initial commit
This commit is contained in:
Executable
+284
@@ -0,0 +1,284 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Server Setup Script for Bike Service Application
|
||||
# Run this script on your Ubuntu server after initial setup
|
||||
|
||||
set -e
|
||||
|
||||
echo "🚀 Setting up Ubuntu server for Bike Service Application..."
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
print_status() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
print_warning() {
|
||||
echo -e "${YELLOW}[WARNING]${NC} $1"
|
||||
}
|
||||
|
||||
print_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
# Check if running as root
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
print_error "This script must be run as root (use sudo)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check Ubuntu version
|
||||
UBUNTU_VERSION=$(lsb_release -rs)
|
||||
if [[ "$UBUNTU_VERSION" != "20.04" && "$UBUNTU_VERSION" != "22.04" && "$UBUNTU_VERSION" != "24.04" ]]; then
|
||||
print_warning "This script is tested on Ubuntu 20.04, 22.04, and 24.04. You're running $UBUNTU_VERSION"
|
||||
fi
|
||||
|
||||
print_status "Starting server setup..."
|
||||
|
||||
# Update system
|
||||
print_status "Updating system packages..."
|
||||
apt update && apt upgrade -y
|
||||
|
||||
# Install required software
|
||||
print_status "Installing required software..."
|
||||
|
||||
# Install Nginx
|
||||
apt install nginx -y
|
||||
|
||||
# Install PHP 8.2 and extensions
|
||||
apt install software-properties-common -y
|
||||
add-apt-repository ppa:ondrej/php -y
|
||||
apt update
|
||||
apt install php8.2-fpm php8.2-mysql php8.2-sqlite3 php8.2-xml php8.2-mbstring php8.2-curl php8.2-zip php8.2-gd php8.2-cli php8.2-common php8.2-bcmath php8.2-json php8.2-tokenizer php8.2-fileinfo php8.2-opcache -y
|
||||
|
||||
# Install Composer
|
||||
print_status "Installing Composer..."
|
||||
curl -sS https://getcomposer.org/installer | php
|
||||
mv composer.phar /usr/local/bin/composer
|
||||
chmod +x /usr/local/bin/composer
|
||||
|
||||
# Install Node.js and npm
|
||||
print_status "Installing Node.js..."
|
||||
curl -fsSL https://deb.nodesource.com/setup_18.x | bash -
|
||||
apt-get install -y nodejs
|
||||
|
||||
# Install Git
|
||||
apt install git -y
|
||||
|
||||
# Install SQLite
|
||||
apt install sqlite3 -y
|
||||
|
||||
# Install additional tools
|
||||
apt install unzip curl wget htop ufw fail2ban -y
|
||||
|
||||
# Configure PHP-FPM
|
||||
print_status "Configuring PHP-FPM..."
|
||||
PHP_INI="/etc/php/8.2/fpm/php.ini"
|
||||
PHP_FPM_INI="/etc/php/8.2/fpm/php.ini"
|
||||
|
||||
# Backup original files
|
||||
cp $PHP_INI $PHP_INI.backup
|
||||
cp $PHP_FPM_INI $PHP_FPM_INI.backup
|
||||
|
||||
# Update PHP configuration
|
||||
sed -i 's/memory_limit = .*/memory_limit = 256M/' $PHP_INI
|
||||
sed -i 's/upload_max_filesize = .*/upload_max_filesize = 64M/' $PHP_INI
|
||||
sed -i 's/post_max_size = .*/post_max_size = 64M/' $PHP_INI
|
||||
sed -i 's/max_execution_time = .*/max_execution_time = 300/' $PHP_INI
|
||||
sed -i 's/;opcache.enable=.*/opcache.enable=1/' $PHP_INI
|
||||
sed -i 's/;opcache.memory_consumption=.*/opcache.memory_consumption=128/' $PHP_INI
|
||||
sed -i 's/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=4000/' $PHP_INI
|
||||
|
||||
# Enable OPcache
|
||||
echo "opcache.enable=1" >> $PHP_INI
|
||||
echo "opcache.memory_consumption=128" >> $PHP_INI
|
||||
echo "opcache.max_accelerated_files=4000" >> $PHP_INI
|
||||
|
||||
# Restart PHP-FPM
|
||||
systemctl restart php8.2-fpm
|
||||
systemctl enable php8.2-fpm
|
||||
|
||||
# Configure Nginx
|
||||
print_status "Configuring Nginx..."
