flfeders/FEDEO
2
1
Fork 0
Code Issues 95 Pull Requests Actions Packages Projects 22 Releases Wiki Activity
Files
19bab852dec9c7663f78ef1fa9d70fb78df13abd
FEDEO/scripts/selfhost-setup.sh

543 lines
17 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
ENV_FILE="$ROOT_DIR/.env"
ENV_EXAMPLE="$ROOT_DIR/.env.example"
COMPOSE_FILE="${FEDEO_COMPOSE_FILE:-$ROOT_DIR/docker-compose.yml}"
MODE=""
START_STACK="ask"
FORCE="false"
TTY_INPUT="${FEDEO_TTY_INPUT:-/dev/tty}"
TTY_FD=""
if { exec 3<"$TTY_INPUT"; } 2>/dev/null; then
TTY_FD="3"
fi
read_interactive() {
if [[ -n "$TTY_FD" ]]; then
read -u "$TTY_FD" "$@"
else
read "$@"
fi
}
compose() {
if [[ "${FEDEO_USE_SUDO_DOCKER:-false}" == "true" ]]; then
sudo docker compose "$@"
else
docker compose "$@"
fi
}
compose_stack() {
compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@"
}
compose_start_command() {
if [[ "${FEDEO_USE_SUDO_DOCKER:-false}" == "true" ]]; then
echo "sudo docker compose --env-file $ENV_FILE -f $COMPOSE_FILE up -d"
else
echo "docker compose --env-file $ENV_FILE -f $COMPOSE_FILE up -d"
fi
}
usage() {
cat <<'USAGE'
FEDEO Selfhost Setup
Nutzung:
bash scripts/selfhost-setup.sh
bash scripts/selfhost-setup.sh --simple
bash scripts/selfhost-setup.sh --advanced
bash scripts/selfhost-setup.sh --simple --start
Optionen:
--simple Kurzer Assistent mit lokalen Diensten und sicheren Defaults
--advanced Fragt zusätzliche Integrationen wie SMTP, OpenAI und DATEV-nahes Umfeld ab
--start Startet den Stack nach dem Schreiben der Konfiguration
--no-start Schreibt nur Konfiguration und Verzeichnisse
--force Überschreibt eine vorhandene .env ohne Rückfrage
USAGE
}
while [[ $# -gt 0 ]]; do
case "$1" in
--simple)
MODE="simple"
;;
--advanced)
MODE="advanced"
;;
--start)
START_STACK="yes"
;;
--no-start)
START_STACK="no"
;;
--force)
FORCE="true"
;;
-h|--help)
usage
exit 0
;;
*)
echo "Unbekannte Option: $1" >&2
usage
exit 1
;;
esac
shift
done
need_file() {
if [[ ! -f "$1" ]]; then
echo "Fehlt: $1" >&2
exit 1
fi
}
random_secret() {
if command -v openssl >/dev/null 2>&1; then
openssl rand -base64 48 | tr -d '\n'
else
LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 64
fi
}
env_quote() {
local value="$1"
value="${value//\'/\'\\\'\'}"
printf "'%s'" "$value"
}
prompt() {
local label="$1"
local default_value="${2:-}"
local value
if [[ -n "$default_value" ]]; then
read_interactive -r -p "$label [$default_value]: " value
echo "${value:-$default_value}"
else
read_interactive -r -p "$label: " value
echo "$value"
fi
}
prompt_required() {
local label="$1"
local default_value="${2:-}"
local value
while true; do
value="$(prompt "$label" "$default_value")"
if [[ -n "$value" ]]; then
echo "$value"
return
fi
echo "Bitte einen Wert eintragen." >&2
done
}
prompt_secret() {
local label="$1"
local default_value="${2:-}"
local value
if [[ -n "$default_value" ]]; then
read_interactive -r -s -p "$label [vorbelegt, Enter übernimmt]: " value
echo >&2
echo "${value:-$default_value}"
else
read_interactive -r -s -p "$label: " value
echo >&2
echo "$value"
fi
}
yes_no() {
local label="$1"
local default_value="${2:-n}"
local answer
while true; do
read_interactive -r -p "$label [$default_value]: " answer
answer="${answer:-$default_value}"
case "$answer" in
y|Y|j|J|yes|Yes|ja|Ja)
return 0
;;
n|N|no|No|nein|Nein)
return 1
;;
*)
echo "Bitte ja oder nein eingeben."
