testscript

#!/bin/bash
# When run on a brand new server, this script follows all instructions of the
# book in turn. Useful for getting the server up to a point and continuing to
# write the book afterwards, then destroying the server, retrying, and so on.
# The script is manually written and maintained, i.e. copied and pasted from
# the book. It isn't smart enough to know when the scripts in the book have
# changed.
#
# Before running, copy django_deployment_vars.example to django_deployment_vars
# and edit it.

set -e

source /root/django_deployment_vars

DJANGO_USER=$DJANGO_PROJECT
DJANGO_GROUP=$DJANGO_PROJECT
if [ $PYTHON = "3" ]; then
	PYTHON_EXECUTABLE=/usr/bin/python3
else
	PYTHON_EXECUTABLE=/usr/bin/python
fi

# Update and install stuff (TODO: put it in the book)
apt update
apt upgrade -y
apt install -y git python3 virtualenvwrapper

#
# USERS AND DIRECTORIES
#


# Creating a user and group
if ! getent passwd $DJANGO_PROJECT; then
	adduser --system --home=/var/opt/$DJANGO_PROJECT \
		--no-create-home --disabled-password --group \
		--shell=/bin/bash $DJANGO_USER
fi

# The program files
cd /opt
[ -d $DJANGO_PROJECT/.git ] || git clone $DJANGO_PROJECT_REPOSITORY
[ -d $DJANGO_PROJECT/venv ] \
	|| virtualenv --system-site-packages --python=$PYTHON_EXECUTABLE \
		/opt/$DJANGO_PROJECT/venv
/opt/$DJANGO_PROJECT/venv/bin/pip install \
	-r /opt/$DJANGO_PROJECT/requirements.txt
/opt/$DJANGO_PROJECT/venv/bin/python -m compileall \
	-x /opt/$DJANGO_PROJECT/venv/ /opt/$DJANGO_PROJECT

# The data directory
mkdir -p /var/opt/$DJANGO_PROJECT
chown $DJANGO_USER /var/opt/$DJANGO_PROJECT

# The log directory
mkdir -p /var/log/$DJANGO_PROJECT
chown $DJANGO_USER /var/log/$DJANGO_PROJECT

# The production settings
mkdir -p /etc/opt/$DJANGO_PROJECT
cat <<-EOF1 >/etc/opt/$DJANGO_PROJECT/settings.py
	from $DJANGO_PROJECT.settings import *

	DEBUG = True
	ALLOWED_HOSTS = ['$DOMAIN', 'www.$DOMAIN']
	DATABASES = {
	    'default': {
	        'ENGINE': 'django.db.backends.sqlite3',
	        'NAME': '/var/opt/$DJANGO_PROJECT/$DJANGO_PROJECT.db',
	    }
	}
EOF1
chgrp $DJANGO_GROUP /etc/opt/$DJANGO_PROJECT
chmod u=rwx,g=rx,o= /etc/opt/$DJANGO_PROJECT
/opt/$DJANGO_PROJECT/venv/bin/python -m compileall \
	/etc/opt/$DJANGO_PROJECT

#
# THE WEB SERVER
#

if [ $WEB_SERVER = 'nginx' ]; then
	# Installing nginx
	apt install -y nginx-light

	# Configuring nginx to serve the domain
	cat <<-EOF1 >/etc/nginx/sites-available/$DOMAIN
		server {
		    listen 80;
		    listen [::]:80;
		    server_name $DOMAIN www.$DOMAIN;
		    root /var/www/$DOMAIN;
		}
	EOF1
	cd /etc/nginx/sites-enabled
	[ -e $DOMAIN ] \
		|| ln -s ../sites-available/$DOMAIN .
	service nginx reload
	mkdir -p /var/www/$DOMAIN
	echo "<p>This is the web site for $DOMAIN.</p>" \
		>/var/www/$DOMAIN/index.html
	cat <<-EOF1 >/etc/nginx/sites-available/default
		server {
		    listen 80 default_server;
		    listen [::]:80 default_server;
		    return 404;
		}
	EOF1
	service nginx reload

