Add new cloud-setup/new-setup.sh

2025-08-25 11:49:11 -07:00
parent 4c940637b1
commit 6ae7a913e4
1 changed files with 461 additions and 0 deletions
--- a/cloud-setup/new-setup.sh
+++ b/cloud-setup/new-setup.sh
@@ -0,0 +1,461 @@
+#!/bin/bash
+
+# Exit on any error
+set -e
+
+# Define directories
+SETUP_DIR="/srv/Files/Notesnook/setup"
+DB_DIR="/srv/Files/Notesnook/db"
+S3_DIR="/srv/Files/Notesnook/s3"
+
+# Default values (prompt user to override)
+BASE_DOMAIN="example.com"
+LOCAL_IP="192.168.1.100"
+INSTANCE_NAME="Notesnook"
+DISABLE_SIGNUPS="false"
+SMTP_HOST="smtp.example.com"
+SMTP_PORT="587"
+SMTP_USERNAME="user@example.com"
+SMTP_PASSWORD="your_smtp_password"
+
+# Prompt for user input
+read -p "Enter your domain (e.g., example.com): " BASE_DOMAIN
+read -p "Enter your LXC container's local IP (e.g., 192.168.1.100): " LOCAL_IP
+read -p "Enter instance name [${INSTANCE_NAME}]: " input_instance
+INSTANCE_NAME=${input_instance:-$INSTANCE_NAME}
+read -p "Disable signups? (true/false) [${DISABLE_SIGNUPS}]: " input_signups
+DISABLE_SIGNUPS=${input_signups:-$DISABLE_SIGNUPS}
+read -p "Enter SMTP host [${SMTP_HOST}]: " input_smtp_host
+SMTP_HOST=${input_smtp_host:-$SMTP_HOST}
+read -p "Enter SMTP port [${SMTP_PORT}]: " input_smtp_port
+SMTP_PORT=${input_smtp_port:-$SMTP_PORT}
+read -p "Enter SMTP username [${SMTP_USERNAME}]: " input_smtp_username
+SMTP_USERNAME=${input_smtp_username:-$SMTP_USERNAME}
+read -p "Enter SMTP password: " SMTP_PASSWORD
+read -p "Enter Traefik dashboard password: " TRAEFIK_PASSWORD
+
+# Generate random secrets
+MINIO_ROOT_PASSWORD=$(openssl rand -base64 12)
+NOTESNOOK_API_SECRET=$(openssl rand -base64 32)
+SERVICE_DISCOVERY_TOKEN=$(openssl rand -base64 32)
+
+# Install dependencies
+echo "Installing dependencies..."
+apt update
+apt install -y podman python3-pip dos2unix apache2-utils
+pip3 install --upgrade podman-compose || pip3 install git+https://github.com/containers/podman-compose.git
+
+# Create directories
+echo "Creating directories..."
+mkdir -p "$SETUP_DIR" "$DB_DIR" "$S3_DIR"
+chmod 700 "$DB_DIR" "$S3_DIR"
+
+# Generate hashed password for Traefik
+TRAEFIK_AUTH_USER=$(htpasswd -nb admin "$TRAEFIK_PASSWORD")
+
+# Create .env file
+echo "Generating .env file..."