;;
esac
done
}
choose_mode() {
if [[ -n "$MODE" ]]; then
return
fi
echo
echo "Setup-Modus"
echo " 1) einfach - Domain, Admin, lokale Datenbank, MinIO, Matrix"
echo " 2) advanced - zusätzlich SMTP, externe Schlüssel und optionale Dienste"
echo
local choice
while true; do
read_interactive -r -p "Modus wählen [1]: " choice
case "${choice:-1}" in
1|einfach|simple)
MODE="simple"
return
;;
2|advanced|erweitert)
MODE="advanced"
return
;;
*)
echo "Bitte 1 oder 2 wählen."
;;
esac
done
}
print_structure_guide() {
cat <<EOF
FEDEO Selfhost Setup
Dieses Script führt dich durch die lokale Betriebsstruktur:
$ROOT_DIR/
docker-compose.yml Docker Stack für FEDEO, Traefik, PostgreSQL, MinIO, Matrix und Monitoring
.env Zielkonfiguration, wird von diesem Script geschrieben
postgres/ persistente FEDEO-Datenbank
minio/ lokaler S3-kompatibler Dateispeicher
matrix/postgres/ persistente Synapse-Datenbank
matrix/synapse/ generierte Synapse-Konfiguration und Matrix-Daten
traefik/letsencrypt/ Let's-Encrypt-Zertifikate
traefik/logs/ Traefik-Logs
Öffentliche Endpunkte auf einer Domain:
https://DOMAIN/ FEDEO Frontend
https://DOMAIN/backend FEDEO API
https://DOMAIN/_matrix Matrix Homeserver
https://DOMAIN/.well-known Matrix Discovery
https://DOMAIN/livekit/sfu LiveKit
https://DOMAIN/livekit/jwt LiveKit JWT-Service
https://DOMAIN/element Element Web
EOF
}
write_env() {
local domain="$1"
local contact_email="$2"
local db_password="$3"
local minio_password="$4"
local cookie_secret="$5"
local jwt_secret="$6"
local encryption_key="$7"
local m2m_key="$8"
local admin_email="$9"
local admin_password="${10}"
local admin_first_name="${11}"
local admin_last_name="${12}"
local tenant_name="${13}"
local tenant_short="${14}"
local matrix_db_password="${15}"
local matrix_turn_secret="${16}"
local matrix_registration_secret="${17}"
local livekit_secret="${18}"
local mailer_host="${19}"
local mailer_port="${20}"
local mailer_ssl="${21}"
local mailer_user="${22}"
local mailer_pass="${23}"
local mailer_from="${24}"
local web_push_public="${25}"
local web_push_private="${26}"
local pdf_license="${27}"
local openai_key="${28}"
local stirling_key="${29}"
local gocardless_secret_id="${30}"
local gocardless_secret_key="${31}"
local dokubox_host="${32}"
local dokubox_port="${33}"
local dokubox_secure="${34}"
local dokubox_user="${35}"
local dokubox_password="${36}"
local seafile_mysql_root_password="${37}"
local seafile_mysql_password="${38}"
local seafile_redis_password="${39}"
local seafile_jwt_private_key="${40}"
local seafile_admin_password="${41}"
cat >"$ENV_FILE" <<EOF
# FEDEO Selfhosting
DOMAIN=$(env_quote "$domain")
CONTACT_EMAIL=$(env_quote "$contact_email")
DB_NAME=$(env_quote "fedeo")
DB_USER=$(env_quote "fedeo")
DB_PASSWORD=$(env_quote "$db_password")
