172 lines
6.8 KiB
Bash
172 lines
6.8 KiB
Bash
#!/usr/bin/env bash
|
|
# deploy.sh — nx9-auth installer for Debian/Ubuntu systems
|
|
#
|
|
# Usage: sudo bash deploy.sh [path/to/nx9-auth-binary]
|
|
# Requires: root, systemd
|
|
|
|
set -euo pipefail
|
|
|
|
BINARY_PATH="${1:-./target/release/nx9-auth}"
|
|
SERVICE_USER="nx9-auth"
|
|
INSTALL_BIN="/usr/local/bin/nx9-auth"
|
|
CONFIG_DIR="/etc/nx9-auth"
|
|
DATA_DIR="/var/lib/nx9-auth"
|
|
LOG_DIR="/var/log/nx9-auth"
|
|
SERVICE_FILE="/etc/systemd/system/nx9-auth.service"
|
|
|
|
# ── Colours ───────────────────────────────────────────────────────────────────
|
|
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
|
ok() { echo -e "${GREEN} ✓${NC} $*"; }
|
|
warn() { echo -e "${YELLOW} !${NC} $*"; }
|
|
fail() { echo -e "${RED} ✗${NC} $*"; exit 1; }
|
|
|
|
# ── Prerequisites ─────────────────────────────────────────────────────────────
|
|
[[ $EUID -eq 0 ]] || fail "This script must be run as root."
|
|
[[ -f "$BINARY_PATH" ]] || fail "Binary not found at: $BINARY_PATH — build with 'cargo build --release' first."
|
|
|
|
echo ""
|
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
echo " nx9-auth deploy"
|
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
echo ""
|
|
|
|
# ── Create system user ────────────────────────────────────────────────────────
|
|
if id -u "$SERVICE_USER" &>/dev/null; then
|
|
warn "System user '$SERVICE_USER' already exists — skipping creation."
|
|
else
|
|
useradd --system --no-create-home --shell /usr/sbin/nologin "$SERVICE_USER"
|
|
ok "Created system user: $SERVICE_USER"
|
|
fi
|
|
|
|
# ── Create directories ────────────────────────────────────────────────────────
|
|
for dir in "$CONFIG_DIR" "$DATA_DIR" "$LOG_DIR"; do
|
|
mkdir -p "$dir"
|
|
chown "$SERVICE_USER:$SERVICE_USER" "$dir"
|
|
chmod 750 "$dir"
|
|
done
|
|
ok "Directories created: $CONFIG_DIR, $DATA_DIR, $LOG_DIR"
|
|
|
|
# ── Install binary ────────────────────────────────────────────────────────────
|
|
cp "$BINARY_PATH" "$INSTALL_BIN"
|
|
chmod 755 "$INSTALL_BIN"
|
|
ok "Binary installed: $INSTALL_BIN"
|
|
|
|
# ── Write default config if not present ──────────────────────────────────────
|
|
if [[ ! -f "$CONFIG_DIR/config.toml" ]]; then
|
|
cat > "$CONFIG_DIR/config.toml" <<'EOF'
|
|
[server]
|
|
host = "0.0.0.0"
|
|
port = 8655
|
|
|
|
[database]
|
|
path = "/var/lib/nx9-auth/auth.db"
|
|
|
|
[security]
|
|
session_ttl_hours = 24
|
|
session_absolute_ttl_days = 30
|
|
token_ttl_days = 365
|
|
argon2_memory = 65536
|
|
argon2_iterations = 3
|
|
argon2_parallelism = 1
|
|
|
|
[audit]
|
|
enabled = true
|
|
EOF
|
|
chown root:"$SERVICE_USER" "$CONFIG_DIR/config.toml"
|
|
chmod 640 "$CONFIG_DIR/config.toml"
|
|
ok "Default config written: $CONFIG_DIR/config.toml"
|
|
else
|
|
warn "Config already exists — skipping: $CONFIG_DIR/config.toml"
|
|
fi
|
|
|
|
# ── Install systemd service ───────────────────────────────────────────────────
|
|
cat > "$SERVICE_FILE" <<EOF
|
|
[Unit]
|
|
Description=nx9-auth Identity and Access Management Service
|
|
Documentation=https://github.com/nx9/nx9-auth
|
|
After=network.target
|
|
Wants=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=$SERVICE_USER
|
|
Group=$SERVICE_USER
|
|
ExecStart=$INSTALL_BIN serve --config $CONFIG_DIR/config.toml
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
TimeoutStopSec=10s
|
|
|
|
# Security hardening
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
PrivateDevices=true
|
|
ProtectClock=true
|
|
ProtectControlGroups=true
|
|
ProtectHostname=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
|
|
# Writable paths
|
|
ReadWritePaths=$DATA_DIR $LOG_DIR
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=nx9-auth
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
chmod 644 "$SERVICE_FILE"
|
|
ok "Systemd service installed: $SERVICE_FILE"
|
|
|
|
# ── Initialize database and configuration ─────────────────────────────────────
|
|
echo ""
|
|
echo "Initializing database and configuration..."
|
|
sudo -u "$SERVICE_USER" "$INSTALL_BIN" init --config "$CONFIG_DIR/config.toml" --non-interactive --skip-admin
|
|
ok "Initialization complete"
|
|
|
|
# ── Enable and start service ──────────────────────────────────────────────────
|
|
systemctl daemon-reload
|
|
systemctl enable nx9-auth
|
|
systemctl restart nx9-auth
|
|
ok "nx9-auth service enabled and started"
|
|
|
|
# ── Doctor check ──────────────────────────────────────────────────────────────
|
|
echo ""
|
|
sleep 2 # Brief wait for service to start
|
|
sudo -u "$SERVICE_USER" "$INSTALL_BIN" doctor --config "$CONFIG_DIR/config.toml" || true
|
|
|
|
# ── Summary ───────────────────────────────────────────────────────────────────
|
|
echo ""
|
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
echo " nx9-auth deployed successfully!"
|
|
echo ""
|
|
echo " Service: systemctl status nx9-auth"
|
|
echo " Logs: journalctl -u nx9-auth -f"
|
|
echo " Config: $CONFIG_DIR/config.toml"
|
|
echo " Database: $DATA_DIR/auth.db"
|
|
echo ""
|
|
echo " Next step:"
|
|
echo " Create your first administrator account:"
|
|
echo " sudo -u nx9-auth nx9-auth init --config $CONFIG_DIR/config.toml"
|
|
echo ""
|
|
echo " Then verify:"
|
|
echo " systemctl status nx9-auth"
|
|
echo " curl http://127.0.0.1:8655/health"
|
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
echo ""
|