target-install.sh

#! /usr/bin/env bash
HERE="$(realpath $(dirname ${BASH_SOURCE[0]}))"
set -e
source ${HERE}/.vars


# commands
usrexec="sudo -u ${user}"
pyenv=/home/${user}/.pyenv
pip=${pyenv}/bin/pip
configdir=/home/${user}/.config
systemd_dir=${configdir}/systemd/user
systemd_unit=${systemd_dir}/${instance}.service
vardir=/home/${user}/.var
appcmd="${usrexec} ${pyenv}/bin/${pypkg} -c ${configdir}/${pypkg}.yml"
APPCLI="${pyenv}/bin/${pypkg} -c ${configdir}/${pypkg}.yml"
APPPY="${pyenv}/bin/python"
APPPY_USER="${usrexec} ${pyenv}/bin/python"

log() {
  printf '[install] %s\n' "$1"
}


# install dependencies
log "Installing system dependencies"
apt-get install -y \
  nginx \
  build-essential \
  libpq-dev \
  ${pyver}-dev \
  ${pyver}-venv \
  postgresql \
  redis-server \
  certbot \
  python3-certbot-dns-cloudflare \
  python3-certbot-nginx \
  openssl


# copy the uninstall script
log "Installing uninstall script and deployment state"
install -D -m 700 ${HERE}/uninstall.sh /usr/local/bin/${instance}-uninstall.sh
install -D -m 600 ${HERE}/.vars /etc/yhttp-deploy/${instance}.vars


# create user if not exists
if [ ! -d "/home/${user}" ]; then
  log "Creating system user: ${user}"
  adduser --disabled-password --gecos '' ${user} 
  log "Creating PostgreSQL user: ${user}"
  echo "CREATE USER ${user} WITH CREATEDB" | sudo -u postgres psql
fi


# create python venv if not exists
if [ ! -d "${pyenv}" ]; then
  log "Creating Python virtual environment: ${pyenv}"
  ${usrexec} ${pyver} -m venv ${pyenv}
fi


# create directories
log "Creating application directories"
${usrexec} mkdir -p ${configdir}/systemd/user
${usrexec} mkdir -p ${vardir}/www/media


# fix permissions
log "Setting application directory permissions"
chmod -R 755 ${vardir}/www
chmod 755 ${vardir}
chmod 755 /home/${user}


# install the python package(s)
log "Installing Python packages"
${usrexec} ${pip} -vv install ${HERE}/${pydist}
${usrexec} ${pip} -vv install uwsgi

# execute user defined commands
for installexec in "${installexecs[@]}"; do
  eval "cmd=\"${installexec}\""
  ${cmd}
done

# deploy assets
if [ -n "$(ls -A ${HERE}/assets)" ]; then
  log "Creating assets directory"
  ${usrexec} mkdir -p ${vardir}/www/assets
  log "Removing previous assets"
  rm -rf ${vardir}/www/assets/*
  log "Setting assets permissions"
  chmod -R 755 ${vardir}/www/assets
  log "Copying assets"
  cp ${HERE}/assets/* ${vardir}/www/assets

  if [ -f ${HERE}/assets-manifest.json ]; then
    log "Copying assets manifest"
    cp ${HERE}/assets-manifest.json ${configdir}/assets-manifest.json
  fi
fi
log "Assigning assets ownership"
chown -R ${user}:${nginxgroup} ${vardir}/www/assets


# deploy public files
log "Creating public directory"
${usrexec} mkdir -p ${vardir}/www/public
log "Removing previous public files"
rm -rf ${vardir}/www/public/*
log "Setting public file permissions"
chmod -R 755 ${vardir}/www/public
if [ -d ${HERE}/public ] && [ -n "$(ls -A ${HERE}/public)" ]; then
  log "Copying public files"
  cp -r ${HERE}/public/* ${vardir}/www/public
fi
log "Assigning public files ownership"
chown -R ${user}:${nginxgroup} ${vardir}/www/public


# yhttp config file
log "Writing YHTTP configuration"
echo -n "\
debug: false
env: production 
publicurl: https://${domain}

assets:
  serve: false
  manifest: ${configdir}/assets-manifest.json

media:
  serve: false
  directory: ${vardir}/www/media

public:
  serve: false

db:
  url: postgresql://:@/${instance}

mako:
  modules: ${vardir}/mako

auth:
  domain: ${domain}
  
  redis:
    host: localhost
    port: 6379

  blacklist:
    key: yhttp-auth-forbidden

  redis:
    host: localhost
    port: 6379

  accesstoken:
    algorithm: HS256
    cookie:
      key: yhttp-accesstoken
      secure: true
      httponly: true
      samesite: Lax
      path: /

  refreshtoken:
    enabled: true
    algorithm: HS256
    cookie:
    cookie:
      key: yhttp-refreshtoken
      secure: true
      httponly: true
      samesite: Strict
      path: /apiv1/tokens

  csrftoken:
    size: 1024
    cookie:
      key: yhttp-csrftoken
      secure: true
      httponly: true
      maxage: 240  # 4 Minute
      samesite: Lax
      path: /apiv1

  oauth2:
    statetoken:
      algorithm: HS256

    google:
      authurl: https://accounts.google.com/o/oauth2/v2/auth
      tokenurl: https://oauth2.googleapis.com/token


!include ${configdir}/${pypkg}-${userconfigfile}
" | ${usrexec} tee ${configdir}/${pypkg}.yml > /dev/null


# copy user config file
log "Copying user configuration"
cp ${HERE}/${userconfigfile} ${configdir}/${pypkg}-${userconfigfile}