DATABASE_URL=$(env_quote "postgres://fedeo:$db_password@db:5432/fedeo")
MINIO_ROOT_USER=$(env_quote "fedeo-minio")
MINIO_ROOT_PASSWORD=$(env_quote "$minio_password")
MINIO_BUCKET=$(env_quote "fedeo")
HOST=$(env_quote "0.0.0.0")
PORT=$(env_quote "3100")
FEDEO_RUN_MIGRATIONS=$(env_quote "true")
COOKIE_SECRET=$(env_quote "$cookie_secret")
JWT_SECRET=$(env_quote "$jwt_secret")
ENCRYPTION_KEY=$(env_quote "$encryption_key")
MAILER_SMTP_HOST=$(env_quote "$mailer_host")
MAILER_SMTP_PORT=$(env_quote "$mailer_port")
MAILER_SMTP_SSL=$(env_quote "$mailer_ssl")
MAILER_SMTP_USER=$(env_quote "$mailer_user")
MAILER_SMTP_PASS=$(env_quote "$mailer_pass")
MAILER_FROM=$(env_quote "$mailer_from")
WEB_PUSH_PUBLIC_KEY=$(env_quote "$web_push_public")
WEB_PUSH_PRIVATE_KEY=$(env_quote "$web_push_private")
WEB_PUSH_SUBJECT=$(env_quote "mailto:$contact_email")
S3_ENDPOINT=$(env_quote "http://minio:9000")
S3_REGION=$(env_quote "eu-central-1")
S3_ACCESS_KEY=$(env_quote "fedeo-minio")
S3_SECRET_KEY=$(env_quote "$minio_password")
S3_BUCKET=$(env_quote "fedeo")
FEDEO_FILE_BACKEND=$(env_quote "s3")
SEAFILE_SERVER_HOSTNAME=$(env_quote "files.$domain")
SEAFILE_SERVER_PROTOCOL=$(env_quote "https")
SEAFILE_BASE_URL=$(env_quote "https://files.$domain")
SEAFILE_INTERNAL_URL=$(env_quote "http://seafile:80")
SEAFILE_IMAGE=$(env_quote "seafileltd/seafile-mc:13.0-latest")
SEAFILE_DB_IMAGE=$(env_quote "mariadb:10.11")
SEAFILE_REDIS_IMAGE=$(env_quote "redis:7-alpine")
INIT_SEAFILE_MYSQL_ROOT_PASSWORD=$(env_quote "$seafile_mysql_root_password")
SEAFILE_MYSQL_DB_USER=$(env_quote "seafile")
SEAFILE_MYSQL_DB_PASSWORD=$(env_quote "$seafile_mysql_password")
SEAFILE_REDIS_PASSWORD=$(env_quote "$seafile_redis_password")
SEAFILE_JWT_PRIVATE_KEY=$(env_quote "$seafile_jwt_private_key")
INIT_SEAFILE_ADMIN_EMAIL=$(env_quote "$admin_email")
INIT_SEAFILE_ADMIN_PASSWORD=$(env_quote "$seafile_admin_password")
SEAFILE_ENABLE_GO_FILESERVER=$(env_quote "true")
SEAFILE_ENABLE_SEADOC=$(env_quote "false")
SEAFILE_ENABLE_NOTIFICATION_SERVER=$(env_quote "false")
SEAFILE_ENABLE_AI=$(env_quote "false")
SEAFILE_ENABLE_FACE_RECOGNITION=$(env_quote "false")
SEAFILE_MD_FILE_COUNT_LIMIT=$(env_quote "100000")
M2M_API_KEY=$(env_quote "$m2m_key")
API_BASE_URL=$(env_quote "https://$domain/backend")
GOCARDLESS_BASE_URL=$(env_quote "https://api.gocardless.com")
GOCARDLESS_SECRET_ID=$(env_quote "$gocardless_secret_id")
GOCARDLESS_SECRET_KEY=$(env_quote "$gocardless_secret_key")
DOKUBOX_IMAP_HOST=$(env_quote "$dokubox_host")
DOKUBOX_IMAP_PORT=$(env_quote "$dokubox_port")
DOKUBOX_IMAP_SECURE=$(env_quote "$dokubox_secure")
DOKUBOX_IMAP_USER=$(env_quote "$dokubox_user")
DOKUBOX_IMAP_PASSWORD=$(env_quote "$dokubox_password")
OPENAI_API_KEY=$(env_quote "$openai_key")
