299 lines
13 KiB
Bash
299 lines
13 KiB
Bash
#!/usr/bin/env bash
|
|
# ──────────────────────────────────────────────────────────────────────────────
|
|
# NixPanel Licensing Server — Deploy Script
|
|
# Run this on the server that will host license.nixpanel.io
|
|
# Requires: Ubuntu 22.04+ / Debian 12+, run as root
|
|
# ──────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'; GREEN='\033[0;32m'; CYAN='\033[0;36m'
|
|
YELLOW='\033[1;33m'; BOLD='\033[1m'; RESET='\033[0m'
|
|
|
|
info() { echo -e "${CYAN}[INFO]${RESET} $*"; }
|
|
success() { echo -e "${GREEN}[ OK ]${RESET} $*"; }
|
|
warn() { echo -e "${YELLOW}[WARN]${RESET} $*"; }
|
|
error() { echo -e "${RED}[ERR ]${RESET} $*" >&2; exit 1; }
|
|
step() { echo -e "\n${BOLD}${CYAN}━━━ $* ━━━${RESET}"; }
|
|
|
|
[[ $EUID -ne 0 ]] && error "Must be run as root"
|
|
|
|
INSTALL_DIR="/opt/nixpanel-licensing"
|
|
BIN_DIR="$INSTALL_DIR/bin"
|
|
KEYS_DIR="$INSTALL_DIR/keys"
|
|
LOG_DIR="/var/log/nixpanel-licensing"
|
|
SRC_DIR="$INSTALL_DIR/src"
|
|
STEP_DIR="/var/lib/nixpanel-licensing/install"
|
|
GITHUB_REPO="NixReaper/nixpanel-licensing"
|
|
|
|
mkdir -p "$INSTALL_DIR" "$BIN_DIR" "$KEYS_DIR" "$LOG_DIR" "$SRC_DIR" "$STEP_DIR"
|
|
chmod 700 "$KEYS_DIR"
|
|
|
|
mark_done() { touch "$STEP_DIR/$1.done"; }
|
|
step_done() { [[ -f "$STEP_DIR/$1.done" ]]; }
|
|
|
|
echo ""
|
|
echo -e "${BOLD}${CYAN} NixPanel Licensing Server — Deployer${RESET}"
|
|
echo -e " Repo: https://github.com/${GITHUB_REPO}"
|
|
echo ""
|
|
|
|
# ── 1. System deps ────────────────────────────────────────────────────────────
|
|
step "Installing system dependencies"
|
|
if ! step_done "sys_deps"; then
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq \
|
|
build-essential pkg-config libssl-dev libmariadb-dev \
|
|
curl wget git unzip ca-certificates gnupg \
|
|
mariadb-server mariadb-client \
|
|
apache2 certbot python3-certbot-apache \
|
|
openssl
|
|
mark_done "sys_deps"
|
|
fi
|
|
success "System dependencies installed"
|
|
|
|
# ── 2. Rust ───────────────────────────────────────────────────────────────────
|
|
step "Installing Rust toolchain"
|
|
if ! step_done "rust"; then
|
|
curl -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
|
|
mark_done "rust"
|
|
fi
|
|
source "$HOME/.cargo/env" 2>/dev/null || true
|
|
CARGO=$(command -v cargo) || error "cargo not found"
|
|
success "Rust $(rustc --version)"
|
|
|
|
# ── 3. MariaDB ────────────────────────────────────────────────────────────────
|
|
step "Configuring MariaDB"
|
|
if ! step_done "mariadb"; then
|
|
systemctl enable --now mariadb
|
|
|
|
DB_PASS=$(openssl rand -hex 24)
|
|
mysql -u root <<SQL
|
|
CREATE DATABASE IF NOT EXISTS nixpanel_licensing CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
|
CREATE USER IF NOT EXISTS 'nixpanel_license'@'127.0.0.1' IDENTIFIED BY '${DB_PASS}';
|
|
GRANT ALL PRIVILEGES ON nixpanel_licensing.* TO 'nixpanel_license'@'127.0.0.1';
|
|
FLUSH PRIVILEGES;
|
|
SQL
|
|
|
|
echo "$DB_PASS" > "$INSTALL_DIR/.db_pass"
|
|
