lorentz/quest-vorteq
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
quest-vorteq/create-files.sh

403 lines
12 KiB
Bash
Executable file
Raw Blame History

#!/bin/bash
# Run this from /opt/stacks/vorteq on expvtcasp01
# Creates all infrastructure files for the Vorteq Quest Portal
set -e
echo "Creating infrastructure files..."
# ============================================================
# docker-compose.yml
# ============================================================
cat > docker-compose.yml << 'DCOMPOSE'
version: '3.8'
services:
# Traefik Reverse Proxy
traefik:
image: traefik:v3.0
container_name: traefik
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- web
ports:
- "80:80"
- "443:443"
- "8080:8080"
environment:
- CF_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik/traefik.yml:/traefik.yml:ro
- ./traefik/acme.json:/acme.json
- ./traefik/config:/config:ro
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
- "traefik.http.routers.traefik.entrypoints=websecure"
- "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
- "traefik.http.routers.traefik.service=api@internal"
- "traefik.http.routers.traefik.middlewares=auth"
- "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$8evjzm8w$$FU3G.qPxZRGlnUKzPJ6QB/"
# PostgreSQL
postgres:
image: postgres:16-alpine
container_name: postgres
restart: unless-stopped
networks:
- web
environment:
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_MULTIPLE_DATABASES: vorteq_dev,vorteq_test,vorteq_prod
volumes:
- postgres_data:/var/lib/postgresql/data
- ./init-databases.sh:/docker-entrypoint-initdb.d/init-databases.sh:ro
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 10s
timeout: 5s
retries: 5
# Redis
redis:
image: redis:7-alpine
container_name: redis
restart: unless-stopped
networks:
- web
volumes:
- redis_data:/data
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
# Development Environment
app-dev:
image: forgejo.wulfconsulting.cloud/lorentz/quest-vorteq:dev
container_name: vorteq-dev
restart: unless-stopped
networks:
- web
environment:
NODE_ENV: development
DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/vorteq_dev
REDIS_URL: redis://redis:6379/0
BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET}
BETTER_AUTH_URL: https://${DEV_DOMAIN}
PORT: 3000
labels:
- "traefik.enable=true"
- "traefik.http.routers.app-dev.rule=Host(`${DEV_DOMAIN}`)"
- "traefik.http.routers.app-dev.entrypoints=websecure"
- "traefik.http.routers.app-dev.tls.certresolver=letsencrypt"
- "traefik.http.services.app-dev.loadbalancer.server.port=3000"
- "traefik.http.routers.app-dev.middlewares=dev-headers"
- "traefik.http.middlewares.dev-headers.headers.customresponseheaders.X-Environment=development"
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
# Testing Environment
app-test:
image: forgejo.wulfconsulting.cloud/lorentz/quest-vorteq:test
container_name: vorteq-test
restart: unless-stopped
networks:
- web
environment:
NODE_ENV: test
DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/vorteq_test
REDIS_URL: redis://redis:6379/1
BETTER_AUTH_SECRET: ${TEST_AUTH_SECRET}
BETTER_AUTH_URL: https://${TEST_DOMAIN}
PORT: 3000
labels:
- "traefik.enable=true"
- "traefik.http.routers.app-test.rule=Host(`${TEST_DOMAIN}`)"
- "traefik.http.routers.app-test.entrypoints=websecure"
- "traefik.http.routers.app-test.tls.certresolver=letsencrypt"
- "traefik.http.services.app-test.loadbalancer.server.port=3000"
- "traefik.http.routers.app-test.middlewares=test-headers"
- "traefik.http.middlewares.test-headers.headers.customresponseheaders.X-Environment=testing"
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
# Production Environment
app-prod:
image: forgejo.wulfconsulting.cloud/lorentz/quest-vorteq:latest
container_name: vorteq-prod
restart: unless-stopped
networks:
- web
environment:
NODE_ENV: production
DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/vorteq_prod
REDIS_URL: redis://redis:6379/2
BETTER_AUTH_SECRET: ${PROD_AUTH_SECRET}
BETTER_AUTH_URL: https://${PROD_DOMAIN}
PORT: 3000
labels:
- "traefik.enable=true"
- "traefik.http.routers.app-prod.rule=Host(`${PROD_DOMAIN}`)"
- "traefik.http.routers.app-prod.entrypoints=websecure"
- "traefik.http.routers.app-prod.tls.certresolver=letsencrypt"
- "traefik.http.services.app-prod.loadbalancer.server.port=3000"
- "traefik.http.routers.app-prod.middlewares=prod-chain"
- "traefik.http.middlewares.prod-chain.chain.middlewares=security-headers,rate-limit,compress"
- "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
- "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
- "traefik.http.middlewares.security-headers.headers.stsPreload=true"
- "traefik.http.middlewares.security-headers.headers.forceSTSHeader=true"
- "traefik.http.middlewares.security-headers.headers.frameDeny=true"
- "traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true"
- "traefik.http.middlewares.security-headers.headers.browserXssFilter=true"
- "traefik.http.middlewares.rate-limit.ratelimit.average=100"
- "traefik.http.middlewares.rate-limit.ratelimit.burst=50"
- "traefik.http.middlewares.compress.compress=true"
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
deploy:
resources:
limits:
cpus: '2'
memory: 2G
reservations:
cpus: '1'
memory: 1G
networks:
web:
external: true
volumes:
postgres_data:
redis_data:
DCOMPOSE
echo " docker-compose.yml"
# ============================================================
# traefik/traefik.yml
# ============================================================
mkdir -p traefik/{config,logs}
cat > traefik/traefik.yml << 'TRAEFIK'
api:
dashboard: true
insecure: false
entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: ":443"
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
exposedByDefault: false
network: web
file:
directory: /config
watch: true
certificatesResolvers:
letsencrypt:
acme:
email: lorentz@wulfconsulting.com
storage: acme.json
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 0
resolvers:
- "1.1.1.1:53"
- "8.8.8.8:53"
log:
level: INFO
accessLog:
filePath: /var/log/traefik/access.log
bufferingSize: 100
TRAEFIK
echo " traefik/traefik.yml"
# ============================================================
# init-databases.sh
# ============================================================
cat > init-databases.sh << 'INITDB'
#!/bin/bash
set -e
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
CREATE DATABASE vorteq_dev;
GRANT ALL PRIVILEGES ON DATABASE vorteq_dev TO postgres;
CREATE DATABASE vorteq_test;
GRANT ALL PRIVILEGES ON DATABASE vorteq_test TO postgres;
CREATE DATABASE vorteq_prod;
GRANT ALL PRIVILEGES ON DATABASE vorteq_prod TO postgres;
EOSQL
echo "Multiple databases created successfully!"
