88b7f55db4
Full production-ready docker-compose stack (db, kong, auth, rest, realtime, storage, imgproxy, meta, functions, studio) targeting api.caterium.ru, plus bootstrap script for a fresh Cloud Server, Caddy reverse-proxy config (HTTPS, WebSocket, upload limits), and dump/restore/verify/storage-sync scripts for moving off the managed Supabase project (cksuehzcimitsxmeloes). Does not touch public/ or any live runtime behavior — frontend cutover is documented separately in frontend-cutover.md and only applied after Etap 8 verification. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
87 lines
3.1 KiB
Bash
87 lines
3.1 KiB
Bash
#!/bin/bash
|
|
# Run as root, once, on a fresh Ubuntu 22.04/24.04 Timeweb Cloud Server (VPS).
|
|
# Usage: sudo bash bootstrap-server.sh
|
|
set -euo pipefail
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "Run as root: sudo bash bootstrap-server.sh" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
echo "== Installing Docker Engine + Compose plugin =="
|
|
apt-get update -qq
|
|
apt-get install -y -qq ca-certificates curl gnupg ufw
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
|
chmod a+r /etc/apt/keyrings/docker.asc
|
|
. /etc/os-release
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${VERSION_CODENAME} stable" \
|
|
> /etc/apt/sources.list.d/docker.list
|
|
apt-get update -qq
|
|
apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
systemctl enable --now docker
|
|
|
|
echo "== Installing Caddy (reverse proxy, automatic HTTPS) =="
|
|
apt-get install -y -qq debian-keyring debian-archive-keyring apt-transport-https
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' > /etc/apt/sources.list.d/caddy-stable.list
|
|
apt-get update -qq
|
|
apt-get install -y -qq caddy
|
|
mkdir -p /var/log/caddy
|
|
cp "$SELF_DIR/Caddyfile" /etc/caddy/Caddyfile
|
|
systemctl enable --now caddy
|
|
|
|
echo "== Firewall =="
|
|
ufw allow OpenSSH
|
|
ufw allow 80/tcp
|
|
ufw allow 443/tcp
|
|
ufw --force enable
|
|
|
|
echo "== Preparing app directory =="
|
|
APP_DIR=/opt/caterium-supabase
|
|
mkdir -p "$APP_DIR"
|
|
cp -r "$SELF_DIR"/* "$APP_DIR"/
|
|
mkdir -p "$APP_DIR/volumes/db/data" "$APP_DIR/volumes/storage"
|
|
|
|
if [ ! -f "$APP_DIR/.env" ]; then
|
|
cp "$APP_DIR/.env.example" "$APP_DIR/.env"
|
|
chmod 600 "$APP_DIR/.env"
|
|
echo ""
|
|
echo "!! $APP_DIR/.env created from template with PLACEHOLDER secrets."
|
|
echo "!! Edit it with real values (see README.md) BEFORE exposing this server publicly."
|
|
echo "!! Then run: cd $APP_DIR && docker compose up -d"
|
|
fi
|
|
|
|
echo ""
|
|
echo "== systemd unit for auto-restart on reboot/crash =="
|
|
cat > /etc/systemd/system/caterium-supabase.service <<'UNIT'
|
|
[Unit]
|
|
Description=Caterium self-hosted Supabase stack
|
|
Requires=docker.service
|
|
After=docker.service network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
WorkingDirectory=/opt/caterium-supabase
|
|
ExecStart=/usr/bin/docker compose up -d
|
|
ExecStop=/usr/bin/docker compose down
|
|
TimeoutStartSec=0
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
systemctl daemon-reload
|
|
systemctl enable caterium-supabase.service
|
|
|
|
echo ""
|
|
echo "Bootstrap complete. Next steps:"
|
|
echo "1. Edit $APP_DIR/.env with real secrets (openssl rand -base64 32 for each REPLACE_ME)."
|
|
echo "2. cd $APP_DIR && docker compose up -d"
|
|
echo "3. docker compose ps # confirm all services are healthy"
|
|
echo "4. Confirm DNS: api.caterium.ru A-record points at this server's IP (Caddy needs it for Let's Encrypt)."
|
|
echo "5. curl -I https://api.caterium.ru/rest/v1/ # should return 200/401, not a connection error"
|