Dernière activité 1686796595

install-ff-syncserver.sh Brut
1#!/bin/bash
2
3
4
5IMPORTANT: make sure to edit the mysql connection info. The lines you need to edit look like this:
6
7mysql://firefox_sync:ecaith8ezieMe7oowies0shee0oj9zii@172.0.2.106/firefox_tokenserver
8
9exit 1
10
11
12if [ "$EUID" -ne 0 ]; then
13 echo "Please run as root"
14 exit
15fi
16
17sudo apt install cmake gcc golang libcurl4-openssl-dev libssl-dev make pkg-config libmariadb-dev-compat mariadb-client python3.10-venv python3-dev
18
19git clone https://github.com/mozilla-services/syncstorage-rs.git /srv/syncstorage
20
21cd /srv/syncstorage
22
23adduser ffsync --system
24chown -R ffsync:nogroup /srv/syncstorage
25
26sudo -H -u ffsync bash -c "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh"
27
28apt install -y nginx
29
30echo '''server {
31 listen 443 ssl http2 default_server;
32 server_name _;
33 ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
34 ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
35 location / {
36 proxy_pass http://127.0.0.1:8000$request_uri;
37 }
38 include /etc/nginx/snippets/ssl-params.conf;
39}''' >/etc/nginx/sites-enabled/default
40
41openssl req -x509 -nodes -days 99999 -newkey rsa:4096 \
42 -subj "/C=PE/ST=Lima/L=Lima/O=Acme Inc. /OU=IT Department/CN=acme.com" \
43 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
44openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
45
46echo """ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
47ssl_prefer_server_ciphers on;
48ssl_ciphers \"EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\";
49ssl_ecdh_curve secp384r1;
50ssl_session_cache shared:SSL:10m;
51ssl_session_tickets off;
52ssl_stapling on;
53ssl_stapling_verify on;
54resolver 8.8.8.8 8.8.4.4 valid=300s;
55resolver_timeout 5s;
56add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains\";
57add_header X-Frame-Options DENY;
58add_header X-Content-Type-Options nosniff;
59ssl_dhparam /etc/ssl/certs/dhparam.pem;""" >/etc/nginx/snippets/ssl-params.conf
60
61systemctl enable --now nginx
62systemctl restart nginx
63systemctl status --no-pager nginx
64
65
66sudo -u ffsync bash -c "/home/ffsync/.cargo/bin/cargo install diesel_cli --no-default-features --features mysql"
67sudo -H -u ffsync bash -c "/home/ffsync/.cargo/bin/diesel --database-url 'mysql://firefox_sync:ecaith8ezieMe7oowies0shee0oj9zii@172.0.2.106/firefox_syncstorage' migration --migration-dir syncstorage-mysql/migrations run"
68sudo -H -u ffsync bash -c "/home/ffsync/.cargo/bin/diesel --database-url 'mysql://firefox_sync:ecaith8ezieMe7oowies0shee0oj9zii@172.0.2.106/firefox_tokenserver' migration --migration-dir tokenserver-db/migrations run"
69
70mysql -u firefox_sync -p"ecaith8ezieMe7oowies0shee0oj9zii" -h 172.0.2.106 -P 3306 <<EOF
71USE firefox_tokenserver
72INSERT INTO services (id, service, pattern) VALUES
73 (1, "sync-1.5", "{node}/1.5/{uid}");
74EOF
75
76sudo -H -u ffsync bash -c "venv/bin/pip install -r tools/tokenserver/requirements.txt"
77sudo -H -u ffsync bash -c "SYNC_TOKENSERVER__DATABASE_URL='mysql://firefox_sync:ecaith8ezieMe7oowies0shee0oj9zii@172.0.2.106/firefox_tokenserver' venv/bin/python3 tools/tokenserver/add_node.py https://ffsync.example.com 1000"
78
79sudo -H -u ffsync bash -c "/home/ffsync/.cargo/bin/cargo clean; /home/ffsync/.cargo/bin/cargo build"
80
81echo '''#!/bin/bash
82source venv/bin/activate; PATH="/srv/syncstorage/venv/bin:$PATH" PYTHONPATH=$PYTHON_SITE_PACKGES RUST_LOG=debug RUST_BACKTRACE=full /srv/syncstorage/target/debug/syncserver --config /srv/syncstorage/config/local.toml''' >/srv/syncstorage/start.sh
83chmod +x /srv/syncstorage/start.sh
84
85echo """[Unit]
86Description=Firefox Sync Server
87After=network.target
88
89[Service]
90Type=simple
91User=ffsync
92WorkingDirectory=/srv/syncstorage/
93ExecStart=/bin/bash /srv/syncstorage/start.sh
94Restart=on-failure
95
96[Install]
97WantedBy=multi-user.target
98""" >/etc/systemd/system/ffsync.service
99
100systemctl daemon-reload
101systemctl enable --now ffsync
102systemctl status --no-pager ffsync
103journalctl -b -f -u ffsync
104
105echo "\n\n\nNow, read the instructions at the end of this installer to set everything else up"
106exit 0
107
108# Nginx edge proxy
109"""
110server
111{
112 listen 80;
113 listen [::]:80;
114 server_name ffsync.example.com;
115 add_header Strict-Transport-Security "max-age=0;";
116 return 301 https://$server_name$request_uri;
117}
118
119
120server
121{
122 listen 443 ssl http2;
123 listen [::]:443 ssl http2;
124 server_name ffsync.example.com;
125
126 client_max_body_size 100M;
127
128 location /
129 {
130 proxy_pass https://172.0.2.121$request_uri;
131 proxy_set_header X-Forwarded-Proto $scheme;
132 proxy_set_header X-Real-IP $remote_addr;
133 proxy_set_header X-Forwarded-Host $host:$server_port;
134 proxy_set_header X-Forwarded-Server $host;
135 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
136 }
137
138 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
139 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
140 include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
141 ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
142 include /etc/nginx/includes/vhost-log.conf;
143}
144"""
145
146# Firefox Settings:
147# identity.sync.tokenserver.uri: https://ffsync.example.com/1.0/sync/1.5
148
149# for android, make sure you arent logged in when changing the sync server url. change the url when you are not signed in
150# the server is just https://ffsync.example.com