501 lines
13 KiB
Bash
Executable File
501 lines
13 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
#############################################################
|
|
# Author: Taryel Hlontsi, 2023
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>
|
|
#############################################################
|
|
|
|
|
|
#############################################################
|
|
# SETUP SECTION, use "sudo" to run the script
|
|
#############################################################
|
|
# if set to true, ssh login only with ssh key which must(!) be configured upfront
|
|
NO_PASSWORD_SSH=true
|
|
|
|
# user for gitea, and DB password that should be entered on the initialization web page
|
|
HOST_USER='git' # better don't change it
|
|
DB_PASSWORD='PasswordGoesHere'
|
|
|
|
GITEA_URL='https://dl.gitea.com/gitea/1.19.3/gitea-1.19.3-linux-arm64'
|
|
|
|
# change the IP. If domain is used then set it here as the server name
|
|
OS_SERVER_NAME="gitea.local"
|
|
OS_IP="192.168.0.10"
|
|
OS_COUNTRY="PL"
|
|
|
|
# may be left as is
|
|
LOG_DIR="/home/${SUDO_USER}"
|
|
LOG="${LOG_DIR}/log.txt"
|
|
|
|
#############################################################
|
|
# HELPER FUNCTIONS
|
|
#############################################################
|
|
warn() {
|
|
PURPLE='\033[1;35m'
|
|
NC='\033[0m'
|
|
echo -e "${PURPLE}$1${NC}"
|
|
echo -e "WARN:\t$1" >> $LOG
|
|
}
|
|
|
|
info() {
|
|
GREEN='\033[1;32m'
|
|
NC='\033[0m'
|
|
echo -e "${GREEN}$1${NC}"
|
|
echo -e "INFO:\t$1" >> $LOG
|
|
}
|
|
|
|
trace() {
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m'
|
|
echo -e "${YELLOW}$1${NC}"
|
|
echo -e "TRACE:\t$1" >> $LOG
|
|
}
|
|
|
|
error() {
|
|
RED='\033[1;31m'
|
|
NC='\033[0m'
|
|
echo -e "${RED}$1${NC}"
|
|
echo -e "ERROR:\t$1" >> $LOG
|
|
}
|
|
|
|
not_set() {
|
|
count=$(grep -Pcx "$1" "$2")
|
|
code=$?
|
|
|
|
if [[ $code == 2 ]] && [[ -z "$count" ]]; then
|
|
echo "not_set() func or its caller contains a bug that has to be fixed! param1=${1} param2=${2} code=${code} count=${count}. Exiting!"
|
|
exit -1
|
|
fi
|
|
|
|
[[ $count == 0 ]] && [[ $code == 1 ]] && return 0
|
|
|
|
return 1
|
|
}
|
|
|
|
not_exist() {
|
|
if [[ ! -e "$2" ]]; then
|
|
warn "file does not exist: $2"
|
|
return 0
|
|
else
|
|
count=$(grep -Pc "$1" "$2")
|
|
code=$?
|
|
[[ $count == 0 ]] && [[ $code == 1 ]] && return 0
|
|
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
configure() {
|
|
if not_exist "$1" "$3"; then
|
|
warn "setting \"$1\" is not in the file, thus won't be changed"
|
|
return 1
|
|
else
|
|
if not_set "$2" "$3"; then
|
|
sed -i "s~.*${1}.*~${2}~gi" "$3" &&
|
|
trace "\"$1\" set to \"$2\"" &&
|
|
return 0
|
|
else
|
|
warn "\"$2\" already set in \"$3\""
|
|
return 2
|
|
fi
|
|
fi
|
|
}
|
|
|
|
#############################################################
|
|
# 1 - ADD USER
|
|
#############################################################
|
|
add_user() {
|
|
info "STEP 1 Adding a user for container"
|
|
|
|
sudo adduser \
|
|
--system \
|
|
--shell /bin/bash \
|
|
--gecos 'Git Version Control' \
|
|
--group \
|
|
--disabled-password \
|
|
--home /home/git \
|
|
git
|
|
|
|
[[ $? -gt 0 ]] && { error 'Check git user setup, stopping now'; exit 1; }
|
|
|
|
info "STEP 1 done"
|
|
warn "Press enter to proceed with the next step"; read
|
|
}
|
|
|
|
#############################################################
|
|
# 2 - CHANGE SERVER NAME
|
|
#############################################################
|
|
change_servername() {
|
|
info "STEP 2 Changing server name to ${OS_SERVER_NAME}"
|
|
|
|
echo $OS_SERVER_NAME > /etc/hostname
|
|
hostentry="127.0.1.1\t${OS_SERVER_NAME}"
|
|
if not_set "$hostentry" "/etc/hosts"; then
|
|
echo -e "$hostentry" >> /etc/hosts
|
|
else
|
|
warn "\"$hostentry\" already set in \"/etc/hosts\""
|
|
fi
|
|
|
|
info "STEP 2 done"
|
|
