From c94ae3df7f469e7cd0aed1b0ec6a9900bf1c0e87 Mon Sep 17 00:00:00 2001
From: nmemmert <67961292+nmemmert@users.noreply.github.com>
Date: Thu, 6 Nov 2025 14:42:36 -0500
Subject: [PATCH] fix installer and rename file

---
 nextgenpdf-install.sh | 223 ++++++++++++++++++++++++++++++++++++++++++
 ubuntu-install.sh     |  13 ++-
 2 files changed, 233 insertions(+), 3 deletions(-)
 create mode 100644 nextgenpdf-install.sh

diff --git a/nextgenpdf-install.sh b/nextgenpdf-install.sh
new file mode 100644
index 0000000..ff4541d
--- /dev/null
+++ b/nextgenpdf-install.sh
@@ -0,0 +1,223 @@
+#!/bin/bash
+
+# NextGen PDF Installation Script for PDF Renamer Flask App
+# This script sets up the PDF renamer application with reverse proxy on Ubuntu
+# Domain: nextgenpdf.trbc.org
+
+set -e
+
+echo "Starting installation of PDF Renamer Flask App..."
+
+# Check if already installed
+if systemctl is-active --quiet pdf-renamer 2>/dev/null; then
+    echo "WARNING: PDF Renamer service is already running."
+    echo "This will reinstall/update the application."
+    echo "Press Ctrl+C to cancel or Enter to continue..."
+    read -r || exit 1
+fi
+
+# Check if running with sudo
+if [ "$EUID" -ne 0 ]; then
+    echo "ERROR: This script must be run with sudo privileges"
+    echo "Usage: sudo ./ubuntu-install.sh"
+    exit 1
+fi
+
+# Update system packages
+echo "Updating system packages..."
+sudo apt update && sudo apt upgrade -y
+
+# Install required packages
+echo "Installing required packages..."
+sudo apt install -y python3 python3-pip python3-venv nginx git
+
+# Clone the repository (replace with your actual repo URL if different)
+echo "Cloning the repository..."
+# Check if we're already in the repository directory
+if [ -d ".git" ]; then
+    echo "Already in repository directory, skipping clone..."
+else
+    # Try HTTPS first, fallback to SSH if available
+    if git clone https://gitlab.com/trbc-dev/pdf-rename-sort.git 2>/dev/null; then
+        echo "Cloned via HTTPS"
+        cd pdf-rename-sort
+    elif git clone git@gitlab.com:trbc-dev/pdf-rename-sort.git 2>/dev/null; then
+        echo "Cloned via SSH"
+        cd pdf-rename-sort
+    else
+        echo "ERROR: Could not clone repository. Please check:"
+        echo "1. Repository URL is correct"
+        echo "2. SSH keys are configured (for SSH clone)"
+        echo "3. Internet connection is working"
+        exit 1
+    fi
+fi
+
+# Create virtual environment and install dependencies
+echo "Setting up Python virtual environment..."
+python3 -m venv venv
+source venv/bin/activate
+pip install --upgrade pip
+pip install -r requirements.txt
+pip install gunicorn
+
+# Create application directory structure
+echo "Setting up application directory..."
+mkdir -p static
+# Copy logo if it exists in repo, otherwise you'll need to add it
+# cp path/to/trbc-logo-full.png static/  # Uncomment and adjust if needed
+
+# Get the actual user who invoked sudo (not root)
+if [ -n "$SUDO_USER" ]; then
+    CURRENT_USER=$SUDO_USER
+elif [ -n "$LOGNAME" ] && [ "$LOGNAME" != "root" ]; then
+    CURRENT_USER=$LOGNAME
+else
+    CURRENT_USER=ubuntu
+fi
+
+echo "Installing for user: $CURRENT_USER"
+
+# Create systemd service file
+echo "Creating systemd service..."
+sudo tee /etc/systemd/system/pdf-renamer.service > /dev/null <<EOF
+[Unit]
+Description=PDF Renamer Flask App
+After=network.target
+
+[Service]
+User=$CURRENT_USER
+WorkingDirectory=/home/$CURRENT_USER/pdf-rename-sort
+Environment="PATH=/home/$CURRENT_USER/pdf-rename-sort/venv/bin"
+Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
+Environment="TENANT_ID=YOUR_MICROSOFT_ENTRA_TENANT_ID"
+Environment="CLIENT_ID=YOUR_MICROSOFT_ENTRA_CLIENT_ID"
+Environment="CLIENT_SECRET=YOUR_MICROSOFT_ENTRA_CLIENT_SECRET"
+Environment="ADMIN_USERNAME=trbcit"
+Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
+ExecStart=/home/$CURRENT_USER/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Set proper permissions
+sudo chown -R $CURRENT_USER:$CURRENT_USER /home/$CURRENT_USER/pdf-rename-sort
+
+# Enable and start the service
+echo "Starting the application service..."
+sudo systemctl daemon-reload
+sudo systemctl enable pdf-renamer
+sudo systemctl start pdf-renamer
+
+# Configure Nginx reverse proxy for PDF Renamer (multi-domain setup)
+echo "Configuring Nginx reverse proxy for PDF Renamer..."
+sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
+server {
+    listen 80;
