got setup.sh to work again
This commit is contained in:
parent
4b9a39997e
commit
cd277d2355
SSH key fingerprint:
SHA256:HnFTLGpSm4Q4Fj502oCFisjZSoakwEuTsJJMSke63RQ
4 changed files with 240 additions and 86 deletions
167
README.md
167
README.md
|
|
@ -2,49 +2,148 @@
|
|||
|
||||
## Testing Locally
|
||||
|
||||
* Using `libvirt` (you can use the `virt-manager` gui frontend), create a VM with 6GB RAM and 4 CPUs and at least 30GB of disk space running Debian 12 with a btrfs root filesystem. The VM should be named `libre-chip.test`. Do *NOT* create a non-root user yet, that comes later.
|
||||
|
||||
* Install some packages in the VM:
|
||||
```
|
||||
apt install openssh-server sudo
|
||||
```
|
||||
|
||||
* Copy your ssh public key from your user on the host (e.g. `~/.ssh/id_rsa.pub`) and put it in the VM's `/root/.ssh/authorized_keys` and make sure both that file and the parent `.ssh` directory have been chmod-ed to `600`.
|
||||
|
||||
* Get the IPv4 address of the VM:
|
||||
```
|
||||
ip addr
|
||||
```
|
||||
* This is assuming you're running Debian 13 on your computer, though it will probably work with any non-ancient variant of GNU/Linux. This guide will create a VM with a snapshot so the `test-in-vm.sh` script can reset it every time for testing installation as many times as you need. But before that, we have to manually prepare the VM first:
|
||||
|
||||
* Add the following lines to your *host's* `/etc/hosts`:
|
||||
```
|
||||
<public-IP-address-of-your-host> pebble
|
||||
<IP-address-of-your-VM> libre-chip.test
|
||||
<IP-address-of-your-VM> librechip.test
|
||||
<IP-address-of-your-VM> mail.libre-chip.test
|
||||
<IP-address-of-your-VM> mail.librechip.test
|
||||
<IP-address-of-your-VM> git.libre-chip.test
|
||||
<IP-address-of-your-VM> git.librechip.test
|
||||
<IP-address-of-your-VM> forum.libre-chip.test
|
||||
<IP-address-of-your-VM> forum.librechip.test
|
||||
10.10.10.1 pebble
|
||||
10.10.10.2 libre-chip.test librechip.test mail.libre-chip.test mail.librechip.test git.libre-chip.test git.librechip.test forum.libre-chip.test forum.librechip.test
|
||||
```
|
||||
|
||||
* (Optional) Create a non-root user with UID 1001, being careful to not use UID 1000 or GID 1000:
|
||||
```
|
||||
adduser --uid 1001 your-user-name
|
||||
adduser your-user-name sudo
|
||||
```
|
||||
|
||||
* logout from the VM but leave it running.
|
||||
|
||||
Create a snapshot of the VM while its running but no users are logged in, and name the snapshot `start`.
|
||||
* Ensure your local user is in the `libvirt` group so you can run `virsh`.
|
||||
* Ensure the default URI for libvirt is `qemu:///system`, you can check by running `virsh uri`. You can change the default by editing `/etc/libvirt/libvirt.conf` or `~/.config/libvirt/libvirt.conf` (which you may need to create first) and uncommenting/adding:
|
||||
```
|
||||
uri_default = "qemu:///system"
|
||||
```
|
||||
* Create a new `libvirt` network:
|
||||
```
|
||||
virsh net-define libre-chip-test.xml
|
||||
virsh net-autostart libre-chip-test
|
||||
virsh net-start libre-chip-test
|
||||
```
|
||||
* Get the latest Debian 12 ISO, you can get it from <https://cdimage.debian.org/mirror/cdimage/archive/12.15.0/amd64/iso-cd/debian-12.15.0-amd64-netinst.iso>
|
||||
* Using the `virt-manager` gui frontend, create a new VM with:
|
||||
* Local install media (ISO image)
|
||||
* Pick the Debian 12 ISO you downloaded above
|
||||
* 12GiB (12288 MiB) RAM
|
||||
* 6 CPUs
|
||||
* A new 30GB disk image
|
||||
* The name should be `libre-chip.test` (*this is important*)
|
||||
* Under "Network selection", choose `libre-chip-test` (*this is important*)
|
||||
* Click "Finish". The VM should start running.
