chore: docs, plans archive, script updates, submodule refs

nexusguard-install.sh

@@ -7,6 +7,11 @@ set -e
 # Defaults
 SERVER_PORT=8080
 WEB_PORT=80
+DB_HOST=127.0.0.1
+DB_PORT=5432
+DB_USER=nexusguard
+DB_PASSWORD=nexusguard
+DB_NAME=nexusguard
 CONF_DIR="/etc/nexusguard"
 CONF_FILE="$CONF_DIR/nexusguard.conf"
 SERVICE_NAME="nexusguard-server"
@@ -33,6 +38,11 @@ Usage: $0 [OPTIONS]
 Options:
     --server-port PORT    API server port (default: 8080)
     --web-port PORT       Nginx web port (default: 80)
+    --db-host HOST        PostgreSQL host (default: 127.0.0.1)
+    --db-port PORT        PostgreSQL port (default: 5432)
+    --db-user USER        PostgreSQL user (default: nexusguard)
+    --db-pass PASS        PostgreSQL password (default: nexusguard)
+    --db-name NAME        PostgreSQL database name (default: nexusguard)
     --help                Show this help message
 
 Prerequisites:
@@ -42,11 +52,13 @@ Prerequisites:
     - Pre-built binaries in ./bin/ directory
 
 This script will:
-    1. Copy server-core binary to /usr/local/bin/
-    2. Copy dashboard dist to /usr/share/nexusguard/dashboard/
-    3. Create /etc/nexusguard/nexusguard.conf
-    4. Create systemd service
-    5. Configure nginx
+    1. Create PostgreSQL database and user
+    2. Copy server-core binary to /usr/local/bin/
+    3. Copy dashboard dist to /usr/share/nexusguard/dashboard/
+    4. Create /etc/nexusguard/nexusguard.conf
+    5. Run database migration
+    6. Create systemd service
+    7. Configure nginx
 EOF
     exit 0
 }
@@ -56,6 +68,11 @@ while [[ "$#" -gt 0 ]]; do
     case $1 in
         --server-port) SERVER_PORT="$2"; shift ;;
         --web-port) WEB_PORT="$2"; shift ;;
+        --db-host) DB_HOST="$2"; shift ;;
+        --db-port) DB_PORT="$2"; shift ;;
+        --db-user) DB_USER="$2"; shift ;;
+        --db-pass) DB_PASSWORD="$2"; shift ;;
+        --db-name) DB_NAME="$2"; shift ;;
         --help) usage ;;
         *) error "Unknown parameter: $1" ;;
     esac
@@ -70,6 +87,8 @@ fi
 # Check dependencies
 command -v nginx >/dev/null 2>&1 || error "nginx is not installed"
 command -v systemctl >/dev/null 2>&1 || error "systemctl is not installed"
+command -v psql >/dev/null 2>&1 || error "PostgreSQL client (psql) is not installed"
+command -v redis-cli >/dev/null 2>&1 || error "Redis client (redis-cli) is not installed"
 
 # Check for pre-built binaries
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -84,6 +103,22 @@ if [ ! -d "$DASHBOARD_DIST" ]; then
     error "Dashboard dist not found at $DASHBOARD_DIST. Build first: cd apps/dashboard-ui && npm run build"
 fi
 
+# Check PostgreSQL connection
+if ! psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d postgres -c "SELECT 1" >/dev/null 2>&1; then
+    warn "Cannot connect to PostgreSQL with current credentials. Trying with postgres user..."
+    if ! psql -h "$DB_HOST" -p "$DB_PORT" -U postgres -d postgres -c "SELECT 1" >/dev/null 2>&1; then
+        error "Cannot connect to PostgreSQL. Please ensure PostgreSQL is running and accessible."
+    fi
+    PG_SUPERUSER="postgres"
+else
+    PG_SUPERUSER="$DB_USER"
+fi
+
+# Check Redis connection
+if ! redis-cli -h "${DB_HOST}" -p 6379 ping >/dev/null 2>&1; then
+    error "Cannot connect to Redis. Please ensure Redis is running."
+fi
+
 info "Installing NexusGuard Server..."
 
 # Create directories
@@ -92,6 +127,20 @@ mkdir -p "$CONF_DIR"
 mkdir -p "$DASHBOARD_DIR"
 mkdir -p "$BINARY_DIR"
 
+# Setup PostgreSQL database
+info "Setting up PostgreSQL database..."
+DB_EXISTS=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$PG_SUPERUSER" -d postgres -tAc "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'" 2>/dev/null || echo "")
+if [ "$DB_EXISTS" != "1" ]; then
+    info "Creating database user: $DB_USER"
+    psql -h "$DB_HOST" -p "$DB_PORT" -U "$PG_SUPERUSER" -d postgres -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASSWORD';" >/dev/null 2>&1 || warn "User $DB_USER may already exist"
+fi
+
+DB_EXISTS=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$PG_SUPERUSER" -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'" 2>/dev/null || echo "")
+if [ "$DB_EXISTS" != "1" ]; then
+    info "Creating database: $DB_NAME"
+    psql -h "$DB_HOST" -p "$DB_PORT" -U "$PG_SUPERUSER" -d postgres -c "CREATE DATABASE $DB_NAME OWNER $DB_USER;" >/dev/null 2>&1 || warn "Database $DB_NAME may already exist"
+fi
+
 # Copy server binary
 info "Installing server-core binary..."
 cp "$SERVER_BINARY" "$BINARY_DIR/$SERVICE_NAME"
@@ -113,11 +162,11 @@ if [ ! -f "$CONF_FILE" ]; then
 # Generated by install.sh on $(date)
 
 # Database
-DB_HOST=127.0.0.1
-DB_PORT=5432
-DB_USER=nexusguard
-DB_PASSWORD=nexusguard
-DB_NAME=nexusguard
+DB_HOST=$DB_HOST
+DB_PORT=$DB_PORT
+DB_USER=$DB_USER
+DB_PASSWORD=$DB_PASSWORD
+DB_NAME=$DB_NAME
 
 # Redis
 REDIS_ADDR=127.0.0.1:6379
@@ -144,6 +193,13 @@ else
     info "Config file already exists, skipping..."
 fi
 
+# Run database migration
+info "Running database migration..."
+set +e
+"$BINARY_DIR/$SERVICE_NAME" -migrate-prod 2>&1 | tail -5
+set -e
+info "Database migration completed."
+
 # Create systemd service
 info "Creating systemd service..."
 cat << EOF > "/etc/systemd/system/$SERVICE_NAME.service"
@@ -180,8 +236,8 @@ server {
     listen  [::]:$WEB_PORT;
     server_name  localhost;
 
-    # Inject window.__CONFIG__ into HTML responses
-    sub_filter '</head>' '<script>window.__CONFIG__ = { apiBaseUrl: "http://localhost:$SERVER_PORT/api/v1" };</script></head>';
+    # Inject runtime config into HTML responses
+    sub_filter '</head>' '<script>window.__CONFIG__ = { apiBaseUrl: "/api/v1" };</script></head>';
     sub_filter_once on;
     sub_filter_types text/html;
 
@@ -223,3 +279,5 @@ info "Service status: systemctl status $SERVICE_NAME"
 echo ""
 info "Secrets were auto-generated. Edit $CONF_FILE to customize if needed."
 info "Restart after changes: systemctl restart $SERVICE_NAME"
+echo ""
+info "To create admin user: $BINARY_DIR/$SERVICE_NAME -create-admin -user admin -pass 'YourPassword!'"