	# Configuring nginx for django
	cat <<-EOF1 >/etc/nginx/sites-available/$DOMAIN
		server {
		    listen 80;
		    listen [::]:80;
		    server_name $DOMAIN www.$DOMAIN;
		    root /var/www/$DOMAIN;
		    location / {
		        proxy_pass http://localhost:8000;
		        proxy_set_header Host \$http_host;
		        proxy_redirect off;
		        proxy_set_header X-Forwarded-For \$remote_addr;
		        proxy_set_header X-Forwarded-Proto \$scheme;
		        proxy_connect_timeout 10;
		        proxy_read_timeout 30;
		        client_max_body_size 20m;
		    }
		}
	EOF1
	service nginx reload
else
	# Installing apache
	apt install -y apache2

	# Configuring apache to serve the domain
	cat <<-EOF1 >/etc/apache2/sites-available/$DOMAIN.conf
		<VirtualHost *:80>
		    ServerName $DOMAIN
		    ServerAlias www.$DOMAIN
		    DocumentRoot /var/www/$DOMAIN
		</VirtualHost>
	EOF1
	cd /etc/apache2/sites-enabled
	[ -e $DOMAIN.conf ] \
		|| ln -s ../sites-available/$DOMAIN.conf .
	service apache2 reload
	mkdir -p /var/www/$DOMAIN
    
	echo '<p>This is the web site for $DOMAIN.</p>' \
	    >/var/www/$DOMAIN/index.html
	cat <<-EOF1 >/etc/apache2/sites-available/000-default.conf
		<VirtualHost *:80>
		    DocumentRoot /var/www/html
		    Redirect 404 /
		</VirtualHost>
	EOF1
	service apache2 reload

	# Configuring apache for django
	cat <<-EOF1 >/etc/apache2/sites-available/$DOMAIN.conf
		<VirtualHost *:80>
		    ServerName $DOMAIN
		    ServerAlias www.$DOMAIN
		    DocumentRoot /var/www/$DOMAIN
		    ProxyPass / http://localhost:8000/
		    ProxyPreserveHost On
		    RequestHeader set X-Forwarded-Proto "http"
		</VirtualHost>
	EOF1
	a2enmod proxy proxy_http headers
	service apache2 reload
fi

#
# STATIC AND MEDIA FILES
#

# Setting up Django
cat <<-EOF1 >/etc/opt/$DJANGO_PROJECT/settings.py
	from $DJANGO_PROJECT.settings import *

	DEBUG = True
	ALLOWED_HOSTS = ['$DOMAIN', 'www.$DOMAIN']
	DATABASES = {
	    'default': {
	        'ENGINE': 'django.db.backends.sqlite3',
	        'NAME': '/var/opt/$DJANGO_PROJECT/$DJANGO_PROJECT.db',
	    }
	}
	STATIC_ROOT = '/var/cache/$DJANGO_PROJECT/static/'
	STATIC_URL = '/static/'
EOF1
/opt/$DJANGO_PROJECT/venv/bin/python -m compileall \
	/etc/opt/$DJANGO_PROJECT
mkdir -p /var/cache/$DJANGO_PROJECT/static
PYTHONPATH=/etc/opt/$DJANGO_PROJECT:/opt/$DJANGO_PROJECT \
	/opt/$DJANGO_PROJECT/venv/bin/python \
	/opt/$DJANGO_PROJECT/manage.py collectstatic \
	--settings=settings --noinput
if [ $WEB_SERVER = 'nginx' ]; then
	# Setting up nginx
	cat <<-EOF1 >/etc/nginx/sites-available/$DOMAIN
		server {
		    listen 80;
		    listen [::]:80;
		    server_name $DOMAIN www.$DOMAIN;
		    root /var/www/$DOMAIN;
		    location / {
		        proxy_pass http://localhost:8000;
		        proxy_set_header Host \$http_host;
		        proxy_redirect off;
		        proxy_set_header X-Forwarded-For \$remote_addr;
		        proxy_set_header X-Forwarded-Proto \$scheme;
		        client_max_body_size 20m;
		    }
		    location /static/ {
		        alias /var/cache/$DJANGO_PROJECT/static/;
		    }
		}
	EOF1
	service nginx reload
else
	# Setting up apache
	cat <<-EOF1 >/etc/apache2/sites-available/$DOMAIN.conf``
		<VirtualHost *:80>
		    ServerName $DOMAIN
		    ServerAlias www.$DOMAIN
		    DocumentRoot /var/www/$DOMAIN
		    ProxyPass /static !
		    ProxyPass / http://localhost:8000/
		    ProxyPreserveHost On
		    RequestHeader set X-Forwarded-Proto "http"
		    Alias /static/ /var/cache/$DJANGO_PROJECT/static/
		    <Directory /var/cache/$DJANGO_PROJECT/static/>
		        Require all granted
		    </Directory>
		</VirtualHost>
	EOF1
	service apache2 reload
fi

