From cda9820ca074dccea4f25799d6edb47775d3e45b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=97=D1=91=D0=BC=D0=B0?= <zema@4i-tech.ru>
Date: Mon, 7 Sep 2026 09:07:50 +0000
Subject: [PATCH] =?UTF-8?q?bootstrap:=20VNC=20one-liner=20+=20=D0=BA=D0=BB?=
 =?UTF-8?q?=D1=8E=D1=87=20=D0=97=D1=91=D0=BC=D1=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 vnc-one.sh       | 132 +++++++++++++++++++++++++++++++++++++++++++++++
 zema_ed25519.pub |   1 +
 2 files changed, 133 insertions(+)
 create mode 100644 vnc-one.sh
 create mode 100644 zema_ed25519.pub

diff --git a/vnc-one.sh b/vnc-one.sh
new file mode 100644
index 0000000..8690969
--- /dev/null
+++ b/vnc-one.sh
@@ -0,0 +1,132 @@
+#!/bin/bash
+# ============================================================
+#  ZEMA BOOTSTRAP for vps-6 (one-liner via VNC, root)
+#  Что делает: 1) SSH-ключ Зёмы  2) PostgreSQL+n8n (docker)
+#              3) nginx vhost + TLS  4) отчёт
+#  Идемпотентен: повторный запуск ничего не ломает.
+# ============================================================
+set -u
+exec 2>&1
+
+echo "=== [1/4] SSH-ключ Зёмы ==="
+mkdir -p /root/.ssh && chmod 700 /root/.ssh && touch /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
+PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcGXJL16eHdI2HhmCiCdc7PYJaCYQmVVodwZwHCM2Pt zema@phoenix-sandbox-0709'
+if grep -qxF "$PUB" /root/.ssh/authorized_keys; then
+  echo "  ключ уже на месте"
+else
+  echo "$PUB" >> /root/.ssh/authorized_keys && echo "  ключ ДОБАВЛЕН"
+fi
+
+echo "=== [2/4] Стек: PostgreSQL + n8n (/opt/stack) ==="
+mkdir -p /opt/stack && cd /opt/stack
+if [ ! -f .env ]; then
+  PG_PW=$(head -c 24 /dev/urandom | base64 | tr -d '/+=' | head -c 28)
+  N8N_KEY=$(head -c 30 /dev/urandom | base64 | tr -d '/+=' | head -c 40)
+  umask 177
+  cat > .env <<EOF
+POSTGRES_PASSWORD=${PG_PW}
+N8N_ENCRYPTION_KEY=${N8N_KEY}
+EOF
+  umask 022
+  echo "  .env сгенерирован (600)"
+fi
+. /opt/stack/.env
+
+if [ ! -f docker-compose.yml ]; then
+cat > docker-compose.yml <<EOF
+services:
+  postgres:
+    image: postgres:16
+    container_name: stack-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: n8n
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
+      POSTGRES_DB: n8n
+    ports:
+      - "127.0.0.1:5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U n8n"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  n8n:
+    image: docker.n8n.io/n8nio/n8n
+    container_name: stack-n8n
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      - DB_TYPE=postgresdb
+      - DB_POSTGRESDB_HOST=postgres
+      - DB_POSTGRESDB_PORT=5432
+      - DB_POSTGRESDB_DATABASE=n8n
+      - DB_POSTGRESDB_USER=n8n
+      - DB_POSTGRESDB_PASSWORD=\${POSTGRES_PASSWORD}
+      - N8N_ENCRYPTION_KEY=\${N8N_ENCRYPTION_KEY}
+      - N8N_HOST=n8n.4i-tech.ru
+      - N8N_PROTOCOL=https
+      - N8N_PORT=5678
+      - WEBHOOK_URL=https://n8n.4i-tech.ru/
+      - N8N_DIAGNOSTICS_ENABLED=false
+      - GENERIC_TIMEZONE=Europe/Moscow
+    ports:
+      - "127.0.0.1:5678:5678"
+    volumes:
+      - n8ndata:/home/node/.n8n
+
+volumes:
+  pgdata:
+  n8ndata:
+EOF
+  echo "  docker-compose.yml записан"
+fi
+
+if docker compose version >/dev/null 2>&1; then DC="docker compose"; else DC="docker-compose"; fi
+echo "  поднимаю стек ($DC)..."
+$DC up -d
+$DC ps
+
+echo "=== [3/4] nginx + TLS: n8n.4i-tech.ru ==="
+if [ ! -f /etc/nginx/sites-available/n8n.4i-tech.ru ]; then
+cat > /etc/nginx/sites-available/n8n.4i-tech.ru <<'EOF'
+server {
+    listen 80;
+    server_name n8n.4i-tech.ru;
+    location / {
+        proxy_pass http://127.0.0.1:5678;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        client_max_body_size 32m;
+    }
+}
+EOF
+  ln -sf /etc/nginx/sites-available/n8n.4i-tech.ru /etc/nginx/sites-enabled/n8n.4i-tech.ru
+  echo "  vhost записан"
+fi
+nginx -t 2>&1 | tail -1 && systemctl reload nginx && echo "  nginx перезагружен"
+
+if [ ! -f /etc/letsencrypt/live/n8n.4i-tech.ru/fullchain.pem ]; then
+  echo "  запрашиваю TLS-сертификат..."
+  certbot --nginx -d n8n.4i-tech.ru -m ataman@4i-tech.ru --agree-tos --non-interactive --redirect 2>&1 | tail -3 || echo "  !! certbot не прошёл (DNS/лимит) — HTTP-vhost жив, повтори позже"
+else
+  echo "  серт уже есть"
+fi
+
+echo "=== [4/4] Отчёт ==="
+sleep 5
+echo "--- контейнеры:"
+docker ps --filter name=stack- --format "{{.Names}}: {{.Status}}"
+echo "--- n8n локально:"
+curl -s -o /dev/null -w "  http://127.0.0.1:5678 -> %{http_code}\n" --max-time 8 http://127.0.0.1:5678/ || echo "  n8n ещё поднимается"
+echo "--- снаружи:"
+curl -s -o /dev/null -w "  https://n8n.4i-tech.ru -> %{http_code}\n" --max-time 8 https://n8n.4i-tech.ru/ 2>/dev/null || echo "  (DNS/TLS ещё не готов — Зёма доведёт)"
+echo "=== BOOTSTRAP ЗАВЕРШЁН. Зёма, заходи. ==="
diff --git a/zema_ed25519.pub b/zema_ed25519.pub
new file mode 100644
index 0000000..4b1a0e0
--- /dev/null
+++ b/zema_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcGXJL16eHdI2HhmCiCdc7PYJaCYQmVVodwZwHCM2Pt zema@phoenix-sandbox-0709
\ No newline at end of file