warn "Press enter to proceed with the next step"; read
|
|
}
|
|
|
|
#############################################################
|
|
# 3 - INSTALL MARIADB
|
|
#############################################################
|
|
install_mariadb() {
|
|
info "STEP 3 Installing Maria DB"
|
|
|
|
apt-get -y install mariadb-server > /dev/null
|
|
systemctl --quiet is-active mariadb || systemctl start mariadb
|
|
systemctl --quiet is-enabled mariadb || systemctl enable mariadb
|
|
|
|
mysql -u root <<EOF
|
|
CREATE DATABASE IF NOT EXISTS gitea;
|
|
GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';
|
|
DROP DATABASE IF EXISTS test;
|
|
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
|
|
DELETE FROM mysql.user WHERE User='';
|
|
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
|
|
ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';
|
|
FLUSH PRIVILEGES;
|
|
EOF
|
|
[[ $? -eq 0 ]] || { error 'Something went bananas while setting up a Maria DB, proceed?'; }
|
|
|
|
mysql -u root -p${DB_PASSWORD} -h localhost <<EOF
|
|
SHOW DATABASES;
|
|
SELECT User FROM mysql.user;
|
|
EOF
|
|
|
|
info "STEP 3 done"
|
|
warn "Press enter to proceed with the next step"; read
|
|
}
|
|
|
|
#############################################################
|
|
# 4 - INSTALL NGINX
|
|
#############################################################
|
|
install_nginx() {
|
|
info "STEP 4 Installing Nginx"
|
|
|
|
which nginx && { warn 'Nginx already installed. Since there might be other sites configured on the server, advised to proceed with manual configuration of Nginx:
|
|
- main config: /etc/nginx/nginx.conf
|
|
- sites: /etc/nginx/sites-available
|
|
- linked to: /etc/nginx/sites-enabled
|
|
- logs: /var/log/nginx'; return 1; }
|
|
|
|
KEY="/etc/ssl/private/gitea-snakeoil.key"
|
|
CRT="/etc/ssl/certs/gitea-snakeoil.crt"
|
|
|
|
trace "Generating a self signed sertificate (${KEY} and ${CRT})"
|
|
|
|
openssl req -x509 \
|
|
-nodes \
|
|
-days 2048 \
|
|
-newkey rsa:2048 \
|
|
-keyout $KEY \
|
|
-out $CRT \
|
|
-subj "/C=${OS_COUNTRY}/ST=${OS_COUNTRY}/L=${OS_COUNTRY}/O=E Corp/OU=IT/CN=${OS_SERVER_NAME}/emailAddress=info@example.com"
|
|
|
|
apt-get install -y nginx > /dev/null
|
|
systemctl --quiet is-active nginx || systemctl start nginx
|
|
ufw allow 'Nginx Full'
|
|
|
|
trace "Rewriting default /etc/nginx/nginx.conf"
|
|
cat <<EOF | tee /etc/nginx/nginx.conf
|
|
user www-data;
|
|
worker_processes auto;
|
|
pid /run/nginx.pid;
|
|
include /etc/nginx/modules-enabled/*.conf;
|
|
|
|
events {
|
|
worker_connections 768;
|
|
}
|
|
|
|
http {
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 70;
|
|
types_hash_max_size 2048;
|
|
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
ssl_protocols TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
access_log /var/log/nginx/access.log;
|
|
error_log /var/log/nginx/error.log;
|
|
|
|
gzip on;
|
|
|
|
include /etc/nginx/conf.d/*.conf;
|
|
include /etc/nginx/sites-enabled/*;
|
|
}
|
|
EOF
|
|
|
|
trace "Generating a new config /etc/nginx/sites-available/${OS_SERVER_NAME}.conf"
|
|
|
|
cat <<EOF | tee /etc/nginx/sites-available/${OS_SERVER_NAME}.conf
|
|
server {
|
|
listen 80;
|
|
server_name ${OS_SERVER_NAME};
|
|
return 301 https://${OS_SERVER_NAME}$request_uri;
|
|
access_log /var/log/nginx/${OS_SERVER_NAME}-access.log;
|
|
error_log /var/log/nginx/${OS_SERVER_NAME}-error.log;
|
|
}
|
|
server {
|
|
listen 443 ssl http2;
|
|
|
|
server_name ${OS_SERVER_NAME};
|
|
client_max_body_size 256m;
|
|
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
|
|
ssl_certificate ${CRT};
|
|
ssl_certificate_key ${KEY};
|
|
|
|
location / {
|
|
proxy_redirect off;
|
|
proxy_pass http://localhost:3000/;
|
|
}
|
|
|
|
access_log /var/log/nginx/${OS_SERVER_NAME}-access.log;
|
|
error_log /var/log/nginx/${OS_SERVER_NAME}-error.log;
|
|
}
|
|
EOF
|
|
|
|
trace 'Making a link from sites-available to sites-enabled...'
|
|
|
|
ln -s /etc/nginx/sites-available/${OS_SERVER_NAME}.conf \
|
|
/etc/nginx/sites-enabled
|
|
nginx -t
|
|
|
|
info "STEP 4 done"
|
|
warn "Press enter to proceed with the next step"; read
|
|
}
|
|
|
|
#############################################################
|
|
# 5 - INSTALL GITEA
|
|
#############################################################
|
|
install_gitea() {
|
|
info "STEP 5 Installing Gitea as a binary"
|
|
|
|
trace "Downloading ${GITEA_URL}"
|
|
|
|
apt-get install -y git wget > /dev/null
|
|
wget --continue $GITEA_URL --output-document gitea
|
|
chmod +x gitea
|
|
chown git:git gitea
|
|
|
|
trace 'Creating nessesary directories with git owner'
|
|
|
|
mkdir -p /var/lib/gitea/{custom,data,log}
|
|
chown -Rv git:git /var/lib/gitea/
|
|
chmod -Rv 750 /var/lib/gitea/
|
|
mkdir /etc/gitea
|
|
chown root:git /etc/gitea
|
|
chmod 770 /etc/gitea
|
|
cp --force gitea /usr/local/bin/gitea
|
|
|
|
cat <<EOF | tee /etc/systemd/system/gitea.service
|
|
[Unit]
|
|
Description=Gitea (Git with a cup of tea)
|
|
DefaultDependencies=no
|
|
After=syslog.target
|
|
After=network.target
|
|
Wants=mariadb.service
|
|
After=mariadb.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=git
|
|
Group=git
|
|
ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
|
|
Environment=GITEA_WORK_DIR=/var/lib/gitea/
|
|
Restart=always
|
|
RestartSec=5s
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
EOF
|
|
trace 'Installing a systemd service'
|
|
|
|
systemctl daemon-reload
|
|
systemctl --quiet is-enabled gitea || systemctl enable gitea
|
|
systemctl restart gitea
|
|
gitea --version
|
|
|
|
info "STEP 5 done"
|
|
warn "Press enter to proceed with the next step"; read
|
|
}
|
|
|
|
#############################################################
|
|
# 6 - ADDITIONAL SECURITY FOR THE SERVER
|
|
#############################################################
|
|
secure_server() {
|
|
info "STEP 6 Securing the server"
|
|
|
|
trace "Installing openssh server..."
|
|
apt-get install -y openssh-server > /dev/null
|
|
systemctl --quiet is-active sshd || systemctl start sshd
|
|
systemctl --quiet is-enabled sshd || systemctl enable sshd
|
|
|
|
SSH_CFG="/etc/ssh/sshd_config"
|
|
SSH_CFG_BACK="${LOG_DIR}/sshd_config.backup"
|
|
|
|
trace "Going to rewrite ${SSH_CFG}"
|
|
trace "Backup will be here: ${SSH_CFG_BACK}"
|
|
|
|
if [[ -e "$SSH_CFG_BACK" ]]; then
|
|
warn "SSH config backup is already there!"
|
|
else
|
|
cp $SSH_CFG $SSH_CFG_BACK
|
|
cat <<EOF | tee ${SSH_CFG}
|
|
Include /etc/ssh/sshd_config.d/*.conf
|
|
PermitRootLogin no
|
|
ChallengeResponseAuthentication no
|
|
UsePAM yes
|
|
X11Forwarding yes
|
|
PrintMotd no
|
|
AcceptEnv LANG LC_*
|
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
EOF
|
|
if $NO_PASSWORD_SSH; then
|
|
info "Disabling SSH with password completely!"
|
|
echo 'PasswordAuthentication no' >> $SSH_CFG
|
|
fi
|
|
fi
|
|
|
|
trace "Installing fail2ban..."
|
|
apt-get install -y fail2ban > /dev/null
|
|
systemctl --quiet is-active fail2ban || systemctl start fail2ban
|
|
systemctl --quiet is-enabled fail2ban || systemctl enable fail2ban
|
|
fail2ban-client status
|
|
F2B_CFG_ORIG="/etc/fail2ban/jail.conf"
|
|
F2B_CFG_COPY="/etc/fail2ban/jail.local"
|
|
if [[ -e "$F2B_CFG_COPY" ]]; then
|
|
warn "Fail2ban was already set up"
|
|
else
|
|
cp $F2B_CFG_ORIG $F2B_CFG_COPY
|
|
trace "Setting up ${F2B_CFG_COPY}"
|
|
configure 'bantime = 10m' 'bantime = 60m' $F2B_CFG_COPY
|
|
configure 'maxretry = 5' 'maxretry = 20' $F2B_CFG_COPY
|
|
fi
|
|
|
|
trace "Configuring ufw..."
|
|
ufw --force enable
|
|
ufw allow 'OpenSSH'
|
|
ufw status
|
|
|
|
info "STEP 6 done"
|
|
warn "Press enter to proceed with the next step"; read
|
|
}
|
|
|
|
#############################################################
|
|
# 7 - MAKE AN UPDATE HELPER (AS A SCRIPT)
|
|
#############################################################
|
|
create_updater() {
|
|
info 'Step 7 Create an updater for gitea (small helper utility)'
|
|
|
|
MY_HOME="/home/${SUDO_USER}"
|
|
SCRIPT='/usr/local/bin/gitea-update'
|
|
|
|
cat <<EOF | tee $SCRIPT
|
|
#!/bin/bash
|
|
|
|
user=\$(whoami)
|
|
if [[ \$user != root ]]; then
|
|
echo 'You are using a non-privileged account'
|
|
exit 1
|
|
fi
|
|
|
|
if [[ \$# -eq 0 ]]; then
|
|
echo 'Provide a web link to the bin file as an argument!'
|
|
echo "Example: gitea-update $GITEA_URL"
|
|
exit 1
|
|
else
|
|
echo "Link: \$1"
|
|
fi
|
|
|
|
mkdir -p "${MY_HOME}" > /dev/null
|
|
cd "${MY_HOME}"
|
|
|
|
gitea --version
|
|
wget --continue \$1 --output-document gitea
|
|
systemctl stop gitea
|
|
chmod +x gitea
|
|
chown git:git gitea
|
|
cp --force gitea /usr/local/bin/gitea
|
|
systemctl restart gitea
|
|
gitea --version
|
|
|
|
EOF
|
|
|
|
chmod +x $SCRIPT
|
|
|
|
trace "Updater has been created. call it 'sudo gitea-update url_to_new_version'"
|
|
|
|
info 'Step 7 done'
|
|
}
|
|
|
|
#############################################################
|
|
# RUN SECTION
|
|
#############################################################
|
|
user=$(whoami)
|
|
if [ $user != root ]; then
|
|
error "You are using a non-privileged account"
|
|
exit 1
|
|
fi
|
|
|
|
echo $(date +'%Y-%m-%d %H:%M') > $LOG
|
|
|
|
info "Hiya!"
|
|
|
|
sudo apt update
|
|
sudo apt upgrade -y
|
|
|
|
add_user
|
|
change_servername
|
|
install_mariadb
|
|
install_nginx
|
|
install_gitea
|
|
secure_server
|
|
create_updater
|
|
|
|
info "Don't forget to reboot"
|
|
info "Bye!"
|
|
info "PS. Log is here: ${LOG}"
|
|
warn "REBOOT NOW!!!"
|
|
|
|
exit 0
|
|
|
|
# restart is mandatory!!!
|
|
|
|
# if a real domain is available - a certificate can be obtained, for examle:
|
|
# sudo apt install certbot python3-certbot-nginx
|
|
# sudo certbot --nginx -d gittar.crabdance.com
|
|
# sudo certbot renew --dry-run
|
|
|
|
# gitea can be upgraded or downgraded by executing
|
|
# sudo gitea-update 'https://dl.gitea.com/gitea/1.19.3/gitea-1.19.3-linux-arm64'
|
|
# however before running it ensure there is no old gitea file in the home dir
|
|
# otherwise it will install the same version again (such 'safety' measure;))
|