chmod 600 "$INSTALL_DIR/.db_pass"
|
|
mark_done "mariadb"
|
|
else
|
|
DB_PASS=$(cat "$INSTALL_DIR/.db_pass")
|
|
fi
|
|
success "MariaDB ready"
|
|
|
|
# ── 4. Clone / update source ──────────────────────────────────────────────────
|
|
step "Fetching source"
|
|
if [[ -d "$SRC_DIR/.git" ]]; then
|
|
info "Updating existing checkout…"
|
|
git -C "$SRC_DIR" pull --ff-only
|
|
else
|
|
git clone "https://github.com/${GITHUB_REPO}.git" "$SRC_DIR"
|
|
fi
|
|
success "Source at $SRC_DIR"
|
|
|
|
# ── 5. Build ──────────────────────────────────────────────────────────────────
|
|
step "Building binaries (release)"
|
|
cd "$SRC_DIR"
|
|
$CARGO build --release
|
|
cp target/release/nixpanel-licensing "$BIN_DIR/nixpanel-licensing"
|
|
cp target/release/keygen "$BIN_DIR/nixpanel-keygen"
|
|
chmod 755 "$BIN_DIR/nixpanel-licensing" "$BIN_DIR/nixpanel-keygen"
|
|
success "Binaries built → $BIN_DIR"
|
|
|
|
# ── 6. RSA keys ───────────────────────────────────────────────────────────────
|
|
step "RSA-4096 license signing keys"
|
|
if ! step_done "keygen"; then
|
|
info "Generating RSA-4096 keypair (this takes a moment)…"
|
|
mkdir -p "$SRC_DIR/keys"
|
|
"$BIN_DIR/nixpanel-keygen"
|
|
cp "$SRC_DIR/keys/private.pem" "$KEYS_DIR/license_private.pem"
|
|
cp "$SRC_DIR/keys/public.pem" "$KEYS_DIR/license_public.pem"
|
|
chmod 600 "$KEYS_DIR/license_private.pem"
|
|
chmod 644 "$KEYS_DIR/license_public.pem"
|
|
mark_done "keygen"
|
|
fi
|
|
success "Keys → $KEYS_DIR"
|
|
info "Public key (distribute to panel nodes):"
|
|
echo ""
|
|
cat "$KEYS_DIR/license_public.pem"
|
|
echo ""
|
|
|
|
# ── 7. Secrets + env ──────────────────────────────────────────────────────────
|
|
step "Generating secrets"
|
|
if ! step_done "secrets"; then
|
|
JWT_SECRET=$(openssl rand -hex 64)
|
|
API_KEY=$(openssl rand -hex 32)
|
|
echo "$JWT_SECRET" > "$INSTALL_DIR/.jwt_secret"
|
|
echo "$API_KEY" > "$INSTALL_DIR/.api_key"
|
|
chmod 600 "$INSTALL_DIR/.jwt_secret" "$INSTALL_DIR/.api_key"
|
|
mark_done "secrets"
|
|
else
|
|
JWT_SECRET=$(cat "$INSTALL_DIR/.jwt_secret")
|
|
API_KEY=$(cat "$INSTALL_DIR/.api_key")
|
|
fi
|
|
|
|
echo ""
|
|
info "Enter your server's public hostname (e.g. license.nixpanel.io):"
|
|
read -rp " Hostname: " SERVER_HOST
|
|
SERVER_HOST="${SERVER_HOST:-license.nixpanel.io}"
|
|
|
|
cat > "$INSTALL_DIR/licensing.env" <<EOF
|
|
HOST=127.0.0.1
|
|
PORT=3000
|
|
RUST_LOG=nixpanel_licensing=info,tower_http=warn
|
|
DATABASE_URL=mysql://nixpanel_license:${DB_PASS}@127.0.0.1:3306/nixpanel_licensing
|
|
JWT_SECRET=${JWT_SECRET}
|
|
JWT_EXPIRES_IN_SECS=86400
|
|
LICENSE_PRIVATE_KEY_PATH=${KEYS_DIR}/license_private.pem
|
|
LICENSE_PUBLIC_KEY_PATH=${KEYS_DIR}/license_public.pem
|
|
LICENSE_TOKEN_TTL_DAYS=30
|
|
LICENSE_GRACE_PERIOD_DAYS=7
|
|
SERVER_URL=https://${SERVER_HOST}
|
|
EOF
|
|
chmod 600 "$INSTALL_DIR/licensing.env"
|
|
success "Environment written → $INSTALL_DIR/licensing.env"
|
|
|
|
# ── 8. First admin account ────────────────────────────────────────────────────
|
