summaryrefslogtreecommitdiffstats
path: root/cmd/ship/host/init.go
diff options
context:
space:
mode:
Diffstat (limited to 'cmd/ship/host/init.go')
-rw-r--r--cmd/ship/host/init.go316
1 files changed, 0 insertions, 316 deletions
diff --git a/cmd/ship/host/init.go b/cmd/ship/host/init.go
deleted file mode 100644
index cfa2795..0000000
--- a/cmd/ship/host/init.go
+++ /dev/null
@@ -1,316 +0,0 @@
1package host
2
3import (
4 "fmt"
5 "strings"
6
7 "github.com/bdw/ship/internal/ssh"
8 "github.com/bdw/ship/internal/state"
9 "github.com/bdw/ship/internal/templates"
10 "github.com/spf13/cobra"
11)
12
13var initCmd = &cobra.Command{
14 Use: "init",
15 Short: "Initialize VPS (one-time setup)",
16 Long: "Set up a fresh VPS with Caddy for automatic HTTPS and required directories",
17 RunE: runInit,
18}
19
20func runInit(cmd *cobra.Command, args []string) error {
21 st, err := state.Load()
22 if err != nil {
23 return fmt.Errorf("error loading state: %w", err)
24 }
25
26 host, _ := cmd.Flags().GetString("host")
27 if host == "" {
28 host = st.GetDefaultHost()
29 }
30 baseDomain, _ := cmd.Flags().GetString("base-domain")
31
32 if host == "" {
33 return fmt.Errorf("--host is required")
34 }
35
36 fmt.Printf("Initializing VPS: %s\n", host)
37
38 client, err := ssh.Connect(host)
39 if err != nil {
40 return fmt.Errorf("error connecting to VPS: %w", err)
41 }
42 defer client.Close()
43
44 fmt.Println("-> Detecting OS...")
45 osRelease, err := client.Run("cat /etc/os-release")
46 if err != nil {
47 return fmt.Errorf("error detecting OS: %w", err)
48 }
49
50 if !strings.Contains(osRelease, "Ubuntu") && !strings.Contains(osRelease, "Debian") {
51 return fmt.Errorf("unsupported OS (only Ubuntu and Debian are supported)")
52 }
53 fmt.Println(" Detected Ubuntu/Debian")
54
55 fmt.Println("-> Checking for Caddy...")
56 _, err = client.Run("which caddy")
57 if err == nil {
58 fmt.Println(" Caddy already installed")
59 } else {
60 fmt.Println(" Installing Caddy...")
61 if err := installCaddy(client); err != nil {
62 return err
63 }
64 fmt.Println(" Caddy installed")
65 }
66
67 fmt.Println("-> Configuring Caddy...")
68 caddyfile := `{
69}
70
71import /etc/caddy/sites-enabled/*
72`
73 if err := client.WriteSudoFile("/etc/caddy/Caddyfile", caddyfile); err != nil {
74 return fmt.Errorf("error creating Caddyfile: %w", err)
75 }
76 fmt.Println(" Caddyfile created")
77
78 fmt.Println("-> Creating directories...")
79 if _, err := client.RunSudo("mkdir -p /etc/ship/env"); err != nil {
80 return fmt.Errorf("error creating /etc/ship/env: %w", err)
81 }
82 if _, err := client.RunSudo("mkdir -p /etc/caddy/sites-enabled"); err != nil {
83 return fmt.Errorf("error creating /etc/caddy/sites-enabled: %w", err)
84 }
85 fmt.Println(" Directories created")
86
87 fmt.Println("-> Starting Caddy...")
88 if _, err := client.RunSudo("systemctl enable caddy"); err != nil {
89 return fmt.Errorf("error enabling Caddy: %w", err)
90 }
91 if _, err := client.RunSudo("systemctl restart caddy"); err != nil {
92 return fmt.Errorf("error starting Caddy: %w", err)
93 }
94 fmt.Println(" Caddy started")
95
96 fmt.Println("-> Verifying installation...")
97 output, err := client.RunSudo("systemctl is-active caddy")
98 if err != nil || strings.TrimSpace(output) != "active" {
99 fmt.Println(" Warning: Caddy may not be running properly")
100 } else {
101 fmt.Println(" Caddy is active")
102 }
103
104 hostState := st.GetHost(host)
105 if baseDomain != "" {
106 hostState.BaseDomain = baseDomain
107 fmt.Printf(" Base domain: %s\n", baseDomain)
108 }
109
110 // Git-centric deployment setup (gated on base domain)
111 if baseDomain != "" {
112 if err := setupGitDeploy(client, baseDomain, hostState); err != nil {
113 return err
114 }
115 }
116
117 if st.GetDefaultHost() == "" {
118 st.SetDefaultHost(host)
119 fmt.Printf(" Set %s as default host\n", host)
120 }
121 if err := st.Save(); err != nil {
122 return fmt.Errorf("error saving state: %w", err)
123 }
124
125 fmt.Println("\nVPS initialized successfully!")
126 fmt.Println("\nNext steps:")
127 fmt.Println(" 1. Deploy an app:")
128 fmt.Printf(" ship --binary ./myapp --domain api.example.com\n")
129 fmt.Println(" 2. Deploy a static site:")
130 fmt.Printf(" ship --static --dir ./dist --domain example.com\n")
131 if baseDomain != "" {
132 fmt.Println(" 3. Initialize a git-deployed app:")
133 fmt.Printf(" ship init myapp\n")
134 }
135 return nil
136}
137
138func setupGitDeploy(client *ssh.Client, baseDomain string, hostState *state.Host) error {
139 fmt.Println("-> Installing Docker...")
140 dockerCommands := []string{
141 "apt-get install -y ca-certificates curl gnupg",
142 "install -m 0755 -d /etc/apt/keyrings",
143 "curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc",
144 "chmod a+r /etc/apt/keyrings/docker.asc",
145 `sh -c 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo ${VERSION_CODENAME}) stable" > /etc/apt/sources.list.d/docker.list'`,
146 "apt-get update",
147 "apt-get install -y docker-ce docker-ce-cli containerd.io",
148 }
149 for _, cmd := range dockerCommands {
150 if _, err := client.RunSudo(cmd); err != nil {
151 return fmt.Errorf("error installing Docker: %w", err)
152 }
153 }
154 fmt.Println(" Docker installed")
155
156 fmt.Println("-> Installing git, fcgiwrap, and cgit...")
157 if _, err := client.RunSudo("apt-get install -y git fcgiwrap cgit"); err != nil {
158 return fmt.Errorf("error installing git/fcgiwrap/cgit: %w", err)
159 }
160 // Allow git-http-backend (runs as www-data) to access repos owned by git.
161 // Scoped to www-data only, not system-wide, to preserve CVE-2022-24765 protection.
162 // www-data's home is /var/www; ensure it can write .gitconfig there.
163 client.RunSudo("mkdir -p /var/www")
164 client.RunSudo("chown www-data:www-data /var/www")
165 if _, err := client.RunSudo("sudo -u www-data git config --global --add safe.directory '*'"); err != nil {
166 return fmt.Errorf("error setting git safe.directory: %w", err)
167 }
168 fmt.Println(" git, fcgiwrap, and cgit installed")
169
170 fmt.Println("-> Creating git user...")
171 // Create git user (ignore error if already exists)
172 client.RunSudo("useradd -r -m -d /home/git -s $(which git-shell) git")
173 if _, err := client.RunSudo("usermod -aG docker git"); err != nil {
174 return fmt.Errorf("error adding git user to docker group: %w", err)
175 }
176 // www-data needs to read git repos for git-http-backend
177 if _, err := client.RunSudo("usermod -aG git www-data"); err != nil {
178 return fmt.Errorf("error adding www-data to git group: %w", err)
179 }
180 // caddy needs to connect to fcgiwrap socket (owned by www-data)
181 if _, err := client.RunSudo("usermod -aG www-data caddy"); err != nil {
182 return fmt.Errorf("error adding caddy to www-data group: %w", err)
183 }
184 fmt.Println(" git user created")
185
186 fmt.Println("-> Copying SSH keys to git user...")
187 copyKeysCommands := []string{
188 "mkdir -p /home/git/.ssh",
189 "cp ~/.ssh/authorized_keys /home/git/.ssh/authorized_keys",
190 "chown -R git:git /home/git/.ssh",
191 "chmod 700 /home/git/.ssh",
192 "chmod 600 /home/git/.ssh/authorized_keys",
193 }
194 for _, cmd := range copyKeysCommands {
195 if _, err := client.RunSudo(cmd); err != nil {
196 return fmt.Errorf("error copying SSH keys: %w", err)
197 }
198 }
199 fmt.Println(" SSH keys copied")
200
201 fmt.Println("-> Creating /srv/git...")
202 if _, err := client.RunSudo("mkdir -p /srv/git"); err != nil {
203 return fmt.Errorf("error creating /srv/git: %w", err)
204 }
205 if _, err := client.RunSudo("chown git:git /srv/git"); err != nil {
206 return fmt.Errorf("error setting /srv/git ownership: %w", err)
207 }
208 fmt.Println(" /srv/git created")
209
210 fmt.Println("-> Writing sudoers for git user...")
211 sudoersContent := `# Ship git-deploy: allow post-receive hooks to install configs and manage services.
212# App names are validated to [a-z][a-z0-9-] before reaching this point.