#
# GUNICORN
#

/opt/$DJANGO_PROJECT/venv/bin/pip install gunicorn
cat <<-EOF1 >/etc/systemd/system/$DJANGO_PROJECT.service
	[Unit]
	Description=$DJANGO_PROJECT

	[Service]
	User=$DJANGO_USER
	Group=$DJANGO_GROUP
	Environment="PYTHONPATH=/etc/opt/$DJANGO_PROJECT:/opt/$DJANGO_PROJECT"
	Environment="DJANGO_SETTINGS_MODULE=settings"
	ExecStart=/opt/$DJANGO_PROJECT/venv/bin/gunicorn \
	    --workers=4 \
	    --log-file=/var/log/$DJANGO_PROJECT/gunicorn.log \
	    --bind=127.0.0.1:8000 --bind=[::1]:8000 \
	    $DJANGO_PROJECT.wsgi:application

	[Install]
	WantedBy=multi-user.target
EOF1
systemctl enable $DJANGO_PROJECT
service $DJANGO_PROJECT start

#
# SETTINGS
#

cat <<-EOF1 >/etc/opt/$DJANGO_PROJECT/settings.py
	from $DJANGO_PROJECT.settings import *

	DEBUG = False
	ALLOWED_HOSTS = ['$DOMAIN', 'www.$DOMAIN']
	DATABASES = {
	    'default': {
	        'ENGINE': 'django.db.backends.sqlite3',
	        'NAME': '/var/opt/$DJANGO_PROJECT/$DJANGO_PROJECT.db',
	    }
	}

	SERVER_EMAIL = 'noreply@$DOMAIN'
	DEFAULT_FROM_EMAIL = 'noreply@$DOMAIN'
	ADMINS = [
	    ('$ADMIN_NAME', '$ADMIN_EMAIL_ADDRESS'),
	]
	MANAGERS = ADMINS
	EMAIL_BACKEND = 'django_sendmail_backend.backends.EmailBackend'

	LOGGING = {
	    'version': 1,
	    'disable_existing_loggers': False,
	    'formatters': {
	        'default': {
	            'format': '[%(asctime)s] %(levelname)s: '
	                      '%(message)s',
	        }
	    },
	    'handlers': {
	        'file': {
	            'class': 'logging.handlers.'
	                     'TimedRotatingFileHandler',
	            'filename': '/var/log/$DJANGO_PROJECT/'
	                        '$DJANGO_PROJECT.log',
	            'when': 'midnight',
	            'backupCount': 60,
	            'formatter': 'default',
	        },
	    },
	    'root': {
	        'handlers': ['file'],
	        'level': 'INFO',
	    },
	}

