Slim down: SSH-only firewall, drop GitHub PAT/GHCR, deploy helper and app dirs

arch-setup.sh

@@ -11,14 +11,9 @@ set -euo pipefail
 # DEFAULTS
 # =============================================================================
 
-GITHUB_PAT=""
 TIMEZONE="Europe/London"
 LOCALE="en_GB.UTF-8"
 
-# Comma-separated list of repos to clone (leave empty to skip)
-# Format: "user/repo:/opt/apps/dirname,user/repo2:/opt/apps/dirname2"
-REPOS_TO_CLONE=""
-
 # =============================================================================
 # COLOURS
 # =============================================================================
@@ -90,38 +85,6 @@ if [ -z "$GIT_EMAIL" ]; then
     GIT_EMAIL="not-set@example.com"
 fi
 
-# GitHub PAT
-echo ""
-echo "  A GitHub Personal Access Token lets the server pull from"
-echo "  your private repos and container registry (GHCR)."
-echo "  You can skip this and add one later."
-read -rp "GitHub username (leave empty to skip): " input_gh_user
-GITHUB_USER="${input_gh_user:-}"
-
-if [ -n "$GITHUB_USER" ]; then
-    read -rp "GitHub PAT: " input_pat
-    GITHUB_PAT="${input_pat:-}"
-
-    if [ -n "$GITHUB_PAT" ]; then
-        # Validate PAT format (should start with ghp_ or github_pat_)
-        if ! [[ "$GITHUB_PAT" =~ ^(ghp_|github_pat_) ]]; then
-            warn "PAT doesn't look right — expected it to start with ghp_ or github_pat_"
-            read -p "Continue anyway? (y/n) " -n 1 -r
-            echo ""
-            if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-                GITHUB_PAT=""
-                GITHUB_USER=""
-                warn "Skipping GitHub setup — you can configure it later"
-            fi
-        fi
-    else
-        warn "No PAT provided — skipping GitHub setup"
-        GITHUB_USER=""
-    fi
-else
-    GITHUB_PAT=""
-fi
-
 # Confirm
 echo ""
 echo -e "${CYAN}━━━ Confirm settings ━━━${NC}"
@@ -130,8 +93,6 @@ echo "  SSH alias:      $SSH_ALIAS"
 echo "  Deploy user:    $DEPLOY_USER"
 echo "  Git name:       $GIT_NAME"
 echo "  Git email:      $GIT_EMAIL"
-echo "  GitHub user:    $([ -n "$GITHUB_USER" ] && echo "$GITHUB_USER" || echo 'Not set')"
-echo "  Git PAT:        $([ -n "$GITHUB_PAT" ] && echo 'Set' || echo 'Not set')"
 echo "  Timezone:       $TIMEZONE"
 echo ""
 read -p "Continue? (y/n) " -n 1 -r
@@ -275,14 +236,12 @@ step "5/8 · Firewall (UFW)"
 ufw default deny incoming
 ufw default allow outgoing
 ufw allow 22/tcp comment 'SSH'
-ufw allow 80/tcp comment 'HTTP'
-ufw allow 443/tcp comment 'HTTPS'
 
 # Enable without prompt, and make it survive reboots
 echo "y" | ufw enable
 systemctl enable ufw
 
-log "UFW enabled — ports 22, 80, 443 open"
+log "UFW enabled — port 22 only"
 ufw status verbose
 
 # =============================================================================
@@ -439,110 +398,11 @@ step "Git configuration"
 su - $DEPLOY_USER << GITEOF
 git config --global user.name "$GIT_NAME"
 git config --global user.email "$GIT_EMAIL"
-git config --global credential.helper store
 git config --global init.defaultBranch main
 GITEOF
 
 log "Git configured for $DEPLOY_USER"
 
