Slim down: SSH-only firewall, drop GitHub PAT/GHCR, deploy helper and app dirs
This commit is contained in:
Gavin Nugent
parent
634b83fe97
commit
59172213dc
1 changed files with 2 additions and 147 deletions
149
arch-setup.sh
149
arch-setup.sh
|
|
@ -11,14 +11,9 @@ set -euo pipefail
|
|||
# DEFAULTS
|
||||
# =============================================================================
|
||||
|
||||
GITHUB_PAT=""
|
||||
TIMEZONE="Europe/London"
|
||||
LOCALE="en_GB.UTF-8"
|
||||
|
||||
# Comma-separated list of repos to clone (leave empty to skip)
|
||||
# Format: "user/repo:/opt/apps/dirname,user/repo2:/opt/apps/dirname2"
|
||||
REPOS_TO_CLONE=""
|
||||
|
||||
# =============================================================================
|
||||
# COLOURS
|
||||
# =============================================================================
|
||||
|
|
@ -90,38 +85,6 @@ if [ -z "$GIT_EMAIL" ]; then
|
|||
GIT_EMAIL="not-set@example.com"
|
||||
fi
|
||||
|
||||
# GitHub PAT
|
||||
echo ""
|
||||
echo " A GitHub Personal Access Token lets the server pull from"
|
||||
echo " your private repos and container registry (GHCR)."
|
||||
echo " You can skip this and add one later."
|
||||
read -rp "GitHub username (leave empty to skip): " input_gh_user
|
||||
GITHUB_USER="${input_gh_user:-}"
|
||||
|
||||
if [ -n "$GITHUB_USER" ]; then
|
||||
read -rp "GitHub PAT: " input_pat
|
||||
GITHUB_PAT="${input_pat:-}"
|
||||
|
||||
if [ -n "$GITHUB_PAT" ]; then
|
||||
# Validate PAT format (should start with ghp_ or github_pat_)
|
||||
if ! [[ "$GITHUB_PAT" =~ ^(ghp_|github_pat_) ]]; then
|
||||
warn "PAT doesn't look right — expected it to start with ghp_ or github_pat_"
|
||||
read -p "Continue anyway? (y/n) " -n 1 -r
|
||||
echo ""
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
GITHUB_PAT=""
|
||||
GITHUB_USER=""
|
||||
warn "Skipping GitHub setup — you can configure it later"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
warn "No PAT provided — skipping GitHub setup"
|
||||
GITHUB_USER=""
|
||||
fi
|
||||
else
|
||||
GITHUB_PAT=""
|
||||
fi
|
||||
|
||||
# Confirm
|
||||
echo ""
|
||||
echo -e "${CYAN}━━━ Confirm settings ━━━${NC}"
|
||||
|
|
@ -130,8 +93,6 @@ echo " SSH alias: $SSH_ALIAS"
|
|||
echo " Deploy user: $DEPLOY_USER"
|
||||
echo " Git name: $GIT_NAME"
|
||||
echo " Git email: $GIT_EMAIL"
|
||||
echo " GitHub user: $([ -n "$GITHUB_USER" ] && echo "$GITHUB_USER" || echo 'Not set')"
|
||||
echo " Git PAT: $([ -n "$GITHUB_PAT" ] && echo 'Set' || echo 'Not set')"
|
||||
echo " Timezone: $TIMEZONE"
|
||||
echo ""
|
||||
read -p "Continue? (y/n) " -n 1 -r
|
||||
|
|
@ -275,14 +236,12 @@ step "5/8 · Firewall (UFW)"
|
|||
ufw default deny incoming
|
||||
ufw default allow outgoing
|
||||
ufw allow 22/tcp comment 'SSH'
|
||||
ufw allow 80/tcp comment 'HTTP'
|
||||
ufw allow 443/tcp comment 'HTTPS'
|
||||
|
||||
# Enable without prompt, and make it survive reboots
|
||||
echo "y" | ufw enable
|
||||
systemctl enable ufw
|
||||
|
||||
log "UFW enabled — ports 22, 80, 443 open"
|
||||
log "UFW enabled — port 22 only"
|
||||
ufw status verbose
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -439,110 +398,11 @@ step "Git configuration"
|
|||
su - $DEPLOY_USER << GITEOF
|
||||
git config --global user.name "$GIT_NAME"
|
||||
git config --global user.email "$GIT_EMAIL"
|
||||
git config --global credential.helper store
|
||||
git config --global init.defaultBranch main
|
||||
GITEOF
|
||||
|
||||
log "Git configured for $DEPLOY_USER"
|
||||
|
||||
# Store PAT if provided (correct format: https://USERNAME:TOKEN@github.com)
|
||||
if [ -n "$GITHUB_PAT" ] && [ -n "$GITHUB_USER" ]; then
|
||||
su - $DEPLOY_USER -c "echo 'https://$GITHUB_USER:$GITHUB_PAT@github.com' > /home/$DEPLOY_USER/.git-credentials"
|
||||
chmod 600 /home/$DEPLOY_USER/.git-credentials
|
||||
chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/.git-credentials
|
||||
log "GitHub PAT stored for git (https://$GITHUB_USER:***@github.com)"
|
||||
|
||||
# Log Docker into GHCR so Once can pull container images
|
||||
log "Logging Docker into ghcr.io..."
