deploy/scripts/bootstrap-certs.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+set -a
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
+    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
+    exit 1
+fi
+
+LIVE_DIR="${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}"
+
+if [[ -f "${LIVE_DIR}/fullchain.pem" ]]; then
+    echo "Certificates already exist at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
+    exit 1
+fi
+
+mkdir -p "$LIVE_DIR"
+
+openssl req -x509 -nodes -newkey rsa:2048 -days 1 \
+    -keyout "${LIVE_DIR}/privkey.pem" \
+    -out "${LIVE_DIR}/fullchain.pem" \
+    -subj "/CN=${CLEARNET_DOMAIN}"
+
+echo "Temporary self-signed certificates created at deploy/certs/live/${CLEARNET_DOMAIN}"

deploy/scripts/deploy.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}. Copy .env.example to .env.prod and configure it." >&2
+    exit 1
+fi
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml up -d --build
+
+echo "Pruning unused Docker data older than 24h..."
+docker system prune -af --filter "until=24h"

deploy/scripts/issue-certs.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+CERTBOT_EMAIL=""
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") --email you@example.com
+
+Obtain Let's Encrypt certificates for CLEARNET_DOMAIN and www.CLEARNET_DOMAIN using
+the webroot challenge. Nginx must be running and serving /.well-known/acme-challenge/
+from deploy/certbot/www.
+
+Environment is read from .env.prod (CLEARNET_DOMAIN).
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --email)
+            CERTBOT_EMAIL="$2"
+            shift 2
+            ;;
+        -h | --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+set -a
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${CLEARNET_DOMAIN:-}" ]]; then
+    echo "CLEARNET_DOMAIN is not set in .env.prod" >&2
+    exit 1
+fi
+
+if [[ -z "$CERTBOT_EMAIL" ]]; then
+    echo "Pass --email for Let's Encrypt registration." >&2
+    usage >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot certonly \
+    --webroot \
+    -w /var/www/certbot \
+    -d "$CLEARNET_DOMAIN" \
+    -d "www.${CLEARNET_DOMAIN}" \
+    --email "$CERTBOT_EMAIL" \
+    --agree-tos \
+    --non-interactive
+
+if [[ ! -f "${ROOT_DIR}/deploy/certs/live/${CLEARNET_DOMAIN}/fullchain.pem" ]]; then
+    echo "Expected certificates at deploy/certs/live/${CLEARNET_DOMAIN}" >&2
+    exit 1
+fi
+
+echo "Certificates issued at deploy/certs/live/${CLEARNET_DOMAIN}"
+echo "Reload nginx: docker compose --env-file .env.prod -f docker-compose.prod.yml exec nginx nginx -s reload"

deploy/scripts/renew-certs.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+mkdir -p "${ROOT_DIR}/deploy/certbot/www" "${ROOT_DIR}/deploy/certs"
+
+docker run --rm \
+    -v "${ROOT_DIR}/deploy/certbot/www:/var/www/certbot" \
+    -v "${ROOT_DIR}/deploy/certs:/etc/letsencrypt" \
+    certbot/certbot renew \
+    --webroot \
+    -w /var/www/certbot
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec nginx nginx -s reload
+
+echo "Certificate renewal complete; nginx reloaded."

deploy/scripts/show-onion.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${ROOT_DIR}/.env.prod"
+
+cd "$ROOT_DIR"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "Missing ${ENV_FILE}" >&2
+    exit 1
+fi
+
+docker compose --env-file "$ENV_FILE" -f docker-compose.prod.yml exec tor \
+    cat /var/lib/tor/hs/hostname

deploy/scripts/update.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+cd "$ROOT_DIR"
+
+git pull
+
+"${ROOT_DIR}/deploy/scripts/deploy.sh"

deploy/tor/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:3.20
+
+RUN apk add --no-cache tor
+
+COPY torrc /etc/tor/torrc
+
+CMD ["tor", "-f", "/etc/tor/torrc"]

deploy/tor/torrc

@@ -0,0 +1,5 @@
+SocksPort 0
+Log notice stdout
+
+HiddenServiceDir /var/lib/tor/hs/
+HiddenServicePort 80 nginx:8080