From b160206eaf32829f833bd8bacefb43fae683d980 Mon Sep 17 00:00:00 2001 From: Michael Herrmann Date: Mon, 14 Aug 2023 12:11:26 +0200 Subject: [PATCH] Make several .bashrc settings optional --- README.md | 19 +++++---- install.sh | 112 +++++++++++++++++++++++++++++++---------------------- 2 files changed, 74 insertions(+), 57 deletions(-) diff --git a/README.md b/README.md index 574b757..63888ed 100644 --- a/README.md +++ b/README.md @@ -73,40 +73,39 @@ Upload [`install.sh`](install.sh) and a `.bashrc` file with the settings below to a Debian 11 server, then run `install.sh` as root. ```bash -# Email address of server administrator: -export ADMIN_EMAIL=email@example.com - # The domain under which this server runs: export HOST_NAME=some.domain.com # A space-separated list of alternative host names: export ALT_HOST_NAMES= +# Django SECRET_KEY: +export SECRET_KEY=atLeast50RandomChars + +##### Optional settings for checking out the server source code with git ####### + # The server that hosts this repository: export GIT_SERVER=github.com - # The path on GIT_SERVER where this repository lies: export GIT_REPO_NAME=omaha-consulting/api.winget.pro - # The branch of this repository that should be checked out: export GIT_REPO_BRANCH=main - # The SSH public key for fetching this repository from GIT_SERVER: export GIT_REPO_PUBKEY="ssh-rsa ... user@machine" - # The SSH private key for fetching this repository from GIT_SERVER. # "\n"s separate lines: export GIT_REPO_PRIVKEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----" +############## Optional settings for sending server health emails ############## + +# Email address of server administrator: +export ADMIN_EMAIL=email@example.com # Emails to the admin will be sent via this account: export SMTP_HOST=email-smtp.eu-central-1.amazonaws.com export SMTP_USER=ABC123... export SMTP_PASSWORD=aBc1234... export SMTP_FROM=server@email.com -# Django SECRET_KEY: -export SECRET_KEY=atLeast50RandomChars - ################## Optional settings for storing files on S3 ################### export DEFAULT_FILE_STORAGE=storages.backends.s3boto3.S3Boto3Storage diff --git a/install.sh b/install.sh index ce91478..4f67b88 100644 --- a/install.sh +++ b/install.sh @@ -39,25 +39,69 @@ log 'Updating system...' apt-get update > /dev/null apt-get upgrade -y > /dev/null -log 'Installing iptables-persistent...' -echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections -echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections -apt-get -y install iptables-persistent -y > /dev/null +if [[ -n "$GIT_SERVER" ]] +then + # Fetch the server source code with git: + log 'Installing git...' + apt-get install git-core -y > /dev/null -log 'Configuring iptables...' -# Only allow local access to port 25: -iptables -A INPUT -i lo -p tcp --dport 25 -j ACCEPT -iptables -A INPUT -p tcp --dport 25 -j REJECT + log 'Configuring git to avoid warnings when pulling...' + git config --global pull.rebase true -# Save iptables rules so they persist across restarts. At the time of this -# writing, there is no open IPv6 port, so enough to save rules.v*4*. -iptables-save > /etc/iptables/rules.v4 + log 'Setting up SSH keys. This is required so we can clone the Git repository without having to supply a password...' + mkdir -p .ssh + echo "$GIT_REPO_PUBKEY" > .ssh/id_rsa.pub + chmod 644 .ssh/id_rsa.pub + echo -e "$GIT_REPO_PRIVKEY" > .ssh/id_rsa + chmod 600 .ssh/id_rsa -log 'Installing git...' -apt-get install git-core -y > /dev/null + log 'Adding git repository server to known hosts...' + ssh-keyscan -H ${GIT_SERVER} >> .ssh/known_hosts 2>/dev/null; chmod 600 .ssh/known_hosts -log 'Configuring git to avoid warnings when pulling...' -git config --global pull.rebase true + log 'Cloning the repository...' + git clone -q -b ${GIT_REPO_BRANCH} git@${GIT_SERVER}:${GIT_REPO_NAME}.git /srv +else + if [ ! -d /srv/conf ] + then + log 'Error: Please place the server source code into /srv.' + exit 1 + fi +fi + +if [[ -n "$SMTP_HOST" ]] +then + log 'Installing Postfix...' + debconf-set-selections <<< "postfix postfix/mailname string $HOST_NAME" + debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'" + apt-get install postfix mailutils libsasl2-2 ca-certificates libsasl2-modules -y > /dev/null + + log 'Configuring Postfix...' + echo "$HOST_NAME" > /etc/mailname + chown postfix /etc/mailname + envsubst '$SMTP_HOST $HOST_NAME' < /srv/conf/postfix/main.cf > /etc/postfix/main.cf + envsubst < /srv/conf/postfix/sasl_passwd > /etc/postfix/sasl_passwd + postmap /etc/postfix/sasl_passwd + chmod 400 /etc/postfix/sasl_passwd + chown postfix /etc/postfix/sasl_passwd + envsubst < /srv/conf/postfix/generic > /etc/postfix/generic + postmap /etc/postfix/generic + chown postfix /etc/postfix/generic + /etc/init.d/postfix reload > /dev/null + + log 'Installing iptables-persistent...' + echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections + echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections + apt-get -y install iptables-persistent -y > /dev/null + + log 'Configuring iptables...' + # Only allow local access to port 25: + iptables -A INPUT -i lo -p tcp --dport 25 -j ACCEPT + iptables -A INPUT -p tcp --dport 25 -j REJECT + + # Save iptables rules so they persist across restarts. At the time of this + # writing, there is no open IPv6 port, so enough to save rules.v*4*. + iptables-save > /etc/iptables/rules.v4 +fi log 'Creating application users...' groupadd --system django @@ -66,43 +110,12 @@ mkdir -p /home/django chown django /home/django chmod 700 /home/django -log 'Setting up SSH keys. This is required so we can clone the Git repository without having to supply a password...' -mkdir -p .ssh -echo "$GIT_REPO_PUBKEY" > .ssh/id_rsa.pub -chmod 644 .ssh/id_rsa.pub -echo -e "$GIT_REPO_PRIVKEY" > .ssh/id_rsa -chmod 600 .ssh/id_rsa - -log 'Adding git repository server to known hosts...' -ssh-keyscan -H ${GIT_SERVER} >> .ssh/known_hosts 2>/dev/null; chmod 600 .ssh/known_hosts - -log 'Cloning the repository...' -git clone -q -b ${GIT_REPO_BRANCH} git@${GIT_SERVER}:${GIT_REPO_NAME}.git /srv - log 'Setting up bash profiles...' ln -sf /srv/conf/.bash_profile . ln -sf /srv/conf/.bash_profile /home/django PATH='$PATH' /usr/bin/envsubst < /srv/conf/django.bashrc > /home/django/.bashrc chown django:django /home/django/.bashrc -log 'Installing Postfix...' -debconf-set-selections <<< "postfix postfix/mailname string $HOST_NAME" -debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'" -apt-get install postfix mailutils libsasl2-2 ca-certificates libsasl2-modules -y > /dev/null - -log 'Configuring Postfix...' -echo "$HOST_NAME" > /etc/mailname -chown postfix /etc/mailname -envsubst '$SMTP_HOST $HOST_NAME' < /srv/conf/postfix/main.cf > /etc/postfix/main.cf -envsubst < /srv/conf/postfix/sasl_passwd > /etc/postfix/sasl_passwd -postmap /etc/postfix/sasl_passwd -chmod 400 /etc/postfix/sasl_passwd -chown postfix /etc/postfix/sasl_passwd -envsubst < /srv/conf/postfix/generic > /etc/postfix/generic -postmap /etc/postfix/generic -chown postfix /etc/postfix/generic -/etc/init.d/postfix reload > /dev/null - log 'Creating data directory...' # At the moment, we only have a db.sqlite3 file in this directory. It's tempting # to then just place the file directly into /var/lib. However, this does not @@ -196,7 +209,12 @@ ln -s /srv/conf/logrotate /etc/logrotate.d/django log 'Setting up crontab...' ln -s /srv/bin/cronic /usr/bin/cronic -sed "s/\$ADMIN_EMAIL/$ADMIN_EMAIL/g" /srv/conf/crontab > crontab +if [[ -n "$ADMIN_EMAIL" ]] +then + sed "s/\$ADMIN_EMAIL/$ADMIN_EMAIL/g" /srv/conf/crontab > crontab +else + cp /srv/conf/crontab crontab +fi if [[ -z "$SSL_CERTIFICATE" ]] then sed -Ei "s/^#(.*certbot renew)/\1/g" crontab