213git ALL=(ALL) NOPASSWD: \
214 /bin/systemctl daemon-reload, \
215 /bin/systemctl reload caddy, \
216 /bin/systemctl restart [a-z]*, \
217 /bin/systemctl enable [a-z]*, \
218 /bin/cp /var/lib/*/src/.ship/service /etc/systemd/system/*.service, \
219 /bin/cp /var/lib/*/src/.ship/Caddyfile /etc/caddy/sites-enabled/*.caddy, \
220 /bin/cp /var/www/*/.ship/Caddyfile /etc/caddy/sites-enabled/*.caddy, \
221 /bin/mkdir -p /var/lib/*, \
222 /bin/mkdir -p /var/www/*, \
223 /bin/chown -R git\:git /var/lib/*, \
224 /bin/chown git\:git /var/www/*
225`
226 if err := client.WriteSudoFile("/etc/sudoers.d/ship-git", sudoersContent); err != nil {
227 return fmt.Errorf("error writing sudoers: %w", err)
228 }
229 if _, err := client.RunSudo("chmod 440 /etc/sudoers.d/ship-git"); err != nil {
230 return fmt.Errorf("error setting sudoers permissions: %w", err)
231 }
232 fmt.Println(" sudoers configured")
233
234 fmt.Println("-> Writing vanity import template...")
235 vanityHTML := `<!DOCTYPE html>
236<html><head>
237{{$path := trimPrefix "/" (placeholder "http.request.orig_uri.path")}}
238{{$parts := splitList "/" $path}}
239{{$module := first $parts}}
240<meta name="go-import" content="{{.Host}}/{{$module}} git https://{{.Host}}/{{$module}}.git">
241</head>
242<body>go get {{.Host}}/{{$module}}</body>
243</html>
244`
245 if _, err := client.RunSudo("mkdir -p /opt/ship/vanity"); err != nil {
246 return fmt.Errorf("error creating vanity directory: %w", err)
247 }
248 if err := client.WriteSudoFile("/opt/ship/vanity/index.html", vanityHTML); err != nil {
249 return fmt.Errorf("error writing vanity template: %w", err)
250 }
251 fmt.Println(" vanity template written")
252
253 fmt.Println("-> Writing base domain Caddy config...")
254 codeCaddyContent, err := templates.CodeCaddy(map[string]string{
255 "BaseDomain": baseDomain,
256 })
257 if err != nil {
258 return fmt.Errorf("error generating code caddy config: %w", err)
259 }
260 if err := client.WriteSudoFile("/etc/caddy/sites-enabled/ship-code.caddy", codeCaddyContent); err != nil {
261 return fmt.Errorf("error writing code caddy config: %w", err)
262 }
263 fmt.Println(" base domain Caddy config written")
264
265 fmt.Println("-> Writing cgit config...")
266 cgitrcContent, err := templates.CgitRC(map[string]string{
267 "BaseDomain": baseDomain,
268 })
269 if err != nil {
270 return fmt.Errorf("error generating cgitrc: %w", err)
271 }
272 if err := client.WriteSudoFile("/etc/cgitrc", cgitrcContent); err != nil {
273 return fmt.Errorf("error writing cgitrc: %w", err)
274 }
275 if err := client.WriteSudoFile("/opt/ship/cgit-header.html", templates.CgitHeader()); err != nil {
276 return fmt.Errorf("error writing cgit header: %w", err)
277 }
278 fmt.Println(" cgit config written")
279
280 fmt.Println("-> Starting Docker and fcgiwrap...")
281 if _, err := client.RunSudo("systemctl enable docker fcgiwrap"); err != nil {
282 return fmt.Errorf("error enabling services: %w", err)
283 }
284 if _, err := client.RunSudo("systemctl restart docker fcgiwrap"); err != nil {
285 return fmt.Errorf("error starting services: %w", err)
286 }
287 fmt.Println(" Docker and fcgiwrap started")
288
289 fmt.Println("-> Restarting Caddy...")
290 if _, err := client.RunSudo("systemctl restart caddy"); err != nil {
291 return fmt.Errorf("error restarting Caddy: %w", err)
292 }
293 fmt.Println(" Caddy restarted")
294
295 hostState.GitSetup = true
296 fmt.Println(" Git deployment setup complete")
297 return nil
298}
299
300func installCaddy(client *ssh.Client) error {
301 commands := []string{
302 "apt-get update",
303 "apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl",
304 "curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg",
305 "curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list",
306 "apt-get update",
307 "apt-get install -y caddy",
308 }
309
310 for _, cmd := range commands {
311 if _, err := client.RunSudo(cmd); err != nil {
312 return fmt.Errorf("error running: %s: %w", cmd, err)
313 }
314 }
315 return nil
316}
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-17 23:16:42 +0000