Skip to content

Commit 7e0adef

Browse files
micahdbakmicahdbak
committed
Initial commit
0 parents  commit 7e0adef

11 files changed

+362
-0
lines changed

‎.gitmodules

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[submodule "backend"]
2+
path = backend
3+
url = https://github.com/CSSS/csss-site-backend
4+
[submodule "frontend"]
5+
path = frontend
6+
url = https://github.com/CSSS/csss-site-frontend
7+
branch = build

‎README.md

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# csss-site-config
2+
3+
This repository contains the server configuration files and deployment scripts necessary for https://new.sfucsss.org.
4+
5+
## SysAdmin / Webmaster
6+
7+
### Fresh Setup
8+
9+
On a fresh machine, preferably running Debian 12, get the `fresh_setup.sh` script with the following:
10+
11+
`wget https://raw.githubusercontent.com/CSSS/csss-site-config/refs/heads/master/fresh_setup.sh`
12+
13+
`chmod +x fresh_setup.sh`
14+
15+
`./fresh_setup.sh`
16+
17+
And run it as the superuser. (The server will be completely prepared and deployed.)
18+
19+
### Cloning With Submodules
20+
21+
This repository makes use of git submodules. To clone it, please run:
22+
23+
`git clone [email protected]:CSSS/csss-site-config --recurse-submodules`
24+
25+
If already cloned and you'd like to make changes to the submodules, cd into either backend/frontend and pull, checkout, etc. to set the current state of the submodule, then add the backend/frontend folder via `git add` to update the submodule in the csss-site-config repository.
26+
27+
Alternatively, if you have just pulled recent changes to csss-site-config which has also changed either submodule, run the following to update the submodules' contents:
28+
29+
`git submodule update`
30+
31+
Alternatively, if you would like to update a submodule to the most recent commit from their main/build branch, run the following:
32+
33+
`git submodule update --remote`
34+
35+
And promptly `git add` either backend/frontend folder to update the submodules in the csss-site-config repository.
36+
37+
### Deploying
38+
39+
(Please read the above section for how git submodules work before deploying - don't mess up please.)
40+
41+
The following process should be followed to make a deployment to https://new.sfucsss.org:
42+
43+
- Ensure the changes to be deployed are on the `main` branch of csss-site-backend and the `build` branch of csss-site-frontend.
44+
- Clone the csss-site-config repository on your local development machine (see the above section on Cloning With Submodules).
45+
- Run: `git submodule update --remote` from inside the csss-site-config repository to pull the to be deployed changes from csss-site-backend and csss-site-frontend.
46+
- Run: `git add backend frontend` to make csss-site-config acknowledge the new commits to either submodule.
47+
- Run: `git commit -m "(your-commit-message)" && git push origin master` to update the csss-site-config repository.
48+
- SSH into the https://new.sfucsss.org server as the root user.
49+
- Run: `cd /home/csss-site/csss-site-config` to enter the csss-site-config repository.
50+
- Run: `git pull origin master` to pull new commits.
51+
- Run: `git submodule update` to make sure either submodule is up-to-date.
52+
- Run: `./deploy.sh` as the root user to deploy the backend and frontend.
53+
54+
When this script is finished executing, confirm that the deployment was successful by checking the site.
55+
56+
### Update Configs / Update HTTPS Certificates
57+
58+
To update any configuration files including the HTTPS certificates:
59+
60+
- SSH into the https://new.sfucsss.org server as the root user.
61+
- Run: `cd /home/csss-site/csss-site-config` to enter the csss-site-config repository.
62+
- Run: `git pull origin master` to pull new commits.
63+
- Run: `git submodule update` to make sure either submodule is up-to-date.
64+
- Run: `./update_config.sh` as the root user to update all configuration files.
65+
66+
When this script is finished executing, confirm that the update was successful by checking the site.
67+
68+
Certbot is run as one of the steps, so interact with certbot as necessary to update the HTTPS certificates.
69+
70+
If you are updating other configuration files and don't need to request new HTTPS certificates, simply choose the option to reinstall the existing certificates instead of requesting new ones.

‎backend

Submodule backend added at efe6e59

‎csss-site.service

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=CSSS Backend
3+
After=network.target
4+
StartLimitIntervalSec=0
5+
6+
[Service]
7+
Type=simple
8+
Restart=always
9+
RestartSec=1
10+
User=csss-site
11+
ExecStart=/home/csss-site/csss-site-config/gunicorn_start.sh
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎deploy.sh

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
3+
# make sure user is root
4+
user=$(whoami)
5+
if [ $user != 'root' ]; then
6+
echo "this script must be run as the superuser."
7+
exit 1
8+
fi
9+
10+
cd /home/csss-site/csss-site-config
11+
if [ $? -ne 0 ]; then
12+
echo "couldn't enter directory /home/csss-site/csss-site-config."
13+
echo "stopping here."
14+
exit 1
15+
fi
16+
17+
echo "----"
18+
echo "(re)starting csss-site service..."
19+
systemctl restart csss-site.service # restart backend
20+
21+
echo "----"
22+
echo "clearing /var/www/html..."
23+
rm -Rf /var/www/html/*
24+
25+
# selectively copy build files to /var/www/html
26+
echo "----"
27+
echo "copying from csss-site-frontend to /var/www/html..."
28+
cp -Rf ./frontend/* /var/www/html
29+
30+
echo "----"
31+
echo "all done!"