INITDB
chmod +x init-databases.sh
echo " init-databases.sh"
# ============================================================
# .env.example
# ============================================================
cat > .env.example << 'ENVEX'
# PostgreSQL
POSTGRES_PASSWORD=change-me-to-a-strong-password
# Cloudflare DNS Challenge
CLOUDFLARE_DNS_API_TOKEN=your-cloudflare-api-token-here
ACME_EMAIL=lorentz@wulfconsulting.com
# Domains
DEV_DOMAIN=dev.quest.vorteq.wulf.cloud
TEST_DOMAIN=testing.vorteq.wulf.cloud
PROD_DOMAIN=quest.vorteq.wulf.cloud
TRAEFIK_DOMAIN=traefik.vorteq.wulf.cloud
# Better-Auth Secrets (generate with: openssl rand -base64 32)
DEV_AUTH_SECRET=your-dev-secret-here
TEST_AUTH_SECRET=your-test-secret-here
PROD_AUTH_SECRET=your-prod-secret-here
ENVEX
echo " .env.example"
# ============================================================
# setup.sh
# ============================================================
cat > setup.sh << 'SETUP'
#!/bin/bash
set -e
echo "Setting up Traefik Multi-Environment Stack"
echo "=============================================="
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
echo "Checking prerequisites..."
command -v docker >/dev/null 2>&1 || {
echo -e "${RED}Docker is not installed${NC}"
exit 1
}
command -v docker compose >/dev/null 2>&1 || {
echo -e "${RED}Docker Compose is not installed${NC}"
exit 1
}
echo -e "${GREEN}Docker and Docker Compose are installed${NC}"
echo "Creating directory structure..."
mkdir -p traefik/{config,logs}
echo "Setting up SSL certificate storage..."
touch traefik/acme.json
chmod 600 traefik/acme.json
chmod +x init-databases.sh
echo "Creating Docker network..."
docker network create web 2>/dev/null || echo -e "${YELLOW}Network 'web' already exists${NC}"
if [ ! -f .env ]; then
echo "Creating .env file..."
cp .env.example .env
echo -e "${YELLOW}Please edit .env file with your actual values!${NC}"
else
echo -e "${GREEN}.env file already exists${NC}"
fi
SERVER_IP=$(curl -s ifconfig.me 2>/dev/null || echo "YOUR_SERVER_IP")
echo ""
echo "Cloudflare DNS Configuration Check"
echo "===================================="
echo "Make sure these DNS records are configured in Cloudflare:"
echo " - quest.vorteq.wulf.cloud -> ${SERVER_IP}"
echo " - dev.quest.vorteq.wulf.cloud -> ${SERVER_IP}"
echo " - testing.vorteq.wulf.cloud -> ${SERVER_IP}"
echo " - traefik.vorteq.wulf.cloud -> ${SERVER_IP}"
echo ""
echo "Important: Set DNS records to 'DNS only' (grey cloud)"
echo ""
# Generate auth secrets if needed
if grep -q "your-.*-secret-here" .env 2>/dev/null; then
echo -e "${YELLOW}Generating Better-Auth secrets...${NC}"
DEV_SECRET=$(openssl rand -base64 32)
TEST_SECRET=$(openssl rand -base64 32)
PROD_SECRET=$(openssl rand -base64 32)
sed -i "s/your-dev-secret-here/$DEV_SECRET/" .env
sed -i "s/your-test-secret-here/$TEST_SECRET/" .env
sed -i "s/your-prod-secret-here/$PROD_SECRET/" .env
echo -e "${GREEN}Generated and saved auth secrets${NC}"
else
echo -e "${GREEN}Auth secrets already configured${NC}"
fi
echo ""
echo "Pre-flight Checklist"
echo "======================"
echo "Before running docker compose up, ensure:"
echo " - DNS records are configured"
echo " - Firewall allows ports 80 and 443"
echo " - .env file is configured"
echo " - Docker images are built (or registry is accessible)"
echo ""
read -p "Do you want to start the stack now? (y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
echo "Starting services..."
docker compose up -d
echo ""
echo -e "${GREEN}Stack is starting!${NC}"
echo ""
echo "View logs with: docker compose logs -f"
echo "SSL certificates may take a few minutes to provision"
else
echo ""
echo "Setup complete! Run 'docker compose up -d' when ready."
fi
SETUP
chmod +x setup.sh
echo " setup.sh"
# ============================================================
# Done
# ============================================================
echo ""
echo "All files created. Directory listing:"
find . -not -path './.git/*' -not -path './.git' | sort
echo ""
echo "Next steps:"
echo " 1. cp .env.example .env"
echo " 2. nano .env (fill in your secrets)"
echo " 3. git add . && git commit -m 'Initial infrastructure setup' && git push -u origin main"
Reference in a new issue View git blame Copy permalink