310 lines
9.1 KiB
Bash
310 lines
9.1 KiB
Bash
#!/bin/bash
|
|
|
|
# ==========================================
|
|
# WKVS Full Stack Installation Script
|
|
# Autor: Euria
|
|
# Datum: 2026-04-20
|
|
# ==========================================
|
|
|
|
set -e # Stoppt das Skript bei jedem Fehler
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
echo ""
|
|
echo ""
|
|
echo "=========================================="
|
|
echo " WKVS Full Stack Installation"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo ""
|
|
read -p "Dieses Skript funktioniert nur auf einer leeren Linux Instalation. Fohrtfahren? [y/n/c]: " choiceInstall
|
|
|
|
case $choiceInstall in
|
|
[yY]*) ;;
|
|
[nN]*)
|
|
echo "Installation abgebrochen."
|
|
exit 0
|
|
;;
|
|
[cC]*)
|
|
echo "Installation abgebrochen."
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Ungültige Eingabe."
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# --- 1. System Update & Basisinstallation ---
|
|
echo "Schritt 1: System aktualisieren und Basis-Pakete installieren..."
|
|
sudo apt update
|
|
sudo apt install -y mariadb-server apache2 nginx curl dig certbot python3-certbot-nginx
|
|
|
|
# --- 2. MariaDB Installation & Konfiguration ---
|
|
echo "Schritt 2: MariaDB Konfiguration..."
|
|
|
|
read -p "Willst du die Installation komplett automatisch abschließen? [y/n/c]: " choice
|
|
|
|
case $choice in
|
|
[yY]*)
|
|
PREFIX=$(openssl rand -hex 3)
|
|
DB_NAME="${PREFIX}_wkvs_db"
|
|
DB_USER_NORMAL="${PREFIX}_wkvs_user"
|
|
DB_USER_GUEST="${PREFIX}_wkvs_guest"
|
|
DB_PASS_NORMAL=$(openssl rand -base64 24)
|
|
DB_PASS_GUEST=$(openssl rand -base64 24)
|
|
DB_PORT="3306"
|
|
AUTO_INSTALL="true"
|
|
;;
|
|
[nN]*)
|
|
read -p "Name der Datenbank: " DB_NAME
|
|
read -sp "Passwort für $DB_USER_NORMAL: " DB_PASS_NORMAL
|
|
echo ""
|
|
read -p "Name des Gastbenutzers: " DB_USER_GUEST
|
|
read -sp "Passwort für $DB_USER_GUEST: " DB_PASS_GUEST
|
|
echo ""
|
|
read -p "Custom Port (Standard 3306): " DB_PORT
|
|
DB_PORT=${DB_PORT:-3306}
|
|
AUTO_INSTALL="false"
|
|
;;
|
|
[cC]*)
|
|
echo "Installation abgebrochen."
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Ungültige Eingabe."
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# MariaDB Port umstellen (falls Custom)
|
|
if [ "$DB_PORT" != "3306" ]; then
|
|
echo " Stelle MariaDB auf Port $DB_PORT um..."
|
|
if [ -f /etc/mysql/mariadb.conf.d/50-server.cnf ]; then
|
|
sudo sed -i "s/.*port\s*=\s*3306/port = $DB_PORT/" /etc/mysql/mariadb.conf.d/50-server.cnf
|
|
sudo systemctl restart mariadb
|
|
else
|
|
echo " Fehler: Konfigurationsdatei nicht gefunden."
|
|
exit 1
|
|
fi
|
|
else
|
|
sudo systemctl restart mariadb
|
|
fi
|
|
|
|
# --- 3. Datenbank Setup ---
|
|
echo "Schritt 3: Datenbank und Benutzer erstellen..."