‎fresh_setup.sh

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
#!/bin/bash
2+
3+
# this is a script for seting up the website from a fresh install
4+
5+
# NOTE: it should be downloaded directly onto the machine to be set-up with:
6+
# - wget https://raw.githubusercontent.com/CSSS/csss-site-config/refs/heads/master/fresh_setup.sh
7+
8+
# TODO:
9+
# - look into `apt install unattended-upgrades`
10+
# - look into activating fail2ban for ssh protection (I doubt we'll need this unless we get too much random traffic)
11+
12+
# make sure user is root
13+
user=$(whoami)
14+
if [ $user != 'root' ]; then
15+
echo "this script must be run as the superuser."
16+
exit 1
17+
fi
18+
19+
echo "hi sysadmin!"
20+
echo "this script will install (almost) everything needed to run the csss website"
21+
echo "(make sure you are running on a Debian 12 Linux machine as the superuser!)"
22+
23+
echo "(P)roceed, (c)ancel?"
24+
read choice
25+
26+
# if choice isn't (P)roceed, just cancel
27+
if [ $choice != 'P' ]; then
28+
echo "OK, cancelling."
29+
exit 0
30+
fi
31+
32+
echo "----"
33+
echo "configure apt sources..."
34+
echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list
35+
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
36+
37+
echo "----"
38+
echo "update and upgrade apt..."
39+
apt update && apt upgrade -y
40+
41+
echo "----"
42+
echo "install packages..."
43+
apt install git software-properties-common python3.11 python3.11-venv libaugeas0 nginx postgresql-15 postgresql-contrib -y
44+
# install certbot
45+
python3 -m venv /opt/certbot
46+
/opt/certbot/bin/pip install --upgrade pip
47+
/opt/certbot/bin/pip install certbot certbot-nginx
48+
ln -s /opt/certbot/bin/certbot /usr/bin/certbot
49+
50+
echo "----"
51+
echo "add user csss_site..."
52+
useradd csss-site -m # -m: has home /home/csss-site
53+
usermod -L csss-site # -L: cannot login
54+
chsh -s /usr/bin/bash csss-site # make user csss-site use the bash shell
55+
cd /home/csss-site
56+
57+
echo "----"
58+
echo "clone repository csss-site-config..."
59+
sudo -u csss-site git clone https://github.com/CSSS/csss-site-config --recurse-submodules
60+
cd csss-site-config
61+
62+
echo "----"
63+
echo "configure sudo..."
64+
cp ./sudoers.conf /etc/sudoers.d/csss-site
65+
66+
echo "----"
67+
echo "configure nginx..."
68+
# www-data and /var/www stuff
69+
usermod -aG www-data csss-site
70+
mkdir /var/www/logs
71+
mkdir /var/www/logs/csss-site-backend
72+
chown -R www-data:www-data /var/www
73+
chmod -R ug=rwx,o=rx /var/www
74+
# nginx config files
75+
cp ./nginx.conf /etc/nginx/sites-available/csss-site
76+
# remove default configuration to prevent funky certbot behaviour
77+
rm /etc/nginx/sites-enabled/default
78+
79+
# prompt user to modify the nginx configuration if they so please
80+
echo "Do you want to modify the nginx configuration file?"
81+
while true; do
82+
echo "(M)odify, (c)ontinue?"
83+
read choice
84+
85+
if [ $choice = 'M' ]; then
86+
vim /etc/nginx/sites-available/csss-site
87+
break
88+
elif [ $choice = 'c' ]; then
89+
break
90+
else
91+
echo "Not sure what you mean..."
92+
fi
93+
done
94+
95+
ln -s /etc/nginx/sites-available/csss-site /etc/nginx/sites-enabled/csss-site
96+
echo "You'll need to fill out the certbot configuration manually."
97+
echo "Use [email protected] for contact email."
98+
certbot --nginx
99+
nginx -t
100+
101+
echo "----"
102+
echo "starting nginx..."
103+
systemctl enable nginx && systemctl start nginx
104+
105+
echo "----"
106+
echo "configure postgres..."
107+
# see https://towardsdatascience.com/setting-up-postgresql-in-debian-based-linux-e4985b0b766f for more details
108+
# NOTE: the installation of postgresql-15 creates the postgres user, which has special privileges
109+
sudo -u postgres createdb --no-password main
110+
sudo -u postgres createuser --no-password csss-site
111+
sudo -u postgres psql --command='GRANT ALL PRIVILEGES ON DATABASE main TO "csss-site"'
112+
sudo -u postgres psql main --command='GRANT ALL ON SCHEMA public TO "csss-site"'
113+
114+
echo "----"
115+
echo "create a virtual environment for csss-site..."
116+
sudo -u csss-site python3.11 -m venv ./.venv
117+
118+
echo "----"
119+
echo "install pip packages for csss-site..."
120+
source ./.venv/bin/activate
121+
cd backend
122+
sudo -u csss-site ../.venv/bin/pip install -r ./requirements.txt
123+
cd .. # back to csss-site-config
124+
deactivate
125+
126+
echo "----"
127+
echo "configure csss-site service..."
128+
cp ./csss-site.service /etc/systemd/system/csss-site.service
129+
systemctl enable csss-site
130+
131+
echo "----"
132+
echo "deploy csss-site..."
133+
./deploy.sh

‎frontend

Submodule frontend added at 27e083e

‎gunicorn_start.sh

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
3+
NAME=csss-site
4+
DIR=/home/csss-site/csss-site-config/backend/src
5+
USER=csss-site
6+
GROUP=csss-site
7+
WORKERS=2 # TODO: should we increase this?
8+
WORKER_CLASS=uvicorn.workers.UvicornWorker
9+
VENV=/home/csss-site/csss-site-config/.venv/bin/activate
10+
BIND=unix:/var/www/gunicorn.sock
11+
LOG_LEVEL=error
12+
13+
cd $DIR
14+
source $VENV
15+
16+
gunicorn main:app \
17+
--name $NAME \
18+
--workers $WORKERS \
19+
--worker-class $WORKER_CLASS \
20+
--user=$USER \
21+
--group=$GROUP \
22+
--bind=$BIND \
23+
--log-level=$LOG_LEVEL \
24+
--log-file=-

‎nginx.conf

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
upstream backend {
2+
server unix:/var/www/gunicorn.sock fail_timeout=0;
3+
}
4+
5+
server {
6+
server_name new.sfucsss.org;
7+
listen 80;
8+
9+
root /var/www/html;
10+
11+
access_log /var/www/logs/csss-site-backend/nginx-access.log;
12+
error_log /var/www/logs/csss-site-backend/nginx-error.log;
13+
14+
# proxy csss-site-backend
15+
location /api/ {
16+
rewrite ^/api/(.*)$ /$1 break;
17+
18+
keepalive_timeout 5;
19+
client_max_body_size 1G; # Was 4G
20+
21+
proxy_set_header Host $host;
22+
proxy_set_header X-Real-IP $remote_addr;
23+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
24+
proxy_set_header X-Forwarded-Proto $scheme;
25+
proxy_pass http://backend;
26+
27+
add_header Access-Control-Allow-Origin https://new.sfucsss.org always;
28+
add_header Access-Control-Allow-Credentials true;
29+
}
30+
31+
# redirects old 2024 mountain madness requests to the new URL
32+
location ~ ^/events/2024/mm(/|/index.html)?$ {
33+
return 301 /mountain_madness/2024/index.html;
34+
}
35+
36+
# any other matching path
37+
location / {
38+
try_files $uri $uri/ $uri/index.html =404;
39+
}
40+
}

‎sudoers.conf

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# enable the csss-site user to deploy the website
2+
csss-site ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/systemctl restart csss-site

‎update_config.sh

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/bash
2+
3+
# make sure user is root
4+
user=$(whoami)
5+
if [ $user != 'root' ]; then
6+
echo "this script must be run as the superuser."
7+
exit 1
8+
fi
9+
10+
cd /home/csss-site/csss-site-config
11+
if [ $? -ne 0 ]; then
12+
echo "couldn't enter directory /home/csss-site/csss-site-config."
13+
echo "stopping here."
14+
exit 1
15+
fi
16+
17+
echo "----"
18+
echo "update sudo..."
19+
cp ./sudoers.conf /etc/sudoers.d/csss-site
20+
21+
echo "----"
22+
echo "update nginx..."
23+
cp ./nginx.conf /etc/nginx/sites-available/csss-site
24+
certbot --nginx # reconfigure the server with SSL certificates
25+
nginx -t
26+
# only restart nginx if config is valid
27+
if [ $? -eq 0 ]; then
28+
systemctl restart nginx
29+
fi
30+
31+
echo "----"
32+
echo "update csss-site service..."
33+
systemd-analyze verify ./csss-site.service
34+
# only use new service if it is valid
35+
if [ $? -eq 0 ]; then
36+
cp ./csss-site.service /etc/systemd/system/csss-site.service
37+
systemctl daemon-reload
38+
systemctl restart csss-site.service
39+
fi

0 commit comments

Comments
 (0)