184 lines
8.2 KiB
Bash
184 lines
8.2 KiB
Bash
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# BistroUsky — instalační skript pro LXC kontejner (Debian/Ubuntu)
|
|
# Spusť jako root: bash install.sh
|
|
# =============================================================================
|
|
set -euo pipefail
|
|
|
|
# ── Barvy pro výstup ──────────────────────────────────────────────────────
|
|
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
|
info() { echo -e "${GREEN}[INFO]${NC} $*"; }
|
|
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
|
error() { echo -e "${RED}[ERR]${NC} $*"; exit 1; }
|
|
|
|
# ── Konfigurace (uprav dle potřeby) ──────────────────────────────────────
|
|
APP_USER="bistrousky"
|
|
APP_DIR="/var/www/bistrousky"
|
|
NODE_VERSION="22"
|
|
DOMAIN="" # např. shop.bistrousky.cz — nech prázdné pro přeskočení Nginx SSL
|
|
DB_NAME="bistrousky"
|
|
DB_USER="bistrousky"
|
|
DB_PASS="" # bude vygenerováno automaticky, pokud prázdné
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
[[ $EUID -ne 0 ]] && error "Spusť skript jako root (sudo bash install.sh)"
|
|
|
|
# ── Vygenerovat DB heslo pokud není zadáno ────────────────────────────────
|
|
if [[ -z "$DB_PASS" ]]; then
|
|
DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 32)
|
|
fi
|
|
|
|
info "=== BistroUsky instalace ==="
|
|
info "Systém: $(lsb_release -ds 2>/dev/null || cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2)"
|
|
|
|
# ── 1. Systémové balíčky ──────────────────────────────────────────────────
|
|
info "Aktualizace systému a instalace závislostí..."
|
|
apt-get update -qq
|
|
apt-get install -y -qq \
|
|
curl wget git build-essential \
|
|
nginx certbot python3-certbot-nginx \
|
|
postgresql postgresql-contrib \
|
|
openssl ufw
|
|
|
|
# ── 2. Node.js ────────────────────────────────────────────────────────────
|
|
if ! command -v node &>/dev/null || [[ "$(node -v | cut -d. -f1 | tr -d v)" -lt "$NODE_VERSION" ]]; then
|
|
info "Instalace Node.js ${NODE_VERSION}..."
|
|
curl -fsSL "https://deb.nodesource.com/setup_${NODE_VERSION}.x" | bash -
|
|
apt-get install -y nodejs
|
|
else
|
|
info "Node.js $(node -v) již nainstalován."
|
|
fi
|
|
|
|
# ── 3. PM2 ────────────────────────────────────────────────────────────────
|
|
info "Instalace PM2..."
|
|
npm install -g pm2 --quiet
|
|
|
|
# ── 4. Systémový uživatel ─────────────────────────────────────────────────
|
|
if ! id "$APP_USER" &>/dev/null; then
|
|
info "Vytváření uživatele ${APP_USER}..."
|
|
useradd --system --shell /bin/bash --create-home --home-dir "$APP_DIR" "$APP_USER"
|
|
else
|
|
info "Uživatel ${APP_USER} již existuje."
|
|
fi
|
|
|
|
mkdir -p "$APP_DIR"
|
|
chown -R "$APP_USER:$APP_USER" "$APP_DIR"
|
|
|
|
# ── 5. PostgreSQL ─────────────────────────────────────────────────────────
|
|
info "Konfigurace PostgreSQL..."
|
|
systemctl enable postgresql --quiet
|
|
systemctl start postgresql
|
|
|
|
sudo -u postgres psql <<SQL
|
|
DO \$\$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${DB_USER}') THEN
|
|
CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASS}';
|
|
ELSE
|
|
ALTER USER ${DB_USER} WITH PASSWORD '${DB_PASS}';
|
|
END IF;
|
|
END
|
|
\$\$;
|
|
CREATE DATABASE IF NOT EXISTS ${DB_NAME} OWNER ${DB_USER};
|
|
GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};
|
|
SQL
|
|
# pozn: CREATE DATABASE IF NOT EXISTS není platná syntaxe v Postgres —
|
|
# použijeme || true
|
|
sudo -u postgres createdb --owner="$DB_USER" "$DB_NAME" 2>/dev/null || true
|
|
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};" 2>/dev/null || true
|
|
|
|
# ── 6. Aplikace ───────────────────────────────────────────────────────────
|
|
info "Nastavení aplikace v ${APP_DIR}..."