|
||||
|
||||
# Create application directory
|
||||
mkdir -p /var/www/bikeservice
|
||||
chown -R www-data:www-data /var/www/bikeservice
|
||||
|
||||
# Create Nginx site configuration
|
||||
cat > /etc/nginx/sites-available/bikeservice << 'EOF'
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
root /var/www/bikeservice/backend/public;
|
||||
index index.php index.html index.htm;
|
||||
|
||||
# Security headers
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||
|
||||
# Gzip compression
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 1024;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_types
|
||||
text/plain
|
||||
text/css
|
||||
text/xml
|
||||
text/javascript
|
||||
application/json
|
||||
application/javascript
|
||||
application/xml+rss
|
||||
application/atom+xml
|
||||
image/svg+xml;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php?$query_string;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
|
||||
include fastcgi_params;
|
||||
|
||||
fastcgi_buffer_size 128k;
|
||||
fastcgi_buffers 4 256k;
|
||||
fastcgi_busy_buffers_size 256k;
|
||||
fastcgi_read_timeout 300;
|
||||
}
|
||||
|
||||
location ~ /\.(?!well-known).* {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
client_max_body_size 64M;
|
||||
}
|
||||
EOF
|
||||
|
||||
# Enable site
|
||||
ln -sf /etc/nginx/sites-available/bikeservice /etc/nginx/sites-enabled/
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Test Nginx configuration
|
||||
nginx -t
|
||||
|
||||
# Restart Nginx
|
||||
systemctl restart nginx
|
||||
systemctl enable nginx
|
||||
|
||||
# Configure firewall
|
||||
print_status "Configuring firewall..."
|
||||
ufw --force enable
|
||||
ufw allow ssh
|
||||
ufw allow 'Nginx Full'
|
||||
ufw allow 80
|
||||
ufw allow 443
|
||||
|
||||
# Configure fail2ban
|
||||
print_status "Configuring fail2ban..."
|
||||
systemctl enable fail2ban
|
||||
systemctl start fail2ban
|
||||
|
||||
# Create systemd service for queue worker
|
||||
print_status "Creating queue worker service..."
|
||||
cat > /etc/systemd/system/bikeservice-queue.service << 'EOF'
|
||||
[Unit]
|
||||
Description=Bike Service Queue Worker
|
||||
After=network.target
|
||||
Wants=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=www-data
|
||||
Group=www-data
|
||||
WorkingDirectory=/var/www/bikeservice/backend
|
||||
ExecStart=/usr/bin/php artisan queue:work --sleep=3 --tries=3 --max-time=3600 --memory=512
|
||||
ExecReload=/bin/kill -USR1 $MAINPID
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=bikeservice-queue
|
||||
|
||||
Environment=APP_ENV=production
|
||||
Environment=APP_DEBUG=false
|
||||
|
||||
LimitNOFILE=65536
|
||||
LimitNPROC=32768
|
||||
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
ProtectSystem=strict
|
||||
ReadWritePaths=/var/www/bikeservice/backend/storage
|
||||
ProtectHome=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
# Reload systemd and enable queue service
|
||||
systemctl daemon-reload
|
||||
systemctl enable bikeservice-queue
|
||||
|
||||
# Set up cron for Laravel scheduler
|
||||
print_status "Setting up Laravel scheduler..."
|
||||
(crontab -l 2>/dev/null; echo "* * * * * cd /var/www/bikeservice/backend && php artisan schedule:run >> /dev/null 2>&1") | crontab -
|
||||
|
||||
# Create deployment user
|
||||
print_status "Creating deployment user..."
|
||||
useradd -m -s /bin/bash deploy
|
||||
usermod -aG sudo deploy
|
||||
echo "deploy:$(openssl rand -base64 32)" | chpasswd
|
||||
|
||||
# Set up SSH key authentication for deploy user
|
||||
mkdir -p /home/deploy/.ssh
|
||||
chmod 700 /home/deploy/.ssh
|
||||
touch /home/deploy/.ssh/authorized_keys
|
||||
chmod 600 /home/deploy/.ssh/authorized_keys
|
||||
chown -R deploy:deploy /home/deploy/.ssh
|
||||
|
||||
print_warning "Please add your SSH public key to /home/deploy/.ssh/authorized_keys"
|
||||
print_warning "You can do this by running: ssh-copy-id deploy@your-server-ip"
|
||||
|
||||
# Set proper permissions for application directory
|
||||
chown -R deploy:www-data /var/www/bikeservice
|
||||
chmod -R 775 /var/www/bikeservice
|
||||
|
||||
# Create log files
|
||||
touch /var/log/nginx/bikeservice_access.log
|
||||
touch /var/log/nginx/bikeservice_error.log
|
||||
chown www-data:adm /var/log/nginx/bikeservice_*.log
|
||||
|
||||
print_status "Server setup completed!"
|
||||
echo
|
||||
echo "Next steps:"
|
||||
echo "1. Add your SSH public key to the deploy user:"
|
||||
echo " ssh-copy-id deploy@your-server-ip"
|
||||
echo "2. Upload your application files to /var/www/bikeservice"
|
||||
echo "3. Configure your .env file"
|
||||
echo "4. Run the deployment script"
|
||||
echo
|
||||
echo "Useful commands:"
|
||||
echo "- Check service status: systemctl status nginx php8.2-fpm bikeservice-queue"
|
||||
echo "- View logs: journalctl -u bikeservice-queue -f"
|
||||
echo "- Check Nginx logs: tail -f /var/log/nginx/bikeservice_error.log"
|
||||
echo
|
||||
echo "Security notes:"
|
||||
echo "- SSH key authentication is required for deploy user"
|
||||
echo "- Firewall is enabled (SSH and HTTP/HTTPS only)"
|
||||
echo "- fail2ban is configured to protect against brute force attacks"
|
||||
|
||||
Reference in New Issue
Block a user