	CACHES = {
	    'default': {
	        'BACKEND': 'django.core.cache.backends.filebased.'
	                   'FileBasedCache',
	        'LOCATION': '/var/cache/$DJANGO_PROJECT/cache',
	    }
	}
EOF1
mkdir -p /var/cache/$DJANGO_PROJECT/cache
chown $DJANGO_USER /var/cache/$DJANGO_PROJECT/cache
cat <<-EOF1 >/usr/local/sbin/restart-$DJANGO_PROJECT
	#!/bin/bash
	set -e
	/opt/$DJANGO_PROJECT/venv/bin/python -m compileall -q \
	     -x /opt/$DJANGO_PROJECT/venv/ /opt/$DJANGO_PROJECT \
	     /etc/opt/$DJANGO_PROJECT
	service $DJANGO_PROJECT restart
EOF1
chmod ugo+x /usr/local/sbin/restart-$DJANGO_PROJECT
/opt/$DJANGO_PROJECT/venv/bin/pip install django-sendmail-backend
DEBIAN_FRONTEND=noninteractive apt install -y -q dma
cat <<-EOF1 >/etc/dma/dma.conf
	SMARTHOST $EMAIL_HOST
	PORT 587
	AUTHPATH /etc/dma/auth.conf
	SECURETRANSFER
	STARTTLS
	MAILNAME /etc/mailname
EOF1
echo "$EMAIL_HOST_USER|$EMAIL_HOST:$EMAIL_HOST_PASSWORD" >/etc/dma/auth.conf
echo "$DOMAIN" >/etc/mailname
restart-$DJANGO_PROJECT
cat <<-EOF1 >/etc/cron.daily/$DJANGO_PROJECT-clearsessions
	#!/bin/bash
	export PYTHONPATH=/etc/opt/$DJANGO_PROJECT:/opt/$DJANGO_PROJECT
	export DJANGO_SETTINGS_MODULE=settings
	su $DJANGO_USER -c "/opt/$DJANGO_PROJECT/venv/bin/python \
	    /opt/$DJANGO_PROJECT/manage.py clearsessions"
EOF1
chmod 755 /etc/cron.daily/$DJANGO_PROJECT-clearsessions

#
# POSTGRESQL missing
#

#
# RECOVERY
#

apt install -y duply
mkdir -p /etc/duply/main
chmod 700 /etc/duply/main
cat <<-EOF1 >/etc/duply/main/conf
	GPG_KEY=disabled

	SOURCE=/
	TARGET=b2://$ACC_ID:$APP_KEY@$NICK-backup/$SERVER_NAME/

	MAX_AGE=2Y
	MAX_FULLS_WITH_INCRS=2
	MAX_FULLBKP_AGE=3M
	DUPL_PARAMS="\$DUPL_PARAMS --full-if-older-than \$MAX_FULLBKP_AGE "

	VERBOSITY=warning
	ARCH_DIR=/var/cache/duplicity/duply_main/
EOF1
cat <<-EOF1 >/etc/duply/main/exclude
	- /dev
	- /proc
	- /sys
	- /run
	- /var/lock
	- /var/run
	- /lost+found
	- /boot
	- /tmp
	- /var/tmp
	- /media
	- /mnt
	- /usr
	- /opt
	- /bin
	- /sbin
	- /lib
	- /lib32
	- /lib64
	- /var/cache
	- /var/crash
	- /var/swap
	- /var/swapfile
	- /var/swap.img
	- /var/lib/mysql
	- /var/lib/postgresql
EOF1
cat <<-EOF1 >/etc/duply/main/pre
	#!/bin/bash
	su postgres -c 'pg_dumpall --file=/var/backups/postgresql.dump'
	echo '.dump' | \
		sqlite3 /var/opt/$DJANGO_PROJECT/$DJANGO_PROJECT.db \
			>/var/backups/sqlite-$DJANGO_PROJECT.dump
EOF1
chmod 755 /etc/duply/main/pre
cat <<-EOF1 >/etc/cron.daily/duply
	#!/bin/bash
	duply main purge --force >/tmp/duply.out
	duply main purgeIncr --force >>/tmp/duply.out
	duply main backup >>/tmp/duply.out
EOF1
chmod 755 /etc/cron.daily/duply