|
step "Creating initial admin account"
|
|
if ! step_done "admin"; then
|
|
echo ""
|
|
read -rp " Admin username [admin]: " ADMIN_USER; ADMIN_USER="${ADMIN_USER:-admin}"
|
|
read -rsp " Admin password: " ADMIN_PASS; echo ""
|
|
read -rsp " Confirm password: " ADMIN_PASS2; echo ""
|
|
[[ "$ADMIN_PASS" != "$ADMIN_PASS2" ]] && error "Passwords do not match"
|
|
read -rp " Admin email: " ADMIN_EMAIL
|
|
|
|
# Start the server temporarily to run migrations, then use the API to create admin
|
|
info "Starting server for first-run migration + admin creation…"
|
|
source "$INSTALL_DIR/licensing.env" 2>/dev/null || true
|
|
export $(grep -v '^#' "$INSTALL_DIR/licensing.env" | xargs)
|
|
"$BIN_DIR/nixpanel-licensing" &
|
|
SERVER_PID=$!
|
|
sleep 3
|
|
|
|
# Create admin via API
|
|
HTTP_STATUS=$(curl -s -o /tmp/admin_create_resp.json -w "%{http_code}" \
|
|
-X POST "http://127.0.0.1:3000/api/v1/admin/bootstrap" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"username\":\"${ADMIN_USER}\",\"password\":\"${ADMIN_PASS}\",\"email\":\"${ADMIN_EMAIL}\"}")
|
|
|
|
kill "$SERVER_PID" 2>/dev/null || true
|
|
|
|
if [[ "$HTTP_STATUS" == "200" || "$HTTP_STATUS" == "201" ]]; then
|
|
success "Admin account created"
|
|
else
|
|
warn "Bootstrap returned HTTP $HTTP_STATUS — admin may already exist, or set one up manually"
|
|
cat /tmp/admin_create_resp.json 2>/dev/null || true
|
|
echo ""
|
|
fi
|
|
mark_done "admin"
|
|
fi
|
|
|
|
# ── 9. systemd service ────────────────────────────────────────────────────────
|
|
step "Installing systemd service"
|
|
cat > /etc/systemd/system/nixpanel-licensing.service <<EOF
|
|
[Unit]
|
|
Description=NixPanel Licensing Server
|
|
After=network.target mariadb.service
|
|
Wants=mariadb.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
ExecStart=${BIN_DIR}/nixpanel-licensing
|
|
WorkingDirectory=${INSTALL_DIR}
|
|
EnvironmentFile=${INSTALL_DIR}/licensing.env
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
StandardOutput=append:${LOG_DIR}/server.log
|
|
StandardError=append:${LOG_DIR}/server-error.log
|
|
LimitNOFILE=65536
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl enable nixpanel-licensing
|
|
systemctl restart nixpanel-licensing
|
|
success "nixpanel-licensing service running"
|
|
|
|
# ── 10. Apache reverse proxy ──────────────────────────────────────────────────
|
|
step "Configuring Apache reverse proxy"
|
|
a2enmod proxy proxy_http headers ssl rewrite
|
|
cat > /etc/apache2/sites-available/nixpanel-licensing.conf <<APACHEEOF
|
|
<VirtualHost *:80>
|
|
ServerName ${SERVER_HOST}
|
|
# Redirect all HTTP to HTTPS (certbot will update this after SSL)
|
|
RewriteEngine On
|
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}%1 [R=301,L]
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
ServerName ${SERVER_HOST}
|
|
|
|
ProxyPreserveHost On
|
|
ProxyPass / http://127.0.0.1:3000/
|
|
ProxyPassReverse / http://127.0.0.1:3000/
|
|
|
|
# Security headers
|
|
Header always set X-Frame-Options "DENY"
