docker-compose/authentik
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add init.sh option to deploy production or test; add test compose file

Browse source
This commit is contained in:
Philip Henning 2025-01-28 20:04:49 +01:00
parent 854da26eaa
commit 22e4ddcb46
2 changed files with 216 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

65
scripts/init.sh
View file

@ -30,6 +30,24 @@ trap 'printf "\nOperation aborted by user.\n" >&2; exit 1' SIGINT
cd "$(dirname "$(realpath "$0")")/../"
AUTHENTIK_DOCKER_COMPOSE_PATH="$(realpath "$(pwd)")"
# Ask if initialized for production or test
while true; do
read -p "Do you want to init a [P]roduction or [T]est environment? (P/T): " DEPLOYMENT_ENVIRONMENT
case "$DEPLOYMENT_ENVIRONMENT" in
[Pp]* )
DEPLOYMENT_ENVIRONMENT="PRODUCTION"
break
;;
[Tt]* )
DEPLOYMENT_ENVIRONMENT="TEST"
break
;;
* )
echo "Please answer with P or T."
;;
esac
done
# Check if .env exists and exit if it is
if [[ ! -f ./.env ]]; then
cat ./env.template >> ./.env
@ -43,7 +61,7 @@ if [[ ! -f ./.env ]]; then
fi
# Check if lego.env exists and exit if it is
if [[ ! -f ./lego.env ]]; then
if [[ ! -f ./lego.env && "${DEPLOYMENT_ENVIRONMENT}" == "PRODUCTION" ]]; then
echo "# Lego - Let's Encrypt certificate tool" >> ./lego.env
prompt_password HETZNER_API_KEY; echo "HETZNER_API_KEY=${RETURNED_PASSWORD}" >> ./lego.env; unset RETURNED_PASSWORD
echo "" >> ./.env
@ -54,29 +72,31 @@ fi
[[ ! -f ./data/restic/ssh/id_ed25519 ]] && ssh-keygen -t ed25519 -C "sso.base23.de" -f ./data/restic/ssh/id_ed25519
# Generate dhparam, if not existing
[[ ! -d ./data/nginx/certs ]] && mkdir -p ./data/nginx/certs && chmod 700 ./data/nginx/certs && chown 101:101 ./data/nginx/certs || true
[[ ! -f ./data/nginx/dhparams.pem ]] && echo "" && openssl dhparam -out ./data/nginx/dhparams.pem 4096 && chown 101:101 ./data/nginx/dhparams.pem \
&& echo "" && echo "Checking generated dhparams" && openssl dhparam -check -in ./data/nginx/dhparams.pem || true
if [[ "${DEPLOYMENT_ENVIRONMENT}" == "PRODUCTION" ]]; then
[[ ! -d ./data/nginx/certs ]] && mkdir -p ./data/nginx/certs && chmod 700 ./data/nginx/certs && chown 101:101 ./data/nginx/certs || true
[[ ! -f ./data/nginx/dhparams.pem ]] && echo "" && openssl dhparam -out ./data/nginx/dhparams.pem 4096 && chown 101:101 ./data/nginx/dhparams.pem \
&& echo "" && echo "Checking generated dhparams" && openssl dhparam -check -in ./data/nginx/dhparams.pem || true
# Create certificate
if [[ ! -d ./data/.lego ]]; then
echo ""
echo "Create certificate"
lego \
--path ./data/.lego \
--accept-tos \
--email="acme@base23.de" \
--domains="*.base23.de" \
--dns hetzner \
run \
&& install -m 400 -o 101 -g 101 "./data/.lego/certificates"/{_.base23.de.crt,_.base23.de.issuer.crt,_.base23.de.key} "./data/nginx/certs"
fi
# Setup directory for acme cheallenges
[[ ! -d ./data/nginx/acme ]] && mkdir -p ./data/nginx/acme
# Create certificate
if [[ ! -d ./data/.lego ]]; then
echo ""
echo "Create certificate"
lego \
--path ./data/.lego \
--accept-tos \
--email="acme@base23.de" \
--domains="*.base23.de" \
--dns hetzner \
run \
&& install -m 400 -o 101 -g 101 "./data/.lego/certificates"/{_.base23.de.crt,_.base23.de.issuer.crt,_.base23.de.key} "./data/nginx/certs"
fi
# Setup cronjob to automatically renew certificates
[[ ! -f /etc/systemd/system/lego-renew-wildcard-base23-de.service ]] && cat <<EOF > /etc/systemd/system/lego-renew-wildcard-base23-de.service && systemctl daemon-reload
# Setup directory for acme cheallenges
[[ ! -d ./data/nginx/acme ]] && mkdir -p ./data/nginx/acme
# Setup cronjob to automatically renew certificates
[[ ! -f /etc/systemd/system/lego-renew-wildcard-base23-de.service ]] && cat <<EOF > /etc/systemd/system/lego-renew-wildcard-base23-de.service && systemctl daemon-reload
[Unit]
Description=SSL Certificate renewal for *.base23.de with LEGO
Documentation=https://go-acme.github.io/lego/
@ -96,7 +116,7 @@ RemainAfterExit=no
WantedBy=multi-user.target
EOF
[[ ! -f /etc/systemd/system/lego-renew-wildcard-base23-de.timer ]] && cat <<EOF > /etc/systemd/system/lego-renew-wildcard-base23-de.timer && systemctl daemon-reload && systemctl enable --now lego-renew-wildcard-base23-de.timer
[[ ! -f /etc/systemd/system/lego-renew-wildcard-base23-de.timer ]] && cat <<EOF > /etc/systemd/system/lego-renew-wildcard-base23-de.timer && systemctl daemon-reload && systemctl enable --now lego-renew-wildcard-base23-de.timer
[Unit]
Description=SSL Certificate renewal for *.base23.de with LEGO Timer
@ -109,3 +129,4 @@ Persistent=true
[Install]
WantedBy=timers.target
EOF
fi