# wsgi file
log "Writing WSGI configuration"
echo -n "\
import os
from ${pynamespace} import app

app.settings <<= '${configdir}/${pypkg}.yml'
app.ready()
" | ${usrexec} tee ${configdir}/${instance}_wsgi.py > /dev/null


# uwsgi config file
log "Writing uWSGI configuration"
echo -n "\
[uwsgi]
socket = ${vardir}/${instance}.s
module = ${instance}_wsgi:app
chmod-socket = 660
vacuum = true
master = true
workers = 1
threads = 2
chdir = ${configdir}
" | ${usrexec} tee ${configdir}/${instance}_uwsgi.ini > /dev/null


# create database
if sudo -u postgres psql -lqt | cut -d'|' -f1 | grep -qw ${instance} ; then
  echo "database ${instance} already created"
  log "Upgrading existing database: ${instance}"
  ${appcmd} db migration upgrade
else
  log "Creating database: ${instance}"
  ${appcmd} db create
  log "Creating database objects: ${instance}"
  ${appcmd} db objects create
  log "Inserting database base data: ${instance}"
  ${appcmd} db basedata insert
  log "Setting database migration version: ${instance}"
  ${appcmd} db migration set last
fi


# systemd unit
log "Writing systemd service unit"
echo -n "\
[Unit]
Description=${instance} web service
After=network.target

[Service]
User=${user}
Group=${nginxgroup}
ExecStart=${pyenv}/bin/uwsgi \
  --ini ${configdir}/${instance}_uwsgi.ini \
  --wsgi-file ${instance}_wsgi.py

[Install]
WantedBy=multi-user.target
" | ${usrexec} tee ${systemd_unit} > /dev/null


for worker in "${workers[@]}"; do
  eval "unitcmd=\"${worker}\""
  IFS='=' read -r worker_name worker_cmd <<< "$unitcmd"
  worker_service="${instance}-${worker_name}.service"
  log "Writing systemd service unit for worker: ${worker_service}"
  echo -n "\
[Unit]
Description=${instance} worker
Requires=${instance}.service
After=${instance}.service
BindsTo=${instance}.service

[Service]
User=${user}
Group=${nginxgroup}
ExecStart=${worker_cmd}

[Install]
WantedBy=multi-user.target
" | ${usrexec} tee ${systemd_dir}/${worker_service} > /dev/null
done


log "Reloading systemd"
systemctl daemon-reload
log "Enabling service: ${instance}.service"
systemctl enable ${systemd_unit}
for worker in "${workers[@]}"; do
  eval "unitcmd=\"${worker}\""
  IFS='=' read -r worker_name worker_cmd <<< "$unitcmd"
  worker_service="${instance}-${worker_name}.service"
  log "Enabling service: ${worker_service}"
  systemctl enable ${systemd_dir}/${worker_service}
done

log "Restarting service: ${instance}.service"
systemctl restart ${instance}.service
systemctl status ${instance}.service


# ssl
sslcert=/etc/letsencrypt/live/${ssldomain}/fullchain.pem
sslkey=/etc/letsencrypt/live/${ssldomain}/privkey.pem
if [ ! -f ${sslcert} ]; then
  cloudflare_ini=${configdir}/cloudflare.ini
  if [ ! -f ${cloudflare_ini} ]; then
    echo "${cloudflare_ini} file does not exists, please create it" >&2
    exit 1
  fi
  
  ssloptions=/etc/letsencrypt/options-ssl-nginx.conf
  if [ ! -f ${ssloptions} ]; then
  log "Installing certbot SSL options"
  cp /usr/lib/python3/dist-packages/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf /etc/letsencrypt/
  fi
  
  ssldhparams=/etc/letsencrypt/ssl-dhparams.pem
  if [ ! -f ${ssldhparams} ]; then
  log "Generating SSL Diffie-Hellman parameters"
  openssl dhparam -out ${ssldhparams} 2048
  fi

  log "Requesting SSL certificate for ${ssldomain}"
  certbot certonly \
    --dns-cloudflare \
    --dns-cloudflare-credentials ${cloudflare_ini} \
    --dns-cloudflare-propagation-seconds 60 \
    --non-interactive \
    --no-eff-email \
    --email ${adminemail} \
    --agree-tos \
    -d ${ssldomain} \
    -d *.${ssldomain}
fi


log "Writing nginx configuration"
echo -n "\
# Managed by yhttp-deploy: instance=${instance}
server {
  listen 80;
  listen [::]:80;
  server_name ${domain} ${aliasdomains};
  return 301 https://\$host\$request_uri;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name ${domain} ${aliasdomains};

  ssl_certificate ${sslcert};
  ssl_certificate_key ${sslkey};
  include /etc/letsencrypt/options-ssl-nginx.conf;
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

  location /assets {
    alias ${vardir}/www/assets;
  }

  location /media {
    alias ${vardir}/www/media;
  }

  root ${vardir}/www/public;
  location / {
    try_files \$uri @upstream;
  }

  location @upstream {
    include uwsgi_params;
    uwsgi_pass unix:${vardir}/${instance}.s;
  }
}
" > /etc/nginx/sites-available/${nginxconfigfile}
if [ ! -f "/etc/nginx/sites-enabled/${nginxconfigfile}" ]; then
  log "Enabling nginx site: ${nginxconfigfile}"
  ln -s /etc/nginx/sites-available/${nginxconfigfile} /etc/nginx/sites-enabled
fi
log "Reloading nginx"
systemctl reload nginx