Skip to content

Commit 70e07d7

Browse files
mearvkmearvk
committed
Science Commit 5.
1 parent 32949d8 commit 70e07d7

1 file changed

Lines changed: 239 additions & 9 deletions

File tree

‎modules/black/presidential/Brarner.M.Alete/install/deploy-remote-linux.sh‎

Lines changed: 239 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -72,34 +72,264 @@ fi
7272
# Set permissions
7373
ssh "$REMOTE_USER@$REMOTE_HOST" "chmod -R 755 ${REMOTE_PATH} && chown -R www-data:www-data ${REMOTE_PATH} 2>/dev/null || chown -R apache:apache ${REMOTE_PATH} 2>/dev/null"
7474

75-
# Configure Apache alias
76-
echo "[*] Configuring Apache alias for /brarner.m.alete..."
75+
# Install Tomcat on top of Apache2 if Apache is found
76+
echo "[*] Checking for Tomcat / installing if Apache2 already present..."
77+
ssh "$REMOTE_USER@$REMOTE_HOST" "
78+
TOMCAT_VERSION='11.0.2'
79+
TOMCAT_HOME='/opt/tomcat'
80+
TOMCAT_URL=\"https://archive.apache.org/dist/tomcat/tomcat-11/v\${TOMCAT_VERSION}/bin/apache-tomcat-\${TOMCAT_VERSION}.tar.gz\"
81+
82+
APACHE_FOUND=false
83+
TOMCAT_FOUND=false
84+
85+
if systemctl is-active --quiet apache2 2>/dev/null || systemctl is-active --quiet httpd 2>/dev/null; then
86+
APACHE_FOUND=true
87+
fi
88+
89+
if [ -d \"\$TOMCAT_HOME\" ] && [ -f \"\$TOMCAT_HOME/bin/catalina.sh\" ]; then
90+
TOMCAT_FOUND=true
91+
fi
92+
93+
# Install Tomcat alongside Apache2
94+
if [ \"\$APACHE_FOUND\" = true ] && [ \"\$TOMCAT_FOUND\" = false ]; then
95+
echo '[*] Apache2 found — installing Tomcat '\$TOMCAT_VERSION' on top...'
96+
cd /tmp
97+
curl -sfLO \"\$TOMCAT_URL\"
98+
mkdir -p \"\$TOMCAT_HOME\"
99+
tar -xzf \"apache-tomcat-\${TOMCAT_VERSION}.tar.gz\" -C \"\$TOMCAT_HOME\" --strip-components=1
100+
rm -f \"apache-tomcat-\${TOMCAT_VERSION}.tar.gz\"
101+
102+
id tomcat &>/dev/null || useradd -r -M -d \"\$TOMCAT_HOME\" -s /bin/false tomcat
103+
chown -R tomcat:tomcat \"\$TOMCAT_HOME\"
104+
chmod +x \"\$TOMCAT_HOME\"/bin/*.sh
105+
106+
cat > /etc/systemd/system/tomcat.service <<'TOMSVC'
107+
[Unit]
108+
Description=Apache Tomcat 11
109+
After=network.target
110+
111+
[Service]
112+
Type=forking
113+
User=tomcat
114+
Group=tomcat
115+
Environment=JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64
116+
Environment=CATALINA_HOME=/opt/tomcat
117+
Environment=CATALINA_PID=/opt/tomcat/temp/tomcat.pid
118+
ExecStart=/opt/tomcat/bin/startup.sh
119+
ExecStop=/opt/tomcat/bin/shutdown.sh
120+
Restart=on-failure
121+
122+
[Install]
123+
WantedBy=multi-user.target
124+
TOMSVC
125+
systemctl daemon-reload
126+
systemctl enable tomcat
127+
systemctl start tomcat
128+
TOMCAT_FOUND=true
129+
echo '[*] Tomcat installed and started on port 8080'
130+
fi
131+
132+
# Deploy to Tomcat webapps
133+
if [ \"\$TOMCAT_FOUND\" = true ]; then
134+
mkdir -p \"\$TOMCAT_HOME/webapps/brarner\"