|
|
sudo mysql -P "$DB_PORT" <<EOF
|
|
CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\`;
|
|
|
|
-- Normaler User
|
|
CREATE USER IF NOT EXISTS \`$DB_USER_NORMAL\`@'127.0.0.1' IDENTIFIED BY '$DB_PASS_NORMAL';
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON \`${DB_NAME}\`.* TO \`${DB_USER_NORMAL}\`@'127.0.0.1';
|
|
|
|
-- Gast User (Nur SELECT)
|
|
CREATE USER IF NOT EXISTS \`$DB_USER_GUEST\`@'127.0.0.1' IDENTIFIED BY '$DB_PASS_GUEST';
|
|
GRANT SELECT ON \`${DB_NAME}\`.* TO \`${DB_USER_GUEST}\`@'127.0.0.1';
|
|
|
|
FLUSH PRIVILEGES;
|
|
EOF
|
|
|
|
# --- 4. Environment Files & SQL Import ---
|
|
mkdir -p config
|
|
|
|
cat <<EOT > config/.env.db
|
|
DB_USER=$DB_USER_NORMAL
|
|
DB_PASSWORD=$DB_PASS_NORMAL
|
|
DB_NAME=$DB_NAME
|
|
DB_HOST=127.0.0.1
|
|
DB_PORT=$DB_PORT
|
|
EOT
|
|
|
|
cat <<EOT > config/.env.db-guest
|
|
DB_GUEST_USER=$DB_USER_GUEST
|
|
DB_GUEST_PASSWORD=$DB_PASS_GUEST
|
|
DB_NAME=$DB_NAME
|
|
DB_HOST=127.0.0.1
|
|
DB_PORT=$DB_PORT
|
|
EOT
|
|
|
|
# SQL Import (falls vorhanden)
|
|
if [ -f "setup/database/generate-sql.php" ]; then
|
|
echo " Generiere SQL-Struktur..."
|
|
php setup/database/generate-sql.php
|
|
fi
|
|
|
|
if [ -f "setup/database/sql-database.sql" ]; then
|
|
echo " Importiere Datenbank-Struktur..."
|
|
sudo mysql -P "$DB_PORT" "$DB_NAME" < setup/database/sql-database.sql
|
|
echo " Datenbank-Schema erfolgreich importiert."
|
|
else
|
|
echo " Warnung: SQL-Datei nicht gefunden. Import übersprungen."
|
|
fi
|
|
|
|
# --- 5. Verschlüsselungsschlüssel ---
|
|
if [ "$AUTO_INSTALL" = "true" ]; then
|
|
ENCRYPTION_KEY=$(openssl rand -base64 32)
|
|
echo " Automatischer Modus: Verschlüsselungsschlüssel generiert."
|
|
else
|
|
read -sp "Schlüssel zur symmetrischen Verschlüsselung (durch WK-Leitung): " ENCRYPTION_KEY
|
|
echo ""
|
|
fi
|
|
|
|
cat <<EOT > config/.env.pw-encryption-key
|
|
PW_ENCRYPTION_KEY=$ENCRYPTION_KEY
|
|
EOT
|
|
|
|
# --- 6. Composer & PHP Dependencies ---
|
|
if ! command -v composer &> /dev/null; then
|
|
echo " Composer wird installiert..."
|
|
sudo apt install -y composer
|
|
fi
|
|
|
|
echo " Installiere Composer Pakete..."
|
|
composer require vlucas/phpdotenv
|
|
composer require phpmailer/phpmailer
|
|
composer require shuchkin/simplexlsx
|
|
composer require sprain/swiss-qr-bill
|
|
composer require james-heinrich/getid3
|
|
composer require chriskonnertz/string-calc
|
|
composer require tecnickcom/tcpdf
|
|
|
|
# --- 7. Node.js WebSocket ---
|
|
cd websocket || { echo "Fehler: websocket Ordner nicht gefunden!"; exit 1; }
|
|
|
|
npm init -y
|
|
npm install redis ws dotenv
|
|
npm install -g pm2
|
|
cd ..
|
|
|
|
echo " WebSocket (Node.js) Installation abgeschlossen."
|
|
|
|
# --- 8. Apache & Nginx Konfiguration ---
|
|
echo "Schritt 8: Webserver konfigurieren..."
|
|
|
|
# Apache auf internen Port umstellen
|
|
APACHE_INTERNAL_PORT=8080
|
|
if grep -q "Listen 80" /etc/apache2/ports.conf 2>/dev/null; then
|
|
sudo sed -i "s/^Listen 80$/Listen $APACHE_INTERNAL_PORT/" /etc/apache2/ports.conf
|
|
# Falls Default VHost auch 80 hat
|
|
if [ -f /etc/apache2/sites-enabled/000-default.conf ]; then
|
|
sudo sed -i "s/Listen 80/Listen $APACHE_INTERNAL_PORT/" /etc/apache2/sites-enabled/000-default.conf 2>/dev/null || true
|
|
fi
|
|
fi
|
|
sudo systemctl restart apache2
|
|
echo " Apache auf internen Port $APACHE_INTERNAL_PORT umgestellt."