+cat > "$SETUP_DIR/.env" << EOF
+TRAEFIK_AUTH_USER=${TRAEFIK_AUTH_USER}
+MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
+NOTESNOOK_API_SECRET=${NOTESNOOK_API_SECRET}
+SERVICE_DISCOVERY_TOKEN=${SERVICE_DISCOVERY_TOKEN}
+SERVICE_DISCOVERY_URL=https://syncnotesnook.${BASE_DOMAIN}
+AUTH_SERVER_PUBLIC_URL=https://authnotesnook.${BASE_DOMAIN}
+NOTESNOOK_APP_PUBLIC_URL=https://syncnotesnook.${BASE_DOMAIN}
+EVENTS_SERVER_URL=https://eventsnotesnook.${BASE_DOMAIN}
+ATTACHMENTS_SERVER_PUBLIC_URL=https://s3notesnook.${BASE_DOMAIN}
+MONOGRAPH_PUBLIC_URL=https://monographnotesnook.${BASE_DOMAIN}
+TRAEFIK_DASHBOARD_URL=https://traefiknotesnook.${BASE_DOMAIN}
+BASE_DOMAIN=${BASE_DOMAIN}
+LOCAL_IP=${LOCAL_IP}
+SMTP_HOST=${SMTP_HOST}
+SMTP_PORT=${SMTP_PORT}
+SMTP_USERNAME=${SMTP_USERNAME}
+SMTP_PASSWORD=${SMTP_PASSWORD}
+DISABLE_SIGNUPS=${DISABLE_SIGNUPS}
+INSTANCE_NAME=${INSTANCE_NAME}
+NOTESNOOK_IDENTITY_IMAGE=streetwriters/identity:latest
+NOTESNOOK_SYNC_IMAGE=streetwriters/notesnook-sync:latest
+NOTESNOOK_SSE_IMAGE=streetwriters/sse:latest
+NOTESNOOK_MONOGRAPH_IMAGE=streetwriters/monograph:latest
+EOF
+chmod 600 "$SETUP_DIR/.env"
+
+# Create traefik.yml
+echo "Generating traefik.yml..."
+cat > "$SETUP_DIR/traefik.yml" << EOF
+global:
+  checkNewVersion: true
+  sendAnonymousUsage: false
+
+entryPoints:
+  websecure:
+    address: :443
+
+api:
+  dashboard: true
+  insecure: false
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+EOF
+
+# Create docker-compose.yml
+echo "Generating docker-compose.yml..."
+cat > "$SETUP_DIR/docker-compose.yml" << EOF
+version: '3.8'
+
+services:
+  traefik:
+    image: traefik:v2.10
+    container_name: traefik
+    ports:
+      - "\${LOCAL_IP}:443:443"
+    volumes:
+      - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - /var/run/podman/podman.sock:/var/run/docker.sock:ro
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.dashboard.rule=Host(\`traefiknotesnook.\${BASE_DOMAIN}\`)
+      - traefik.http.routers.dashboard.entrypoints=websecure
+      - traefik.http.routers.dashboard.tls=true
+      - traefik.http.routers.dashboard.service=api@internal
+      - traefik.http.routers.dashboard.middlewares=auth
+      - traefik.http.middlewares.auth.basicauth.users=\${TRAEFIK_AUTH_USER}
+    networks:
+      - notesnook
+    restart: unless-stopped
+
+  validate:
+    image: vandot/alpine-bash
+    container_name: validate
+    entrypoint: /bin/bash
+    environment:
+      - INSTANCE_NAME=\${INSTANCE_NAME}
+      - NOTESNOOK_API_SECRET=\${NOTESNOOK_API_SECRET}
+      - DISABLE_SIGNUPS=\${DISABLE_SIGNUPS}
+      - SMTP_USERNAME=\${SMTP_USERNAME}
+      - SMTP_PASSWORD=\${SMTP_PASSWORD}
+      - SMTP_HOST=\${SMTP_HOST}
+      - SMTP_PORT=\${SMTP_PORT}
+      - AUTH_SERVER_PUBLIC_URL=\${AUTH_SERVER_PUBLIC_URL}
+      - NOTESNOOK_APP_PUBLIC_URL=\${NOTESNOOK_APP_PUBLIC_URL}
+      - MONOGRAPH_PUBLIC_URL=\${MONOGRAPH_PUBLIC_URL}
+      - ATTACHMENTS_SERVER_PUBLIC_URL=\${ATTACHMENTS_SERVER_PUBLIC_URL}
+    command:
+      - -c
+      - |
+        required_vars=(
+          "INSTANCE_NAME"
+          "NOTESNOOK_API_SECRET"
+          "DISABLE_SIGNUPS"
+          "SMTP_USERNAME"
+          "SMTP_PASSWORD"
+          "SMTP_HOST"
+          "SMTP_PORT"
+          "AUTH_SERVER_PUBLIC_URL"
+          "NOTESNOOK_APP_PUBLIC_URL"
+          "MONOGRAPH_PUBLIC_URL"
+          "ATTACHMENTS_SERVER_PUBLIC_URL"
+        )
+        for var in "\${required_vars[@]}"; do
+          if [ -z "\${!var}" ]; then
+            echo "Error: Required environment variable \$var is not set."
