feat: add install/uninstall scripts for non-Docker deployment
This commit is contained in:
datadunia
@@ -0,0 +1,222 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# NexusGuard Server Installer
|
||||
# Installs server-core, dashboard-ui, and configures systemd + nginx
|
||||
|
||||
# Defaults
|
||||
SERVER_PORT=8080
|
||||
WEB_PORT=80
|
||||
CONF_DIR="/etc/nexusguard"
|
||||
CONF_FILE="$CONF_DIR/nexusguard.conf"
|
||||
SERVICE_NAME="nexusguard-server"
|
||||
NGINX_CONF="/etc/nginx/conf.d/nexusguard.conf"
|
||||
DASHBOARD_DIR="/usr/share/nexusguard/dashboard"
|
||||
BINARY_DIR="/usr/local/bin"
|
||||
|
||||
# Colors
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
info() { echo -e "${GREEN}[INFO]${NC} $1"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
||||
error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }
|
||||
|
||||
usage() {
|
||||
cat << EOF
|
||||
NexusGuard Server Installer
|
||||
|
||||
Usage: $0 [OPTIONS]
|
||||
|
||||
Options:
|
||||
--server-port PORT API server port (default: 8080)
|
||||
--web-port PORT Nginx web port (default: 80)
|
||||
--help Show this help message
|
||||
|
||||
Prerequisites:
|
||||
- nginx installed and running
|
||||
- PostgreSQL installed and running
|
||||
- Redis installed and running
|
||||
- Pre-built binaries in ./bin/ directory
|
||||
|
||||
This script will:
|
||||
1. Copy server-core binary to /usr/local/bin/
|
||||
2. Copy dashboard dist to /usr/share/nexusguard/dashboard/
|
||||
3. Create /etc/nexusguard/nexusguard.conf
|
||||
4. Create systemd service
|
||||
5. Configure nginx
|
||||
EOF
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Parse arguments
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--server-port) SERVER_PORT="$2"; shift ;;
|
||||
--web-port) WEB_PORT="$2"; shift ;;
|
||||
--help) usage ;;
|
||||
*) error "Unknown parameter: $1" ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# Check root
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
error "Please run as root"
|
||||
fi
|
||||
|
||||
# Check dependencies
|
||||
command -v nginx >/dev/null 2>&1 || error "nginx is not installed"
|
||||
command -v systemctl >/dev/null 2>&1 || error "systemctl is not installed"
|
||||
|
||||
# Check for pre-built binaries
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
SERVER_BINARY="$SCRIPT_DIR/bin/server-core"
|
||||
DASHBOARD_DIST="$SCRIPT_DIR/apps/dashboard-ui/dist"
|
||||
|
||||
if [ ! -f "$SERVER_BINARY" ]; then
|
||||
error "Server binary not found at $SERVER_BINARY. Build first: cd apps/server-core && go build -o ../../bin/server-core ."
|
||||
fi
|
||||
|
||||
if [ ! -d "$DASHBOARD_DIST" ]; then
|
||||
error "Dashboard dist not found at $DASHBOARD_DIST. Build first: cd apps/dashboard-ui && npm run build"
|
||||
fi
|
||||
|
||||
info "Installing NexusGuard Server..."
|
||||
|
||||
# Create directories
|
||||
info "Creating directories..."
|
||||
mkdir -p "$CONF_DIR"
|
||||
mkdir -p "$DASHBOARD_DIR"
|
||||
mkdir -p "$BINARY_DIR"
|
||||
|
||||
# Copy server binary
|
||||
info "Installing server-core binary..."
|
||||
cp "$SERVER_BINARY" "$BINARY_DIR/$SERVICE_NAME"
|
||||
chmod +x "$BINARY_DIR/$SERVICE_NAME"
|
||||
|
||||
# Copy dashboard dist
|
||||
info "Installing dashboard files..."
|
||||
cp -r "$DASHBOARD_DIST"/* "$DASHBOARD_DIR/"
|
||||
|
||||
# Create config file (only if not exists)
|
||||
if [ ! -f "$CONF_FILE" ]; then
|
||||
info "Creating config file..."
