deploy/deploy.sh (3032 bytes)
1 #!/bin/sh 2 # deploy.sh: build sbm-webpublish for Linux and install it on a server with 3 # systemd and nginx. 4 # 5 # sh deploy/deploy.sh root@example.com [site] 6 # 7 # site is the name of the nginx site file in /etc/nginx/sites-enabled. When 8 # that file does not include the nginx snippet, the script adds the include 9 # line to each HTTPS server block of the file (see include.awk). It keeps a 10 # copy of the file, and it puts the copy back if nginx -t fails. 11 # 12 # When the server has no admin password, the script makes one. Read it on 13 # the server with: cat /etc/sbm-webpublish.env 14 set -e 15 host=${1:?usage: sh deploy/deploy.sh user@host [site]} 16 site=$2 17 cd "$(dirname "$0")/.." 18 # -buildvcs=false: the build does not need the git status. Under Cygwin, git 19 # refuses a checkout that Git for Windows made ("dubious ownership"), and 20 # the build stops. 21 GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -buildvcs=false -trimpath -o sbm-webpublish . 22 scp sbm-webpublish deploy/sbm-webpublish.service deploy/nginx-location.conf deploy/include.awk "$host:/tmp/" 23 rm sbm-webpublish 24 ssh "$host" "SITE='$site' sh -s" << 'EOF' 25 set -e 26 install -m 755 /tmp/sbm-webpublish /usr/local/bin/sbm-webpublish 27 install -m 644 /tmp/sbm-webpublish.service /etc/systemd/system/sbm-webpublish.service 28 install -m 644 /tmp/nginx-location.conf /etc/nginx/snippets/sbm-webpublish.conf 29 rm /tmp/sbm-webpublish /tmp/sbm-webpublish.service /tmp/nginx-location.conf 30 if [ ! -s /etc/sbm-webpublish.env ]; then 31 (umask 077 && printf 'ADMIN_PASSWORD=%s\n' "$(head -c 18 /dev/urandom | base64)" > /etc/sbm-webpublish.env) 32 echo "made an admin password: cat /etc/sbm-webpublish.env" 33 fi 34 systemctl daemon-reload 35 systemctl enable sbm-webpublish 36 systemctl restart sbm-webpublish 37 sleep 1 38 if ! systemctl is-active --quiet sbm-webpublish; then 39 journalctl -u sbm-webpublish -n 20 --no-pager 40 exit 1 41 fi 42 echo "sbm-webpublish is running" 43 44 conf=/etc/nginx/sites-enabled/$SITE 45 copy=/etc/nginx/$SITE.before-sbm-webpublish 46 if [ -n "$SITE" ] && [ ! -f "$conf" ]; then 47 echo "no nginx site file $conf" 48 exit 1 49 fi 50 if [ -n "$SITE" ] && ! grep -q 'snippets/sbm-webpublish.conf' "$conf"; then 51 # The copy and the new file are outside sites-enabled, so that nginx 52 # does not read them. cat writes through a symbolic link. 53 cp "$conf" "$copy" 54 awk -f /tmp/include.awk "$copy" > /tmp/sbm-webpublish.site 55 cat /tmp/sbm-webpublish.site > "$conf" 56 rm /tmp/sbm-webpublish.site 57 if ! nginx -t; then 58 cat "$copy" > "$conf" 59 echo "nginx -t failed. $conf is as before." 60 exit 1 61 fi 62 echo "added the include line to $conf (the old file is $copy)" 63 fi 64 rm /tmp/include.awk 65 if grep -qs 'snippets/sbm-webpublish.conf' /etc/nginx/sites-enabled/*; then 66 nginx -t 67 systemctl reload nginx 68 echo "nginx reloaded" 69 else 70 echo "No HTTPS server block got the include line. Add this line to the" 71 echo "HTTPS server block of the site:" 72 echo " include snippets/sbm-webpublish.conf;" 73 echo "Then run: nginx -t && systemctl reload nginx" 74 fi 75 EOF