+            exit 1
+          fi
+        done
+        echo "All required environment variables are set."
+    networks:
+      - notesnook
+    restart: "no"
+
+  notesnook-db:
+    image: mongo:7.0.12
+    container_name: notesnook-db
+    volumes:
+      - /srv/Files/Notesnook/db:/data/db
+      - /srv/Files/Notesnook/db:/data/configdb
+    networks:
+      - notesnook
+    command: --replSet rs0 --bind_ip_all
+    depends_on:
+      validate:
+        condition: service_completed_successfully
+    healthcheck:
+      test: echo 'db.runCommand("ping").ok' | mongosh mongodb://localhost:27017 --quiet
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    restart: unless-stopped
+
+  initiate-rs0:
+    image: mongo:7.0.12
+    container_name: initiate-rs0
+    networks:
+      - notesnook
+    depends_on:
+      notesnook-db:
+        condition: service_healthy
+    entrypoint: /bin/sh
+    command: -c "mongosh mongodb://notesnook-db:27017 <<EOF\nrs.initiate();\nrs.status();\nEOF"
+    restart: "no"
+
+  minio:
+    image: minio/minio:RELEASE.2024-07-29T22-14-52Z
+    container_name: minio
+    environment:
+      - MINIO_ROOT_USER=admin
+      - MINIO_ROOT_PASSWORD=\${MINIO_ROOT_PASSWORD}
+      - MINIO_BROWSER=on
+    command: server /data/s3 --console-address ":9001"
+    volumes:
+      - /srv/Files/Notesnook/s3:/data/s3
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.minio.rule=Host(\`s3notesnook.\${BASE_DOMAIN}\`)
+      - traefik.http.routers.minio.entrypoints=websecure
+      - traefik.http.routers.minio.tls=true
+      - traefik.http.services.minio.loadbalancer.server.port=9001
+    networks:
+      - notesnook
+    healthcheck:
+      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9001' || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    restart: unless-stopped
+
+  setup-s3:
+    image: minio/mc:RELEASE.2024-07-26T13-08-44Z
+    container_name: setup-s3
+    depends_on:
+      - minio
+    networks:
+      - notesnook
+    entrypoint: /bin/bash
+    environment:
+      - MINIO_ROOT_USER=admin
+      - MINIO_ROOT_PASSWORD=\${MINIO_ROOT_PASSWORD}
+    command: -c "until mc alias set minio http://minio:9000 \${MINIO_ROOT_USER} \${MINIO_ROOT_PASSWORD}; do sleep 1; done; mc mb minio/attachments -p"
+    restart: "no"
+
+  identity-server:
+    image: \${NOTESNOOK_IDENTITY_IMAGE}
+    container_name: identity-server
+    environment:
+      - NOTESNOOK_SERVER_PORT=5264
+      - NOTESNOOK_SERVER_HOST=notesnook-server
+      - IDENTITY_SERVER_PORT=8264
+      - IDENTITY_SERVER_HOST=identity-server
+      - SSE_SERVER_PORT=7264
+      - SSE_SERVER_HOST=sse-server
+      - SELF_HOSTED=1
+      - IDENTITY_SERVER_URL=https://authnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_APP_HOST=https://syncnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_API_SECRET=\${NOTESNOOK_API_SECRET}
+      - MONGODB_CONNECTION_STRING=mongodb://notesnook-db:27017/identity?replSet=rs0
+      - MONGODB_DATABASE_NAME=identity
+      - SMTP_HOST=\${SMTP_HOST}
+      - SMTP_PORT=\${SMTP_PORT}
+      - SMTP_USERNAME=\${SMTP_USERNAME}
+      - SMTP_PASSWORD=\${SMTP_PASSWORD}
+      - DISABLE_SIGNUPS=\${DISABLE_SIGNUPS}
+      - INSTANCE_NAME=\${INSTANCE_NAME}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.identity-server.rule=Host(\`authnotesnook.\${BASE_DOMAIN}\`)
+      - traefik.http.routers.identity-server.entrypoints=websecure
+      - traefik.http.routers.identity-server.tls=true
+      - traefik.http.services.identity-server.loadbalancer.server.port=8264
+    networks:
+      - notesnook
+    depends_on:
+      - notesnook-db
+    healthcheck:
+      test: wget --tries=1 -nv -q http://localhost:8264/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    restart: unless-stopped
+
+  notesnook-sync:
+    image: \${NOTESNOOK_SYNC_IMAGE}
+    container_name: notesnook-sync
+    environment:
+      - NOTESNOOK_SERVER_PORT=5264
+      - NOTESNOOK_SERVER_HOST=notesnook-server