+    server_name nextgenpdf.trbc.org;  # Production domain
+
+    # Handle large file uploads (500MB)
+    client_max_body_size 500M;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+    # Handle static files
+    location /static {
+        alias /home/$CURRENT_USER/pdf-rename-sort/static;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Proxy to Flask app on port 3000
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+
+        # WebSocket support (if needed in future)
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Timeout settings for large files
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 300s;  # Increased for large uploads
+        proxy_read_timeout 300s;  # Increased for large uploads
+    }
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_proxied expired no-cache no-store private must-revalidate auth;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
+}
+EOF
+
+# Enable the PDF Renamer site (doesn't remove existing sites)
+sudo ln -s /etc/nginx/sites-available/pdf-renamer /etc/nginx/sites-enabled/ 2>/dev/null || true
+
+# Don't remove default nginx site - let existing apps continue working
+# sudo rm -f /etc/nginx/sites-enabled/default
+
+# Test nginx configuration
+echo "Testing Nginx configuration..."
+sudo nginx -t
+
+# Reload nginx
+echo "Reloading Nginx..."
+sudo systemctl reload nginx
+
+# Configure firewall (UFW)
+echo "Configuring firewall..."
+sudo ufw allow ssh
+sudo ufw allow 'Nginx Full'
+sudo ufw --force enable
+
+echo ""
+echo "Installation completed successfully!"
+echo ""
+echo "IMPORTANT: Configure Microsoft Entra ID authentication:"
+echo "1. Go to Azure Portal > Microsoft Entra ID > App registrations"
+echo "2. Create a new registration or use existing one"
+echo "3. Note the Application (client) ID and Directory (tenant) ID"
+echo "4. Add a client secret under Certificates & secrets"
+echo "5. Add redirect URI: https://nextgenpdf.trbc.org/auth/microsoft/callback"
+echo "6. Grant appropriate permissions if needed"
+echo ""
+echo "Next steps:"
+echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
+echo "   - SECRET_KEY: Set a secure random key (use: openssl rand -hex 32)"
+echo "   - TENANT_ID: Your Microsoft Entra tenant ID"
+echo "   - CLIENT_ID: Your Microsoft Entra application ID"
+echo "   - CLIENT_SECRET: Your Microsoft Entra client secret"
+echo "   - ADMIN_USERNAME and ADMIN_PASSWORD: Set secure admin credentials"
+echo ""
+echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer:"
+echo "   - Change 'pdf-renamer.your-domain.com' to 'nextgenpdf.trbc.org'"
+echo "   - Point your DNS for nextgenpdf.trbc.org to this server's IP"
+echo ""
+echo "3. For SSL/HTTPS, install certbot:"
+echo "   sudo apt install certbot python3-certbot-nginx"
+echo "   sudo certbot --nginx -d nextgenpdf.trbc.org"
+echo ""
+echo "4. Reload systemd after updating environment variables:"
+echo "   sudo systemctl daemon-reload"
+echo "   sudo systemctl restart pdf-renamer"
+echo ""
+echo "5. Check service status:"
+echo "   sudo systemctl status pdf-renamer"
+echo "   sudo systemctl status nginx"
+echo ""
+echo "NOTE: This setup runs alongside your existing app on port 5000."
+echo "The PDF Renamer will be accessible at https://nextgenpdf.trbc.org."
+echo "Installed for user: $CURRENT_USER"
\ No newline at end of file
diff --git a/ubuntu-install.sh b/ubuntu-install.sh
index df264a2..c9c0b2a 100644
--- a/ubuntu-install.sh
+++ b/ubuntu-install.sh
@@ -66,8 +66,15 @@ mkdir -p static
 # Copy logo if it exists in repo, otherwise you'll need to add it
 # cp path/to/trbc-logo-full.png static/  # Uncomment and adjust if needed
 
-# Get the current user (fallback to ubuntu if not detected)
-CURRENT_USER=${USER:-ubuntu}
+# Get the actual user who invoked sudo (not root)
+if [ -n "$SUDO_USER" ]; then
+    CURRENT_USER=$SUDO_USER
+elif [ -n "$LOGNAME" ] && [ "$LOGNAME" != "root" ]; then
+    CURRENT_USER=$LOGNAME
+else
+    CURRENT_USER=ubuntu
+fi
+
 echo "Installing for user: $CURRENT_USER"
 
 # Create systemd service file
@@ -87,7 +94,7 @@ Environment="CLIENT_ID=YOUR_MICROSOFT_ENTRA_CLIENT_ID"
 Environment="CLIENT_SECRET=YOUR_MICROSOFT_ENTRA_CLIENT_SECRET"
 Environment="ADMIN_USERNAME=trbcit"
 Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
-ExecStart=/home/ubuntu/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
+ExecStart=/home/$CURRENT_USER/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
 Restart=always
 
 [Install]