Fix.

diff --git a/bookworm/copy/server/etc/caddy/Caddyfile b/bookworm/copy/server/etc/caddy/Caddyfile
index 1eddd8379209dedf13ba1cf2f1e52c34a4e7439e..36e54b21a0efd7309d1ad8be18ea70e39d737916 100644 (file)
--- a/bookworm/copy/server/etc/caddy/Caddyfile
+++ b/bookworm/copy/server/etc/caddy/Caddyfile
@@ -1,7 +1,10 @@
 REPLACE_WITH_FQDN {
-    root * /var/www/dump
-    basicauth /private/* {
-        user REPLACE_WITH_HASH
-    }
-    file_server browse
+       root * /var/www/dump
+       basicauth /private/* {
+               user REPLACE_WITH_HASH
+       }
+       header {
+               Content-Type application/octet-stream
+       }
+       file_server browse
 }

diff --git a/bookworm/scripts/setup_server.sh b/bookworm/scripts/setup_server.sh
index 09545d1e3503376caa64507ada36ce4a76e7ba7d..82c0b76a4d102c21457bf34ff6661f5df0081e16 100755 (executable)
--- a/bookworm/scripts/setup_server.sh
+++ b/bookworm/scripts/setup_server.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 set -e
 cd $(dirname "$0")
-. lib/apt_digested.sh
+. lib/apt_get_digested.sh
 . lib/constants_etc.sh  # PATH_ETC
 . lib/constants_ssh.sh  # PATH_REL_SSH, PATH_USER_SSH
 . lib/constants_user.sh  # USERNAME
@@ -9,6 +9,7 @@ cd $(dirname "$0")
 . lib/core_setup.sh
 . lib/expect_n_args.sh
 . lib/prefixed_msg.sh
+. lib/put_finished_marker.sh
 . lib/trapp.sh
 
 prefixed_msg_init
@@ -23,6 +24,7 @@ FQDN="$3"
 
 PATH_BORG_HOME=/home/borg
 PATH_CADDYFILE="${PATH_ETC}/caddy/Caddyfile"
+PATH_CADDY_REPO='https://dl.cloudsmith.io/public/caddy/stable'
 PATH_DUMP='/var/www/dump'
 
 prefixed_msg_no_nl 'Determining external IP …'
@@ -47,6 +49,26 @@ if [ ! -z "${FQDN}" ]; then
     fi
 fi
 
+prefixed_msg 'Ensure we have curl and gpg (for caddy installation preparation) …'
+apt_get_digested '-q -q install curl gpg'
+PATH_CURL_ERROR=$(mktemp)
+CMD_RM_CURL_ERROR="rm ${PATH_CURL_ERROR}"
+trapp "${CDM_RM_CURL_ERROR}"
+prefixed_msg 'Retrieve caddy repo key …'
+set +e
+curl -1Lf "${PATH_CADDY_REPO}/gpg.key" 2> "${PATH_CURL_ERROR}" | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+RESULT="$?"
+set -e
+if [ "${RESULT}" != '0' ]; then
+    cat "${PATH_CURL_ERROR}"
+    exit 1
+fi
+${CMD_RM_CURL_ERROR}
+trapp
+PATH_APT_CADDY_REPO='/etc/apt/sources.list.d/caddy-stable.list'
+prefixed_msg "Adding caddy repo to ${PATH_APT_CADDY_REPO} …"
+curl -1LfsS "${PATH_CADDY_REPO}/debian.deb.txt" > "${PATH_APT_CADDY_REPO}"
+
 core_setup "${HOSTNAME}" "${FQDN}" "${EXTERNAL_IP}" "${INSTALL_TAGS}"
 
 prefixed_msg 'Moving SSH data from root to user …'

diff --git a/trixie/copy/all/etc/hosts b/trixie/copy/all/etc/hosts
deleted file mode 120000 (symlink)
index bd0fd44..0000000
--- a/trixie/copy/all/etc/hosts
+++ /dev/null
@@ -1 +0,0 @@
-../../../../bookworm/copy/all/etc/hosts
\ No newline at end of file

diff --git a/trixie/scripts/lib/core_setup.sh b/trixie/scripts/lib/core_setup.sh
index 83a44cf9ac4b2ec5a333ee1bc0dc5c3698265670..f871ed8c310852a4f4c3a4eea5ad6021b9c2cef3 100644 (file)
--- a/trixie/scripts/lib/core_setup.sh
+++ b/trixie/scripts/lib/core_setup.sh
@@ -28,16 +28,6 @@ core_setup() {
     prefixed_msg 'Setting hostname …'
     hostnamectl hostname "${HOSTNAME}"
 
