zihluwang
8931598794
Split the monolithic init-caddy.sh into four ordered, idempotent setup scripts for the Caddy deployment environment: - install-base-deps: install required apt packages - install-aws-cli: bootstrap AWS CLI v2 - install-caddy: fetch binary, create caddy:caddy, register systemd unit - prepare-caddy-cicd: create bot deploy user + SSH, hand over web root with ACLs, write site Caddyfile and start the service - Make the web root overridable via WEB_ROOT (default /var/www)
107 lines
3.4 KiB
Bash
107 lines
3.4 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# Caddy CI/CD Serving Preparation for Debian/Ubuntu
|
|
# Prepares the server so a CI/CD pipeline can publish content that Caddy
|
|
# serves: creates the deployment user 'bot' with its SSH access, creates and
|
|
# hands over the web root to bot:caddy with ACLs that keep it readable by the
|
|
# Caddy server, writes the default site Caddyfile and sample page, then starts
|
|
# the Caddy service. The web root defaults to /var/www and can be overridden
|
|
# by exporting the WEB_ROOT environment variable before running.
|
|
#
|
|
|
|
set -euo pipefail
|
|
|
|
# Web root served by Caddy; override by exporting WEB_ROOT before running
|
|
WEB_ROOT="${WEB_ROOT:-/var/www}"
|
|
CADDY_CONF_DIR="/etc/caddy"
|
|
|
|
# Ensure script is executed with root privileges
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "Error: This script must be run as root." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f /etc/systemd/system/caddy.service ]; then
|
|
echo "Error: caddy.service not found. Run install-caddy.sh first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! getent group caddy >/dev/null 2>&1; then
|
|
echo "Error: group 'caddy' does not exist. Run install-caddy.sh first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> [1/5] Creating deployment user 'bot'..."
|
|
# Create deployment user 'bot'
|
|
if ! id -u bot >/dev/null 2>&1; then
|
|
useradd -m -s /bin/bash bot
|
|
fi
|
|
|
|
echo "==> [2/5] Configuring SSH directory for bot..."
|
|
# Configure SSH directory for bot
|
|
install -d -m 700 -o bot -g bot /home/bot/.ssh
|
|
touch /home/bot/.ssh/authorized_keys
|
|
chown bot:bot /home/bot/.ssh/authorized_keys
|
|
chmod 600 /home/bot/.ssh/authorized_keys
|
|
|
|
echo "==> [3/5] Creating web root and handing it to bot (${WEB_ROOT})..."
|
|
if [ ! -d "${WEB_ROOT}" ]; then
|
|
mkdir -p "${WEB_ROOT}"
|
|
|
|
cat <<EOF > "${WEB_ROOT}/index.html"
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>Caddy Ready</title>
|
|
</head>
|
|
<body>
|
|
<h1>Caddy server is running</h1>
|
|
<p>Static files root: <code>${WEB_ROOT}</code></p>
|
|
</body>
|
|
</html>
|
|
EOF
|
|
else
|
|
echo " '${WEB_ROOT}' already exists - leaving existing content untouched."
|
|
fi
|
|
|
|
# Set base ownership: bot (deployment) and caddy (web server group)
|
|
chown -R bot:caddy "${WEB_ROOT}"
|
|
|
|
# Directory base permissions (SGID ensures newly created items inherit group 'caddy')
|
|
find "${WEB_ROOT}" -type d -exec chmod 2755 {} +
|
|
find "${WEB_ROOT}" -type f -exec chmod 644 {} +
|
|
|
|
# Apply POSIX ACLs: bot has rwx, caddy has read/execute, with default inheritance
|
|
setfacl -R -m u:bot:rwx,u:caddy:rX "${WEB_ROOT}"
|
|
setfacl -R -d -m u:bot:rwx,u:caddy:rX "${WEB_ROOT}"
|
|
|
|
echo "==> [4/5] Writing site Caddyfile (${CADDY_CONF_DIR}/Caddyfile)..."
|
|
mkdir -p "${CADDY_CONF_DIR}"
|
|
chown root:caddy "${CADDY_CONF_DIR}"
|
|
chmod 755 "${CADDY_CONF_DIR}"
|
|
|
|
if [ ! -f "${CADDY_CONF_DIR}/Caddyfile" ]; then
|
|
cat <<EOF > "${CADDY_CONF_DIR}/Caddyfile"
|
|
:80 {
|
|
root * ${WEB_ROOT}
|
|
file_server
|
|
}
|
|
EOF
|
|
chown root:caddy "${CADDY_CONF_DIR}/Caddyfile"
|
|
chmod 644 "${CADDY_CONF_DIR}/Caddyfile"
|
|
else
|
|
echo " '${CADDY_CONF_DIR}/Caddyfile' already exists - leaving it untouched."
|
|
fi
|
|
|
|
echo "==> [5/5] Starting Caddy service..."
|
|
systemctl enable --now caddy
|
|
|
|
echo "========================================================="
|
|
echo " Caddy CI/CD preparation finished successfully!"
|
|
echo " - Deployment user: bot (SSH keys accepted in authorized_keys)"
|
|
echo " - Web Root: ${WEB_ROOT} (owned by bot:caddy, readable by caddy)"
|
|
echo " - Config: ${CADDY_CONF_DIR}/Caddyfile"
|
|
echo " - Status: $(systemctl is-active caddy)"
|
|
echo "========================================================="
|