58 lines
2.6 KiB
Bash
58 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
# One-time setup of a fresh Ubuntu droplet (22.04 or 24.04) for TaskForge.
|
|
# deploy.sh runs this automatically on the first deploy. By hand, on the droplet as root:
|
|
# bash setup-droplet.sh tasks.example.com (with taskforge.service and Caddyfile next to it)
|
|
#
|
|
# Installs: SQLite, a C toolchain (to link the server), Caddy (HTTPS via Let's Encrypt), a firewall,
|
|
# a systemd service and a daily database backup. Point your domain's A record at the droplet first.
|
|
set -euo pipefail
|
|
|
|
DOMAIN="${1:?usage: setup-droplet.sh <domain>}"
|
|
|
|
apt-get update
|
|
apt-get install -y libsqlite3-0 sqlite3 build-essential curl gnupg ufw \
|
|
debian-keyring debian-archive-keyring apt-transport-https
|
|
|
|
# Caddy from its official repository.
|
|
if ! command -v caddy >/dev/null; then
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' > /etc/apt/sources.list.d/caddy-stable.list
|
|
apt-get update
|
|
apt-get install -y caddy
|
|
fi
|
|
|
|
# Service account and directories.
|
|
id taskforge >/dev/null 2>&1 || useradd --system --home-dir /var/lib/taskforge --shell /usr/sbin/nologin taskforge
|
|
mkdir -p /opt/taskforge/bin /opt/taskforge/web /opt/taskforge/staging /var/lib/taskforge /var/backups/taskforge
|
|
chown taskforge:taskforge /var/lib/taskforge
|
|
chmod 750 /var/lib/taskforge /var/backups/taskforge
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
install -m 644 "$HERE/taskforge.service" /etc/systemd/system/taskforge.service
|
|
sed "s/{DOMAIN}/$DOMAIN/" "$HERE/Caddyfile" > /etc/caddy/Caddyfile
|
|
|
|
# Daily consistent backup (safe while the server runs), kept for 14 days. Attachments are immutable files
|
|
# named by their hash, so copying the new ones is enough.
|
|
cat > /etc/cron.daily/taskforge-backup <<'EOF'
|
|
#!/bin/sh
|
|
sqlite3 /var/lib/taskforge/taskforge.db ".backup '/var/backups/taskforge/taskforge-$(date +%F).db'"
|
|
find /var/backups/taskforge -name 'taskforge-*.db' -mtime +14 -delete
|
|
mkdir -p /var/backups/taskforge/blobs
|
|
cp -rn /var/lib/taskforge/blobs/. /var/backups/taskforge/blobs/ 2>/dev/null || true
|
|
EOF
|
|
chmod 755 /etc/cron.daily/taskforge-backup
|
|
|
|
ufw allow OpenSSH
|
|
ufw allow 80/tcp
|
|
ufw allow 443/tcp
|
|
ufw --force enable
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable taskforge
|
|
systemctl reload caddy || systemctl restart caddy
|
|
|
|
echo
|
|
echo "Droplet set up for https://$DOMAIN"
|
|
echo "After the server binary is installed, create the first admin on the droplet:"
|
|
echo " sudo -u taskforge /opt/taskforge/bin/taskforge-server --db /var/lib/taskforge/taskforge.db add-user <username> \"<Your Name>\" --admin"
|