|
||||
* In the VM:
|
||||
* Go to "Advanced Options" and choose the "Expert install" option.
|
||||
* Pick "Choose Language"
|
||||
* Pick "English"
|
||||
* Choose "United States"
|
||||
* Choose "United States - en_US.UTF-8".
|
||||
* For additional locales, choose "C.UTF-8".
|
||||
* Select "C.UTF-8" as the default locale.
|
||||
* Pick "Configure the keyboard".
|
||||
* Pick "American English".
|
||||
* Pick "Detect and mount installation media".
|
||||
* Pick "Load installer components from installation media".
|
||||
* Enable "network-console".
|
||||
* Pick "Detect network hardware".
|
||||
* Pick "Configure the network".
|
||||
* For "Auto-configure networking?", pick "No".
|
||||
* The IP address should be `10.10.10.2`, netmask `255.255.255.0`, gateway `10.10.10.1`, name server `10.10.10.1`.
|
||||
* The hostname should be `libre-chip`, the domain name should be `test`.
|
||||
* Pick "Continue installation remotely using SSH".
|
||||
* Use whatever you like as the "Remote installation password".
|
||||
* Once you get to the "Start SSH" page, then you can continue on your host with SSH.
|
||||
* On your host:
|
||||
* Start a new terminal
|
||||
* Resize the new terminal window to be as big as you like (the installer doesn't deal well with changes in the window size after logging in with ssh)
|
||||
* Run `ssh installer@libre-chip.test` -- this lets you copy and paste things into the terminal instead of having to type everything out.
|
||||
* If ssh complains that the host key changed (because you had something else at `libre-chip.test` before, like a previous version of the VM), run `ssh-keygen -R 10.10.10.2` and `ssh-keygen -R libre-chip.test` to remove the old host, and then run ssh again.
|
||||
* Pick the advanced installation option.
|
||||
* Pick "Set up users and passwords".
|
||||
* For "Allow login as root?", choose "Yes".
|
||||
* Choose a suitable root password.
|
||||
* For "Create a normal user account now?", choose "No" (*this is important*).
|
||||
* Pick "Configure the clock".
|
||||
* For "Set the clock using NTP?", choose "Yes", using the default NTP server.
|
||||
* For time zone, choose "Coordinated Universal Time (UTC)".
|
||||
* Pick "Detect disks".
|
||||
* Pick "Partition disks".
|
||||
* For "Partitioning method", choose "Manual".
|
||||
* Pick "Virtual disk 1".
|
||||
* Create the new empty partition table on that device.
|
||||
* For "Partition table type", pick "gpt".
|
||||
* Pick "FREE SPACE".
|
||||
* Choose "Create a new partition".
|
||||
* Choose `1 GB` and locate it at the "Beginning".
|
||||
* For "Use as", choose "Ext4".
|
||||
* For "Mount point", choose "/boot".
|
||||
* Select "Done setting up the partition".
|
||||
* Pick the lower "FREE SPACE".
|
||||
* Choose "Create a new partition".
|
||||
* For "New partition size", choose `max`.
|
||||
* For "Use as", choose "btrfs" (*this is important*).
|
||||
* Select "Done setting up the partition".
|
||||
* Select "Finish partitioning and write changes to disk".
|
||||
* When it complains about no swap space and asks if you want to return to the partitioning menu, choose "No".
|
||||
* For "Write the changes to disk?", choose "Yes".
|
||||
* Pick "Install the base system".
|
||||
* For "Kernel to install", pick "linux-image-amd64" (or whatever one is appropriate for your CPU architecture).
|
||||
* For "Drivers to include in the initrd", pick "generic".
|
||||
* For "Character set to support", pick "Guess optimal character set".
|
||||
* Pick "Configure the package manager".
|
||||
* For "Scan extra installation media", choose "No".
|
||||
* For "Use a network mirror", choose "Yes".
|
||||
* Pick "http".
|
||||
* Pick "United States".
|
||||
* Pick "deb.debian.org".
|
||||
* Leave the proxy blank.
|
||||
* Choose "No" for non-free firmware/software and contrib software.
|
||||
* Enable source repositories in APT.
|
||||
* Leave "security updates", and "release updates" enabled, and "backported software" disabled.
|
||||
* Pick "Select and install software".
|
||||
* Pick "Install security updates automatically".
|
||||
* For "popularity-contest", pick "No".
