nate/eoy-pdf-sortandmerge
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add nginx reverse proxy and DNS domain configuration to Ubuntu install script

Browse Source
This commit is contained in:
nmemmert committed 2025-11-05 11:55:13 -05:00
1 parent 5d6a19e7ca
commit cc4745d109
1 file changed
+99 -10
Download Patch File Download Diff File Expand all files Collapse all files
ubuntu-install.sh
+99 -10
View File
@@ -97,7 +97,7 @@ echo "2. Navigate to Azure Active Directory > App registrations"
echo "3. Create a new registration or use existing one"
echo "4. Note the Application (client) ID and Directory (tenant) ID"
echo "5. Create a client secret under Certificates & secrets"
echo "6. Add redirect URI: http://your-server-ip:5000/auth/callback"
echo "6. Add redirect URI: http://your-domain-name/auth/callback (will be configured automatically)"
echo "=================================================================="
echo ""
@@ -106,8 +106,19 @@ read -p "Enter Azure AD Tenant ID (Directory ID): " AZURE_TENANT_ID
read -p "Enter Azure AD Client ID (Application ID): " AZURE_CLIENT_ID
read -s -p "Enter Azure AD Client Secret: " AZURE_CLIENT_SECRET
echo ""
read -p "Enter server IP/domain (for redirect URI) [localhost]: " SERVER_HOST
SERVER_HOST=${SERVER_HOST:-localhost}
read -p "Enter DNS domain name (e.g., eoypdf.trbc.org) [localhost]: " DNS_DOMAIN
DNS_DOMAIN=${DNS_DOMAIN:-localhost}
read -p "Enter server IP/domain (for redirect URI) [$DNS_DOMAIN]: " SERVER_HOST
SERVER_HOST=${SERVER_HOST:-$DNS_DOMAIN}
# Determine if we should use HTTPS
USE_HTTPS=false
if [[ "$DNS_DOMAIN" != "localhost" && "$DNS_DOMAIN" != "127.0.0.1" ]]; then
read -p "Do you have SSL certificates for $DNS_DOMAIN? (y/n) [n]: " HAS_SSL
if [[ "${HAS_SSL,,}" == "y" || "${HAS_SSL,,}" == "yes" ]]; then
USE_HTTPS=true
fi
fi
# Create .env file with real values
cat > .env << EOF
@@ -127,7 +138,7 @@ AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET
AZURE_AUTHORITY=https://login.microsoftonline.com/$AZURE_TENANT_ID
# Redirect URI (must match what's configured in Azure AD app registration)
AZURE_REDIRECT_URI=http://$SERVER_HOST:5000/auth/callback
AZURE_REDIRECT_URI=http${USE_HTTPS:+s}://$SERVER_HOST/auth/callback
# Scopes to request (openid, profile, email are common)
AZURE_SCOPES=openid profile email
@@ -138,6 +149,71 @@ EOF
log_success "Azure AD configuration saved to .env file"
# Install and configure nginx
log_info "Installing and configuring nginx..."
sudo apt install -y nginx
# Create nginx configuration
NGINX_CONF="/etc/nginx/sites-available/pdf-sort-merge"
sudo tee "$NGINX_CONF" > /dev/null << EOF
server {
listen 80;
server_name $DNS_DOMAIN;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
# Proxy to Flask app
location / {
proxy_pass http://127.0.0.1:5000;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
# WebSocket support (if needed)
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
# Timeout settings
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
# Static files
location /static/ {
alias $APP_DIR/static/;
expires 1y;
add_header Cache-Control "public, immutable";
}
}
EOF
# Enable the site
sudo ln -sf "$NGINX_CONF" /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
# Test nginx configuration
log_info "Testing nginx configuration..."
if sudo nginx -t; then
log_success "Nginx configuration is valid"
else
log_error "Nginx configuration has errors"
exit 1
fi
# Restart nginx
sudo systemctl restart nginx
sudo systemctl enable nginx
log_success "Nginx configured to serve $DNS_DOMAIN on port 80"
# Create systemd service file
log_info "Creating systemd service..."
SERVICE_FILE="/etc/systemd/system/pdf-sort-merge.service"
@@ -173,7 +249,8 @@ mkdir -p results static templates
# Set up firewall (optional)
log_info "Configuring firewall..."
sudo ufw allow 5000/tcp || log_warning "Failed to configure firewall - you may need to do this manually"
sudo ufw allow 80/tcp || log_warning "Failed to configure firewall for port 80 - you may need to do this manually"
sudo ufw allow ssh/tcp || log_warning "Failed to configure firewall for SSH - you may need to do this manually"
# Enable and start service
log_info "Enabling and starting service..."
@@ -235,18 +312,30 @@ log_success "Installation completed!"
echo ""
echo "=================================================================="
echo "NEXT STEPS:"
echo "1. Edit the .env file with your Azure AD credentials:"
echo " nano $APP_DIR/.env"
echo "1. Point your DNS for $DNS_DOMAIN to this server's IP address"
echo ""
echo "2. Configure your Azure AD app registration with redirect URI:"
echo " http://your-server-ip:5000/auth/callback"
echo "2. If you have SSL certificates, update the nginx config:"
echo " sudo nano /etc/nginx/sites-available/pdf-sort-merge"
echo " (add SSL configuration and change listen 80 to 443)"
echo ""
echo "3. Access the application at:"
echo "3. Update your Azure AD app registration redirect URI to:"
if [[ "$USE_HTTPS" == "true" ]]; then
echo " https://$SERVER_HOST/auth/callback"
else
echo " http://$SERVER_HOST/auth/callback"
fi
echo ""
echo "4. Access the application at:"
if [[ "$DNS_DOMAIN" != "localhost" ]]; then
echo " http://$DNS_DOMAIN"
else
echo " http://localhost:5000"
fi
echo ""
echo "MANAGEMENT COMMANDS:"
echo " Start service: sudo systemctl start pdf-sort-merge"
echo " Stop service: sudo systemctl stop pdf-sort-merge"
echo " Restart nginx: sudo systemctl restart nginx"
echo " Check status: sudo systemctl status pdf-sort-merge"
echo " View logs: sudo journalctl -u pdf-sort-merge -f"
echo " Update app: ./manage.sh update"