From cc4745d109beb13781644cdf559d93007fc07664 Mon Sep 17 00:00:00 2001 From: nmemmert <67961292+nmemmert@users.noreply.github.com> Date: Wed, 5 Nov 2025 11:55:13 -0500 Subject: [PATCH] Add nginx reverse proxy and DNS domain configuration to Ubuntu install script --- ubuntu-install.sh | 111 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 100 insertions(+), 11 deletions(-) diff --git a/ubuntu-install.sh b/ubuntu-install.sh index 61e4f16..9b8166c 100644 --- a/ubuntu-install.sh +++ b/ubuntu-install.sh @@ -97,7 +97,7 @@ echo "2. Navigate to Azure Active Directory > App registrations" echo "3. Create a new registration or use existing one" echo "4. Note the Application (client) ID and Directory (tenant) ID" echo "5. Create a client secret under Certificates & secrets" -echo "6. Add redirect URI: http://your-server-ip:5000/auth/callback" +echo "6. Add redirect URI: http://your-domain-name/auth/callback (will be configured automatically)" echo "==================================================================" echo "" @@ -106,8 +106,19 @@ read -p "Enter Azure AD Tenant ID (Directory ID): " AZURE_TENANT_ID read -p "Enter Azure AD Client ID (Application ID): " AZURE_CLIENT_ID read -s -p "Enter Azure AD Client Secret: " AZURE_CLIENT_SECRET echo "" -read -p "Enter server IP/domain (for redirect URI) [localhost]: " SERVER_HOST -SERVER_HOST=${SERVER_HOST:-localhost} +read -p "Enter DNS domain name (e.g., eoypdf.trbc.org) [localhost]: " DNS_DOMAIN +DNS_DOMAIN=${DNS_DOMAIN:-localhost} +read -p "Enter server IP/domain (for redirect URI) [$DNS_DOMAIN]: " SERVER_HOST +SERVER_HOST=${SERVER_HOST:-$DNS_DOMAIN} + +# Determine if we should use HTTPS +USE_HTTPS=false +if [[ "$DNS_DOMAIN" != "localhost" && "$DNS_DOMAIN" != "127.0.0.1" ]]; then + read -p "Do you have SSL certificates for $DNS_DOMAIN? (y/n) [n]: " HAS_SSL + if [[ "${HAS_SSL,,}" == "y" || "${HAS_SSL,,}" == "yes" ]]; then + USE_HTTPS=true + fi +fi # Create .env file with real values cat > .env << EOF @@ -127,7 +138,7 @@ AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET AZURE_AUTHORITY=https://login.microsoftonline.com/$AZURE_TENANT_ID # Redirect URI (must match what's configured in Azure AD app registration) -AZURE_REDIRECT_URI=http://$SERVER_HOST:5000/auth/callback +AZURE_REDIRECT_URI=http${USE_HTTPS:+s}://$SERVER_HOST/auth/callback # Scopes to request (openid, profile, email are common) AZURE_SCOPES=openid profile email @@ -138,6 +149,71 @@ EOF log_success "Azure AD configuration saved to .env file" +# Install and configure nginx +log_info "Installing and configuring nginx..." +sudo apt install -y nginx + +# Create nginx configuration +NGINX_CONF="/etc/nginx/sites-available/pdf-sort-merge" +sudo tee "$NGINX_CONF" > /dev/null << EOF +server { + listen 80; + server_name $DNS_DOMAIN; + + # Security headers + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-XSS-Protection "1; mode=block" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "no-referrer-when-downgrade" always; + add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always; + + # Proxy to Flask app + location / { + proxy_pass http://127.0.0.1:5000; + proxy_set_header Host \$host; + proxy_set_header X-Real-IP \$remote_addr; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto \$scheme; + + # WebSocket support (if needed) + proxy_http_version 1.1; + proxy_set_header Upgrade \$http_upgrade; + proxy_set_header Connection "upgrade"; + + # Timeout settings + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + # Static files + location /static/ { + alias $APP_DIR/static/; + expires 1y; + add_header Cache-Control "public, immutable"; + } +} +EOF + +# Enable the site +sudo ln -sf "$NGINX_CONF" /etc/nginx/sites-enabled/ +sudo rm -f /etc/nginx/sites-enabled/default + +# Test nginx configuration +log_info "Testing nginx configuration..." +if sudo nginx -t; then + log_success "Nginx configuration is valid" +else + log_error "Nginx configuration has errors" + exit 1 +fi + +# Restart nginx +sudo systemctl restart nginx +sudo systemctl enable nginx + +log_success "Nginx configured to serve $DNS_DOMAIN on port 80" + # Create systemd service file log_info "Creating systemd service..." SERVICE_FILE="/etc/systemd/system/pdf-sort-merge.service" @@ -173,7 +249,8 @@ mkdir -p results static templates # Set up firewall (optional) log_info "Configuring firewall..." -sudo ufw allow 5000/tcp || log_warning "Failed to configure firewall - you may need to do this manually" +sudo ufw allow 80/tcp || log_warning "Failed to configure firewall for port 80 - you may need to do this manually" +sudo ufw allow ssh/tcp || log_warning "Failed to configure firewall for SSH - you may need to do this manually" # Enable and start service log_info "Enabling and starting service..." @@ -235,18 +312,30 @@ log_success "Installation completed!" echo "" echo "==================================================================" echo "NEXT STEPS:" -echo "1. Edit the .env file with your Azure AD credentials:" -echo " nano $APP_DIR/.env" +echo "1. Point your DNS for $DNS_DOMAIN to this server's IP address" echo "" -echo "2. Configure your Azure AD app registration with redirect URI:" -echo " http://your-server-ip:5000/auth/callback" +echo "2. If you have SSL certificates, update the nginx config:" +echo " sudo nano /etc/nginx/sites-available/pdf-sort-merge" +echo " (add SSL configuration and change listen 80 to 443)" echo "" -echo "3. Access the application at:" -echo " http://localhost:5000" +echo "3. Update your Azure AD app registration redirect URI to:" +if [[ "$USE_HTTPS" == "true" ]]; then + echo " https://$SERVER_HOST/auth/callback" +else + echo " http://$SERVER_HOST/auth/callback" +fi +echo "" +echo "4. Access the application at:" +if [[ "$DNS_DOMAIN" != "localhost" ]]; then + echo " http://$DNS_DOMAIN" +else + echo " http://localhost:5000" +fi echo "" echo "MANAGEMENT COMMANDS:" echo " Start service: sudo systemctl start pdf-sort-merge" echo " Stop service: sudo systemctl stop pdf-sort-merge" +echo " Restart nginx: sudo systemctl restart nginx" echo " Check status: sudo systemctl status pdf-sort-merge" echo " View logs: sudo journalctl -u pdf-sort-merge -f" echo " Update app: ./manage.sh update"