|
||||
* For "Software selection", disable "Debian desktop environment" and "GNOME", and enable "SSH server".
|
||||
* Pick "Install the GRUB boot loader".
|
||||
* For "Run os-prober automatically", choose "No".
|
||||
* For "Install the GRUB boot loader to your primary drive", choose "Yes".
|
||||
* Choose "/dev/vda".
|
||||
* Pick "Finish the installation".
|
||||
* For "Is the system clock set to UTC", choose "Yes".
|
||||
* Choose "<Continue>" to reboot.
|
||||
* SSH should exit.
|
||||
* Close and reopen the terminal, or run `reset`, to clean up the mess left by the debian installer.
|
||||
* Wait until the VM has finished rebooting, then in the VM window, login as `root` with the password you set before:
|
||||
* Run `apt install sudo git htop`.
|
||||
* Create a non-root user now, but (*this is important*) you must avoid UID/GID 1000 since that will be used by the `git` user:
|
||||
* Run `adduser --uid 1001 jacob` (you can substitute `jacob` with whatever username you like.) Pick a suitable password, you can leave the other information blank if you like.
|
||||
* Run `adduser jacob sudo`. (substitute `jacob` with the username you picked.)
|
||||
* Press Ctrl+D to logout.
|
||||
* On your host:
|
||||
* Copy your SSH public key(s) on the host to the VM:
|
||||
* Run `scp ~/.ssh/id_*.pub jacob@libre-chip.test:`. (substitute `jacob` with the username you picked.)
|
||||
* Run `ssh jacob@libre-chip.test`. (substitute `jacob` with the username you picked.)
|
||||
* Verify you don't have UID 1000 or GID 1000 by running `id`, it should say something like `uid=1001(jacob) gid=1001(jacob)`.
|
||||
* Install the SSH public key(s) as allowed to login to the VM without a password:
|
||||
```
|
||||
mkdir -p -m700 ~/.ssh
|
||||
cat id_*.pub > ~/.ssh/authorized_keys
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
sudo mkdir -p -m700 /root/.ssh
|
||||
sudo install -m600 ~/.ssh/authorized_keys /root/.ssh/
|
||||
```
|
||||
* Press Ctrl+D to logout.
|
||||
* Verify you can login as root without a password:
|
||||
* Run `ssh root@libre-chip.test id`, you shouldn't need any password and it should say `uid=0(root) gid=0(root) groups=0(root)`. If you do need a password to unlock your SSH key, you need to have a running copy of `ssh-agent` and need your SSH key to be loaded.
|
||||
* Now we create the snapshot:
|
||||
* Verify the VM is still running and that nothing is logged-in to the VM. (if you just rebooted the VM, login via SSH and then logout to ensure all the necessary system stuff has finished booting.)
|
||||
* Go to "View"/"Snapshots" in the VM's window in `virt-manager`.
|
||||
* Click the "+" button to create a new snapshot.
|
||||
* Name the snapshot `start`. (*this is important*)
|
||||
* Click "Finish".
|
||||
|
||||
Now you're ready to test! Just run `./test-in-vm.sh` on the host, it will automatically reset the VM and login over ssh and run the setup script.
|
||||
|
||||
## Installing on the public server
|
||||
|
||||
***Not Tested Yet!***
|
||||
|
||||
Make sure the VM has no users with UID 1000, and that the VM has a btrfs root filesystem.