+      - IDENTITY_SERVER_PORT=8264
+      - IDENTITY_SERVER_HOST=identity-server
+      - SSE_SERVER_PORT=7264
+      - SSE_SERVER_HOST=sse-server
+      - SELF_HOSTED=1
+      - IDENTITY_SERVER_URL=https://authnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_APP_HOST=https://syncnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_API_SECRET=\${NOTESNOOK_API_SECRET}
+      - MONGODB_CONNECTION_STRING=mongodb://notesnook-db:27017/?replSet=rs0
+      - MONGODB_DATABASE_NAME=notesnook
+      - S3_INTERNAL_SERVICE_URL=http://minio:9000/
+      - S3_INTERNAL_BUCKET_NAME=attachments
+      - S3_ACCESS_KEY_ID=admin
+      - S3_ACCESS_KEY=\${MINIO_ROOT_PASSWORD}
+      - S3_SERVICE_URL=https://s3notesnook.\${BASE_DOMAIN}
+      - S3_REGION=us-east-1
+      - S3_BUCKET_NAME=attachments
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.notesnook-sync.rule=Host(\`syncnotesnook.\${BASE_DOMAIN}\`)
+      - traefik.http.routers.notesnook-sync.entrypoints=websecure
+      - traefik.http.routers.notesnook-sync.tls=true
+      - traefik.http.services.notesnook-sync.loadbalancer.server.port=5264
+    networks:
+      - notesnook
+    depends_on:
+      - minio
+      - setup-s3
+      - identity-server
+    healthcheck:
+      test: wget --tries=1 -nv -q http://localhost:5264/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    restart: unless-stopped
+
+  sse-server:
+    image: \${NOTESNOOK_SSE_IMAGE}
+    container_name: sse-server
+    environment:
+      - NOTESNOOK_SERVER_PORT=5264
+      - NOTESNOOK_SERVER_HOST=notesnook-server
+      - IDENTITY_SERVER_PORT=8264
+      - IDENTITY_SERVER_HOST=identity-server
+      - SSE_SERVER_PORT=7264
+      - SSE_SERVER_HOST=sse-server
+      - SELF_HOSTED=1
+      - IDENTITY_SERVER_URL=https://authnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_APP_HOST=https://syncnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_API_SECRET=\${NOTESNOOK_API_SECRET}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.sse-server.rule=Host(\`eventsnotesnook.\${BASE_DOMAIN}\`)
+      - traefik.http.routers.sse-server.entrypoints=websecure
+      - traefik.http.routers.sse-server.tls=true
+      - traefik.http.services.sse-server.loadbalancer.server.port=7264
+    networks:
+      - notesnook
+    depends_on:
+      - identity-server
+      - notesnook-sync
+    healthcheck:
+      test: wget --tries=1 -nv -q http://localhost:7264/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    restart: unless-stopped
+
+  monograph:
+    image: \${NOTESNOOK_MONOGRAPH_IMAGE}
+    container_name: monograph
+    environment:
+      - NOTESNOOK_SERVER_PORT=5264
+      - NOTESNOOK_SERVER_HOST=notesnook-server
+      - IDENTITY_SERVER_PORT=8264
+      - IDENTITY_SERVER_HOST=identity-server
+      - SSE_SERVER_PORT=7264
+      - SSE_SERVER_HOST=sse-server
+      - SELF_HOSTED=1
+      - IDENTITY_SERVER_URL=https://authnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_APP_HOST=https://syncnotesnook.\${BASE_DOMAIN}
+      - NOTESNOOK_API_SECRET=\${NOTESNOOK_API_SECRET}
+      - API_HOST=http://notesnook-sync:5264/
+      - PUBLIC_URL=https://monographnotesnook.\${BASE_DOMAIN}
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.monograph.rule=Host(\`monographnotesnook.\${BASE_DOMAIN}\`)
+      - traefik.http.routers.monograph.entrypoints=websecure
+      - traefik.http.routers.monograph.tls=true
+      - traefik.http.services.monograph.loadbalancer.server.port=3000
+    networks:
+      - notesnook
+    depends_on:
+      - notesnook-sync
+    healthcheck:
+      test: wget --tries=1 -nv -q http://localhost:3000/api/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    restart: unless-stopped
+
+networks:
+  notesnook:
+    driver: bridge
+EOF
+
+# Ensure proper file encoding
+dos2unix "$SETUP_DIR/.env" "$SETUP_DIR/traefik.yml" "$SETUP_DIR/docker-compose.yml"
+
+# Validate YAML syntax
+echo "Validating YAML files..."
