133 lines
4.5 KiB
Bash
133 lines
4.5 KiB
Bash
#!/bin/bash
|
|
# ============================================================
|
|
# ZEMA BOOTSTRAP for vps-6 (one-liner via VNC, root)
|
|
# Что делает: 1) SSH-ключ Зёмы 2) PostgreSQL+n8n (docker)
|
|
# 3) nginx vhost + TLS 4) отчёт
|
|
# Идемпотентен: повторный запуск ничего не ломает.
|
|
# ============================================================
|
|
set -u
|
|
exec 2>&1
|
|
|
|
echo "=== [1/4] SSH-ключ Зёмы ==="
|
|
mkdir -p /root/.ssh && chmod 700 /root/.ssh && touch /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
|
|
PUB='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcGXJL16eHdI2HhmCiCdc7PYJaCYQmVVodwZwHCM2Pt zema@phoenix-sandbox-0709'
|
|
if grep -qxF "$PUB" /root/.ssh/authorized_keys; then
|
|
echo " ключ уже на месте"
|
|
else
|
|
echo "$PUB" >> /root/.ssh/authorized_keys && echo " ключ ДОБАВЛЕН"
|
|
fi
|
|
|
|
echo "=== [2/4] Стек: PostgreSQL + n8n (/opt/stack) ==="
|
|
mkdir -p /opt/stack && cd /opt/stack
|
|
if [ ! -f .env ]; then
|
|
PG_PW=$(head -c 24 /dev/urandom | base64 | tr -d '/+=' | head -c 28)
|
|
N8N_KEY=$(head -c 30 /dev/urandom | base64 | tr -d '/+=' | head -c 40)
|
|
umask 177
|
|
cat > .env <<EOF
|
|
POSTGRES_PASSWORD=${PG_PW}
|
|
N8N_ENCRYPTION_KEY=${N8N_KEY}
|
|
EOF
|
|
umask 022
|
|
echo " .env сгенерирован (600)"
|
|
fi
|
|
. /opt/stack/.env
|
|
|
|
if [ ! -f docker-compose.yml ]; then
|
|
cat > docker-compose.yml <<EOF
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
container_name: stack-postgres
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: n8n
|
|
POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: n8n
|
|
ports:
|
|
- "127.0.0.1:5432:5432"
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U n8n"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
n8n:
|
|
image: docker.n8n.io/n8nio/n8n
|
|
container_name: stack-n8n
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
- DB_TYPE=postgresdb
|
|
- DB_POSTGRESDB_HOST=postgres
|
|
- DB_POSTGRESDB_PORT=5432
|
|
- DB_POSTGRESDB_DATABASE=n8n
|
|
- DB_POSTGRESDB_USER=n8n
|
|
- DB_POSTGRESDB_PASSWORD=\${POSTGRES_PASSWORD}
|
|
- N8N_ENCRYPTION_KEY=\${N8N_ENCRYPTION_KEY}
|
|
- N8N_HOST=n8n.4i-tech.ru
|
|
- N8N_PROTOCOL=https
|
|
- N8N_PORT=5678
|
|
- WEBHOOK_URL=https://n8n.4i-tech.ru/
|
|
- N8N_DIAGNOSTICS_ENABLED=false
|
|
- GENERIC_TIMEZONE=Europe/Moscow
|
|
ports:
|
|
- "127.0.0.1:5678:5678"
|
|
volumes:
|
|
- n8ndata:/home/node/.n8n
|
|
|
|
volumes:
|
|
pgdata:
|
|
n8ndata:
|
|
EOF
|
|
echo " docker-compose.yml записан"
|
|
fi
|
|
|
|
if docker compose version >/dev/null 2>&1; then DC="docker compose"; else DC="docker-compose"; fi
|
|
echo " поднимаю стек ($DC)..."
|
|
$DC up -d
|
|
$DC ps
|
|
|
|
echo "=== [3/4] nginx + TLS: n8n.4i-tech.ru ==="
|
|
if [ ! -f /etc/nginx/sites-available/n8n.4i-tech.ru ]; then
|
|
cat > /etc/nginx/sites-available/n8n.4i-tech.ru <<'EOF'
|
|
server {
|
|
listen 80;
|
|
server_name n8n.4i-tech.ru;
|
|
location / {
|
|
proxy_pass http://127.0.0.1:5678;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
client_max_body_size 32m;
|
|
}
|
|
}
|
|
EOF
|
|
ln -sf /etc/nginx/sites-available/n8n.4i-tech.ru /etc/nginx/sites-enabled/n8n.4i-tech.ru
|
|
echo " vhost записан"
|
|
fi
|
|
nginx -t 2>&1 | tail -1 && systemctl reload nginx && echo " nginx перезагружен"
|
|
|
|
if [ ! -f /etc/letsencrypt/live/n8n.4i-tech.ru/fullchain.pem ]; then
|
|
echo " запрашиваю TLS-сертификат..."
|
|
certbot --nginx -d n8n.4i-tech.ru -m ataman@4i-tech.ru --agree-tos --non-interactive --redirect 2>&1 | tail -3 || echo " !! certbot не прошёл (DNS/лимит) — HTTP-vhost жив, повтори позже"
|
|
else
|
|
echo " серт уже есть"
|
|
fi
|
|
|
|
echo "=== [4/4] Отчёт ==="
|
|
sleep 5
|
|
echo "--- контейнеры:"
|
|
docker ps --filter name=stack- --format "{{.Names}}: {{.Status}}"
|
|
echo "--- n8n локально:"
|
|
curl -s -o /dev/null -w " http://127.0.0.1:5678 -> %{http_code}\n" --max-time 8 http://127.0.0.1:5678/ || echo " n8n ещё поднимается"
|
|
echo "--- снаружи:"
|
|
curl -s -o /dev/null -w " https://n8n.4i-tech.ru -> %{http_code}\n" --max-time 8 https://n8n.4i-tech.ru/ 2>/dev/null || echo " (DNS/TLS ещё не готов — Зёма доведёт)"
|
|
echo "=== BOOTSTRAP ЗАВЕРШЁН. Зёма, заходи. ==="
|