2026-10-06 15:58:02 +02:00
|
|
|
#!/bin/bash
|
|
|
|
|
# Set up, or bring up to date, the Kokkoja server on this machine. Run as
|
|
|
|
|
# root ON THE SERVER, after deploy/deploy.sh has copied the files to
|
|
|
|
|
# /opt/kokkoja/incoming. Safe to run again: every step checks first.
|
|
|
|
|
#
|
|
|
|
|
# What it makes:
|
|
|
|
|
# /opt/kokkoja/relay/ the relay's code
|
|
|
|
|
# /opt/kokkoja/venv/ Python with the websockets library
|
|
|
|
|
# /var/www/kokkoja/ the client, with config.json
|
|
|
|
|
# kokkoja-relay.service the relay, as the system user "kokkoja"
|
|
|
|
|
# nginx site "kokkoja" the web site and the relay behind TLS
|
|
|
|
|
#
|
|
|
|
|
# TLS is the one step left to a person, once the name resolves to this
|
|
|
|
|
# machine (see deploy/README.md):
|
2026-10-13 20:40:09 +02:00
|
|
|
# certbot --nginx -d app.kokkoja.com -d kokkoja.andykopra.com
|
2026-10-06 15:58:02 +02:00
|
|
|
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
incoming=/opt/kokkoja/incoming
|
|
|
|
|
test -d "$incoming" || { echo "nothing in $incoming: run deploy/deploy.sh first" >&2; exit 1; }
|
|
|
|
|
|
|
|
|
|
if ! id kokkoja >/dev/null 2>&1; then
|
|
|
|
|
useradd --system --no-create-home --shell /usr/sbin/nologin kokkoja
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# Python with the websockets library, in a virtual environment of its own.
|
|
|
|
|
if ! python3 -c 'import ensurepip' >/dev/null 2>&1; then
|
|
|
|
|
apt-get install -y python3-venv
|
|
|
|
|
fi
|
|
|
|
|
if [ ! -x /opt/kokkoja/venv/bin/python ]; then
|
|
|
|
|
python3 -m venv /opt/kokkoja/venv
|
|
|
|
|
fi
|
|
|
|
|
/opt/kokkoja/venv/bin/pip install --quiet --upgrade pip
|
|
|
|
|
/opt/kokkoja/venv/bin/pip install --quiet -r "$incoming/relay/requirements.txt"
|
|
|
|
|
|
|
|
|
|
# The relay's code, and the client.
|
|
|
|
|
rm -rf /opt/kokkoja/relay
|
|
|
|
|
cp -r "$incoming/relay" /opt/kokkoja/relay
|
|
|
|
|
chmod -R a+rX /opt/kokkoja/relay
|
|
|
|
|
mkdir -p /var/www/kokkoja
|
|
|
|
|
rsync -a --delete "$incoming/client/" /var/www/kokkoja/
|
|
|
|
|
chmod -R a+rX /var/www/kokkoja
|
|
|
|
|
|
|
|
|
|
# The service.
|
|
|
|
|
install -m 644 "$incoming/deploy/kokkoja-relay.service" /etc/systemd/system/kokkoja-relay.service
|
|
|
|
|
systemctl daemon-reload
|
|
|
|
|
systemctl enable --quiet kokkoja-relay.service
|
|
|
|
|
systemctl restart kokkoja-relay.service
|
|
|
|
|
|
|
|
|
|
# The nginx site. Once certbot has edited the installed copy, it is not
|
|
|
|
|
# replaced: certbot's additions would be lost.
|
|
|
|
|
if [ ! -e /etc/nginx/sites-available/kokkoja ]; then
|
|
|
|
|
install -m 644 "$incoming/deploy/nginx-site.conf" /etc/nginx/sites-available/kokkoja
|
|
|
|
|
elif ! grep -q "managed by Certbot" /etc/nginx/sites-available/kokkoja; then
|
|
|
|
|
install -m 644 "$incoming/deploy/nginx-site.conf" /etc/nginx/sites-available/kokkoja
|
|
|
|
|
else
|
|
|
|
|
echo "nginx site left as certbot made it; compare with deploy/nginx-site.conf by hand"
|
|
|
|
|
fi
|
|
|
|
|
ln -sf ../sites-available/kokkoja /etc/nginx/sites-enabled/kokkoja
|
|
|
|
|
nginx -t
|
|
|
|
|
systemctl reload nginx
|
|
|
|
|
|
|
|
|
|
systemctl --no-pager --lines=3 status kokkoja-relay.service || true
|
|
|
|
|
echo "Kokkoja server is set up."
|