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
|
|
ErrorLog ${LOG_DIR}/apache-error.log
|
|
CustomLog ${LOG_DIR}/apache-access.log combined
|
|
|
|
# SSL placeholder — certbot will fill these in
|
|
# SSLEngine on
|
|
# SSLCertificateFile ...
|
|
# SSLCertificateKeyFile ...
|
|
</VirtualHost>
|
|
APACHEEOF
|
|
|
|
a2ensite nixpanel-licensing
|
|
a2dissite 000-default 2>/dev/null || true
|
|
systemctl enable --now apache2
|
|
apache2ctl configtest && systemctl reload apache2
|
|
success "Apache configured for ${SERVER_HOST}"
|
|
|
|
# ── 11. SSL ───────────────────────────────────────────────────────────────────
|
|
step "SSL certificate (Let's Encrypt)"
|
|
echo ""
|
|
echo -e " ${BOLD}Obtain SSL cert now?${RESET} (requires DNS A record pointing ${SERVER_HOST} → this server)"
|
|
read -rp " Get SSL cert? [Y/n]: " DO_SSL
|
|
DO_SSL="${DO_SSL:-Y}"
|
|
|
|
if [[ "${DO_SSL,,}" == "y" ]]; then
|
|
read -rp " Email for Let's Encrypt notices: " LE_EMAIL
|
|
certbot --apache -d "$SERVER_HOST" --non-interactive --agree-tos -m "$LE_EMAIL" \
|
|
&& success "SSL certificate installed" \
|
|
|| warn "certbot failed — run manually: certbot --apache -d ${SERVER_HOST}"
|
|
else
|
|
info "Skipped — run later: certbot --apache -d ${SERVER_HOST}"
|
|
fi
|
|
|
|
# ── Done ──────────────────────────────────────────────────────────────────────
|
|
SERVER_IP=$(hostname -I | awk '{print $1}')
|
|
|
|
echo ""
|
|
echo -e "${BOLD}${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
|
|
echo -e "${BOLD}${GREEN} Licensing Server Deployed!${RESET}"
|
|
echo -e "${BOLD}${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
|
|
echo ""
|
|
echo -e " ${BOLD}API:${RESET} https://${SERVER_HOST}"
|
|
echo -e " ${BOLD}Health check:${RESET} curl https://${SERVER_HOST}/health"
|
|
echo -e " ${BOLD}Logs:${RESET} ${LOG_DIR}/"
|
|
echo -e " ${BOLD}Config:${RESET} ${INSTALL_DIR}/licensing.env"
|
|
echo -e " ${BOLD}Public key:${RESET} ${KEYS_DIR}/license_public.pem"
|
|
echo ""
|
|
echo -e " ${BOLD}Internal API key${RESET} (add to website.env LICENSING_SERVER_API_KEY):"
|
|
echo -e " ${YELLOW}$(cat "$INSTALL_DIR/.api_key")${RESET}"
|
|
echo ""
|
|
echo -e " ${BOLD}Next steps:${RESET}"
|
|
echo -e " 1. Copy public key to panel nodes: ${KEYS_DIR}/license_public.pem"
|
|
echo -e " 2. Set LICENSING_SERVER_URL=https://${SERVER_HOST} in nixpanel.io website.env"
|
|
echo -e " 3. Create license plans via: POST https://${SERVER_HOST}/api/v1/admin/plans"
|
|
echo -e " 4. Status: systemctl status nixpanel-licensing"
|
|
echo ""
|