mirror of
https://gh.llkk.cc/https://github.com/WeblateOrg/scripts.git
synced 2025-10-03 15:01:00 +08:00
209 lines
6.4 KiB
Bash
Executable file
209 lines
6.4 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
# shellcheck disable=SC1091
|
|
. /etc/weblate-bootstrap
|
|
|
|
if [ "$1" = "--nocert" ] ; then
|
|
HTTPS_STAGE=local
|
|
shift
|
|
else
|
|
HTTPS_STAGE=production
|
|
fi
|
|
|
|
if [ "$1" = "--nomail" ] ; then
|
|
IGNORE_CHECKS=,weblate.E003
|
|
shift
|
|
else
|
|
IGNORE_CHECKS=""
|
|
fi
|
|
|
|
adduser weblate --disabled-password --gecos Weblate
|
|
usermod --append --groups adm weblate
|
|
usermod --append --groups docker weblate
|
|
|
|
WEBLATE_HOME=~weblate
|
|
WEBLATE_DOCKER="$WEBLATE_HOME/weblate"
|
|
|
|
cd /tmp
|
|
apt-get update
|
|
apt-get install --no-install-recommends -y\
|
|
fail2ban python3-pyinotify python3-systemd \
|
|
nginx \
|
|
openssh-client \
|
|
python3-certbot-nginx
|
|
|
|
# SSL cert
|
|
if [ "$HTTPS_STAGE" = "production" ] ; then
|
|
certbot --agree-tos --email care@weblate.org --redirect --no-eff-email -d "$WEBLATE_DOMAIN"
|
|
fi
|
|
|
|
# Enable http/2
|
|
sed -i -e 's/ssl;/ssl http2;/' -e 's/ssl ipv6only=on/ssl ipv6only=on http2/' /etc/nginx/sites-available/default
|
|
# Enable status locally
|
|
sed -i '/server_name _/a location = /nginx_status {\n stub_status;\n}' /etc/nginx/sites-available/default
|
|
# Hide server version
|
|
sed -i 's/# server_tokens off/server_tokens off/' /etc/nginx/nginx.conf
|
|
|
|
# Weblate nginx snippet
|
|
cat > /etc/nginx/snippets/weblate.conf <<EOT
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8080;
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Host \$server_name;
|
|
}
|
|
client_max_body_size 100m;
|
|
access_log /var/log/nginx/matomo.log matomo;
|
|
access_log /var/log/nginx/access.log;
|
|
EOT
|
|
cat > /etc/nginx/conf.d/matomo.conf <<EOT
|
|
log_format matomo '{"ip": "\$remote_addr",'
|
|
'"host": "\$host",'
|
|
'"path": "\$request_uri",'
|
|
'"status": "\$status",'
|
|
'"referrer": "\$http_referer",'
|
|
'"user_agent": "\$http_user_agent",'
|
|
'"length": \$bytes_sent,'
|
|
'"generation_time_milli": \$request_time,'
|
|
'"date": "\$time_iso8601"}';
|
|
EOT
|
|
# Insert include after first server_name stanza
|
|
sed -i "0,/server_name $WEBLATE_DOMAIN.*/s//&\\ninclude snippets\/weblate.conf;/" /etc/nginx/sites-available/default
|
|
# Delete default location, replaced by snippet
|
|
sed -i ':a;N;$!ba;s/\(snippets\/weblate.conf;\)[^}]*}/\1/g' /etc/nginx/sites-available/default
|
|
systemctl enable nginx.service
|
|
systemctl restart nginx.service
|
|
|
|
# Matomo
|
|
sudo -u weblate git clone https://github.com/matomo-org/matomo-log-analytics.git $WEBLATE_HOME/matomo-log-analytics
|
|
cat > $WEBLATE_HOME/run-matomo.sh <<EOT
|
|
#!/bin/sh
|
|
/usr/bin/python3 \
|
|
$WEBLATE_HOME/matomo-log-analytics/import_logs.py \
|
|
--url=https://stats.cihar.com \
|
|
--enable-http-errors \
|
|
--idsite=$MATOMO_SITE \
|
|
--token-auth=$MATOMO_TOKEN \
|
|
/var/log/nginx/matomo.log.1
|
|
EOT
|
|
chmod +x $WEBLATE_HOME/run-matomo.sh
|
|
chown weblate:weblate $WEBLATE_HOME/run-matomo.sh
|
|
echo "$(( RANDOM % 60 )) 7 * * * $WEBLATE_HOME/run-matomo.sh | logger -t matomo" > /tmp/weblate-cron
|
|
crontab /tmp/weblate-cron
|
|
rm /tmp/weblate-cron
|
|
|
|
|
|
# Fail2ban
|
|
sudo -u weblate git clone https://github.com/WeblateOrg/fail2ban.git $WEBLATE_HOME/fail2ban
