WIP: recover runtime implementation after accidental git clean
This commit is contained in:
thakares committed
1 parent
5abbf5123e
commit
6a04d7f793
10 files changed
+563
No files matched your search
@@ -0,0 +1,171 @@
|
||||
#!/usr/bin/env bash
|
||||
# deploy.sh — nx9-auth installer for Debian/Ubuntu systems
|
||||
#
|
||||
# Usage: sudo bash deploy.sh [path/to/nx9-auth-binary]
|
||||
# Requires: root, systemd
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
BINARY_PATH="${1:-./target/release/nx9-auth}"
|
||||
SERVICE_USER="nx9-auth"
|
||||
INSTALL_BIN="/usr/local/bin/nx9-auth"
|
||||
CONFIG_DIR="/etc/nx9-auth"
|
||||
DATA_DIR="/var/lib/nx9-auth"
|
||||
LOG_DIR="/var/log/nx9-auth"
|
||||
SERVICE_FILE="/etc/systemd/system/nx9-auth.service"
|
||||
|
||||
# ── Colours ───────────────────────────────────────────────────────────────────
|
||||
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
||||
ok() { echo -e "${GREEN} ✓${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW} !${NC} $*"; }
|
||||
fail() { echo -e "${RED} ✗${NC} $*"; exit 1; }
|
||||
|
||||
# ── Prerequisites ─────────────────────────────────────────────────────────────
|
||||
[[ $EUID -eq 0 ]] || fail "This script must be run as root."
|
||||
[[ -f "$BINARY_PATH" ]] || fail "Binary not found at: $BINARY_PATH — build with 'cargo build --release' first."
|
||||
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo " nx9-auth deploy"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo ""
|
||||
|
||||
# ── Create system user ────────────────────────────────────────────────────────
|
||||
if id -u "$SERVICE_USER" &>/dev/null; then
|
||||
warn "System user '$SERVICE_USER' already exists — skipping creation."
|
||||
else
|
||||
useradd --system --no-create-home --shell /usr/sbin/nologin "$SERVICE_USER"
|
||||
ok "Created system user: $SERVICE_USER"
|
||||
fi
|
||||
|
||||
# ── Create directories ────────────────────────────────────────────────────────
|
||||
for dir in "$CONFIG_DIR" "$DATA_DIR" "$LOG_DIR"; do
|
||||
mkdir -p "$dir"
|
||||
chown "$SERVICE_USER:$SERVICE_USER" "$dir"
|
||||
chmod 750 "$dir"
|
||||
done
|
||||
ok "Directories created: $CONFIG_DIR, $DATA_DIR, $LOG_DIR"
|
||||
|
||||
# ── Install binary ────────────────────────────────────────────────────────────
|
||||
cp "$BINARY_PATH" "$INSTALL_BIN"
|
||||
chmod 755 "$INSTALL_BIN"
|
||||
ok "Binary installed: $INSTALL_BIN"
|
||||
|
||||
# ── Write default config if not present ──────────────────────────────────────
|
||||
if [[ ! -f "$CONFIG_DIR/config.toml" ]]; then
|
||||
cat > "$CONFIG_DIR/config.toml" <<'EOF'
|
||||
[server]
|
||||
host = "0.0.0.0"
|
||||
port = 8655
|
||||
|
||||
[database]
|
||||
path = "/var/lib/nx9-auth/auth.db"
|
||||
|
||||
[security]
|
||||
session_ttl_hours = 24
|
||||
session_absolute_ttl_days = 30
|
||||
token_ttl_days = 365
|
||||
argon2_memory = 65536
|
||||
argon2_iterations = 3
|
||||
argon2_parallelism = 1
|
||||
|
||||
[audit]
|
||||
enabled = true
|
||||
EOF
|
||||
chown root:"$SERVICE_USER" "$CONFIG_DIR/config.toml"
|
||||
chmod 640 "$CONFIG_DIR/config.toml"
|
||||
ok "Default config written: $CONFIG_DIR/config.toml"
|
||||
else
|
||||
warn "Config already exists — skipping: $CONFIG_DIR/config.toml"
|
||||
fi
|
||||
|
||||
# ── Install systemd service ───────────────────────────────────────────────────
|
||||
cat > "$SERVICE_FILE" <<EOF
|
||||
[Unit]
|
||||
Description=nx9-auth Identity and Access Management Service
|
||||
Documentation=https://github.com/nx9/nx9-auth
|
||||
After=network.target
|
||||
Wants=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=$SERVICE_USER
|
||||
Group=$SERVICE_USER
|
||||
ExecStart=$INSTALL_BIN serve --config $CONFIG_DIR/config.toml
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
TimeoutStopSec=10s
|
||||
|
||||
# Security hardening
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
PrivateTmp=true
|
||||
NoNewPrivileges=true
|
||||
CapabilityBoundingSet=
|
||||
AmbientCapabilities=
|
||||
LockPersonality=true
|
||||
MemoryDenyWriteExecute=true
|
||||
PrivateDevices=true
|
||||
ProtectClock=true
|
||||
ProtectControlGroups=true
|
||||
ProtectHostname=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelTunables=true
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
RestrictNamespaces=true
|
||||
RestrictRealtime=true
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
|
||||
# Writable paths
|
||||
ReadWritePaths=$DATA_DIR $LOG_DIR
|
||||
|
||||
# Logging
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=nx9-auth
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
chmod 644 "$SERVICE_FILE"
|
||||
ok "Systemd service installed: $SERVICE_FILE"
|
||||
|
||||
# ── Initialize database and configuration ─────────────────────────────────────
|
||||
echo ""
|
||||
echo "Initializing database and configuration..."
|
||||
sudo -u "$SERVICE_USER" "$INSTALL_BIN" init --config "$CONFIG_DIR/config.toml" --non-interactive --skip-admin
|
||||
ok "Initialization complete"
|
||||
|
||||
# ── Enable and start service ──────────────────────────────────────────────────
|
||||
systemctl daemon-reload
|
||||
systemctl enable nx9-auth
|
||||
systemctl restart nx9-auth
|
||||
ok "nx9-auth service enabled and started"
|
||||
|
||||
# ── Doctor check ──────────────────────────────────────────────────────────────
|
||||
echo ""
|
||||
sleep 2 # Brief wait for service to start
|
||||
sudo -u "$SERVICE_USER" "$INSTALL_BIN" doctor --config "$CONFIG_DIR/config.toml" || true
|
||||
|
||||
# ── Summary ───────────────────────────────────────────────────────────────────
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo " nx9-auth deployed successfully!"
|
||||
echo ""
|
||||
echo " Service: systemctl status nx9-auth"
|
||||
echo " Logs: journalctl -u nx9-auth -f"
|
||||
echo " Config: $CONFIG_DIR/config.toml"
|
||||
echo " Database: $DATA_DIR/auth.db"
|
||||
echo ""
|
||||
echo " Next step:"
|
||||
echo " Create your first administrator account:"
|
||||
echo " sudo -u nx9-auth nx9-auth init --config $CONFIG_DIR/config.toml"
|
||||
echo ""
|
||||
echo " Then verify:"
|
||||
echo " systemctl status nx9-auth"
|
||||
echo " curl http://127.0.0.1:8655/health"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo ""
|
||||
Reference in new issue
Block a user