126 lines
4.2 KiB
Bash
126 lines
4.2 KiB
Bash
#!/bin/bash
|
|
# Modstagram Server Setup - IP: 185.164.73.197
|
|
# Run: bash server-setup.sh
|
|
|
|
set -e
|
|
|
|
SERVER_IP="185.164.73.197"
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
ADMIN_EMAIL="${SSL_ADMIN_EMAIL:-admin@modstagram.com}"
|
|
|
|
echo "=========================================="
|
|
echo " Modstagram Server Setup"
|
|
echo " IP: $SERVER_IP"
|
|
echo "=========================================="
|
|
|
|
echo ""
|
|
echo ">>> [1/6] Install BIND9, Nginx, Certbot..."
|
|
apt-get update -y
|
|
apt-get install -y bind9 bind9utils nginx certbot python3-certbot-nginx
|
|
|
|
mkdir -p /var/www/certbot
|
|
mkdir -p /var/cache/nginx/cdn
|
|
|
|
echo ""
|
|
echo ">>> [2/6] Configure DNS..."
|
|
cp "$SCRIPT_DIR/dns/db.modstagram.com" /etc/bind/db.modstagram.com
|
|
cp "$SCRIPT_DIR/dns/db.modstagram.ir" /etc/bind/db.modstagram.ir
|
|
|
|
if ! grep -q 'zone "modstagram.com"' /etc/bind/named.conf.local 2>/dev/null; then
|
|
cat "$SCRIPT_DIR/dns/named.conf.local.snippet" >> /etc/bind/named.conf.local
|
|
fi
|
|
|
|
if ! grep -q 'allow-query' /etc/bind/named.conf.options; then
|
|
sed -i '/options {/a \ allow-query { any; };\n listen-on { any; };' /etc/bind/named.conf.options
|
|
fi
|
|
|
|
named-checkconf
|
|
systemctl restart bind9
|
|
systemctl enable bind9
|
|
echo " DNS active (port 53)"
|
|
|
|
echo ""
|
|
echo ">>> [3/6] Configure Nginx..."
|
|
|
|
for conf in api.modstagram.com modstagram.com panel.modstagram.com app.modstagram.com blog.modstagram.com pay.modstagram.com cdn.modstagram.com.http; do
|
|
src="$SCRIPT_DIR/nginx/${conf}.conf"
|
|
dst_name="${conf/.http/}.conf"
|
|
dst="/etc/nginx/sites-available/${dst_name}"
|
|
cp "$src" "$dst"
|
|
ln -sf "$dst" "/etc/nginx/sites-enabled/${dst_name}"
|
|
done
|
|
|
|
rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
|
|
|
|
nginx -t
|
|
systemctl reload nginx
|
|
systemctl enable nginx
|
|
echo " Nginx active"
|
|
|
|
echo ""
|
|
echo ">>> [4/6] Firewall (optional)..."
|
|
if command -v ufw >/dev/null 2>&1; then
|
|
ufw allow 22/tcp 2>/dev/null || true
|
|
ufw allow 53/tcp 2>/dev/null || true
|
|
ufw allow 53/udp 2>/dev/null || true
|
|
ufw allow 80/tcp 2>/dev/null || true
|
|
ufw allow 443/tcp 2>/dev/null || true
|
|
ufw --force enable 2>/dev/null || true
|
|
else
|
|
echo " ufw not installed, skipping"
|
|
fi
|
|
|
|
echo ""
|
|
echo ">>> [5/6] SSL (Let's Encrypt)..."
|
|
echo " DNS must point to $SERVER_IP"
|
|
|
|
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
|
|
-d modstagram.com -d www.modstagram.com || echo " WARN: modstagram.com SSL failed"
|
|
|
|
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
|
|
-d api.modstagram.com -d app.modstagram.com || echo " WARN: api SSL failed"
|
|
|
|
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
|
|
-d panel.modstagram.com || echo " WARN: panel SSL failed"
|
|
|
|
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
|
|
-d blog.modstagram.com || echo " WARN: blog SSL failed"
|
|
|
|
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
|
|
-d pay.modstagram.com || echo " WARN: pay SSL failed"
|
|
|
|
certbot --nginx --non-interactive --agree-tos --email "$ADMIN_EMAIL" \
|
|
-d cdn.modstagram.com || echo " WARN: cdn SSL failed"
|
|
|
|
cp "$SCRIPT_DIR/nginx/cdn.modstagram.com.conf" /etc/nginx/sites-available/cdn.modstagram.com.conf
|
|
ln -sf /etc/nginx/sites-available/cdn.modstagram.com.conf /etc/nginx/sites-enabled/cdn.modstagram.com.conf
|
|
nginx -t && systemctl reload nginx
|
|
|
|
cp "$SCRIPT_DIR/nginx/modstagram-redirects.conf" /etc/nginx/sites-available/modstagram-redirects.conf
|
|
ln -sf /etc/nginx/sites-available/modstagram-redirects.conf /etc/nginx/sites-enabled/modstagram-redirects.conf
|
|
nginx -t && systemctl reload nginx 2>/dev/null || echo " WARN: redirects need SSL first"
|
|
|
|
(crontab -l 2>/dev/null | grep -v "certbot renew"; echo "0 3 * * * certbot renew --quiet --nginx && systemctl reload nginx") | crontab -
|
|
|
|
echo ""
|
|
echo ">>> [6/6] Restart apps..."
|
|
if command -v pm2 >/dev/null 2>&1; then
|
|
pm2 restart all || true
|
|
fi
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo " DONE!"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo " Registrar panel:"
|
|
echo " 1) Glue: ns1.modstagram.com -> $SERVER_IP"
|
|
echo " 2) Glue: ns2.modstagram.com -> $SERVER_IP"
|
|
echo " 3) NS: ns1.modstagram.com, ns2.modstagram.com"
|
|
echo " 4) Remove ParsPack CDN"
|
|
echo ""
|
|
echo " Test:"
|
|
echo " dig @127.0.0.1 api.modstagram.com +short"
|
|
echo " wget -qO- http://127.0.0.1:3002/api/v1/version"
|
|
echo ""
|