scripts/gitea-install-ubuntu2004.sh

#!/bin/bash

#############################################################
# Author: Taryel Hlontsi, 2023
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <https://www.gnu.org/licenses/>
#############################################################


#############################################################
#           SETUP SECTION, use "sudo" to run the script
#############################################################
# if set to true, ssh login only with ssh key which must(!) be configured upfront
NO_PASSWORD_SSH=true

# user for gitea, and DB password that should be entered on the initialization web page
HOST_USER='git' # better don't change it
DB_PASSWORD='PasswordGoesHere'

GITEA_URL='https://dl.gitea.com/gitea/1.19.3/gitea-1.19.3-linux-arm64'

# change the IP. If domain is used then set it here as the server name
OS_SERVER_NAME="gitea.local"
OS_IP="192.168.0.10"
OS_COUNTRY="PL"

# may be left as is
LOG_DIR="/home/${SUDO_USER}"
LOG="${LOG_DIR}/log.txt"

#############################################################
#          HELPER FUNCTIONS
#############################################################
warn() {
    PURPLE='\033[1;35m'
    NC='\033[0m'
    echo -e "${PURPLE}$1${NC}"
    echo -e "WARN:\t$1" >> $LOG
}

info() {
    GREEN='\033[1;32m'
    NC='\033[0m'
    echo -e "${GREEN}$1${NC}"
    echo -e "INFO:\t$1" >> $LOG
}

trace() {
    YELLOW='\033[1;33m'
    NC='\033[0m'
    echo -e "${YELLOW}$1${NC}"
    echo -e "TRACE:\t$1" >> $LOG
}

error() {
    RED='\033[1;31m'
    NC='\033[0m'
    echo -e "${RED}$1${NC}"
    echo -e "ERROR:\t$1" >> $LOG
}

not_set() {
    count=$(grep -Pcx "$1" "$2")
    code=$?

    if [[ $code == 2 ]] && [[ -z "$count" ]]; then
        echo "not_set() func or its caller contains a bug that has to be fixed! param1=${1} param2=${2} code=${code} count=${count}. Exiting!"
        exit -1
    fi

    [[ $count == 0 ]] && [[ $code == 1 ]] && return 0

    return 1   
}

not_exist() {
    if [[ ! -e "$2" ]]; then
	warn "file does not exist: $2"
	return 0
    else
	count=$(grep -Pc "$1" "$2")
	code=$?
	[[ $count == 0 ]] && [[ $code == 1 ]] && return 0

	return 1   
    fi
}

configure() {
    if not_exist "$1" "$3"; then
	warn "setting \"$1\" is not in the file, thus won't be changed"
	return 1
    else
	if not_set "$2" "$3"; then	
	    sed -i "s~.*${1}.*~${2}~gi" "$3" &&
		trace "\"$1\" set to \"$2\"" &&
		return 0
	else
	    warn "\"$2\" already set in \"$3\""
	    return 2
	fi
    fi    
}

#############################################################
#          1 - ADD USER
#############################################################
add_user() {
    info "STEP 1 Adding a user for container"

    sudo adduser \
   --system \
   --shell /bin/bash \
   --gecos 'Git Version Control' \
   --group \
   --disabled-password \
   --home /home/git \
   git

    [[ $? -gt 0 ]] && { error 'Check git user setup, stopping now'; exit 1; }

    info "STEP 1 done"
    warn "Press enter to proceed with the next step"; read
}

#############################################################
#          2 - CHANGE SERVER NAME
#############################################################
change_servername() {
    info "STEP 2 Changing server name to ${OS_SERVER_NAME}"

    echo $OS_SERVER_NAME > /etc/hostname
    hostentry="127.0.1.1\t${OS_SERVER_NAME}"
    if not_set "$hostentry" "/etc/hosts"; then
	echo -e "$hostentry" >> /etc/hosts
    else
	warn "\"$hostentry\" already set in \"/etc/hosts\""
    fi

    info "STEP 2 done"
    warn "Press enter to proceed with the next step"; read
}

#############################################################
#          3 - INSTALL MARIADB
#############################################################
install_mariadb() {
    info "STEP 3 Installing Maria DB"

    apt-get -y install mariadb-server > /dev/null
    systemctl --quiet is-active mariadb || systemctl start mariadb
    systemctl --quiet is-enabled mariadb || systemctl enable mariadb

    mysql -u root <<EOF
CREATE DATABASE IF NOT EXISTS gitea;
GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';
FLUSH PRIVILEGES;
EOF
    [[ $? -eq 0 ]] || { error 'Something went bananas while setting up a Maria DB, proceed?'; }

