra/nextcloud/redis --field password
|
|
printf '\nNEXTCLOUD_ADMIN_USER='
|
|
"$agent" raw-field --entry infra/nextcloud/admin --field username
|
|
printf '\nNEXTCLOUD_ADMIN_PASSWORD='
|
|
"$agent" raw-field --entry infra/nextcloud/admin --field password
|
|
printf '\nNEXTCLOUD_TRUSTED_DOMAINS=cloud.xtao.net\n'
|
|
printf 'TRUSTED_PROXIES=172.16.0.0/12 192.168.1.0/24\n'
|
|
printf 'OVERWRITEHOST=cloud.xtao.net\nOVERWRITEPROTOCOL=https\nOVERWRITECLIURL=https://cloud.xtao.net\n'
|
|
printf 'APACHE_DISABLE_REWRITE_IP=1\nPHP_MEMORY_LIMIT=1024M\nPHP_UPLOAD_LIMIT=10G\n'
|
|
} > "$nextcloud_env"
|
|
|
|
{
|
|
printf 'appendonly yes\n'
|
|
printf 'requirepass '
|
|
"$agent" raw-field --entry infra/nextcloud/redis --field password
|
|
printf '\n'
|
|
} > "$redis_conf"
|
|
|
|
chmod 600 "$postgres_env" "$nextcloud_env" "$redis_conf"
|
|
mv "$postgres_env" /volume1/xtao-data/nextcloud/secrets/postgres.env
|
|
mv "$nextcloud_env" /volume1/xtao-data/nextcloud/secrets/nextcloud.env
|
|
mv "$redis_conf" /volume1/xtao-data/nextcloud/secrets/redis.conf
|
|
chown 999:0 /volume1/xtao-data/nextcloud/secrets/redis.conf
|
|
chmod 400 /volume1/xtao-data/nextcloud/secrets/redis.conf
|
|
rmdir "$tmpdir"
|
|
|
|
[ -f /volume1/xtao-data/nextcloud/compose.yaml ] && cp -p /volume1/xtao-data/nextcloud/compose.yaml "/volume1/xtao-data/nextcloud/compose.yaml.bak.phase03.$ts"
|
|
install -m 600 "$compose_src" /volume1/xtao-data/nextcloud/compose.yaml
|
|
|
|
[ -f /volume1/xtao-data/traefik/dynamic/nextcloud.yml ] && cp -p /volume1/xtao-data/traefik/dynamic/nextcloud.yml "/volume1/xtao-data/traefik/dynamic/nextcloud.yml.bak.phase03.$ts"
|
|
install -m 600 "$traefik_src" /volume1/xtao-data/traefik/dynamic/nextcloud.yml
|
|
|
|
cd /volume1/xtao-data/nextcloud
|
|
"$compose_bin" -f compose.yaml config >/dev/null
|
|
"$compose_bin" -f compose.yaml pull
|
|
"$compose_bin" -f compose.yaml up -d
|
|
|
|
for i in $(seq 1 90); do
|
|
if "$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ status >/tmp/xtao-nextcloud-occ-status 2>&1; then
|
|
break
|
|
fi
|
|
sleep 4
|
|
done
|
|
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ background:cron
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_domains 1 --value=cloud.xtao.net
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 0 --value=172.16.0.0/12
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 1 --value=192.168.1.0/24
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwritehost --value=cloud.xtao.net
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwriteprotocol --value=https
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwrite.cli.url --value=https://cloud.xtao.net
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set htaccess.RewriteBase --value=/
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set maintenance_window_start --type=integer --value=8
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ maintenance:update:htaccess
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ status
|
|
|
|
printf 'PASS nextcloud_deploy route=cloud.xtao.net secrets=redacted compose=/volume1/xtao-data/nextcloud/compose.yaml\n'
|