|
||||
|
||||
Run the setup script on the VM:
|
||||
|
|
|
|||
27
libre-chip-test.xml
Normal file
27
libre-chip-test.xml
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
<network xmlns:dnsmasq="http://libvirt.org/schemas/network/dnsmasq/1.0">
|
||||
<name>libre-chip-test</name>
|
||||
<forward mode="nat" />
|
||||
<dns forwardPlainNames="yes">
|
||||
<forwarder addr="1.1.1.1"/>
|
||||
<host ip="10.10.10.1">
|
||||
<hostname>pebble</hostname>
|
||||
<hostname>pebble.libre-chip.test</hostname>
|
||||
</host>
|
||||
<host ip="10.10.10.2">
|
||||
<hostname>libre-chip.test</hostname>
|
||||
<hostname>librechip.test</hostname>
|
||||
<hostname>git.libre-chip.test</hostname>
|
||||
<hostname>git.librechip.test</hostname>
|
||||
<hostname>forum.libre-chip.test</hostname>
|
||||
<hostname>forum.librechip.test</hostname>
|
||||
<hostname>mail.libre-chip.test</hostname>
|
||||
<hostname>mail.librechip.test</hostname>
|
||||
</host>
|
||||
</dns>
|
||||
<ip address="10.10.10.1" netmask="255.255.255.0">
|
||||
</ip>
|
||||
<dnsmasq:options>
|
||||
<dnsmasq:option value="domain-needed"/>
|
||||
<dnsmasq:option value="no-hosts"/>
|
||||
</dnsmasq:options>
|
||||
</network>
|
||||
107
setup.sh
107
setup.sh
|
|
@ -125,7 +125,8 @@ fi
|
|||
|
||||
apt-get remove -y -q docker.io docker-doc docker-compose podman-docker containerd runc
|
||||
|
||||
mkdir -p /var/lib/stalwart-mail
|
||||
# make /var/lib/stalwart-mail and make the logs dir too since stalwart-mail fails to create it for some reason
|
||||
mkdir -p /var/lib/stalwart-mail/logs
|
||||
apt-get update -y -q
|
||||
apt-get install ca-certificates curl jq gettext-base diffutils -y -q
|
||||
# force using overlay2 driver so btrfs snapshots will snapshot the entire system and not miss all the docker stuff
|
||||
|
|
@ -145,11 +146,13 @@ if ((${#test_ca_list[@]})); then
|
|||
update-ca-certificates
|
||||
fi
|
||||
addgroup --gid=1000 git || true
|
||||
[[ "$(getent group 1000)" =~ ^'git:x:1000:' ]] ||
|
||||
fatal "some other group has gid 1000, which is needed for the git group"
|
||||
group_1000="$(getent group 1000)"
|
||||
[[ "$group_1000" =~ ^'git:x:1000:' ]] ||
|
||||
fatal "some other group has gid 1000, which is needed for the git group: $group_1000"
|
||||
adduser --system --shell=/bin/bash --gecos 'Git Version Control' --uid=1000 --ingroup=git --disabled-password --home=/var/lib/forgejo git || true
|
||||
[[ "$(getent passwd 1000)" == 'git:x:1000:1000:Git Version Control,,,:/var/lib/forgejo:/bin/bash' ]] ||
|
||||
fatal "some other user has gid 1000, which is needed for the git user"
|
||||
user_1000="$(getent passwd 1000)"
|
||||
[[ "$user_1000" =~ ^'git:x:1000:1000:Git Version Control',*':/var/lib/forgejo:/bin/bash'$ ]] ||
|
||||
fatal "some other user has gid 1000, which is needed for the git user: $user_1000"
|
||||
[[ -f ~git/.ssh/id_ed25519 ]] || sudo -u git ssh-keygen -f ~git/.ssh/id_ed25519 -t ed25519 -C "Forgejo Host Key" -N ""
|
||||
[[ -f ~git/.ssh/authorized_keys ]] || sudo -u git cat ~git/.ssh/id_ed25519.pub | sudo -u git tee ~git/.ssh/authorized_keys
|
||||
sudo -u git chmod 600 ~git/.ssh/authorized_keys
|
||||
|
|
@ -204,49 +207,69 @@ wd="$(pwd)"
|
|||
if ! [[ "$wd" =~ ^/[-/a-zA-Z0-9_]*$ ]]; then
|
||||
fatal "invalid characters in current directory: $wd"
|
||||
fi
|
||||
nginx_container="$(docker create --rm -v /var/www/.well-known/acme-challenge:/var/www/.well-known/acme-challenge:ro -v "$wd"/http_only_nginx_templates:/etc/nginx/templates:ro -p 80:80 nginx:bookworm)"
|
||||
docker start "$nginx_container"
|
||||
trap 'docker stop "$nginx_container"' EXIT
|
||||
echo "waiting for server to come up..."
|
||||
for _ in {0..30}; do
|
||||
sleep 1
|
||||
if curl "http://$BASE_DOMAIN_NAME/" >/dev/null; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
echo "server up"
|
||||
certbot_args=(certonly -n --email "postmaster@$BASE_DOMAIN_NAME" "--server=$ACME_SERVER_URL" --cert-name server --agree-tos --webroot --webroot-path /var/www)
|
||||
certbot_args+=(--disable-hook-validation --post-hook "cd '$wd' && docker compose -p server restart")
|
||||
for subdomain in "${subdomains[@]}"; do
|
||||
if [[ -n "$subdomain" ]]; then
|
||||
subdomain+=.
