luki-net/proxmox-scripts
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cad741a97caa28ed60dbc0e1cb21dc02afea75e5
proxmox-scripts/install/webapp-install.sh
T
l.kirchner 601abeef4c Add webapp in-container installer (Node + act_runner host mode) 
Installs Node.js and act_runner in host mode, registers the runner as
the unprivileged webapp user, and wires up systemd units for the runner
and the next-start service. A narrow sudoers rule lets the runner restart
only webapp.service; the build/deploy itself is driven by the repo workflow.
2026-06-05 02:29:15 +02:00

196 lines
8.0 KiB
Bash
Raw Blame History

#!/usr/bin/env bash
# webapp installer — runs inside the LXC, called by ct/webapp.sh
#
# Sets up a Next.js site deployed by a self-hosted Gitea Actions runner:
# - Node.js (NodeSource) + git + rsync + sudo
# - act_runner in HOST mode (no Docker), registered to the Gitea instance,
# running as the unprivileged `webapp` user and polling Gitea outbound
# - a systemd service running `next start` from /opt/webapp/current
# - a narrow sudoers rule so the runner may only restart that one service
#
# The actual build/deploy logic lives in the repo's .gitea/workflows/deploy.yml
# (deploy-as-code). The runner checks out, builds, syncs the result into
# /opt/webapp/current and restarts webapp.service.
set -euo pipefail
APP="webapp"
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
source <(curl -fsSL "$LIB_URL/install.func")
[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
# ── load deploy config pushed in by the host script ──────────────────────────
CONF="/root/webapp.deploy.env"
[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
set -a; . "$CONF"; set +a
: "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL}"
: "${RUNNER_TOKEN:?missing RUNNER_TOKEN}"
APP_PORT="${APP_PORT:-3000}"
NODE_MAJOR="${NODE_MAJOR:-22}"
RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
RUNNER_LABELS="${RUNNER_LABELS:-webapp:host}"
RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
APP_USER="webapp"
APP_HOME="/opt/webapp"
RUNNER_DIR="$APP_HOME/runner"
CURRENT_DIR="$APP_HOME/current"
CONF_DIR="/etc/webapp"
ENV_FILE="$CONF_DIR/env"
run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
# ── packages: git + rsync + sudo ; Node.js via NodeSource ────────────────────
setup_base_apt git rsync sudo
NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
apt-get install -y -qq nodejs >/dev/null
msg_ok "Node $(node -v) installed"
else
msg_warn "Node $(node -v) already present, skipping"
fi
# ── act_runner binary ─────────────────────────────────────────────────────────
if [[ ! -x /usr/local/bin/act_runner ]]; then
ARCH="$(dpkg --print-architecture)"
case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
-o /usr/local/bin/act_runner
chmod +x /usr/local/bin/act_runner
msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
else
msg_warn "act_runner already present, skipping download"
fi
# ── user + dirs ──────────────────────────────────────────────────────────────
create_system_user "$APP_USER" "$APP_HOME"
mkdir -p "$RUNNER_DIR" "$CURRENT_DIR" "$CONF_DIR"
chown -R "$APP_USER:$APP_USER" "$APP_HOME"
# ── env file: NEXT_PUBLIC_* are inlined at build time AND read at runtime ────
# (kept on the host so the repo carries no environment-specific config; the
# workflow sources this file before `next build`.)
cat >"$ENV_FILE" <<EOF
NODE_ENV=production
NEXT_TELEMETRY_DISABLED=1
NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
NEXT_PUBLIC_SANITY_PROJECT_ID=${NEXT_PUBLIC_SANITY_PROJECT_ID:-}
NEXT_PUBLIC_SANITY_DATASET=${NEXT_PUBLIC_SANITY_DATASET:-production}
NEXT_PUBLIC_SANITY_API_VERSION=${NEXT_PUBLIC_SANITY_API_VERSION:-2026-06-02}
NEXT_PUBLIC_CALENDLY_URL=${NEXT_PUBLIC_CALENDLY_URL:-}
EOF
chown root:"$APP_USER" "$ENV_FILE"
chmod 640 "$ENV_FILE"
# ── register the runner (idempotent) ─────────────────────────────────────────
if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL..."