    mysql -u root -p${DB_PASSWORD} -h localhost <<EOF
SHOW DATABASES;
SELECT User FROM mysql.user;
EOF

    info "STEP 3 done"
    warn "Press enter to proceed with the next step"; read
}

#############################################################
#          4 - INSTALL NGINX
#############################################################
install_nginx() {
    info "STEP 4 Installing Nginx"

    which nginx && { warn 'Nginx already installed. Since there might be other sites configured on the server, advised to proceed with manual configuration of Nginx: 
- main config: /etc/nginx/nginx.conf
- sites: /etc/nginx/sites-available
- linked to: /etc/nginx/sites-enabled
- logs: /var/log/nginx'; return 1; }

    KEY="/etc/ssl/private/gitea-snakeoil.key"
    CRT="/etc/ssl/certs/gitea-snakeoil.crt"

    trace "Generating a self signed sertificate (${KEY} and ${CRT})"
    
    openssl req -x509 \
    -nodes \
    -days 2048 \
    -newkey rsa:2048 \
    -keyout $KEY \
    -out $CRT \
    -subj "/C=${OS_COUNTRY}/ST=${OS_COUNTRY}/L=${OS_COUNTRY}/O=E Corp/OU=IT/CN=${OS_SERVER_NAME}/emailAddress=info@example.com"

    apt-get install -y nginx > /dev/null
    systemctl --quiet is-active nginx || systemctl start nginx
    ufw allow 'Nginx Full'

    trace "Rewriting default /etc/nginx/nginx.conf"
    cat <<EOF | tee /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
}

http {
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 10m;
	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 70;
	types_hash_max_size 2048;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	ssl_protocols TLSv1.3;
	ssl_prefer_server_ciphers on;

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	gzip on;

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}
EOF

    trace "Generating a new config /etc/nginx/sites-available/${OS_SERVER_NAME}.conf"
    
    cat <<EOF | tee /etc/nginx/sites-available/${OS_SERVER_NAME}.conf
server {
        listen 80;
        server_name ${OS_SERVER_NAME};
        return 301 https://${OS_SERVER_NAME}$request_uri;
	access_log /var/log/nginx/${OS_SERVER_NAME}-access.log;
	error_log /var/log/nginx/${OS_SERVER_NAME}-error.log;
}
server {
        listen 443 ssl http2;
        
	server_name ${OS_SERVER_NAME};
        client_max_body_size 256m;
	
	proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
	
        ssl_certificate ${CRT};
        ssl_certificate_key ${KEY};
        
	location / {
		proxy_redirect off;
                proxy_pass http://localhost:3000/;
	}
	
	access_log /var/log/nginx/${OS_SERVER_NAME}-access.log;
	error_log /var/log/nginx/${OS_SERVER_NAME}-error.log;
}
EOF

    trace 'Making a link from sites-available to sites-enabled...'
    
    ln -s /etc/nginx/sites-available/${OS_SERVER_NAME}.conf \
	     /etc/nginx/sites-enabled
    nginx -t

    info "STEP 4 done"
    warn "Press enter to proceed with the next step"; read
}

#############################################################
#          5 - INSTALL GITEA
#############################################################
install_gitea() {
    info "STEP 5 Installing Gitea as a binary"

    trace "Downloading ${GITEA_URL}"

    apt-get install -y git wget > /dev/null
    wget --continue $GITEA_URL --output-document gitea
    chmod +x gitea
    chown git:git gitea

    trace 'Creating nessesary directories with git owner'
    
    mkdir -p /var/lib/gitea/{custom,data,log}
    chown -Rv git:git /var/lib/gitea/
    chmod -Rv 750 /var/lib/gitea/
    mkdir /etc/gitea
    chown root:git /etc/gitea
    chmod 770 /etc/gitea
    cp --force gitea /usr/local/bin/gitea

    cat <<EOF | tee /etc/systemd/system/gitea.service
[Unit]
Description=Gitea (Git with a cup of tea)
DefaultDependencies=no
After=syslog.target
After=network.target
Wants=mariadb.service
After=mariadb.service

[Service]
Type=simple
User=git
Group=git
ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
Environment=GITEA_WORK_DIR=/var/lib/gitea/
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target