-# Store PAT if provided (correct format: https://USERNAME:TOKEN@github.com)
-if [ -n "$GITHUB_PAT" ] && [ -n "$GITHUB_USER" ]; then
-    su - $DEPLOY_USER -c "echo 'https://$GITHUB_USER:$GITHUB_PAT@github.com' > /home/$DEPLOY_USER/.git-credentials"
-    chmod 600 /home/$DEPLOY_USER/.git-credentials
-    chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/.git-credentials
-    log "GitHub PAT stored for git (https://$GITHUB_USER:***@github.com)"
-
-    # Log Docker into GHCR so Once can pull container images
-    log "Logging Docker into ghcr.io..."
-    if echo "$GITHUB_PAT" | su - $DEPLOY_USER -c "docker login ghcr.io -u $GITHUB_USER --password-stdin"; then
-        log "Docker logged into ghcr.io as $GITHUB_USER"
-    else
-        warn "Docker GHCR login failed — you can run manually: docker login ghcr.io -u $GITHUB_USER"
-    fi
-fi
-
-# Clone repos if specified
-if [ -n "$REPOS_TO_CLONE" ]; then
-    IFS=',' read -ra REPO_PAIRS <<< "$REPOS_TO_CLONE"
-    for pair in "${REPO_PAIRS[@]}"; do
-        IFS=':' read -r repo dir <<< "$pair"
-        if [ ! -d "$dir" ]; then
-            mkdir -p "$(dirname "$dir")"
-            su - $DEPLOY_USER -c "git clone https://github.com/$repo.git $dir"
-            chown -R $DEPLOY_USER:$DEPLOY_USER "$dir"
-            log "Cloned $repo → $dir"
-        else
-            warn "$dir already exists — skipping clone"
-        fi
-    done
-fi
-
-# =============================================================================
-# CREATE DIRECTORIES
-# =============================================================================
-
-step "Directory structure"
-
-mkdir -p /opt/apps
-chown -R $DEPLOY_USER:$DEPLOY_USER /opt/apps
-log "Created /opt/apps for custom Docker apps"
-
-mkdir -p /var/www
-chown -R $DEPLOY_USER:$DEPLOY_USER /var/www
-log "Created /var/www for static sites"
-
-# =============================================================================
-# DEPLOY HELPER SCRIPT
-# =============================================================================
-
-step "Deploy helper script"
-
-cat > /home/$DEPLOY_USER/deploy.sh << 'DEPLOYSCRIPT'
-#!/bin/bash
-# Usage: ./deploy.sh <app-directory> [branch]
-set -euo pipefail
-
-APP_DIR="${1:?Usage: ./deploy.sh <app-directory> [branch]}"
-BRANCH="${2:-main}"
-
-if [ ! -d "$APP_DIR" ]; then
-    echo "Error: $APP_DIR does not exist"
-    exit 1
-fi
-
-cd "$APP_DIR"
-echo "📦 Deploying $(basename $APP_DIR) from branch $BRANCH..."
-
-echo "⬇️  Pulling latest..."
-git fetch origin
-git checkout "$BRANCH"
-git pull origin "$BRANCH"
-
-if [ -f "docker-compose.yml" ] || [ -f "compose.yml" ]; then
-    echo "🐳 Docker Compose detected — rebuilding..."
-    docker compose down
-    docker compose up -d --build
-    echo "✅ Containers running:"
-    docker compose ps
-elif [ -f "Dockerfile" ]; then
-    APP_NAME=$(basename "$APP_DIR")
-    echo "🐳 Dockerfile detected — rebuilding $APP_NAME..."
-    docker build -t "$APP_NAME" .
-    docker stop "$APP_NAME" 2>/dev/null || true
-    docker rm "$APP_NAME" 2>/dev/null || true
-    docker run -d --name "$APP_NAME" --restart unless-stopped "$APP_NAME"
-    echo "✅ Container running"
-else
-    echo "📁 Static site — no build step needed"
-fi
-
-echo "🎉 Deployed at $(date)"
-DEPLOYSCRIPT
-
-chown $DEPLOY_USER:$DEPLOY_USER /home/$DEPLOY_USER/deploy.sh
-chmod +x /home/$DEPLOY_USER/deploy.sh
-log "Deploy helper created at ~/deploy.sh"
-
 # =============================================================================
 # GENERATE LOCAL SSH CONFIG FILE
 # =============================================================================
@@ -580,9 +440,7 @@ echo "  ├─ Root login:    disabled"
 echo "  └─ Auth:          key-only"
 echo ""
 echo -e "  ${GREEN}Firewall${NC}"
-echo "  ├─ 22/tcp          SSH"
+echo "  └─ 22/tcp          SSH (only open port)"
-echo "  ├─ 80/tcp          HTTP"
-echo "  └─ 443/tcp         HTTPS"
 echo ""
 echo -e "  ${GREEN}Services${NC}"
 echo "  ├─ Docker:        $(docker --version 2>/dev/null || echo 'installed')"
@@ -591,9 +449,6 @@ echo "  ├─ Fail2ban:      active (systemd backend)"
 echo "  └─ Auto-updates:  weekly pacman-update.timer"
 echo ""
 echo -e "  ${GREEN}Paths${NC}"
-echo "  ├─ Custom apps:   /opt/apps/"
-echo "  ├─ Static sites:  /var/www/"
-echo "  ├─ Deploy script: ~/deploy.sh <app-dir> [branch]"
 echo "  └─ SSH config:    ~/ssh-config-snippet.txt"
 echo ""
 echo -e "  ${YELLOW}NEXT STEPS${NC}"