|
|
|
|
# --- 9. Nginx Reverse Proxy & SSL ---
|
|
echo "Schritt 9: Nginx Reverse Proxy & HTTPS einrichten..."
|
|
|
|
read -p "Domain der Webseite: (Beispiel: wk.wkvs.ch) " DOMAIN
|
|
|
|
if [ -z "$DOMAIN" ]; then
|
|
echo "❌ FEHLER: Die Domain darf nicht leer sein!"
|
|
exit 1
|
|
fi
|
|
|
|
DOMAIN=$(echo "$DOMAIN" | xargs)
|
|
|
|
# DNS Prüfung
|
|
echo " DNS-Prüfung für $DOMAIN..."
|
|
RESOLVED_IP=$(dig +short $DOMAIN 2>/dev/null | head -n1)
|
|
SERVER_IP=$(curl -s https://api.ipify.org 2>/dev/null)
|
|
|
|
if [ -z "$RESOLVED_IP" ]; then
|
|
echo "❌ FEHLER: Domain '$DOMAIN' kann nicht aufgelöst werden."
|
|
echo " Bitte warten Sie, bis die DNS-Einträge aktiv sind."
|
|
exit 1
|
|
fi
|
|
|
|
if [ -n "$SERVER_IP" ] && [ "$RESOLVED_IP" != "$SERVER_IP" ]; then
|
|
echo "⚠️ WARNUNG: Domain zeigt auf $RESOLVED_IP, Server ist $SERVER_IP."
|
|
echo " Bitte prüfen Sie Ihre DNS-Einträge."
|
|
read -p "Möchten Sie trotzdem fortfahren? [y/n]: " confirm
|
|
if [ "$confirm" != "y" ]; then
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
# Nginx Konfiguration erstellen
|
|
NGINX_CONF="/etc/nginx/sites-available/$DOMAIN"
|
|
NGINX_LINK="/etc/nginx/sites-enabled/$DOMAIN"
|
|
|
|
rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
|
|
rm -f "$NGINX_CONF" 2>/dev/null || true
|
|
|
|
cat > "$NGINX_CONF" <<EOF
|
|
# HTTP -> HTTPS Weiterleitung
|
|
server {
|
|
listen 80;
|
|
server_name $DOMAIN;
|
|
return 301 https://\$host\$request_uri;
|
|
}
|
|
|
|
# HTTPS Server
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name $DOMAIN;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
# WebSocket Route
|
|
location /ws/ {
|
|
proxy_pass http://127.0.0.1:8082;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_connect_timeout 75s;
|
|
}
|
|
|
|
# Versteckte Dateien
|
|
location ~ /\. {
|
|
deny all;
|
|
access_log off;
|
|
log_not_found off;
|
|
}
|
|
|
|
# Apache Proxy
|
|
location / {
|
|
proxy_pass http://127.0.0.1:$APACHE_INTERNAL_PORT;
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
sudo ln -sf "$NGINX_CONF" "$NGINX_LINK"
|
|
|
|
# Let's Encrypt Zertifikat
|
|
echo " Starte Let's Encrypt Zertifikatsanfrage..."
|
|
read -p "E-Mail für Let's Encrypt: " EMAIL
|
|
|
|
sudo certbot --nginx -d $DOMAIN --agree-tos --no-eff-email --redirect --email "$EMAIL" --non-interactive
|
|
|
|
# Dienste neu starten
|
|
sudo systemctl reload nginx
|
|
sudo systemctl restart apache2
|
|
|
|
echo "=========================================="
|
|
echo "✅ Installation erfolgreich abgeschlossen!"
|
|
echo "=========================================="
|
|
echo "Zusammenfassung:"
|
|
echo "- Datenbank: $DB_NAME (Port: $DB_PORT)"
|
|
echo "- Apache intern: Port $APACHE_INTERNAL_PORT"
|
|
echo "- Node.js WS: Port 8082 (unter /ws/)"
|
|
echo "- HTTPS: https://$DOMAIN/intern/wk-leitung/logindata"
|
|
echo ""
|
|
echo "Nächste Schritte:"
|
|
echo "1. Starten Sie den WebSocket Server: cd websocket && pm2 start app.js"
|
|
echo "2. Testen Sie die Seite: https://$DOMAIN/intern/wk-leitung/logindata" |