|
||||
fi
|
||||
certbot_args+=(-d "$subdomain$BASE_DOMAIN_NAME")
|
||||
certbot_args+=(-d "$subdomain$ALT_BASE_DOMAIN_NAME")
|
||||
done
|
||||
retry_if_failed certbot "${certbot_args[@]}"
|
||||
trap EXIT
|
||||
docker stop "$nginx_container"
|
||||
if [[ ! -h /etc/letsencrypt/live/server/privkey.pem ]]; then
|
||||
nginx_container="$(docker create --rm -v /var/www/.well-known/acme-challenge:/var/www/.well-known/acme-challenge:ro -v "$wd"/http_only_nginx_templates:/etc/nginx/templates:ro -p 80:80 nginx:bookworm)"
|
||||
docker start "$nginx_container"
|
||||
trap 'docker stop "$nginx_container"' EXIT
|
||||
echo "waiting for server to come up..."
|
||||
for _ in {0..30}; do
|
||||
sleep 1
|
||||
if curl "http://$BASE_DOMAIN_NAME/" >/dev/null; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
echo "server up"
|
||||
certbot_args=(certonly -n --email "postmaster@$BASE_DOMAIN_NAME" "--server=$ACME_SERVER_URL" --cert-name server --agree-tos --webroot --webroot-path /var/www)
|
||||
certbot_args+=(--disable-hook-validation --post-hook "cd '$wd' && docker compose -p server restart")
|
||||
for subdomain in "${subdomains[@]}"; do
|
||||
if [[ -n "$subdomain" ]]; then
|
||||
subdomain+=.
|
||||
fi
|
||||
certbot_args+=(-d "$subdomain$BASE_DOMAIN_NAME")
|
||||
certbot_args+=(-d "$subdomain$ALT_BASE_DOMAIN_NAME")
|
||||
done
|
||||
retry_if_failed certbot "${certbot_args[@]}"
|
||||
trap EXIT
|
||||
docker stop "$nginx_container"
|
||||
fi
|
||||
DOCKER_BUILDKIT=1 docker compose -p server up -d
|
||||
sleep 10
|
||||
|
||||
function create_stalwart_app_password() {
|
||||
local passwd="$1"
|
||||
echo -n '$app$'
|
||||
local date="$(date --utc --iso-8601=ns)"
|
||||
local name='app_pass$'"$(echo -n "$date" | sed 's/,\([0-9][0-9][0-9]\)[0-9]*/.\1/')"
|
||||
echo -n "$name" | base64 -w0
|
||||
echo -n '$'
|
||||
echo -n "$passwd" | openssl passwd -6 -stdin
|
||||
}
|
||||
|
||||
if [[ -n "$mail_passwd_hash" ]]; then
|
||||
forgejo_smtp_passwd="$(crudini --get /etc/forgejo/app.ini mailer PASSWD)"
|
||||
stalwart-cli domain create "$BASE_DOMAIN_NAME"
|
||||
curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/dkim" --data-binary '{"id":null,"algorithm":"Ed25519","domain":"'"$BASE_DOMAIN_NAME"'","selector":null}' > /dev/null
|
||||
curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/dkim" --data-binary '{"id":null,"algorithm":"Rsa","domain":"'"$BASE_DOMAIN_NAME"'","selector":null}' > /dev/null
|
||||
stalwart-cli account create -d 'Admin Account' -i true -a "postmaster@$BASE_DOMAIN_NAME" 'admin' "$mail_passwd"
|
||||
stalwart-cli account create -d 'Forgejo Server' -i false -a "forgejo@$BASE_DOMAIN_NAME" 'forgejo' "$forgejo_smtp_passwd"
|
||||
add_postmaster=(docker compose -p server exec -T -u git forgejo forgejo admin user create --admin --username postmaster --password "$mail_passwd" --email "postmaster@$BASE_DOMAIN_NAME")
|
||||
retry_if_failed -q "${add_postmaster[@]}"
|
||||
forgejo_smtp_passwd_hash="$(create_stalwart_app_password "$forgejo_smtp_passwd")"
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/principal" --data-binary '{"type":"individual","quota":0,"name":"admin","description":"Admin Account","secrets":["'"$mail_passwd_hash"'"],"emails":["'"postmaster@$BASE_DOMAIN_NAME"'"],"urls":[],"memberOf":[],"roles":["admin","user"],"lists":[],"members":[],"enabledPermissions":[],"disabledPermissions":[],"externalMembers":[]}' > /dev/null