EOF
    trace 'Installing a systemd service'
    
    systemctl daemon-reload
    systemctl --quiet is-enabled gitea || systemctl enable gitea
    systemctl restart gitea
    gitea --version

    info "STEP 5 done"
    warn "Press enter to proceed with the next step"; read
}

#############################################################
#          6 - ADDITIONAL SECURITY FOR THE SERVER
#############################################################
secure_server() {
    info "STEP 6 Securing the server"

    trace "Installing openssh server..."
    apt-get install -y openssh-server > /dev/null
    systemctl --quiet is-active sshd || systemctl start sshd
    systemctl --quiet is-enabled sshd || systemctl enable sshd

    SSH_CFG="/etc/ssh/sshd_config"
    SSH_CFG_BACK="${LOG_DIR}/sshd_config.backup"

    trace "Going to rewrite ${SSH_CFG}"
    trace "Backup will be here: ${SSH_CFG_BACK}"

    if [[ -e "$SSH_CFG_BACK" ]]; then
	warn "SSH config backup is already there!"
    else
	cp $SSH_CFG $SSH_CFG_BACK
	cat <<EOF | tee ${SSH_CFG}
Include /etc/ssh/sshd_config.d/*.conf
PermitRootLogin no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem	sftp	/usr/lib/openssh/sftp-server
EOF
	if $NO_PASSWORD_SSH; then
	    info "Disabling SSH with password completely!"
	    echo 'PasswordAuthentication no' >> $SSH_CFG
	fi    
    fi

    trace "Installing fail2ban..."
    apt-get install -y fail2ban > /dev/null
    systemctl --quiet is-active fail2ban || systemctl start fail2ban
    systemctl --quiet is-enabled fail2ban || systemctl enable fail2ban
    fail2ban-client status
    F2B_CFG_ORIG="/etc/fail2ban/jail.conf"
    F2B_CFG_COPY="/etc/fail2ban/jail.local"
    if [[ -e "$F2B_CFG_COPY" ]]; then
	warn "Fail2ban was already set up"
    else
	cp $F2B_CFG_ORIG $F2B_CFG_COPY
	trace "Setting up ${F2B_CFG_COPY}"
	configure 'bantime  = 10m' 'bantime  = 60m' $F2B_CFG_COPY
	configure 'maxretry = 5' 'maxretry = 20' $F2B_CFG_COPY
    fi

    trace "Configuring ufw..."
    ufw --force enable
    ufw allow 'OpenSSH'
    ufw status    
    
    info "STEP 6 done"
    warn "Press enter to proceed with the next step"; read    
}

#############################################################
#          7 - MAKE AN UPDATE HELPER (AS A SCRIPT)
#############################################################
create_updater() {
    info 'Step 7 Create an updater for gitea (small helper utility)'

    MY_HOME="/home/${SUDO_USER}"
    SCRIPT='/usr/local/bin/gitea-update'

    cat <<EOF | tee $SCRIPT
#!/bin/bash

user=\$(whoami)
if [[ \$user != root ]]; then
   echo 'You are using a non-privileged account'
   exit 1
fi

if [[ \$# -eq 0 ]]; then
    echo 'Provide a web link to the bin file as an argument!'
    echo "Example: gitea-update $GITEA_URL"
    exit 1
else
    echo "Link: \$1"
fi

mkdir -p "${MY_HOME}" > /dev/null
cd "${MY_HOME}"

gitea --version
wget --continue \$1 --output-document gitea
systemctl stop gitea
chmod +x gitea
chown git:git gitea
cp --force gitea /usr/local/bin/gitea
systemctl restart gitea
gitea --version

EOF

    chmod +x $SCRIPT

    trace "Updater has been created. call it 'sudo gitea-update url_to_new_version'"

    info 'Step 7 done'
}

#############################################################
#          RUN SECTION
#############################################################
user=$(whoami)
if [ $user != root ]; then
	error "You are using a non-privileged account"
        exit 1
fi

echo $(date +'%Y-%m-%d %H:%M') > $LOG

info "Hiya!"

sudo apt update
sudo apt upgrade -y

add_user
change_servername
install_mariadb
install_nginx
install_gitea
secure_server
create_updater

info "Don't forget to reboot"
info "Bye!"
info "PS. Log is here: ${LOG}"
warn "REBOOT NOW!!!"

exit 0

# restart is mandatory!!!

# if a real domain is available - a certificate can be obtained, for examle:
# sudo apt install certbot python3-certbot-nginx
# sudo certbot --nginx -d gittar.crabdance.com
# sudo certbot renew --dry-run

# gitea can be upgraded or downgraded by executing
# sudo gitea-update 'https://dl.gitea.com/gitea/1.19.3/gitea-1.19.3-linux-arm64'
# however before running it ensure there is no old gitea file in the home dir
# otherwise it will install the same version again (such 'safety' measure;))