|
||||
cat << EOF > "$CONF_FILE"
|
||||
# NexusGuard Configuration
|
||||
# This file is sourced by the server-core and nginx
|
||||
|
||||
# Database
|
||||
export DB_HOST=127.0.0.1
|
||||
export DB_PORT=5432
|
||||
export DB_USER=nexusguard
|
||||
export DB_PASSWORD=nexusguard
|
||||
export DB_NAME=nexusguard
|
||||
|
||||
# Redis
|
||||
export REDIS_ADDR=127.0.0.1:6379
|
||||
|
||||
# Security (CHANGE THESE!)
|
||||
export JWT_SECRET=change-me-to-a-random-string
|
||||
export SERVER_SALT=change-me-to-another-random-string
|
||||
|
||||
# Network
|
||||
export NFTABLES_TABLE=nexusguard
|
||||
export IPAM_POOL=10.8.0.0/16
|
||||
|
||||
# Server
|
||||
export GIN_MODE=release
|
||||
export PORT=$SERVER_PORT
|
||||
|
||||
# Dashboard
|
||||
export API_BASE_URL=http://localhost:$SERVER_PORT/api/v1
|
||||
export WEB_PORT=$WEB_PORT
|
||||
EOF
|
||||
chmod 600 "$CONF_FILE"
|
||||
warn "Config file created at $CONF_FILE"
|
||||
warn "IMPORTANT: Edit $CONF_FILE and set JWT_SECRET and SERVER_SALT!"
|
||||
else
|
||||
info "Config file already exists, skipping..."
|
||||
fi
|
||||
|
||||
# Create systemd service
|
||||
info "Creating systemd service..."
|
||||
cat << EOF > "/etc/systemd/system/$SERVICE_NAME.service"
|
||||
[Unit]
|
||||
Description=NexusGuard SD-WAN Server
|
||||
After=network.target postgresql.service redis.service
|
||||
Wants=postgresql.service redis.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
WorkingDirectory=$BINARY_DIR
|
||||
EnvironmentFile=$CONF_FILE
|
||||
ExecStart=$BINARY_DIR/$SERVICE_NAME
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
# Security hardening
|
||||
NoNewPrivileges=false
|
||||
ProtectSystem=false
|
||||
ProtectHome=false
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
# Create nginx config
|
||||
info "Creating nginx configuration..."
|
||||
cat << EOF > "$NGINX_CONF"
|
||||
server {
|
||||
listen $WEB_PORT;
|
||||
listen [::]:$WEB_PORT;
|
||||
server_name localhost;
|
||||
|
||||
# Inject window.__CONFIG__ into HTML responses
|
||||
sub_filter '</head>' '<script>window.__CONFIG__ = { apiBaseUrl: "http://localhost:$SERVER_PORT/api/v1" };</script></head>';
|
||||
sub_filter_once on;
|
||||
sub_filter_types text/html;
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://127.0.0.1:$SERVER_PORT;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
|
||||
location / {
|
||||
root $DASHBOARD_DIR;
|
||||
try_files \$uri \$uri/ /index.html;
|
||||
}
|
||||
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root $DASHBOARD_DIR;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Enable and start service
|
||||
info "Enabling and starting service..."
|
||||
systemctl daemon-reload
|
||||
systemctl enable "$SERVICE_NAME"
|
||||
systemctl start "$SERVICE_NAME"
|
||||
|
||||
# Reload nginx
|
||||
info "Reloading nginx..."
|
||||
nginx -t && systemctl reload nginx
|
||||
|
||||
info "Installation complete!"
|
||||
echo ""
|
||||
info "Access URL: http://localhost:$WEB_PORT"
|
||||
info "Config file: $CONF_FILE"
|
||||
info "Service status: systemctl status $SERVICE_NAME"
|
||||
echo ""
|
||||
warn "IMPORTANT: Edit $CONF_FILE to set secure JWT_SECRET and SERVER_SALT values!"
|
||||
warn "Then restart the service: systemctl restart $SERVICE_NAME"
|
||||
Reference in New Issue
Block a user