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/principal" --data-binary '{"type":"domain","name":"'"$BASE_DOMAIN_NAME"'"}' > /dev/null
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/dkim" --data-binary '{"id":null,"algorithm":"Ed25519","domain":"'"$BASE_DOMAIN_NAME"'","selector":null}' > /dev/null
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/dkim" --data-binary '{"id":null,"algorithm":"Rsa","domain":"'"$BASE_DOMAIN_NAME"'","selector":null}' > /dev/null
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/principal" --data-binary '{"type":"individual","name":"forgejo","secrets":["'"$forgejo_smtp_passwd_hash"'"],"emails":["'"forgejo@$BASE_DOMAIN_NAME"'"],"description":"Forgejo Server","roles":["user"]}' > /dev/null
|
||||
forum_smtp_passwd="$(sed 's/^ *DISCOURSE_SMTP_PASSWORD: "*\([^"]*\)"$/\1/p; d' < /var/discourse/containers/app.yml)"
|
||||
[[ -n "$forum_smtp_passwd" ]] || fatal "can't parse smtp password out of /var/discourse/containers/app.yml"
|
||||
stalwart-cli account create -d 'Forum Replies' -i false -a "@$BASE_DOMAIN_NAME" 'forum' "$forum_smtp_passwd"
|
||||
stalwart-cli account create -d 'Forum Notifications' -i false -a "forum-noreply@$BASE_DOMAIN_NAME" 'forum-noreply' "$forum_smtp_passwd"
|
||||
forgejo_api=(retry_if_failed -q curl --fail-with-body -u "postmaster:$mail_passwd" -H 'Accept: application/json' -H 'Content-Type: application/json')
|
||||
"${forgejo_api[@]}" -X 'POST' "https://git.$BASE_DOMAIN_NAME/api/v1/orgs" -d '{"username": "libre-chip"}' > /dev/null
|
||||
"${forgejo_api[@]}" -X 'POST' "https://git.$BASE_DOMAIN_NAME/api/v1/orgs/libre-chip/repos" -d '{"name": "website"}' > /dev/null
|
||||
post_receive_hook="$(jq -csR '{content:.}' < website_git_post_receive_hook.sh)"
|
||||
"${forgejo_api[@]}" -X 'PATCH' "https://git.$BASE_DOMAIN_NAME/api/v1/repos/libre-chip/website/hooks/git/post-receive" -d "$post_receive_hook" > /dev/null
|
||||
forum_smtp_passwd_hash="$(create_stalwart_app_password "$forum_smtp_passwd")"
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/principal" --data-binary '{"type":"individual","name":"forum","secrets":["'"$forum_smtp_passwd_hash"'"],"emails":["'"@$BASE_DOMAIN_NAME"'"],"description":"Forum Replies","roles":["user"]}' > /dev/null
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/principal" --data-binary '{"type":"individual","name":"forum-noreply","secrets":["'"$forum_smtp_passwd_hash"'"],"emails":["'"forum-noreply@$BASE_DOMAIN_NAME"'"],"description":"Forum Notifications","roles":["user"]}' > /dev/null
|
||||
add_postmaster=(docker compose -p server exec -T -u git forgejo forgejo admin user create --admin --username postmaster --password "$mail_passwd" --email "postmaster@$BASE_DOMAIN_NAME")
|
||||
change_postmaster_password=(docker compose -p server exec -T -u git forgejo forgejo admin user change-password --username postmaster --password "$mail_passwd" --must-change-password=false)
|
||||
if docker compose -p server exec -T -u git forgejo forgejo admin user create --admin --username postmaster --password "$mail_passwd" --email "postmaster@$BASE_DOMAIN_NAME"; then
|
||||
forgejo_api=(retry_if_failed -q curl --fail-with-body -u "postmaster:$mail_passwd" -H 'Accept: application/json' -H 'Content-Type: application/json')
|
||||
"${forgejo_api[@]}" -X 'POST' "https://git.$BASE_DOMAIN_NAME/api/v1/orgs" -d '{"username": "libre-chip"}' > /dev/null
