scripts/install-weblate-docker

#!/bin/bash

set -e

# shellcheck disable=SC1091
. /etc/weblate-bootstrap

if [ "$1" = "--nocert" ] ; then
    HTTPS_STAGE=local
    shift
else
    HTTPS_STAGE=production
fi

if [ "$1" = "--nomail" ] ; then
    IGNORE_CHECKS=,weblate.E003
    shift
else
    IGNORE_CHECKS=""
fi

adduser weblate --disabled-password --gecos Weblate
usermod --append --groups adm weblate
usermod --append --groups docker weblate

WEBLATE_HOME=~weblate
WEBLATE_DOCKER="$WEBLATE_HOME/weblate"

cd /tmp
apt-get update
apt-get install --no-install-recommends -y\
    fail2ban python3-pyinotify python3-systemd \
    nginx \
    openssh-client \
    python3-certbot-nginx

# SSL cert
if [ "$HTTPS_STAGE" = "production" ] ; then
    certbot --agree-tos --email care@weblate.org --redirect --no-eff-email -d "$WEBLATE_DOMAIN"
fi

# Enable http/2
sed -i -e 's/ssl;/ssl http2;/' -e 's/ssl ipv6only=on/ssl ipv6only=on http2/' /etc/nginx/sites-available/default
# Enable status locally
sed -i '/server_name _/a location = /nginx_status {\n    stub_status;\n}'   /etc/nginx/sites-available/default
# Hide server version
sed -i 's/# server_tokens off/server_tokens off/' /etc/nginx/nginx.conf

# Weblate nginx snippet
cat > /etc/nginx/snippets/weblate.conf <<EOT
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host \$host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host \$server_name;
    }
    client_max_body_size 100m;
    access_log /var/log/nginx/matomo.log matomo;
    access_log /var/log/nginx/access.log;
EOT
cat > /etc/nginx/conf.d/matomo.conf <<EOT
log_format  matomo                   '{"ip": "\$remote_addr",'
                                    '"host": "\$host",'
                                    '"path": "\$request_uri",'
                                    '"status": "\$status",'
                                    '"referrer": "\$http_referer",'
                                    '"user_agent": "\$http_user_agent",'
                                    '"length": \$bytes_sent,'
                                    '"generation_time_milli": \$request_time,'
                                    '"date": "\$time_iso8601"}';
EOT
# Insert include after first server_name stanza
sed -i "0,/server_name $WEBLATE_DOMAIN.*/s//&\\ninclude snippets\/weblate.conf;/" /etc/nginx/sites-available/default
# Delete default location, replaced by snippet
sed -i ':a;N;$!ba;s/\(snippets\/weblate.conf;\)[^}]*}/\1/g' /etc/nginx/sites-available/default
systemctl enable nginx.service
systemctl restart nginx.service

# Matomo
sudo -u weblate git clone https://github.com/matomo-org/matomo-log-analytics.git $WEBLATE_HOME/matomo-log-analytics
cat > $WEBLATE_HOME/run-matomo.sh <<EOT
#!/bin/sh
/usr/bin/python3 \
        $WEBLATE_HOME/matomo-log-analytics/import_logs.py \
        --url=https://stats.cihar.com \
        --enable-http-errors \
        --idsite=$MATOMO_SITE \
        --token-auth=$MATOMO_TOKEN \
        /var/log/nginx/matomo.log.1
EOT
chmod +x $WEBLATE_HOME/run-matomo.sh
chown weblate:weblate $WEBLATE_HOME/run-matomo.sh
echo "$(( RANDOM % 60 )) 7 * * * $WEBLATE_HOME/run-matomo.sh | logger -t matomo" > /tmp/weblate-cron
crontab /tmp/weblate-cron
rm /tmp/weblate-cron


# Fail2ban
sudo -u weblate git clone https://github.com/WeblateOrg/fail2ban.git $WEBLATE_HOME/fail2ban
ln -s $WEBLATE_HOME/fail2ban/filter.d/* /etc/fail2ban/filter.d/
ln -s $WEBLATE_HOME/fail2ban/jail.d/* /etc/fail2ban/jail.d/
systemctl restart fail2ban.service