|
|
ln -s $WEBLATE_HOME/fail2ban/filter.d/* /etc/fail2ban/filter.d/
|
|
ln -s $WEBLATE_HOME/fail2ban/jail.d/* /etc/fail2ban/jail.d/
|
|
systemctl restart fail2ban.service
|
|
|
|
|
|
# Install Weblate dirs
|
|
mkdir -p "$WEBLATE_DOCKER" "$WEBLATE_HOME/cache" "$WEBLATE_HOME/data" "$WEBLATE_HOME/postgresql" "$WEBLATE_HOME/redis"
|
|
|
|
# Go to the docker dir
|
|
cd $WEBLATE_DOCKER
|
|
|
|
curl -fsSL https://raw.githubusercontent.com/WeblateOrg/docker-compose/main/docker-compose.yml > docker-compose.yml
|
|
curl -fsSL https://raw.githubusercontent.com/WeblateOrg/docker-compose/main/environment > environment
|
|
cat > docker-compose.override.yml <<EOT
|
|
services:
|
|
weblate:
|
|
image: weblate/weblate:latest
|
|
ports:
|
|
- 127.0.0.1:8080:8080
|
|
volumes:
|
|
weblate-data:
|
|
driver: local
|
|
driver_opts:
|
|
type: 'none'
|
|
o: 'bind'
|
|
device: '$WEBLATE_HOME/data'
|
|
weblate-cache:
|
|
driver: local
|
|
driver_opts:
|
|
type: 'none'
|
|
o: 'bind'
|
|
device: '$WEBLATE_HOME/cache'
|
|
postgres-data:
|
|
driver: local
|
|
driver_opts:
|
|
type: 'none'
|
|
o: 'bind'
|
|
device: '$WEBLATE_HOME/postgresql'
|
|
redis-data:
|
|
driver: local
|
|
driver_opts:
|
|
type: 'none'
|
|
o: 'bind'
|
|
device: '$WEBLATE_HOME/redis'
|
|
EOT
|
|
|
|
cat >> environment <<EOT
|
|
|
|
# E-mail setup
|
|
WEBLATE_EMAIL_HOST=mail.cihar.com
|
|
WEBLATE_EMAIL_PORT=587
|
|
WEBLATE_EMAIL_HOST_USER=$WEBLATE_DOMAIN
|
|
WEBLATE_EMAIL_HOST_PASSWORD=$EXIM_PASS
|
|
WEBLATE_EMAIL_USE_TLS=1
|
|
|
|
# Hosted customization
|
|
WEBLATE_SERVER_EMAIL=noreply@weblate.org
|
|
WEBLATE_DEFAULT_FROM_EMAIL=noreply@weblate.org
|
|
WEBLATE_SITE_TITLE="$WEBLATE_TITLE"
|
|
WEBLATE_SITE_DOMAIN="$WEBLATE_DOMAIN"
|
|
WEBLATE_ADMIN_NAME='Michal Čihař'
|
|
WEBLATE_ADMIN_EMAIL='michal@cihar.com'
|
|
WEBLATE_DEFAULT_COMMITER_EMAIL='hosted@weblate.org'
|
|
WEBLATE_DEFAULT_COMMITER_NAME='Hosted Weblate'
|
|
WEBLATE_STATUS_URL="https://status.weblate.org/"
|
|
WEBLATE_GET_HELP_URL="https://care.weblate.org/"
|
|
WEBLATE_CONTACT_FORM="from"
|
|
WEBLATE_ADMINS_CONTACT='rt@weblate.org'
|
|
WEBLATE_SILENCED_SYSTEM_CHECKS=weblate.E012,weblate.E013$IGNORE_CHECKS
|
|
|
|
# Sentry integration
|
|
SENTRY_DSN="$WEBLATE_SENTRY"
|
|
SENTRY_TOKEN="$WEBLATE_SENTRY_TOKEN"
|
|
SENTRY_TRACES_SAMPLE_RATE="0.1"
|
|
|
|
# Registration
|
|
WEBLATE_REGISTRATION_OPEN=0
|
|
WEBLATE_REQUIRE_LOGIN=1
|
|
WEBLATE_LEGAL_INTEGRATION=wllegal
|
|
|
|
# SSL
|
|
WEBLATE_ENABLE_HTTPS=1
|
|
WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR
|
|
|
|
# Machinery, see https://github.com/WeblateOrg/weblate/issues/8908
|
|
WEBLATE_MT_APERTIUM_APY="http://172.16.0.9:2737/"
|
|
WEBLATE_MT_LIBRETRANSLATE_API_URL="http://172.16.0.9:5000/"
|
|
EOT
|
|
|
|
# Fix permissions
|
|
chown -R weblate:weblate $WEBLATE_HOME
|
|
|
|
# Start Weblate
|
|
sudo -u weblate docker compose up -d --wait
|
|
|
|
# Show logs
|
|
sudo -u weblate docker compose logs
|
|
|
|
# Track deploy to Sentry
|
|
sudo -u weblate docker compose exec --user weblate weblate weblate sentry_deploy
|
|
|
|
# Create admin user
|
|
if [ -n "$WEBLATE_PASSWORD" ] ; then
|
|
sudo -u weblate docker compose exec --user weblate weblate weblate createadmin --username nijel --email michal@cihar.com --name 'Michal Čihař' --password "$WEBLATE_PASSWORD" --update
|
|
fi
|
|
|
|
# Check
|
|
sudo -u weblate docker compose exec --user weblate weblate weblate check --deploy
|
