init

2026-08-28 17:31:02 +02:00
commit 2b30e8bd39
694 changed files with 49243 additions and 0 deletions
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+set -a
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
+    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
+    exit 1
+fi
+
+LIVE_DIR="${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}"
+
+if [[ -f "${LIVE_DIR}/fullchain.pem" ]]; then
+    echo "Certificates already exist at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
+    exit 1
+fi
+
+mkdir -p "$LIVE_DIR"
+
+openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
+    -keyout "${LIVE_DIR}/privkey.pem" \
+    -out "${LIVE_DIR}/fullchain.pem" \
+    -subj "/CN=${CLEARNET_DOMAIN}"
+
+echo "Temporary self-signed certificates created at deploy/certs/live/${CLEARNET_DOMAIN}"
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
+    exit 1
+fi
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml up -d --build
+
+echo "Pruning unused Docker data older than 24h..."
+docker system prune -af --filter "until=24h"
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+CERTBOT_EMAIL=""
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") --email you@example.com
+
+Obtain or renew Let's Encrypt certificates for CLEARNET_DOMAIN using the webroot
+challenge. Nginx must be running and serving /.well-known/acme-challenge/ from
+deploy/certbot/www.
+
+Environment is read from .env.prod (CLEARNET_DOMAIN).
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --email)
+            CERTBOT_EMAIL="$2"
+            shift 2
+            ;;
+        -h | --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+set -a
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
+    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
+    exit 1
+fi
+
+if [[ -z "$CERTBOT_EMAIL" ]]; then
+    echo "Pass --email for Let's Encrypt registration." >&2
+    usage >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot certonly \
+    --webroot \
+    -w /var/www/certbot \
+    -d "$CLEARNET_DOMAIN" \
+    --email "$CERTBOT_EMAIL" \
+    --agree-tos \
+    --non-interactive
+
+if [[ ! -f "${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}/fullchain.pem" ]]; then
+    echo "Expected certificates at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
+    exit 1
+fi
+
+echo "Certificates issued at deploy/certs/live/${CLEARNET_DOMAIN}"
+echo "Reload nginx: docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload"
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot renew \
+    --webroot \
+    -w /var/www/certbot
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec nginx nginx -s reload
+
+echo "Certificate renewal complete; nginx reloaded."
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec tor \
+    cat /var/lib/tor/hs/hostname
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+cd "$ROOT_DIR"
+
+git pull
+
+"${ROOT_DIR}/deploy/scripts/deploy.sh"