+python3 -c "import yaml; yaml.safe_load(open('$SETUP_DIR/docker-compose.yml'))"
+python3 -c "import yaml; yaml.safe_load(open('$SETUP_DIR/traefik.yml'))"
+
+# Pull images
+echo "Pulling container images..."
+cd "$SETUP_DIR"
+podman-compose pull || {
+  echo "Warning: Failed to pull some images. Attempting to pull individually..."
+  podman pull traefik:v2.10
+  podman pull vandot/alpine-bash
+  podman pull mongo:7.0.12
+  podman pull minio/minio:RELEASE.2024-07-29T22-14-52Z
+  podman pull minio/mc:RELEASE.2024-07-26T13-08-44Z
+  podman pull streetwriters/identity:latest || echo "streetwriters/identity:latest unavailable. Build manually if needed."
+  podman pull streetwriters/notesnook-sync:latest || echo "streetwriters/notesnook-sync:latest unavailable. Build manually if needed."
+  podman pull streetwriters/sse:latest || echo "streetwriters/sse:latest unavailable. Build manually if needed."
+  podman pull streetwriters/monograph:latest || echo "streetwriters/monograph:latest unavailable. Build manually if needed."
+}
+
+# Instructions for building images if needed
+if ! podman images | grep -q streetwriters; then
+  echo "Some streetwriters images are missing. To build them manually:"
+  echo "  git clone https://github.com/streetwriters/notesnook-sync-server"
+  echo "  cd notesnook-sync-server"
+  echo "  podman build -t streetwriters/identity:latest -f Dockerfile.identity ."
+  echo "  podman build -t streetwriters/notesnook-sync:latest -f Dockerfile.sync ."
+  echo "  podman build -t streetwriters/sse:latest -f Dockerfile.sse ."
+  echo "  podman build -t streetwriters/monograph:latest -f Dockerfile.monograph ."
+fi
+
+# Start services
+echo "Starting services..."
+podman-compose up -d
+
+# Display status
+podman-compose ps
+
+# Test health endpoints
+echo "Testing health endpoints..."
+curl -k https://authnotesnook.${BASE_DOMAIN}/health || echo "Auth server health check failed."
+curl -k https://syncnotesnook.${BASE_DOMAIN}/health || echo "Sync server health check failed."
+curl -k https://eventsnotesnook.${BASE_DOMAIN}/health || echo "Events server health check failed."
+curl -k https://monographnotesnook.${BASE_DOMAIN}/api/health || echo "Monograph server health check failed."
+curl -k https://s3notesnook.${BASE_DOMAIN} || echo "S3 server health check failed."
+curl -k https://traefiknotesnook.${BASE_DOMAIN} || echo "Traefik dashboard health check failed."
+
+# Display client configuration instructions
+echo "Setup complete! Configure your Notesnook client with:"
+echo "  Sync Server: https://syncnotesnook.${BASE_DOMAIN}"
+echo "  Auth Server: https://authnotesnook.${BASE_DOMAIN}"
+echo "  Events Server: https://eventsnotesnook.${BASE_DOMAIN}"
+echo "  Attachments Server: https://s3notesnook.${BASE_DOMAIN}"
+echo "  Monograph Server: https://monographnotesnook.${BASE_DOMAIN} (leave blank if not using)"
+echo "Access Traefik dashboard at: https://traefiknotesnook.${BASE_DOMAIN} (username: admin, password: <your_password>)"
+echo "Ensure Cloudflare wildcard DNS (*.${BASE_DOMAIN}) is set to Proxied and SSL/TLS is Full."