STIRLING_API_KEY=$(env_quote "$stirling_key")
NUXT_PUBLIC_PDF_LICENSE=$(env_quote "$pdf_license")
NODE_EXPORTER_URL=$(env_quote "http://node-exporter:9100")
FEDEO_BOOTSTRAP_ADMIN_EMAIL=$(env_quote "$admin_email")
FEDEO_BOOTSTRAP_ADMIN_PASSWORD=$(env_quote "$admin_password")
FEDEO_BOOTSTRAP_ADMIN_FIRST_NAME=$(env_quote "$admin_first_name")
FEDEO_BOOTSTRAP_ADMIN_LAST_NAME=$(env_quote "$admin_last_name")
FEDEO_BOOTSTRAP_TENANT_NAME=$(env_quote "$tenant_name")
FEDEO_BOOTSTRAP_TENANT_SHORT=$(env_quote "$tenant_short")
MATRIX_SERVER_NAME=$(env_quote "$domain")
MATRIX_POSTGRES_DB=$(env_quote "synapse")
MATRIX_POSTGRES_USER=$(env_quote "synapse")
MATRIX_POSTGRES_PASSWORD=$(env_quote "$matrix_db_password")
MATRIX_TURN_SHARED_SECRET=$(env_quote "$matrix_turn_secret")
LIVEKIT_KEY=$(env_quote "fedeo-livekit")
LIVEKIT_SECRET=$(env_quote "$livekit_secret")
MATRIX_HOMESERVER_URL=$(env_quote "http://matrix-synapse:8008")
MATRIX_RTC_HOST=$(env_quote "$domain")
MATRIX_RTC_JWT_URL=$(env_quote "https://$domain/livekit/jwt")
MATRIX_LIVEKIT_URL=$(env_quote "wss://$domain/livekit/sfu")
MATRIX_REGISTRATION_SHARED_SECRET=$(env_quote "$matrix_registration_secret")
MATRIX_SERVICE_USER_LOCALPART=$(env_quote "fedeo_service")
NUXT_PUBLIC_MATRIX_ELEMENT_URL=$(env_quote "https://$domain/element")
EOF
}
prepare_directories() {
mkdir -p \
"$ROOT_DIR/traefik/letsencrypt" \
"$ROOT_DIR/traefik/logs" \
"$ROOT_DIR/postgres" \
"$ROOT_DIR/minio" \
"$ROOT_DIR/seafile/mysql" \
"$ROOT_DIR/seafile/data" \
"$ROOT_DIR/matrix/postgres" \
"$ROOT_DIR/matrix/synapse"
touch "$ROOT_DIR/traefik/letsencrypt/acme.json"
chmod 600 "$ROOT_DIR/traefik/letsencrypt/acme.json"
}
main() {
need_file "$COMPOSE_FILE"
need_file "$ENV_EXAMPLE"
print_structure_guide
choose_mode
if [[ -f "$ENV_FILE" && "$FORCE" != "true" ]]; then
if yes_no ".env existiert bereits. Backup erstellen und überschreiben?" "n"; then
cp "$ENV_FILE" "$ENV_FILE.$(date +%Y%m%d-%H%M%S).bak"
else
echo "Abgebrochen, .env bleibt unverändert."
exit 0
fi
fi
echo
echo "Basis"
local domain contact_email admin_email admin_password admin_first_name admin_last_name tenant_name tenant_short
domain="$(prompt_required "Domain für FEDEO" "app.example.com")"
contact_email="$(prompt_required "Kontakt-E-Mail für Let's Encrypt" "admin@example.com")"
admin_email="$(prompt_required "Erster Admin-Login" "$contact_email")"
admin_password="$(prompt_secret "Erstes Admin-Passwort" "$(random_secret)")"
admin_first_name="$(prompt_required "Admin-Vorname" "Admin")"
admin_last_name="$(prompt_required "Admin-Nachname" "Benutzer")"
tenant_name="$(prompt_required "Name des ersten Mandanten" "Mein Unternehmen")"
tenant_short="$(prompt_required "Kurzname des ersten Mandanten" "MEIN")"
echo
echo "Secrets werden automatisch erzeugt."