135+
cp -r ${REMOTE_PATH}/* \"\$TOMCAT_HOME/webapps/brarner/\" 2>/dev/null
136+
chown -R tomcat:tomcat \"\$TOMCAT_HOME/webapps/brarner\"
137+
echo '[*] Deployed to Tomcat context: /brarner'
138+
fi
139+
"
140+
141+
# Configure Apache2 — ServerAlias + Tomcat proxy (if both) or static alias (Apache only)
142+
echo "[*] Configuring Apache2 ServerAlias and routing..."
77143
ssh "$REMOTE_USER@$REMOTE_HOST" "
78144
CONF='/etc/apache2/conf-available/brarner-m-alete.conf'
79145
[ -d /etc/httpd/conf.d ] && CONF='/etc/httpd/conf.d/brarner-m-alete.conf'
80-
cat > \"\$CONF\" <<'APACHECONF'
81-
Alias /brarner.m.alete /var/www/html/brarner.m.alete
82146
147+
TOMCAT_UP=false
148+
if systemctl is-active --quiet tomcat 2>/dev/null; then
149+
TOMCAT_UP=true
150+
fi
151+
152+
if [ \"\$TOMCAT_UP\" = true ]; then
153+
# Apache2 + Tomcat: static images via Apache, servlets via proxy to Tomcat
154+
cat > \"\$CONF\" <<'APACHECONF'
155+
# Brarner.M.Alete™ — Apache2 + Tomcat proxy
156+
# ServerAlias: lauradei.us, www.lauradei.us
157+
158+
# Static files served directly by Apache
159+
Alias /brarner.m.alete/images /var/www/html/brarner.m.alete/images
160+
<Directory /var/www/html/brarner.m.alete/images>
161+
Options -Indexes
162+
Require all granted
163+
</Directory>
164+
165+
# Servlet/dynamic requests proxied to Tomcat 8080
166+
ProxyPass /brarner.m.alete/images !
167+
ProxyPass /brarner.m.alete http://localhost:8080/brarner
168+
ProxyPassReverse /brarner.m.alete http://localhost:8080/brarner
169+
170+
<Location /brarner.m.alete>
171+
Require all granted
172+
</Location>
173+
APACHECONF
174+
175+
# Enable proxy modules
176+
if command -v a2enmod &>/dev/null; then
177+
a2enmod proxy proxy_http 2>/dev/null
178+
fi
179+
else
180+
# Apache2 only — static alias
181+
cat > \"\$CONF\" <<'APACHECONF'
182+
# Brarner.M.Alete™ — Apache2 static
183+
# ServerAlias: lauradei.us, www.lauradei.us
184+
185+
Alias /brarner.m.alete /var/www/html/brarner.m.alete
83186
<Directory /var/www/html/brarner.m.alete>
84187
Options -Indexes +FollowSymLinks
85188
AllowOverride All
86189
Require all granted
87190
</Directory>
88191
APACHECONF
192+
fi
89193
90-
# Enable on Debian/Ubuntu
194+
# Add ServerAlias to default vhost
195+
VHOST='/etc/apache2/sites-available/000-default.conf'
196+
[ ! -f \"\$VHOST\" ] && VHOST='/etc/httpd/conf.d/vhost.conf'
197+
if [ -f \"\$VHOST\" ] && ! grep -q 'ServerAlias.*lauradei' \"\$VHOST\"; then
198+
sed -i '/ServerName/a\\ ServerAlias lauradei.us www.lauradei.us' \"\$VHOST\" 2>/dev/null
199+
fi
200+
201+
# Enable and reload
91202
if command -v a2enconf &>/dev/null; then
92203
a2enconf brarner-m-alete 2>/dev/null
93204
fi
94-
95-
# Reload
96205
systemctl reload apache2 2>/dev/null || systemctl reload httpd 2>/dev/null
97206
"
98207