-    local PATH_HOSTS="${PATH_ETC}/hosts"
-    prefixed_msg "Adapting ${PATH_HOSTS} …"
-    if [ -z "${FQDN}" ]; then
-        sed -i 's/REPLACE_WITH_FQDN/REPLACE_WITH_HOSTNAME.local REPLACE_WITH_HOSTNAME.localdomain/g' "${PATH_HOSTS}"
-    else
-        sed -i 's/REPLACE_WITH_FQDN/'"${FQDN}"'/g' "${PATH_HOSTS}"
-        sed -i "s/#REPLACE_WITH_EXTERNAL_IP/${EXTERNAL_IP}/g" "${PATH_HOSTS}"
-    fi
-    sed -i 's/REPLACE_WITH_HOSTNAME/'"${HOSTNAME}"'/g' "${PATH_HOSTS}"
-
     prefixed_msg 'Syncing clock …'
     ntpdate-debian -s
 

diff --git a/trixie/scripts/setup_server.sh b/trixie/scripts/setup_server.sh
deleted file mode 120000 (symlink)
index d4eabffa12ab14975cec410ff5437646b04f6f61..0000000000000000000000000000000000000000
--- a/trixie/scripts/setup_server.sh
+++ /dev/null
@@ -1 +0,0 @@
-../../bookworm/scripts/setup_server.sh
\ No newline at end of file

diff --git a/trixie/scripts/setup_server.sh b/trixie/scripts/setup_server.sh
new file mode 100755 (executable)
index 0000000000000000000000000000000000000000..09545d1e3503376caa64507ada36ce4a76e7ba7d
--- /dev/null
+++ b/trixie/scripts/setup_server.sh
@@ -0,0 +1,84 @@
+#!/bin/sh
+set -e
+cd $(dirname "$0")
+. lib/apt_digested.sh
+. lib/constants_etc.sh  # PATH_ETC
+. lib/constants_ssh.sh  # PATH_REL_SSH, PATH_USER_SSH
+. lib/constants_user.sh  # USERNAME
+. lib/copy_dirtrees_of_tags.sh
+. lib/core_setup.sh
+. lib/expect_n_args.sh
+. lib/prefixed_msg.sh
+. lib/trapp.sh
+
+prefixed_msg_init
+prefixed_msg 'starting (setting up basics of standard server)'
+
+INSTALL_TAGS='all server user keep_if_installed:systemd-resolved'
+
+expect_n_args 2 3 'CADDY_PASSWORD, HOSTNAME, [FQDN]' $@
+CADDY_PASSWORD="$1"
+HOSTNAME="$2"
+FQDN="$3"
+
+PATH_BORG_HOME=/home/borg
+PATH_CADDYFILE="${PATH_ETC}/caddy/Caddyfile"
+PATH_DUMP='/var/www/dump'
+
+prefixed_msg_no_nl 'Determining external IP …'
+for _CANDIDATE in $(hostname -I); do
+    _START=$(echo ${_CANDIDATE} | cut -d'.' -f1)
+    if [ "$(echo -n ${_START} | wc -c)" -gt 3 ]; then  # ignore IPv6
+        continue
+    fi 
+    if [ "${_START}" = "127" -o "${_START}" = "192" -o "${_START}" = "172" ]; then
+        continue
+    fi
+    EXTERNAL_IP="${_CANDIDATE}"
+    break
+done
+echo " it's: ${EXTERNAL_IP}"
+
+if [ ! -z "${FQDN}" ]; then
+    prefixed_msg "Ensuring provided FQDN ${FQDN} maps to it …"
+    IP_BY_DNS=$(getent ahostsv4 "${FQDN}" | head -1 | cut -d' ' -f1)
+    if [ ! "${IP_BY_DNS}" = "${EXTERNAL_IP}" ]; then
+        abort "DNS mapping provided FQDN '${FQDN}' to ${IP_BY_DNS} rather than this system's external IP ${EXTERNAL_IP}."
+    fi
+fi
+
+core_setup "${HOSTNAME}" "${FQDN}" "${EXTERNAL_IP}" "${INSTALL_TAGS}"
+
+prefixed_msg 'Moving SSH data from root to user …'
+mkdir -p "${PATH_USER_SSH}"
+mv "/root/${PATH_REL_SSH}/authorized_keys" "${PATH_USER_SSH}/"
+chown -R "${USERNAME}:${USERNAME}" "${PATH_USER_SSH}"
+
+prefixed_msg 'Setting up minimal borg user …'
+adduser --quiet --system --home "${PATH_BORG_HOME}" --shell /bin/sh borg
+cp -a "${PATH_USER_SSH}" "${PATH_BORG_HOME}/"
+chown -R borg:nogroup "${PATH_BORG_HOME}/${PATH_REL_SSH}"
+
+prefixed_msg 'Enabling firewall …'
+systemctl --quiet enable --now nftables
+
+prefixed_msg "Creating web-accessible directories …"
+mkdir -p "${PATH_DUMP}/private" "${PATH_DUMP}/public"
+
+prefixed_msg "Adapting ${PATH_CADDYFILE} …"
+CADDY_PW_HASH=$(caddy hash-password --plaintext "${CADDY_PASSWORD}")
+if [ -z "${FQDN}" ]; then
+    ADDRESS_TO_CADDY="${EXTERNAL_IP}"
+else
+    ADDRESS_TO_CADDY="${FQDN}"
+fi
+sed -i 's|REPLACE_WITH_HASH|'"${CADDY_PW_HASH}"'|g' "${PATH_CADDYFILE}"
+sed -i 's/REPLACE_WITH_FQDN/'"${ADDRESS_TO_CADDY}"'/g' "${PATH_CADDYFILE}"
+
+prefixed_msg "Restarting caddy …"
+systemctl reload caddy
+
+prefixed_msg "Asking for user pw so they can sudo …"
+passwd "${USERNAME}"
+
+prefixed_msg_exit