|
||||
if echo "$GITHUB_PAT" | su - $DEPLOY_USER -c "docker login ghcr.io -u $GITHUB_USER --password-stdin"; then
|
||||
log "Docker logged into ghcr.io as $GITHUB_USER"
|
||||
else
|
||||
warn "Docker GHCR login failed — you can run manually: docker login ghcr.io -u $GITHUB_USER"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Clone repos if specified
|
||||
if [ -n "$REPOS_TO_CLONE" ]; then
|
||||
IFS=',' read -ra REPO_PAIRS <<< "$REPOS_TO_CLONE"
|
||||
for pair in "${REPO_PAIRS[@]}"; do
|
||||
IFS=':' read -r repo dir <<< "$pair"
|
||||
if [ ! -d "$dir" ]; then
|
||||
mkdir -p "$(dirname "$dir")"
|
||||
su - $DEPLOY_USER -c "git clone https://github.com/$repo.git $dir"
|
||||
chown -R $DEPLOY_USER:$DEPLOY_USER "$dir"
|
||||
log "Cloned $repo → $dir"
|
||||
else
|
||||
warn "$dir already exists — skipping clone"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# CREATE DIRECTORIES
|
||||
# =============================================================================
|
||||
|
||||
step "Directory structure"
|
||||
|
||||
mkdir -p /opt/apps
|
||||
chown -R $DEPLOY_USER:$DEPLOY_USER /opt/apps
|
||||
log "Created /opt/apps for custom Docker apps"
|
||||
|
||||
mkdir -p /var/www
|
||||
chown -R $DEPLOY_USER:$DEPLOY_USER /var/www
|
||||
log "Created /var/www for static sites"
|
||||
|
||||
# =============================================================================
|
||||
# DEPLOY HELPER SCRIPT
|
||||
# =============================================================================
|
||||
|
||||
step "Deploy helper script"
|
||||
|
||||
cat > /home/$DEPLOY_USER/deploy.sh << 'DEPLOYSCRIPT'
|
||||
#!/bin/bash
|
||||
# Usage: ./deploy.sh <app-directory> [branch]
|
||||
set -euo pipefail
|
||||
|
||||
APP_DIR="${1:?Usage: ./deploy.sh <app-directory> [branch]}"
|
||||
BRANCH="${2:-main}"
|
||||
|
||||
if [ ! -d "$APP_DIR" ]; then
|
||||
echo "Error: $APP_DIR does not exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "$APP_DIR"
|
||||
echo "📦 Deploying $(basename $APP_DIR) from branch $BRANCH..."
|
||||
|
||||
echo "⬇️ Pulling latest..."
|
||||
git fetch origin
|
||||
git checkout "$BRANCH"
|
||||
git pull origin "$BRANCH"
|
||||
|
||||
if [ -f "docker-compose.yml" ] || [ -f "compose.yml" ]; then
|
||||
echo "🐳 Docker Compose detected — rebuilding..."
|
||||
docker compose down
|
||||
docker compose up -d --build
|
||||
echo "✅ Containers running:"
|
||||
docker compose ps
|
||||
elif [ -f "Dockerfile" ]; then
|
||||
APP_NAME=$(basename "$APP_DIR")
|
||||
echo "🐳 Dockerfile detected — rebuilding $APP_NAME..."
|
||||
docker build -t "$APP_NAME" .
|
||||
docker stop "$APP_NAME" 2>/dev/null || true
|
||||
docker rm "$APP_NAME" 2>/dev/null || true
|
||||
docker run -d --name "$APP_NAME" --restart unless-stopped "$APP_NAME"
|
||||
echo "✅ Container running"
|
||||
else
|
||||
echo "📁 Static site — no build step needed"
|
||||
fi
|
||||
|
||||
echo "🎉 Deployed at $(date)"
|
||||
DEPLOYSCRIPT
|
||||
|
||||
chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/deploy.sh
|
||||
chmod +x /home/$DEPLOY_USER/deploy.sh
|
||||
log "Deploy helper created at ~/deploy.sh"
|
||||
|
||||
# =============================================================================
|
||||
# GENERATE LOCAL SSH CONFIG FILE
|
||||
# =============================================================================
|
||||
|
|
@ -580,9 +440,7 @@ echo " ├─ Root login: disabled"
|
|||
echo " └─ Auth: key-only"
|
||||
echo ""
|
||||
echo -e " ${GREEN}Firewall${NC}"
|
||||
echo " ├─ 22/tcp SSH"
|
||||
echo " ├─ 80/tcp HTTP"
|
||||
echo " └─ 443/tcp HTTPS"
|
||||
echo " └─ 22/tcp SSH (only open port)"
|
||||
echo ""
|
||||
echo -e " ${GREEN}Services${NC}"
|
||||
echo " ├─ Docker: $(docker --version 2>/dev/null || echo 'installed')"
|
||||
|
|
@ -591,9 +449,6 @@ echo " ├─ Fail2ban: active (systemd backend)"
|
|||
echo " └─ Auto-updates: weekly pacman-update.timer"
|
||||
echo ""
|
||||
echo -e " ${GREEN}Paths${NC}"
|
||||
echo " ├─ Custom apps: /opt/apps/"
|
||||
echo " ├─ Static sites: /var/www/"
|
||||
echo " ├─ Deploy script: ~/deploy.sh <app-dir> [branch]"
|
||||
echo " └─ SSH config: ~/ssh-config-snippet.txt"
|
||||
echo ""
|
||||
echo -e " ${YELLOW}NEXT STEPS${NC}"
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue