Latest updarte
This commit is contained in:
hubaceks
91
deploy/deploy.sh
Normal file
91
deploy/deploy.sh
Normal file
@@ -0,0 +1,91 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# BistroUsky — deploy skript (aktualizace běžící instance)
|
||||
# Spusť ze složky s kódem: bash deploy/deploy.sh
|
||||
# =============================================================================
|
||||
set -euo pipefail
|
||||
|
||||
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERR]${NC} $*"; exit 1; }
|
||||
|
||||
APP_DIR="/var/www/bistrousky"
|
||||
APP_USER="bistrousky"
|
||||
PM2_APP="bistrousky"
|
||||
|
||||
[[ $EUID -ne 0 ]] && error "Spusť jako root (sudo bash deploy/deploy.sh)"
|
||||
|
||||
# ── 0. Záloha databáze před deploym ──────────────────────────────────────
|
||||
BACKUP_DIR="${APP_DIR}/backups"
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
BACKUP_FILE="${BACKUP_DIR}/db_$(date +%Y%m%d_%H%M%S).sql.gz"
|
||||
info "Záloha DB → ${BACKUP_FILE}..."
|
||||
sudo -u postgres pg_dump bistrousky | gzip > "$BACKUP_FILE"
|
||||
# Ponechat pouze posledních 10 záloh
|
||||
ls -t "${BACKUP_DIR}"/db_*.sql.gz 2>/dev/null | tail -n +11 | xargs -r rm
|
||||
|
||||
# ── 1. Synchronizace kódu ────────────────────────────────────────────────
|
||||
info "Kopírování kódu do ${APP_DIR}..."
|
||||
rsync -a --delete \
|
||||
--exclude='.env' \
|
||||
--exclude='node_modules/' \
|
||||
--exclude='.git/' \
|
||||
--exclude='logs/' \
|
||||
--exclude='backups/' \
|
||||
./ "$APP_DIR/"
|
||||
|
||||
chown -R "$APP_USER:$APP_USER" "$APP_DIR"
|
||||
|
||||
# ── 2. Závislosti (všechny — dev i prod, potřebné pro build) ─────────────
|
||||
info "Instalace závislostí..."
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && npm ci --quiet"
|
||||
|
||||
# ── 3. Prisma ─────────────────────────────────────────────────────────────
|
||||
info "Generování Prisma klienta..."
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && npx prisma generate"
|
||||
|
||||
info "Aplikace DB migrací..."
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && npx prisma migrate deploy"
|
||||
|
||||
# ── 4. Build ──────────────────────────────────────────────────────────────
|
||||
info "Produkční build (Next.js)..."
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && npm run build"
|
||||
|
||||
# ── 4b. Odstranit dev závislosti po buildu ────────────────────────────────
|
||||
info "Odstraňování dev závislostí..."
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && npm prune --omit=dev --quiet"
|
||||
|
||||
# ── 4c. Statické soubory a .env do standalone ─────────────────────────────
|
||||
info "Kopírování statiky a .env do standalone..."
|
||||
cp -r "${APP_DIR}/.next/static" "${APP_DIR}/.next/standalone/.next/static"
|
||||
cp -r "${APP_DIR}/public" "${APP_DIR}/.next/standalone/public"
|
||||
cp "${APP_DIR}/.env" "${APP_DIR}/.next/standalone/.env"
|
||||
|
||||
# ── 5. Restart aplikace (zero-downtime přes PM2 reload) ───────────────────
|
||||
info "Reloading PM2..."
|
||||
mkdir -p "${APP_DIR}/logs"
|
||||
chown "$APP_USER:$APP_USER" "${APP_DIR}/logs"
|
||||
|
||||
if sudo -u "$APP_USER" pm2 describe "$PM2_APP" &>/dev/null; then
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && pm2 reload ecosystem.config.js --env production"
|
||||
else
|
||||
sudo -u "$APP_USER" bash -c "cd $APP_DIR && pm2 start ecosystem.config.js --env production"
|
||||
sudo -u "$APP_USER" pm2 save
|
||||
fi
|
||||
|
||||
# ── 6. Zdravotní kontrola ────────────────────────────────────────────────
|
||||
info "Čekám na nastartování aplikace..."
|
||||
sleep 5
|
||||
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3000 || echo "000")
|
||||
if [[ "$HTTP_CODE" == "200" || "$HTTP_CODE" == "307" || "$HTTP_CODE" == "301" ]]; then
|
||||
info "Aplikace běží (HTTP ${HTTP_CODE}) ✓"
|
||||
else
|
||||
error "Aplikace neodpovídá (HTTP ${HTTP_CODE}) — zkontroluj: pm2 logs ${PM2_APP}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}=== Deploy dokončen ===${NC}"
|
||||
echo -e " Stav: $(sudo -u $APP_USER pm2 jlist | python3 -c "import sys,json; apps=json.load(sys.stdin); [print(a['name'],a['pm2_env']['status']) for a in apps if a['name']=='${PM2_APP}']" 2>/dev/null || echo 'viz pm2 list')"
|
||||
echo -e " Logy: ${YELLOW}pm2 logs ${PM2_APP}${NC}"
|
||||
echo ""
|
||||
183
deploy/install.sh
Normal file
183
deploy/install.sh
Normal file
@@ -0,0 +1,183 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
# BistroUsky — instalační skript pro LXC kontejner (Debian/Ubuntu)
|
||||
# Spusť jako root: bash install.sh
|
||||
# =============================================================================
|
||||
set -euo pipefail
|
||||
|
||||
# ── Barvy pro výstup ──────────────────────────────────────────────────────
|
||||
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
error() { echo -e "${RED}[ERR]${NC} $*"; exit 1; }
|
||||
|
||||
# ── Konfigurace (uprav dle potřeby) ──────────────────────────────────────
|
||||
APP_USER="bistrousky"
|
||||
APP_DIR="/var/www/bistrousky"
|
||||
NODE_VERSION="22"
|
||||
DOMAIN="" # např. shop.bistrousky.cz — nech prázdné pro přeskočení Nginx SSL
|
||||
DB_NAME="bistrousky"
|
||||
DB_USER="bistrousky"
|
||||
DB_PASS="" # bude vygenerováno automaticky, pokud prázdné
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
[[ $EUID -ne 0 ]] && error "Spusť skript jako root (sudo bash install.sh)"
|
||||
|
||||
# ── Vygenerovat DB heslo pokud není zadáno ────────────────────────────────
|
||||
if [[ -z "$DB_PASS" ]]; then
|
||||
DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 32)
|
||||
fi
|
||||
|
||||
info "=== BistroUsky instalace ==="
|
||||
info "Systém: $(lsb_release -ds 2>/dev/null || cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2)"
|
||||
|
||||
# ── 1. Systémové balíčky ──────────────────────────────────────────────────
|
||||
info "Aktualizace systému a instalace závislostí..."
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq \
|
||||
curl wget git build-essential \
|
||||
nginx certbot python3-certbot-nginx \
|
||||
postgresql postgresql-contrib \
|
||||
openssl ufw
|
||||
|
||||
# ── 2. Node.js ────────────────────────────────────────────────────────────
|
||||
if ! command -v node &>/dev/null || [[ "$(node -v | cut -d. -f1 | tr -d v)" -lt "$NODE_VERSION" ]]; then
|
||||
info "Instalace Node.js ${NODE_VERSION}..."
|
||||
curl -fsSL "https://deb.nodesource.com/setup_${NODE_VERSION}.x" | bash -
|
||||
apt-get install -y nodejs
|
||||
else
|
||||
info "Node.js $(node -v) již nainstalován."
|
||||
fi
|
||||
|
||||
# ── 3. PM2 ────────────────────────────────────────────────────────────────
|
||||
info "Instalace PM2..."
|
||||
npm install -g pm2 --quiet
|
||||
|
||||
# ── 4. Systémový uživatel ─────────────────────────────────────────────────
|
||||
if ! id "$APP_USER" &>/dev/null; then
|
||||
info "Vytváření uživatele ${APP_USER}..."
|
||||
useradd --system --shell /bin/bash --create-home --home-dir "$APP_DIR" "$APP_USER"
|
||||
else
|
||||
info "Uživatel ${APP_USER} již existuje."
|
||||
fi
|
||||
|
||||
mkdir -p "$APP_DIR"
|
||||
chown -R "$APP_USER:$APP_USER" "$APP_DIR"
|
||||
|
||||
# ── 5. PostgreSQL ─────────────────────────────────────────────────────────
|
||||
info "Konfigurace PostgreSQL..."
|
||||
systemctl enable postgresql --quiet
|
||||
systemctl start postgresql
|
||||
|
||||
sudo -u postgres psql <<SQL
|
||||
DO \$\$
|
||||
BEGIN
|
||||
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${DB_USER}') THEN
|
||||
CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASS}';
|
||||
ELSE
|
||||
ALTER USER ${DB_USER} WITH PASSWORD '${DB_PASS}';
|
||||
END IF;
|
||||
END
|
||||
\$\$;
|
||||
CREATE DATABASE IF NOT EXISTS ${DB_NAME} OWNER ${DB_USER};
|
||||
GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};
|
||||
SQL
|
||||
# pozn: CREATE DATABASE IF NOT EXISTS není platná syntaxe v Postgres —
|
||||
# použijeme || true
|
||||
sudo -u postgres createdb --owner="$DB_USER" "$DB_NAME" 2>/dev/null || true
|
||||
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};" 2>/dev/null || true
|
||||
|
||||
# ── 6. Aplikace ───────────────────────────────────────────────────────────
|
||||
info "Nastavení aplikace v ${APP_DIR}..."
|
||||
|
||||
# .env soubor
|
||||
ENV_FILE="${APP_DIR}/.env"
|
||||
if [[ ! -f "$ENV_FILE" ]]; then
|
||||
AUTH_SECRET=$(openssl rand -base64 32)
|
||||
cat > "$ENV_FILE" <<ENV
|
||||
DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@localhost:5432/${DB_NAME}?schema=public"
|
||||
AUTH_SECRET="${AUTH_SECRET}"
|
||||
|
||||
STRIPE_SECRET_KEY=""
|
||||
STRIPE_PUBLISHABLE_KEY=""
|
||||
STRIPE_WEBHOOK_SECRET=""
|
||||
|
||||
RESEND_API_KEY=""
|
||||
|
||||
NEXT_PUBLIC_APP_URL="https://${DOMAIN:-localhost}"
|
||||
ENV
|
||||
chmod 600 "$ENV_FILE"
|
||||
chown "$APP_USER:$APP_USER" "$ENV_FILE"
|
||||
info ".env vytvořen: ${ENV_FILE}"
|
||||
else
|
||||
warn ".env již existuje, přeskakuji."
|
||||
fi
|
||||
|
||||
# ── 7. Nginx ──────────────────────────────────────────────────────────────
|
||||
info "Konfigurace Nginx..."
|
||||
NGINX_CONF="/etc/nginx/sites-available/bistrousky"
|
||||
|
||||
cat > "$NGINX_CONF" <<NGINX
|
||||
server {
|
||||
listen 80;
|
||||
server_name ${DOMAIN:-_};
|
||||
|
||||
# Přesměrování na HTTPS (aktivuje se po certbot)
|
||||
# return 301 https://\$host\$request_uri;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
proxy_cache_bypass \$http_upgrade;
|
||||
}
|
||||
|
||||
# Statické soubory servírovat přímo (volitelné, Next.js to zvládne samo)
|
||||
location /_next/static/ {
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||||
}
|
||||
}
|
||||
NGINX
|
||||
|
||||
ln -sf "$NGINX_CONF" /etc/nginx/sites-enabled/bistrousky
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
nginx -t && systemctl enable nginx --quiet && systemctl restart nginx
|
||||
|
||||
# ── 8. Firewall ───────────────────────────────────────────────────────────
|
||||
info "Konfigurace UFW firewallu..."
|
||||
ufw --force enable
|
||||
ufw allow OpenSSH
|
||||
ufw allow "Nginx Full"
|
||||
ufw reload
|
||||
|
||||
# ── 9. PM2 startup (automatický start po rebootu) ─────────────────────────
|
||||
info "Nastavení PM2 startupu..."
|
||||
env PATH="$PATH:/usr/bin" pm2 startup systemd -u "$APP_USER" --hp "$APP_DIR" | tail -1 | bash || true
|
||||
|
||||
# ── Výpis výsledků ────────────────────────────────────────────────────────
|
||||
echo ""
|
||||
echo -e "${GREEN}╔══════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${GREEN}║ Instalace dokončena! ║${NC}"
|
||||
echo -e "${GREEN}╚══════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
echo -e " DB uživatel : ${YELLOW}${DB_USER}${NC}"
|
||||
echo -e " DB heslo : ${YELLOW}${DB_PASS}${NC} ← ulož si to!"
|
||||
echo -e " DB jméno : ${YELLOW}${DB_NAME}${NC}"
|
||||
echo -e " App složka : ${YELLOW}${APP_DIR}${NC}"
|
||||
echo -e " .env soubor : ${YELLOW}${ENV_FILE}${NC}"
|
||||
echo ""
|
||||
echo -e " Další kroky:"
|
||||
echo -e " 1. Nahraj kód do ${YELLOW}${APP_DIR}${NC}"
|
||||
echo -e " 2. Doplň API klíče do ${YELLOW}${ENV_FILE}${NC}"
|
||||
echo -e " 3. Spusť ${YELLOW}bash deploy.sh${NC}"
|
||||
if [[ -n "$DOMAIN" ]]; then
|
||||
echo -e " 4. SSL: ${YELLOW}certbot --nginx -d ${DOMAIN}${NC}"
|
||||
fi
|
||||
echo ""
|
||||
95
deploy/nginx/bistrousky.conf
Normal file
95
deploy/nginx/bistrousky.conf
Normal file
@@ -0,0 +1,95 @@
|
||||
# /etc/nginx/sites-available/bistrousky
|
||||
# Generováno install.sh — pro produkci uprav DOMAIN a aktivuj SSL blok
|
||||
|
||||
upstream bistrousky_app {
|
||||
server 127.0.0.1:3000;
|
||||
keepalive 64;
|
||||
}
|
||||
|
||||
# ── HTTP → HTTPS přesměrování ─────────────────────────────────────────────
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name shop.bistrousky.cz; # ← uprav na svou doménu
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# ── HTTPS (aktivuj po certbot) ────────────────────────────────────────────
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name shop.bistrousky.cz; # ← uprav na svou doménu
|
||||
|
||||
# SSL certifikáty (generuje certbot)
|
||||
ssl_certificate /etc/letsencrypt/live/shop.bistrousky.cz/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/shop.bistrousky.cz/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/shop.bistrousky.cz/chain.pem;
|
||||
|
||||
# Moderní SSL nastavení
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
# Security headers
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
add_header X-Frame-Options SAMEORIGIN always;
|
||||
add_header X-Content-Type-Options nosniff always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
|
||||
# Limity
|
||||
client_max_body_size 10M;
|
||||
|
||||
# Logy
|
||||
access_log /var/log/nginx/bistrousky.access.log;
|
||||
error_log /var/log/nginx/bistrousky.error.log;
|
||||
|
||||
# ── Statické soubory Next.js (cache navždy — hash v názvu) ────────────
|
||||
location /_next/static/ {
|
||||
proxy_pass http://bistrousky_app;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# ── Veřejné soubory ───────────────────────────────────────────────────
|
||||
location /favicon.ico {
|
||||
proxy_pass http://bistrousky_app;
|
||||
add_header Cache-Control "public, max-age=86400";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# ── Stripe webhook — zvýšený timeout ─────────────────────────────────
|
||||
location /api/webhooks/ {
|
||||
proxy_pass http://bistrousky_app;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 30s;
|
||||
}
|
||||
|
||||
# ── Aplikace ─────────────────────────────────────────────────────────
|
||||
location / {
|
||||
proxy_pass http://bistrousky_app;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
proxy_read_timeout 15s;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user