# Install Weblate dirs
mkdir -p "$WEBLATE_DOCKER" "$WEBLATE_HOME/cache" "$WEBLATE_HOME/data" "$WEBLATE_HOME/postgresql" "$WEBLATE_HOME/redis" "$WEBLATE_HOME/ssl-certs"

# Go to the docker dir
cd $WEBLATE_DOCKER

curl -fsSL https://raw.githubusercontent.com/WeblateOrg/docker-compose/main/docker-compose.yml > docker-compose.yml
curl -fsSL https://raw.githubusercontent.com/WeblateOrg/docker-compose/main/environment > environment
cat > docker-compose.override.yml <<EOT
services:
  weblate:
    image: weblate/weblate:latest
    ports:
    - 127.0.0.1:8080:8080
volumes:
  weblate-data:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '$WEBLATE_HOME/data'
  weblate-cache:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '$WEBLATE_HOME/cache'
  postgres-data:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '$WEBLATE_HOME/postgresql'
  redis-data:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '$WEBLATE_HOME/redis'
  ssl-certs:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '$WEBLATE_HOME/ssl-certs'
EOT

cat >> environment <<EOT

# E-mail setup
WEBLATE_EMAIL_HOST=mail.cihar.com
WEBLATE_EMAIL_PORT=587
WEBLATE_EMAIL_HOST_USER=$WEBLATE_DOMAIN
WEBLATE_EMAIL_HOST_PASSWORD=$EXIM_PASS
WEBLATE_EMAIL_USE_TLS=1

# Hosted customization
WEBLATE_SERVER_EMAIL=noreply@weblate.org
WEBLATE_DEFAULT_FROM_EMAIL=noreply@weblate.org
WEBLATE_SITE_TITLE="$WEBLATE_TITLE"
WEBLATE_SITE_DOMAIN="$WEBLATE_DOMAIN"
WEBLATE_ADMIN_NAME='Michal Čihař'
WEBLATE_ADMIN_EMAIL='michal@cihar.com'
WEBLATE_DEFAULT_COMMITER_EMAIL='hosted@weblate.org'
WEBLATE_DEFAULT_COMMITER_NAME='Hosted Weblate'
WEBLATE_STATUS_URL="https://status.weblate.org/"
WEBLATE_GET_HELP_URL="https://care.weblate.org/"
WEBLATE_CONTACT_FORM="from"
WEBLATE_ADMINS_CONTACT='rt@weblate.org'
WEBLATE_SILENCED_SYSTEM_CHECKS=weblate.E012,weblate.E013$IGNORE_CHECKS

# Sentry integration
SENTRY_DSN="$WEBLATE_SENTRY"
SENTRY_TOKEN="$WEBLATE_SENTRY_TOKEN"
SENTRY_TRACES_SAMPLE_RATE="0.1"

# Registration
WEBLATE_REGISTRATION_OPEN=0
WEBLATE_REQUIRE_LOGIN=1
WEBLATE_LEGAL_INTEGRATION=wllegal

# SSL
WEBLATE_ENABLE_HTTPS=1
WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR

# Machinery, see https://github.com/WeblateOrg/weblate/issues/8908
WEBLATE_MT_APERTIUM_APY="http://172.16.0.9:2737/"
WEBLATE_MT_LIBRETRANSLATE_API_URL="http://172.16.0.9:5000/"
EOT

# Fix permissions
chown -R weblate:weblate $WEBLATE_HOME

# Start Weblate
sudo -u weblate docker compose up -d --wait

# Show logs
sudo -u weblate docker compose logs

# Track deploy to Sentry
sudo -u weblate docker compose exec --user weblate weblate weblate sentry_deploy

# Create admin user
if [ -n "$WEBLATE_PASSWORD" ] ; then
    sudo -u weblate docker compose exec --user weblate weblate weblate createadmin --username nijel --email michal@cihar.com --name 'Michal Čihař' --password "$WEBLATE_PASSWORD" --update
fi

# Check
sudo -u weblate docker compose exec --user weblate weblate weblate check --deploy