|
||||
"${forgejo_api[@]}" -X 'POST' "https://git.$BASE_DOMAIN_NAME/api/v1/orgs/libre-chip/repos" -d '{"name": "website"}' > /dev/null
|
||||
post_receive_hook="$(jq -csR '{content:.}' < website_git_post_receive_hook.sh)"
|
||||
"${forgejo_api[@]}" -X 'PATCH' "https://git.$BASE_DOMAIN_NAME/api/v1/repos/libre-chip/website/hooks/git/post-receive" -d "$post_receive_hook" > /dev/null
|
||||
else
|
||||
docker compose -p server exec -T -u git forgejo forgejo admin user change-password --username postmaster --password "$mail_passwd" --must-change-password=false
|
||||
fi
|
||||
retry_if_failed -q curl -u "admin:$mail_passwd" "https://mail.$BASE_DOMAIN_NAME/api/reload/" > /dev/null
|
||||
fi
|
||||
(
|
||||
cd /var/discourse
|
||||
|
|
|
|||
|
|
@ -108,14 +108,20 @@ run:
|
|||
- exec: echo "Beginning of custom commands"
|
||||
- exec: |-
|
||||
if rails r 'exit(1) if User.find_by_email("postmaster@${BASE_DOMAIN_NAME}")'; then
|
||||
rails r "SiteSetting.pop3_polling_openssl_verify = false" || exit
|
||||
rails site_settings:import <<EOF2 || exit
|
||||
failed()
|
||||
{
|
||||
code=$?
|
||||
echo "failed: $*" >&2
|
||||
exit $code
|
||||
}
|
||||
rails r "SiteSetting.pop3_polling_openssl_verify = false" || failed "turn off pop3_polling_openssl_verify"
|
||||
rails site_settings:import <<EOF2 || failed "site_settings:import"
|
||||
---
|
||||
title: Libre-Chip Forum
|
||||
exclude_rel_nofollow_domains: ${BASE_DOMAIN_NAME}
|
||||
share_links: email
|
||||
share_quote_buttons: email
|
||||
default_dark_mode_color_scheme_id: '1'
|
||||
fixed_category_positions: 'true'
|
||||
enable_badges: 'false'
|
||||
pending_users_reminder_delay_minutes: '5'
|
||||
title_prettify: 'false'
|
||||
|
|
@ -135,12 +141,10 @@ run:
|
|||
email_in_allowed_groups: 1|2|0
|
||||
default_trust_level: '1'
|
||||
force_https: 'true'
|
||||
moderators_manage_categories_and_groups: 'true'
|
||||
moderators_view_emails: 'true'
|
||||
allowed_iframes: https://www.google.com/maps/embed?|https://www.openstreetmap.org/export/embed.html?|https://calendar.google.com/calendar/embed?|https://codepen.io/|http://forum.${BASE_DOMAIN_NAME}/discobot/certificate.svg|https://forum.${BASE_DOMAIN_NAME}/discobot/certificate.svg
|
||||
default_navigation_menu_categories: 2|3|4
|
||||
automatic_backups_enabled: 'false'
|
||||
sequential_replies_threshold: '4'
|
||||
backup_frequency: '0'
|
||||
get_a_room_threshold: '10000'
|
||||
default_composer_category: '4'
|
||||
share_anonymized_statistics: 'false'
|
||||
|
|
@ -149,16 +153,17 @@ run:
|
|||
enable_offline_indicator: 'true'
|
||||
chat_enabled: 'false'
|
||||
EOF2
|
||||
rails r "SiteSetting.pop3_polling_openssl_verify = true" || exit
|
||||
rails r - <<EOF2 || exit
|
||||
rails r "SiteSetting.pop3_polling_openssl_verify = true" || failed "turn on pop3_polling_openssl_verify"
|
||||
rails r - <<EOF2 || failed "create postmaster"
|
||||
u = User.new
|
||||
u.email = "postmaster@${BASE_DOMAIN_NAME}"
|
||||
u.username = "postmaster"
|
||||
u.password = "$mail_passwd"
|
||||
u.name = "Admin User"
|
||||
u.save!
|
||||
saved = u.save
|
||||
say(u.errors.full_messages.join("\n")) unless saved
|
||||
u.active = true
|
||||
u.save!
|
||||
u.save
|
||||
u.grant_admin!
|
||||
u.change_trust_level!(1) if u.trust_level < 1
|
||||
u.email_tokens.update_all confirmed: true
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue