first commit

install.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_NAME="ts3monolith"
+APP_USER="${APP_USER:-ts3app}"
+APP_GROUP="${APP_GROUP:-ts3app}"
+APP_DIR="${APP_DIR:-/opt/ts3monolith}"
+BIN_SOURCE="${BIN_SOURCE:-./dist/ts3monolith-linux-amd64}"
+ENV_SOURCE="${ENV_SOURCE:-./.env}"
+DATA_SOURCE="${DATA_SOURCE:-./data}"
+SERVICE_FILE="/etc/systemd/system/${APP_NAME}.service"
+
+if [ "${EUID}" -ne 0 ]; then
+  echo "Uruchom jako root: sudo ./install.sh"
+  exit 1
+fi
+
+if [ ! -f "${BIN_SOURCE}" ]; then
+  echo "Brak binarki: ${BIN_SOURCE}"
+  echo "Najpierw uruchom ./build-release.sh albo ustaw BIN_SOURCE=/sciezka/do/binarki"
+  exit 1
+fi
+
+if [ ! -f "${ENV_SOURCE}" ]; then
+  echo "Brak pliku .env: ${ENV_SOURCE}"
+  echo "Utworz .env albo ustaw ENV_SOURCE=/sciezka/do/.env"
+  exit 1
+fi
+
+if ! command -v systemctl >/dev/null 2>&1; then
+  echo "Brak systemd/systemctl. Ten instalator wymaga systemd."
+  exit 1
+fi
+
+if ! command -v rrdtool >/dev/null 2>&1; then
+  echo "UWAGA: rrdtool nie jest zainstalowany."
+  echo "Aplikacja wymaga go do aktualizacji i renderowania RRD."
+fi
+
+if ! getent group "${APP_GROUP}" >/dev/null 2>&1; then
+  groupadd --system "${APP_GROUP}"
+fi
+
+if ! id "${APP_USER}" >/dev/null 2>&1; then
+  useradd \
+    --system \
+    --gid "${APP_GROUP}" \
+    --home-dir "${APP_DIR}" \
+    --shell /usr/sbin/nologin \
+    "${APP_USER}"
+fi
+
+install -d -m 0750 -o "${APP_USER}" -g "${APP_GROUP}" "${APP_DIR}"
+install -d -m 0750 -o "${APP_USER}" -g "${APP_GROUP}" "${APP_DIR}/data"
+
+install -m 0755 -o root -g root "${BIN_SOURCE}" "${APP_DIR}/${APP_NAME}"
+install -m 0640 -o root -g "${APP_GROUP}" "${ENV_SOURCE}" "${APP_DIR}/.env"
+
+if [ -d "${DATA_SOURCE}" ]; then
+  cp -a "${DATA_SOURCE}/." "${APP_DIR}/data/"
+  chown -R "${APP_USER}:${APP_GROUP}" "${APP_DIR}/data"
+fi
+
+cat > "${SERVICE_FILE}" <<SERVICE
+[Unit]
+Description=TS3 Monolith
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${APP_USER}
+Group=${APP_GROUP}
+WorkingDirectory=${APP_DIR}
+EnvironmentFile=${APP_DIR}/.env
+ExecStart=${APP_DIR}/${APP_NAME}
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=${APP_DIR}/data
+LockPersonality=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+
+[Install]
+WantedBy=multi-user.target
+SERVICE
+
+chmod 0644 "${SERVICE_FILE}"
+systemctl daemon-reload
+systemctl enable "${APP_NAME}.service" >/dev/null
+systemctl restart "${APP_NAME}.service"
+
+sleep 1
+
+if systemctl is-active --quiet "${APP_NAME}.service"; then
+  echo
+  echo "OK: ${APP_NAME} dziala."
+  echo "Katalog: ${APP_DIR}"
+  echo "Status:  systemctl status ${APP_NAME}"
+  echo "Logi:    journalctl -u ${APP_NAME} -f"
+else
+  echo
+  echo "Usluga nie wystartowala. Ostatnie logi:"
+  journalctl -u "${APP_NAME}" -n 50 --no-pager || true
+  exit 1
+fi