local db_password minio_password cookie_secret jwt_secret encryption_key m2m_key
local matrix_db_password matrix_turn_secret matrix_registration_secret livekit_secret
local seafile_mysql_root_password seafile_mysql_password seafile_redis_password seafile_jwt_private_key seafile_admin_password
db_password="$(random_secret)"
minio_password="$(random_secret)"
cookie_secret="$(random_secret)"
jwt_secret="$(random_secret)"
encryption_key="$(random_secret)"
m2m_key="$(random_secret)"
matrix_db_password="$(random_secret)"
matrix_turn_secret="$(random_secret)"
matrix_registration_secret="$(random_secret)"
livekit_secret="$(random_secret)"
seafile_mysql_root_password="$(random_secret)"
seafile_mysql_password="$(random_secret)"
seafile_redis_password="$(random_secret)"
seafile_jwt_private_key="$(random_secret)"
seafile_admin_password="$(random_secret)"
local mailer_host="smtp.example.com"
local mailer_port="587"
local mailer_ssl="false"
local mailer_user="mailer@example.com"
local mailer_pass="change-this-mail-password"
local mailer_from="FEDEO <no-reply@example.com>"
local web_push_public="replace-this-web-push-public-key"
local web_push_private="replace-this-web-push-private-key"
local pdf_license="replace-with-your-pdf-license"
local openai_key="replace-this"
local stirling_key="replace-this"
local gocardless_secret_id="replace-this"
local gocardless_secret_key="replace-this"
local dokubox_host="imap.example.com"
local dokubox_port="993"
local dokubox_secure="true"
local dokubox_user="dokubox@example.com"
local dokubox_password="change-this-imap-password"
if [[ "$MODE" == "advanced" ]]; then
echo
echo "Advanced: SMTP"
mailer_host="$(prompt "SMTP Host" "$mailer_host")"
mailer_port="$(prompt "SMTP Port" "$mailer_port")"
mailer_ssl="$(prompt "SMTP SSL true/false" "$mailer_ssl")"
mailer_user="$(prompt "SMTP Benutzer" "$mailer_user")"
mailer_pass="$(prompt_secret "SMTP Passwort" "$mailer_pass")"
mailer_from="$(prompt "Absender" "FEDEO <no-reply@$domain>")"
echo
echo "Advanced: optionale Schlüssel"
pdf_license="$(prompt "PDF-Lizenz" "$pdf_license")"
openai_key="$(prompt_secret "OpenAI API Key" "$openai_key")"
stirling_key="$(prompt_secret "Stirling API Key" "$stirling_key")"
web_push_public="$(prompt "Web Push Public Key" "$web_push_public")"
web_push_private="$(prompt_secret "Web Push Private Key" "$web_push_private")"
echo
echo "Advanced: Banking und Dokubox"
gocardless_secret_id="$(prompt "GoCardless Secret ID" "$gocardless_secret_id")"
gocardless_secret_key="$(prompt_secret "GoCardless Secret Key" "$gocardless_secret_key")"
dokubox_host="$(prompt "Dokubox IMAP Host" "$dokubox_host")"
dokubox_port="$(prompt "Dokubox IMAP Port" "$dokubox_port")"
dokubox_secure="$(prompt "Dokubox IMAP Secure true/false" "$dokubox_secure")"
dokubox_user="$(prompt "Dokubox IMAP Benutzer" "$dokubox_user")"
dokubox_password="$(prompt_secret "Dokubox IMAP Passwort" "$dokubox_password")"
fi
write_env \
"$domain" "$contact_email" "$db_password" "$minio_password" \
"$cookie_secret" "$jwt_secret" "$encryption_key" "$m2m_key" \
"$admin_email" "$admin_password" "$admin_first_name" "$admin_last_name" \
"$tenant_name" "$tenant_short" "$matrix_db_password" "$matrix_turn_secret" \
"$matrix_registration_secret" "$livekit_secret" "$mailer_host" "$mailer_port" \
"$mailer_ssl" "$mailer_user" "$mailer_pass" "$mailer_from" "$web_push_public" \
"$web_push_private" "$pdf_license" "$openai_key" "$stirling_key" \
"$gocardless_secret_id" "$gocardless_secret_key" "$dokubox_host" \
"$dokubox_port" "$dokubox_secure" "$dokubox_user" "$dokubox_password" \
"$seafile_mysql_root_password" "$seafile_mysql_password" "$seafile_redis_password" \
"$seafile_jwt_private_key" "$seafile_admin_password"
prepare_directories
echo
echo "Konfiguration geschrieben:"
echo " $ENV_FILE"
echo
echo "Vor dem Start prüfen:"
echo " 1. DNS zeigt auf diesen Server: $domain"
echo " Zusätzlich für Seafile: files.$domain"
echo " 2. Ports 80, 443, 3478/tcp, 3478/udp, 5349/tcp, 49160-49200/udp sind offen"
echo " 3. Platzhalter für optionale Dienste in .env bei Bedarf ersetzen"
if [[ "$START_STACK" == "ask" ]]; then
if yes_no "Stack jetzt mit Docker Compose starten?" "n"; then
START_STACK="yes"
else
START_STACK="no"
fi
fi
if [[ "$START_STACK" == "yes" ]]; then
compose_stack up -d
else
echo
echo "Start später mit:"
echo " $(compose_start_command)"
fi
}
main
Reference in New Issue View Git Blame Copy Permalink