99208
echo ""
209+
210+
# ─── SSL/TLS 443 — Let's Encrypt (Trusted CA) + Tomcat locked to localhost ───
211+
echo "[*] Configuring SSL/TLS port 443 via Let's Encrypt (Trusted CA)..."
212+
ssh "$REMOTE_USER@$REMOTE_HOST" "
213+
# Install certbot
214+
if ! command -v certbot &>/dev/null; then
215+
if command -v apt &>/dev/null; then
216+
apt install -y certbot python3-certbot-apache
217+
elif command -v dnf &>/dev/null; then
218+
dnf install -y certbot python3-certbot-apache
219+
fi
220+
fi
221+
222+
# Enable required Apache modules
223+
if command -v a2enmod &>/dev/null; then
224+
a2enmod ssl headers rewrite proxy proxy_http 2>/dev/null
225+
fi
226+
227+
# Obtain cert from Let's Encrypt
228+
certbot --apache --non-interactive --agree-tos \
229+
--email contact@lauradei.us \
230+
-d lauradei.us -d www.lauradei.us \
231+
--redirect 2>/dev/null || echo '[*] Certbot: cert may already exist'
232+
233+
# Determine if Tomcat is up
234+
TOMCAT_UP=false
235+
if systemctl is-active --quiet tomcat 2>/dev/null; then
236+
TOMCAT_UP=true
237+
fi
238+
239+
# SSL VirtualHost (port 443)
240+
SSL_CONF='/etc/apache2/sites-available/brarner-ssl.conf'
241+
[ -d /etc/httpd/conf.d ] && SSL_CONF='/etc/httpd/conf.d/brarner-ssl.conf'
242+
243+
cat > \"\$SSL_CONF\" <<'SSLHEAD'
244+
<IfModule mod_ssl.c>
245+
<VirtualHost *:443>
246+
ServerName lauradei.us
247+
ServerAlias www.lauradei.us
248+
249+
SSLEngine on
250+
SSLCertificateFile /etc/letsencrypt/live/lauradei.us/fullchain.pem
251+
SSLCertificateKeyFile /etc/letsencrypt/live/lauradei.us/privkey.pem
252+
253+
Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"
254+
255+
Alias /brarner.m.alete/images /var/www/html/brarner.m.alete/images
256+
<Directory /var/www/html/brarner.m.alete/images>
257+
Options -Indexes
258+
Require all granted
259+
</Directory>
260+
SSLHEAD
261+
262+
if [ \"\$TOMCAT_UP\" = true ]; then
263+
cat >> \"\$SSL_CONF\" <<'SSLPROXY'
264+
265+
ProxyPass /brarner.m.alete/images !
266+
ProxyPass /brarner.m.alete http://127.0.0.1:8080/brarner
267+
ProxyPassReverse /brarner.m.alete http://127.0.0.1:8080/brarner
268+
SSLPROXY
269+
else
270+
cat >> \"\$SSL_CONF\" <<'SSLSTATIC'
271+
272+
Alias /brarner.m.alete /var/www/html/brarner.m.alete
273+
<Directory /var/www/html/brarner.m.alete>
274+
Options -Indexes +FollowSymLinks
275+
AllowOverride All
276+
Require all granted
277+
</Directory>
278+
SSLSTATIC
279+
fi
280+
281+
cat >> \"\$SSL_CONF\" <<'SSLFOOT'
282+
283+
</VirtualHost>
284+
</IfModule>
285+
SSLFOOT
286+
287+
# Enable SSL site
288+
if command -v a2ensite &>/dev/null; then
289+
a2ensite brarner-ssl 2>/dev/null
290+
fi
291+
292+
# Port 80 → 443 redirect
293+
REDIR='/etc/apache2/sites-available/brarner-redirect.conf'
294+
[ -d /etc/httpd/conf.d ] && REDIR='/etc/httpd/conf.d/brarner-redirect.conf'
295+
cat > \"\$REDIR\" <<'REDIR80'
296+
<VirtualHost *:80>
297+
ServerName lauradei.us
298+
ServerAlias www.lauradei.us
299+
RewriteEngine On
300+
RewriteCond %{HTTPS} off
301+
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
302+
</VirtualHost>
303+
REDIR80
304+
305+
if command -v a2ensite &>/dev/null; then
306+
a2ensite brarner-redirect 2>/dev/null
307+
fi
308+
309+
# Lock Tomcat to localhost only — no external 8080/8443 access
310+
if [ -f /opt/tomcat/conf/server.xml ]; then
311+
sed -i 's|Connector port=\"8080\"|Connector port=\"8080\" address=\"127.0.0.1\"|' /opt/tomcat/conf/server.xml 2>/dev/null
312+
# Remove any 8443 connector or bind to localhost
313+
sed -i 's|Connector port=\"8443\"|Connector port=\"8443\" address=\"127.0.0.1\"|' /opt/tomcat/conf/server.xml 2>/dev/null
314+
systemctl restart tomcat 2>/dev/null
315+
echo '[*] Tomcat locked to 127.0.0.1:8080 — no external access'
316+
fi
317+
318+
# Auto-renewal cron
319+
echo '0 3 * * * root certbot renew --quiet --post-hook \"systemctl reload apache2 2>/dev/null || systemctl reload httpd 2>/dev/null\"' > /etc/cron.d/certbot-renew
320+
321+
# Reload Apache
322+
systemctl reload apache2 2>/dev/null || systemctl reload httpd 2>/dev/null
323+
324+
echo '[*] SSL 443 configured — 80 redirects to 443'
325+
"
326+
100327
echo "═══════════════════════════════════════════════════════════════"
101328
echo " [✓] Deploy complete"
102-
echo " URL: ${SITE_URL}"
329+
echo " URL: https://lauradei.us/brarner.m.alete"
103330
echo " Server: ${REMOTE_HOST}"
104-
echo " Path: ${REMOTE_PATH}"
331+
echo " Ports: 80 (→301 redirect) | 443 (SSL/TLS)"
332+
echo " Cert: Let's Encrypt (auto-renew daily 03:00)"
333+
echo " Tomcat: 127.0.0.1:8080 only (proxied via Apache 443)"
334+
echo " ServerAlias: lauradei.us, www.lauradei.us"
105335
echo "═══════════════════════════════════════════════════════════════"

0 commit comments

Comments
 (0)