grabowski
ce31a5254e
- .env now chmod 0600 and APP_DIR chmod 0750 after chown, so the Matrix token and DB credentials are not world-readable. - uv auto-install (curl | sh as root) is now opt-in via AUTO_INSTALL_UV=1 and pins a specific uv version; otherwise the script requires uv to be pre-installed and fails with instructions, avoiding unattended remote code execution as root.
115 lines
4.5 KiB
Bash
Executable File
115 lines
4.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Install the Thailand Water Level Monitor as a hardened systemd service.
|
|
#
|
|
# Creates a dedicated system user, deploys the code to /opt, builds a uv-managed
|
|
# virtualenv, installs the systemd unit, and enables the service. Idempotent:
|
|
# safe to re-run to update an existing install.
|
|
#
|
|
# Usage (as root, from a checkout of the repo):
|
|
# sudo bash scripts/install.sh
|
|
#
|
|
# Override defaults via environment variables:
|
|
# APP_DIR=/opt/thailand-water-monitor SERVICE_USER=water-monitor sudo -E bash scripts/install.sh
|
|
#
|
|
set -euo pipefail
|
|
|
|
APP_DIR="${APP_DIR:-/opt/thailand-water-monitor}"
|
|
SERVICE_USER="${SERVICE_USER:-water-monitor}"
|
|
SERVICE_GROUP="${SERVICE_GROUP:-${SERVICE_USER}}"
|
|
SERVICE_NAME="water-monitor.service"
|
|
|
|
# Resolve the repo root (parent of this scripts/ directory).
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
|
|
log() { printf '\033[1;32m==>\033[0m %s\n' "$*"; }
|
|
warn() { printf '\033[1;33m[warn]\033[0m %s\n' "$*"; }
|
|
die() { printf '\033[1;31m[error]\033[0m %s\n' "$*" >&2; exit 1; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || die "This script must be run as root (use sudo)."
|
|
|
|
# 1. Dedicated system user/group (no login, no home) --------------------------
|
|
if ! getent group "${SERVICE_GROUP}" >/dev/null; then
|
|
log "Creating group ${SERVICE_GROUP}"
|
|
groupadd --system "${SERVICE_GROUP}"
|
|
fi
|
|
if ! id "${SERVICE_USER}" >/dev/null 2>&1; then
|
|
log "Creating system user ${SERVICE_USER}"
|
|
useradd --system --no-create-home --shell /usr/sbin/nologin \
|
|
--gid "${SERVICE_GROUP}" "${SERVICE_USER}"
|
|
fi
|
|
|
|
# 2. Deploy code to APP_DIR ----------------------------------------------------
|
|
log "Deploying code to ${APP_DIR}"
|
|
mkdir -p "${APP_DIR}"
|
|
if command -v rsync >/dev/null 2>&1; then
|
|
rsync -a --delete \
|
|
--exclude '.git' --exclude '.venv' --exclude 'venv' \
|
|
--exclude '__pycache__' --exclude '*.pyc' \
|
|
--exclude '*.db' --exclude '.env' --exclude 'stations.json' \
|
|
"${REPO_DIR}/" "${APP_DIR}/"
|
|
else
|
|
warn "rsync not found; falling back to cp (will not prune deleted files)"
|
|
cp -r "${REPO_DIR}/." "${APP_DIR}/"
|
|
fi
|
|
|
|
# 3. Build the uv-managed virtualenv ------------------------------------------
|
|
# Prefer an already-installed uv. For stricter supply-chain control install uv
|
|
# ahead of time via your distro / package manager; this script only fetches the
|
|
# upstream installer (piped to a root shell) when AUTO_INSTALL_UV=1 is set, and
|
|
# pins the version so the fetched script is reproducible.
|
|
UV_VERSION="${UV_VERSION:-0.5.11}"
|
|
if ! command -v uv >/dev/null 2>&1; then
|
|
if [ "${AUTO_INSTALL_UV:-0}" = "1" ]; then
|
|
warn "uv not found; installing pinned uv ${UV_VERSION} from astral.sh (runs as root)"
|
|
curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" \
|
|
| env UV_INSTALL_DIR=/usr/local/bin sh
|
|
else
|
|
die "uv not found. Install it (e.g. your package manager, or 'pipx install uv'),
|
|
or re-run with AUTO_INSTALL_UV=1 to fetch the pinned upstream installer."
|
|
fi
|
|
fi
|
|
UV="$(command -v uv)"
|
|
|
|
log "Creating virtualenv at ${APP_DIR}/venv"
|
|
cd "${APP_DIR}"
|
|
# Named 'venv' (not uv's default .venv) to match the systemd unit's ExecStart.
|
|
"${UV}" venv venv
|
|
"${UV}" pip install --python venv/bin/python -r requirements.txt
|
|
|
|
# 4. Environment file ----------------------------------------------------------
|
|
if [ ! -f "${APP_DIR}/.env" ]; then
|
|
if [ -f "${REPO_DIR}/.env" ]; then
|
|
log "Copying .env from checkout"
|
|
cp "${REPO_DIR}/.env" "${APP_DIR}/.env"
|
|
else
|
|
warn "No .env found. Copy .env.example to ${APP_DIR}/.env and fill in"
|
|
warn "MATRIX_ACCESS_TOKEN / MATRIX_ROOM_ID and DB settings before starting."
|
|
fi
|
|
fi
|
|
|
|
# 5. Ownership and permissions -------------------------------------------------
|
|
# Service user needs write access for logs / stations.json.
|
|
log "Setting ownership to ${SERVICE_USER}:${SERVICE_GROUP}"
|
|
chown -R "${SERVICE_USER}:${SERVICE_GROUP}" "${APP_DIR}"
|
|
# Restrict traversal to root + the service user, and lock down the secrets file
|
|
# (contains the Matrix token and DB credentials).
|
|
chmod 0750 "${APP_DIR}"
|
|
if [ -f "${APP_DIR}/.env" ]; then
|
|
chmod 0600 "${APP_DIR}/.env"
|
|
fi
|
|
|
|
# 6. Install and enable the systemd unit --------------------------------------
|
|
log "Installing systemd unit"
|
|
install -m 0644 "${SCRIPT_DIR}/${SERVICE_NAME}" "/etc/systemd/system/${SERVICE_NAME}"
|
|
systemctl daemon-reload
|
|
systemctl enable "${SERVICE_NAME}"
|
|
|
|
log "Done."
|
|
echo
|
|
echo "Next steps:"
|
|
echo " sudo systemctl start ${SERVICE_NAME}"
|
|
echo " systemctl status ${SERVICE_NAME}"
|
|
echo " sudo journalctl -u ${SERVICE_NAME} -f"
|