#!/usr/bin/env bash # # deploy.sh -- deploy the pocket-id stack (caddy + anubis + pocket-id) on # Alpine Linux. Single-node, dedicated host: runs everything as root. # # What this does: # 1. Installs docker + docker-cli-compose if missing. # 2. Lays down docker-compose.yml, Caddyfile, .env.example in $STACK_DIR. # 3. Generates .env on first run with random ENCRYPTION_KEY and # ANUBIS_PID_KEY. Existing .env is never overwritten. # 4. Prompts for POCKETID_DOMAIN and ACME_EMAIL if not preset. # 5. Enables docker on boot, runs `docker compose pull && up -d`. # 6. Waits for healthchecks to go green. # # Self-contained: docker-compose.yml, Caddyfile, Caddyfile.webfinger and # .env.example are embedded at the bottom of this file as a base64-encoded # tar.gz. The script extracts them at runtime, so this single file is all you # need on the target box. The WebFinger block is appended only when BASE_DOMAIN # is set in .env. # # To rebuild after editing the loose files: run ./build.sh in this dir. # # Idempotent: re-running pulls new images and recreates changed services # without touching .env or named volumes. # # Usage: # bash deploy.sh # interactive prompts # POCKETID_DOMAIN=id.example.com ACME_EMAIL=me@example.com \ # bash deploy.sh # STACK_DIR=/opt/pocket-id bash deploy.sh # SKIP_DOCKER_INSTALL=1 bash deploy.sh # docker already installed # FORCE=1 bash deploy.sh # skip confirmations set -euo pipefail : "${STACK_DIR:=/srv/pocket-id}" : "${SKIP_DOCKER_INSTALL:=0}" : "${FORCE:=0}" : "${SKIP_PROMPTS:=0}" # non-interactive: require values via env, no prompts [[ "$SKIP_PROMPTS" == "1" ]] && FORCE=1 : "${POCKETID_DOMAIN:=}" : "${ACME_EMAIL:=}" : "${BASE_DOMAIN:=}" # optional: enables the WebFinger block (set with REDIRECT_URL) : "${REDIRECT_URL:=}" # optional: where the base domain 301s non-webfinger traffic log() { printf '\033[1;32m[+]\033[0m %s\n' "$*"; } warn() { printf '\033[1;33m[!]\033[0m %s\n' "$*" >&2; } die() { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; } [[ $EUID -eq 0 ]] || die "Run as root." # --------------------------------------------------------------------------- # OS detection + Docker install (Alpine / Debian / Alma). This deploy.sh is # self-contained (scp'd standalone), so the OS logic is inlined here instead # of sourced from scripts/oslib.sh. # --------------------------------------------------------------------------- osfam() { local id="" like="" if [[ -r /etc/os-release ]]; then id="$(. /etc/os-release 2>/dev/null && echo "${ID:-}")" like="$(. /etc/os-release 2>/dev/null && echo "${ID_LIKE:-}")" fi case " $id $like " in *" alpine "*) echo alpine ;; *" debian "*|*" ubuntu "*) echo debian ;; *" rhel "*|*" fedora "*|*" centos "*) echo rhel ;; *) echo "${id:-unknown}" ;; esac } install_docker() { if command -v docker >/dev/null 2>&1; then log "Docker already installed: $(docker --version)" else log "Installing Docker (OS: $(osfam))..." case "$(osfam)" in alpine) apk add -q docker docker-cli-compose openrc ;; debian|rhel) command -v curl >/dev/null 2>&1 || \ { command -v apt-get >/dev/null 2>&1 && apt-get install -y -qq curl; } || \ { command -v dnf >/dev/null 2>&1 && dnf install -y -q curl; } curl -fsSL https://get.docker.com | sh ;; *) die "Unsupported OS for auto Docker install. Set SKIP_DOCKER_INSTALL=1 and install Docker yourself." ;; esac fi # Enable + start under whichever init is present. if command -v rc-update >/dev/null 2>&1; then rc-update add docker default >/dev/null 2>&1 || true rc-service docker status >/dev/null 2>&1 || rc-service docker start elif command -v systemctl >/dev/null 2>&1; then systemctl enable --now docker >/dev/null 2>&1 || systemctl start docker || true fi } open_web_ports() { # Register 80/443 for this stack. Prefer the host firewall (harden-firewall.sh) # when present: drop in a rule file and re-apply. Else fall back to ufw/ # firewalld if active (no-op when neither is). # # NOTE: Caddy publishes 80/443 via Docker, which reaches the host through the # nat/FORWARD chains and BYPASSES the INPUT firewall -- so this is harmless # belt-and-braces for any host-bound bind and self-documents the stack ports. if [[ -d /etc/firewall/ports.d && -x /usr/local/sbin/firewall-apply ]]; then log "Registering 80,443/tcp with host firewall..." printf '80/tcp\n443/tcp\n' > /etc/firewall/ports.d/pocket-id.rule /usr/local/sbin/firewall-apply elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then