Add full project files

scripts/server-setup.sh

@@ -0,0 +1,125 @@
+#!/bin/bash
+# Modstagram Server Setup - IP: 185.164.73.197
+# Run: bash server-setup.sh
+
+set -e
+
+SERVER_IP="185.164.73.197"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ADMIN_EMAIL="${SSL_ADMIN_EMAIL:-admin@modstagram.com}"
+
+echo "=========================================="
+echo "  Modstagram Server Setup"
+echo "  IP: $SERVER_IP"
+echo "=========================================="
+
+echo ""
+echo ">>> [1/6] Install BIND9, Nginx, Certbot..."
+apt-get update -y
+apt-get install -y bind9 bind9utils nginx certbot python3-certbot-nginx
+
+mkdir -p /var/www/certbot
+mkdir -p /var/cache/nginx/cdn
+
+echo ""
+echo ">>> [2/6] Configure DNS..."
+cp "$SCRIPT_DIR/dns/db.modstagram.com" /etc/bind/db.modstagram.com
+cp "$SCRIPT_DIR/dns/db.modstagram.ir" /etc/bind/db.modstagram.ir
+
+if ! grep -q 'zone "modstagram.com"' /etc/bind/named.conf.local 2>/dev/null; then
+  cat "$SCRIPT_DIR/dns/named.conf.local.snippet" >> /etc/bind/named.conf.local
+fi
+
+if ! grep -q 'allow-query' /etc/bind/named.conf.options; then
+  sed -i '/options {/a \    allow-query { any; };\n    listen-on { any; };' /etc/bind/named.conf.options
+fi
+
+named-checkconf
+systemctl restart bind9
+systemctl enable bind9
+echo "    DNS active (port 53)"
+
+echo ""
+echo ">>> [3/6] Configure Nginx..."
+
+for conf in api.modstagram.com modstagram.com panel.modstagram.com app.modstagram.com blog.modstagram.com pay.modstagram.com cdn.modstagram.com.http; do
+  src="$SCRIPT_DIR/nginx/${conf}.conf"
+  dst_name="${conf/.http/}.conf"
+  dst="/etc/nginx/sites-available/${dst_name}"
+  cp "$src" "$dst"
+  ln -sf "$dst" "/etc/nginx/sites-enabled/${dst_name}"
+done
+
+rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
+
+nginx -t
+systemctl reload nginx
+systemctl enable nginx
+echo "    Nginx active"
+
+echo ""
+echo ">>> [4/6] Firewall (optional)..."
+if command -v ufw >/dev/null 2>&1; then
+  ufw allow 22/tcp 2>/dev/null || true
+  ufw allow 53/tcp 2>/dev/null || true
+  ufw allow 53/udp 2>/dev/null || true
+  ufw allow 80/tcp 2>/dev/null || true
+  ufw allow 443/tcp 2>/dev/null || true
+  ufw --force enable 2>/dev/null || true
+else
+  echo "    ufw not installed, skipping"
+fi
+
+echo ""
+echo ">>> [5/6] SSL (Let's Encrypt)..."
+echo "    DNS must point to $SERVER_IP"
+
+certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
+  -d modstagram.com -d www.modstagram.com || echo "    WARN: modstagram.com SSL failed"
+
+certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
+  -d api.modstagram.com || echo "    WARN: api SSL failed"
+
+certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
+  -d panel.modstagram.com || echo "    WARN: panel SSL failed"
+
+certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
+  -d blog.modstagram.com || echo "    WARN: blog SSL failed"
+
+certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
+  -d pay.modstagram.com || echo "    WARN: pay SSL failed"
+
+certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
+  -d cdn.modstagram.com || echo "    WARN: cdn SSL failed"
+
+cp "$SCRIPT_DIR/nginx/cdn.modstagram.com.conf" /etc/nginx/sites-available/cdn.modstagram.com.conf
+ln -sf /etc/nginx/sites-available/cdn.modstagram.com.conf /etc/nginx/sites-enabled/cdn.modstagram.com.conf
+nginx -t && systemctl reload nginx
+
+cp "$SCRIPT_DIR/nginx/modstagram-redirects.conf" /etc/nginx/sites-available/modstagram-redirects.conf
+ln -sf /etc/nginx/sites-available/modstagram-redirects.conf /etc/nginx/sites-enabled/modstagram-redirects.conf
+nginx -t && systemctl reload nginx 2>/dev/null || echo "    WARN: redirects need SSL first"
+
+(crontab -l 2>/dev/null | grep -v "certbot renew"; echo "0 3 * * * certbot renew --quiet --nginx && systemctl reload nginx") | crontab -
+
+echo ""
+echo ">>> [6/6] Restart apps..."
+if command -v pm2 >/dev/null 2>&1; then
+  pm2 restart all || true
+fi
+
+echo ""
+echo "=========================================="
+echo "  DONE!"
+echo "=========================================="
+echo ""
+echo "  Registrar panel:"
+echo "  1) Glue: ns1.modstagram.com -> $SERVER_IP"
+echo "  2) Glue: ns2.modstagram.com -> $SERVER_IP"
+echo "  3) NS: ns1.modstagram.com, ns2.modstagram.com"
+echo "  4) Remove ParsPack CDN"
+echo ""
+echo "  Test:"
+echo "  dig @127.0.0.1 api.modstagram.com +short"
+echo "  wget -qO- http://127.0.0.1:3002/api/v1/version"
+echo ""