|
|
|
|
# .env soubor
|
|
ENV_FILE="${APP_DIR}/.env"
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
AUTH_SECRET=$(openssl rand -base64 32)
|
|
cat > "$ENV_FILE" <<ENV
|
|
DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@localhost:5432/${DB_NAME}?schema=public"
|
|
AUTH_SECRET="${AUTH_SECRET}"
|
|
|
|
STRIPE_SECRET_KEY=""
|
|
STRIPE_PUBLISHABLE_KEY=""
|
|
STRIPE_WEBHOOK_SECRET=""
|
|
|
|
RESEND_API_KEY=""
|
|
|
|
NEXT_PUBLIC_APP_URL="https://${DOMAIN:-localhost}"
|
|
ENV
|
|
chmod 600 "$ENV_FILE"
|
|
chown "$APP_USER:$APP_USER" "$ENV_FILE"
|
|
info ".env vytvořen: ${ENV_FILE}"
|
|
else
|
|
warn ".env již existuje, přeskakuji."
|
|
fi
|
|
|
|
# ── 7. Nginx ──────────────────────────────────────────────────────────────
|
|
info "Konfigurace Nginx..."
|
|
NGINX_CONF="/etc/nginx/sites-available/bistrousky"
|
|
|
|
cat > "$NGINX_CONF" <<NGINX
|
|
server {
|
|
listen 80;
|
|
server_name ${DOMAIN:-_};
|
|
|
|
# Přesměrování na HTTPS (aktivuje se po certbot)
|
|
# return 301 https://\$host\$request_uri;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
proxy_cache_bypass \$http_upgrade;
|
|
}
|
|
|
|
# Statické soubory servírovat přímo (volitelné, Next.js to zvládne samo)
|
|
location /_next/static/ {
|
|
proxy_pass http://127.0.0.1:3000;
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
}
|
|
NGINX
|
|
|
|
ln -sf "$NGINX_CONF" /etc/nginx/sites-enabled/bistrousky
|
|
rm -f /etc/nginx/sites-enabled/default
|
|
nginx -t && systemctl enable nginx --quiet && systemctl restart nginx
|
|
|
|
# ── 8. Firewall ───────────────────────────────────────────────────────────
|
|
info "Konfigurace UFW firewallu..."
|
|
ufw --force enable
|
|
ufw allow OpenSSH
|
|
ufw allow "Nginx Full"
|
|
ufw reload
|
|
|
|
# ── 9. PM2 startup (automatický start po rebootu) ─────────────────────────
|
|
info "Nastavení PM2 startupu..."
|
|
env PATH="$PATH:/usr/bin" pm2 startup systemd -u "$APP_USER" --hp "$APP_DIR" | tail -1 | bash || true
|
|
|
|
# ── Výpis výsledků ────────────────────────────────────────────────────────
|
|
echo ""
|
|
echo -e "${GREEN}╔══════════════════════════════════════════════════╗${NC}"
|
|
echo -e "${GREEN}║ Instalace dokončena! ║${NC}"
|
|
echo -e "${GREEN}╚══════════════════════════════════════════════════╝${NC}"
|
|
echo ""
|
|
echo -e " DB uživatel : ${YELLOW}${DB_USER}${NC}"
|
|
echo -e " DB heslo : ${YELLOW}${DB_PASS}${NC} ← ulož si to!"
|
|
echo -e " DB jméno : ${YELLOW}${DB_NAME}${NC}"
|
|
echo -e " App složka : ${YELLOW}${APP_DIR}${NC}"
|
|
echo -e " .env soubor : ${YELLOW}${ENV_FILE}${NC}"
|
|
echo ""
|
|
echo -e " Další kroky:"
|
|
echo -e " 1. Nahraj kód do ${YELLOW}${APP_DIR}${NC}"
|
|
echo -e " 2. Doplň API klíče do ${YELLOW}${ENV_FILE}${NC}"
|
|
echo -e " 3. Spusť ${YELLOW}bash deploy.sh${NC}"
|
|
if [[ -n "$DOMAIN" ]]; then
|
|
echo -e " 4. SSL: ${YELLOW}certbot --nginx -d ${DOMAIN}${NC}"
|
|
fi
|
|
echo ""
|