log "ufw active -- allowing 80,443/tcp..." ufw allow 80/tcp >/dev/null; ufw allow 443/tcp >/dev/null elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then log "firewalld active -- allowing http,https..." firewall-cmd -q --add-service=http --permanent firewall-cmd -q --add-service=https --permanent firewall-cmd -q --reload fi } # ---------------------------------------------------------------------------- # Extract embedded archive # ---------------------------------------------------------------------------- SCRIPT_DIR=$(mktemp -d -t pocket-id-deploy.XXXXXX) trap 'rm -rf "$SCRIPT_DIR"' EXIT extract_archive() { grep -a -A 9999999 '^__ARCHIVE_BELOW__$' "$0" \ | tail -n +2 \ | base64 -d \ | tar -xz -C "$SCRIPT_DIR" } if grep -q -a '^__ARCHIVE_BELOW__$' "$0"; then log "Extracting embedded deployment files..." extract_archive else die "No embedded archive found. Run build.sh to embed deployment files." fi for f in docker-compose.yml Caddyfile Caddyfile.webfinger .env.example; do [[ -f "$SCRIPT_DIR/$f" ]] || die "Embedded archive missing $f" done # ---------------------------------------------------------------------------- # Prompt for required vars if not set # ---------------------------------------------------------------------------- prompt() { local varname="$1" message="$2" local -n ref="$varname" if [[ -z "${ref:-}" ]]; then [[ "$SKIP_PROMPTS" == "1" ]] && die "$varname required (set it in the environment; running with SKIP_PROMPTS=1)." read -r -p "$message: " ref [[ -n "$ref" ]] || die "$varname required." fi } prompt POCKETID_DOMAIN "Public hostname (e.g. id.example.com)" prompt ACME_EMAIL "Let's Encrypt email" # ---------------------------------------------------------------------------- # Docker # ---------------------------------------------------------------------------- if [[ "$SKIP_DOCKER_INSTALL" != "1" ]]; then install_docker fi open_web_ports # ---------------------------------------------------------------------------- # Stack directory + files # ---------------------------------------------------------------------------- log "Setting up $STACK_DIR..." install -d -m 0750 "$STACK_DIR" install -m 0640 "$SCRIPT_DIR/docker-compose.yml" "$STACK_DIR/docker-compose.yml" # (Caddyfile is assembled below, after .env, so the optional WebFinger block # can be appended when BASE_DOMAIN is set.) ENV_FILE="$STACK_DIR/.env" if [[ ! -f "$ENV_FILE" ]]; then log "Seeding $ENV_FILE with generated secrets..." install -m 0600 "$SCRIPT_DIR/.env.example" "$ENV_FILE" sed -i \ -e "s|^POCKETID_DOMAIN=.*|POCKETID_DOMAIN=${POCKETID_DOMAIN}|" \ -e "s|^ACME_EMAIL=.*|ACME_EMAIL=${ACME_EMAIL}|" \ -e "s|^ENCRYPTION_KEY=.*|ENCRYPTION_KEY=$(openssl rand -base64 32)|" \ -e "s|^ANUBIS_PID_KEY=.*|ANUBIS_PID_KEY=$(openssl rand -hex 32)|" \ -e "s|^BASE_DOMAIN=.*|BASE_DOMAIN=${BASE_DOMAIN}|" \ -e "s|^REDIRECT_URL=.*|REDIRECT_URL=${REDIRECT_URL}|" \ "$ENV_FILE" else log ".env exists; leaving secrets alone." fi # Validate required values are present. missing=() for var in POCKETID_DOMAIN ACME_EMAIL ENCRYPTION_KEY ANUBIS_PID_KEY; do grep -E "^${var}=.+$" "$ENV_FILE" >/dev/null || missing+=("$var") done (( ${#missing[@]} == 0 )) || die "Missing values in $ENV_FILE: ${missing[*]}" # Assemble the deployed Caddyfile each run: base (pocket-id) + the optional # WebFinger block when BASE_DOMAIN is set in .env. Regenerated every run so # edits to .env propagate. install -m 0640 "$SCRIPT_DIR/Caddyfile" "$STACK_DIR/Caddyfile" bd="$(sed -n 's/^BASE_DOMAIN=//p' "$ENV_FILE")" ru="$(sed -n 's/^REDIRECT_URL=//p' "$ENV_FILE")" if [[ -n "$bd" ]]; then [[ -n "$ru" ]] || die "BASE_DOMAIN is set but REDIRECT_URL is empty in $ENV_FILE; set both or neither." log "WebFinger enabled -- serving /.well-known/webfinger at ${bd}." cat "$SCRIPT_DIR/Caddyfile.webfinger" >> "$STACK_DIR/Caddyfile" else log "No BASE_DOMAIN -- pocket-id only (use the webfinger deployment for OIDC discovery)." fi # ---------------------------------------------------------------------------- # Bring up the stack # ---------------------------------------------------------------------------- if [[ "$FORCE" != "1" ]]; then cat </dev/null || true) unhealthy=$(echo "$status" | awk '$2 != "healthy" && $2 != "" {print $1}') if [[ -z "$unhealthy" && -n "$status" ]]; then log "All services healthy." break fi sleep 5 done echo log "Stack status:" docker compose ps echo cat <