128 lines
3.9 KiB
YAML
128 lines
3.9 KiB
YAML
#cloud-config
|
|
package_update: true
|
|
package_upgrade: false
|
|
|
|
write_files:
|
|
- path: /usr/local/sbin/install-bliishspace
|
|
owner: root:root
|
|
permissions: "0755"
|
|
content: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
apt-get update
|
|
apt-get install -y ca-certificates curl git sqlite3 build-essential python3 caddy gnupg
|
|
|
|
if ! command -v node >/dev/null 2>&1 || ! node --version | grep -q '^v__BLIISH_NODE_MAJOR__\.'; then
|
|
install -d -m 0755 /etc/apt/keyrings
|
|
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg
|
|
chmod 0644 /etc/apt/keyrings/nodesource.gpg
|
|
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node___BLIISH_NODE_MAJOR__.x nodistro main" >/etc/apt/sources.list.d/nodesource.list
|
|
apt-get update
|
|
apt-get install -y nodejs
|
|
fi
|
|
|
|
if ! command -v corepack >/dev/null 2>&1; then
|
|
npm install -g corepack
|
|
fi
|
|
|
|
corepack enable
|
|
|
|
if ! id -u bliish >/dev/null 2>&1; then
|
|
useradd --system --create-home --home-dir /var/lib/bliishspace --shell /usr/sbin/nologin bliish
|
|
fi
|
|
|
|
install -d -o bliish -g bliish /var/lib/bliishspace
|
|
install -d -o bliish -g bliish /var/lib/bliishspace/uploads
|
|
install -d -o root -g root /opt
|
|
|
|
if [ ! -d /opt/bliishspace/.git ]; then
|
|
rm -rf /opt/bliishspace
|
|
git clone "__BLIISH_REPOSITORY_URL__" /opt/bliishspace
|
|
fi
|
|
|
|
git -C /opt/bliishspace fetch --all --tags
|
|
git -C /opt/bliishspace checkout "__BLIISH_REPOSITORY_REF__"
|
|
chown -R root:root /opt/bliishspace
|
|
|
|
cat >/etc/bliishspace.env <<'ENV'
|
|
BLIISH_BASE_URL=__BLIISH_BASE_URL__
|
|
BLIISH_DATABASE_PATH=/var/lib/bliishspace/bliish.sqlite
|
|
BLIISH_UPLOAD_DIR=/var/lib/bliishspace/uploads
|
|
BLIISH_ADMIN_USER_ID=__BLIISH_ADMIN_USER_ID__
|
|
BLIISH_MEDIA_CONCURRENCY=__BLIISH_MEDIA_CONCURRENCY__
|
|
HOST=127.0.0.1
|
|
PORT=3000
|
|
ENV
|
|
|
|
chown root:bliish /etc/bliishspace.env
|
|
chmod 0640 /etc/bliishspace.env
|
|
|
|
cd /opt/bliishspace
|
|
PNPM_PACKAGE_MANAGER="$(node -p "require('./package.json').packageManager || 'pnpm@11.1.3'")"
|
|
corepack prepare "$PNPM_PACKAGE_MANAGER" --activate
|
|
pnpm install --frozen-lockfile
|
|
pnpm build
|
|
|
|
runuser -u bliish -- bash -lc 'set -a; . /etc/bliishspace.env; set +a; cd /opt/bliishspace; pnpm db:init'
|
|
|
|
cat >/etc/systemd/system/bliishspace.service <<'SERVICE'
|
|
[Unit]
|
|
Description=Bliish.space
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=bliish
|
|
Group=bliish
|
|
WorkingDirectory=/opt/bliishspace
|
|
EnvironmentFile=/etc/bliishspace.env
|
|
ExecStart=/usr/bin/node /opt/bliishspace/dist/index.js
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectHome=true
|
|
ProtectSystem=strict
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
SystemCallArchitectures=native
|
|
ReadWritePaths=/var/lib/bliishspace
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
SERVICE
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now bliishspace
|
|
|
|
cat >/etc/caddy/Caddyfile <<'CADDY'
|
|
{
|
|
email hi@bliish.com
|
|
}
|
|
|
|
__BLIISH_DOMAIN__ {
|
|
encode zstd gzip
|
|
reverse_proxy 127.0.0.1:3000
|
|
}
|
|
|
|
www.__BLIISH_DOMAIN__ {
|
|
redir https://__BLIISH_DOMAIN__{uri} permanent
|
|
}
|
|
CADDY
|
|
|
|
caddy validate --config /etc/caddy/Caddyfile
|
|
systemctl enable --now caddy
|
|
systemctl reload caddy
|
|
|
|
runcmd:
|
|
- [bash, /usr/local/sbin/install-bliishspace]
|
|
|
|
final_message: "Bliish.space cloud-init finished. Check systemctl status bliishspace and journalctl -u bliishspace."
|