run_user bash -c "cd '$RUNNER_DIR' && /usr/local/bin/act_runner register \
--no-interactive \
--instance '$GITEA_INSTANCE_URL' \
--token '$RUNNER_TOKEN' \
--name '$RUNNER_NAME' \
--labels '$RUNNER_LABELS'"
chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
msg_ok "Runner registered"
else
msg_warn "Runner already registered (.runner exists), skipping"
fi
# ── narrow sudoers: runner may ONLY (re)start/stop/status webapp.service ─────
cat >/etc/sudoers.d/webapp-deploy <<EOF
$APP_USER ALL=(root) NOPASSWD: /usr/bin/systemctl restart webapp.service, /usr/bin/systemctl start webapp.service, /usr/bin/systemctl stop webapp.service, /usr/bin/systemctl status webapp.service
EOF
chmod 440 /etc/sudoers.d/webapp-deploy
visudo -cf /etc/sudoers.d/webapp-deploy >/dev/null
# ── systemd units ─────────────────────────────────────────────────────────────
# webapp.service: serves the built site from the live copy. Enabled (so it
# starts on boot) but not started now — the first workflow run populates
# /opt/webapp/current and starts it via the sudoers-allowed restart.
cat >/etc/systemd/system/webapp.service <<EOF
[Unit]
Description=webapp — Next.js production server
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=$APP_USER
Group=$APP_USER
WorkingDirectory=$CURRENT_DIR
EnvironmentFile=$ENV_FILE
ExecStart=/usr/bin/npm run start -- -H 0.0.0.0 -p $APP_PORT
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=full
PrivateTmp=true
[Install]
WantedBy=multi-user.target
EOF
cat >/etc/systemd/system/webapp-runner.service <<EOF
[Unit]
Description=webapp — Gitea Actions runner (host mode, deploy)
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=$APP_USER
Group=$APP_USER
WorkingDirectory=$RUNNER_DIR
Environment=HOME=$APP_HOME
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ExecStart=/usr/local/bin/act_runner daemon
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable webapp.service >/dev/null 2>&1
systemctl enable --now webapp-runner.service
msg_ok "systemd units installed (runner started; webapp.service enabled, starts on first deploy)"
# ── notes / summary file ──────────────────────────────────────────────────────
CRED_FILE="/root/webapp.credentials"
cat >"$CRED_FILE" <<EOF
webapp — Next.js site deployed via a self-hosted Gitea Actions runner
Repo (informational): ${REPO_URL:-<your website repo>}
Gitea instance: $GITEA_INSTANCE_URL
Runner name / labels: $RUNNER_NAME [$RUNNER_LABELS] (act_runner $RUNNER_VERSION, host mode)
Site (local): http://127.0.0.1:$APP_PORT (live after first deploy)
Live copy: $CURRENT_DIR
Site env (build+run): $ENV_FILE
Deploy is driven by the repo workflow .gitea/workflows/deploy.yml
First deploy: push to the repo, OR repo -> Actions -> deploy -> "Run workflow"
Manual restart: sudo systemctl restart webapp.service
Logs: journalctl -u webapp -u webapp-runner -f
Prerequisites on the Gitea side:
- Actions enabled on the instance and on the repo (repo -> Settings -> Actions)
- The LXC needs outbound HTTPS to $GITEA_INSTANCE_URL and to github.com
(the latter only to fetch actions/checkout, unless you self-host actions)
EOF
chmod 600 "$CRED_FILE"
# registration token already consumed → drop the bootstrap env file
shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
apt_cleanup
msg_ok "$APP installation finished"
Reference in New Issue View Git Blame Copy Permalink