From d1a94d33785c4d09e8f8bb1d7658be3695c678c4 Mon Sep 17 00:00:00 2001
From: nmemmert <67961292+nmemmert@users.noreply.github.com>
Date: Thu, 6 Nov 2025 10:02:38 -0500
Subject: [PATCH] Add Ubuntu production deployment script and documentation

---
 README.md         |  36 +++++++++++
 pdf_renamer.py    |   1 +
 ubuntu-install.sh | 162 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 199 insertions(+)
 create mode 100644 ubuntu-install.sh

diff --git a/README.md b/README.md
index 83377a5..38b7729 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,42 @@ Users can choose their preferred login method on the login page.
 - All processing happens server-side with temporary file storage
 - Maximum upload size is limited to 100MB
 
+## Production Deployment
+
+For production deployment on Ubuntu with reverse proxy:
+
+1. **Run the automated installation script**:
+   ```bash
+   # On your Ubuntu server
+   wget https://gitlab.com/trbc-dev/pdf-rename-sort/-/raw/main/ubuntu-install.sh
+   chmod +x ubuntu-install.sh
+   sudo ./ubuntu-install.sh
+   ```
+
+2. **Configure environment variables**:
+   Edit `/etc/systemd/system/pdf-renamer.service` and update:
+   - `SECRET_KEY`: Generate a secure random key
+   - `TENANT_ID`, `CLIENT_ID`, `CLIENT_SECRET`: From Azure AD app registration
+   - `ADMIN_USERNAME` and `ADMIN_PASSWORD`: Set secure credentials
+
+3. **Update domain configuration**:
+   Edit `/etc/nginx/sites-available/pdf-renamer` and replace `your-domain.com` with your actual domain
+
+4. **Enable SSL (recommended)**:
+   ```bash
+   sudo apt install certbot python3-certbot-nginx
+   sudo certbot --nginx -d your-domain.com
+   ```
+
+5. **Reload services**:
+   ```bash
+   sudo systemctl daemon-reload
+   sudo systemctl restart pdf-renamer
+   sudo systemctl reload nginx
+   ```
+
+The application will be accessible at your domain on ports 80 (HTTP) and 443 (HTTPS after SSL setup).
+
 ## Development
 
 To contribute or modify:
diff --git a/pdf_renamer.py b/pdf_renamer.py
index 98f1388..1c539ad 100644
--- a/pdf_renamer.py
+++ b/pdf_renamer.py
@@ -286,6 +286,7 @@ def upload_files():
 @app.route('/jobs')
 @login_required
 def jobs():
+    global jobs
     return render_template_string('''
     <!DOCTYPE html>
     <html>
diff --git a/ubuntu-install.sh b/ubuntu-install.sh
new file mode 100644
index 0000000..4b4eb26
--- /dev/null
+++ b/ubuntu-install.sh
@@ -0,0 +1,162 @@
+#!/bin/bash
+
+# Ubuntu Installation Script for PDF Renamer Flask App
+# This script sets up the PDF renamer application with reverse proxy on Ubuntu
+
+set -e
+
+echo "Starting installation of PDF Renamer Flask App..."
+
+# Update system packages
+echo "Updating system packages..."
+sudo apt update && sudo apt upgrade -y
+
+# Install required packages
+echo "Installing required packages..."
+sudo apt install -y python3 python3-pip python3-venv nginx git
+
+# Clone the repository (replace with your actual repo URL if different)
+echo "Cloning the repository..."
+git clone https://gitlab.com/trbc-dev/pdf-rename-sort.git
+cd pdf-rename-sort
+
+# Create virtual environment and install dependencies
+echo "Setting up Python virtual environment..."
+python3 -m venv venv
+source venv/bin/activate
+pip install --upgrade pip
+pip install -r requirements.txt
+pip install gunicorn
+
+# Create application directory structure
+echo "Setting up application directory..."
+mkdir -p static
+# Copy logo if it exists in repo, otherwise you'll need to add it
+# cp path/to/trbc-logo-full.png static/  # Uncomment and adjust if needed
+
+# Create systemd service file
+echo "Creating systemd service..."
+sudo tee /etc/systemd/system/pdf-renamer.service > /dev/null <<EOF
+[Unit]
+Description=PDF Renamer Flask App
+After=network.target
+
+[Service]
+User=ubuntu
+WorkingDirectory=/home/ubuntu/pdf-rename-sort
+Environment="PATH=/home/ubuntu/pdf-rename-sort/venv/bin"
+Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
+Environment="TENANT_ID=your-tenant-id"
+Environment="CLIENT_ID=your-client-id"
+Environment="CLIENT_SECRET=your-client-secret"
+Environment="ADMIN_USERNAME=trbcit"
+Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
+ExecStart=/home/ubuntu/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Set proper permissions
+sudo chown -R ubuntu:ubuntu /home/ubuntu/pdf-rename-sort
+
+# Enable and start the service
+echo "Starting the application service..."
+sudo systemctl daemon-reload
+sudo systemctl enable pdf-renamer
+sudo systemctl start pdf-renamer
+
+# Configure Nginx reverse proxy
+echo "Configuring Nginx reverse proxy..."
+sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
+server {
+    listen 80;
+    server_name your-domain.com www.your-domain.com;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+    # Handle static files
+    location /static {
+        alias /home/ubuntu/pdf-rename-sort/static;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Proxy to Flask app
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+
+        # WebSocket support (if needed in future)
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Timeout settings
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_proxied expired no-cache no-store private must-revalidate auth;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
+}
+EOF
+
+# Enable the site
+sudo ln -s /etc/nginx/sites-available/pdf-renamer /etc/nginx/sites-enabled/ 2>/dev/null || true
+
+# Remove default nginx site if it exists
+sudo rm -f /etc/nginx/sites-enabled/default
+
+# Test nginx configuration
+echo "Testing Nginx configuration..."
+sudo nginx -t
+
+# Reload nginx
+echo "Reloading Nginx..."
+sudo systemctl reload nginx
+
+# Configure firewall (UFW)
+echo "Configuring firewall..."
+sudo ufw allow ssh
+sudo ufw allow 'Nginx Full'
+sudo ufw --force enable
+
+echo ""
+echo "Installation completed successfully!"
+echo ""
+echo "Next steps:"
+echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
+echo "   - SECRET_KEY: Set a secure random key"
+echo "   - TENANT_ID, CLIENT_ID, CLIENT_SECRET: Configure for Microsoft Entra ID"
+echo "   - ADMIN_USERNAME and ADMIN_PASSWORD: Set secure admin credentials"
+echo ""
+echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer to your actual domain"
+echo ""
+echo "3. For SSL/HTTPS, install certbot:"
+echo "   sudo apt install certbot python3-certbot-nginx"
+echo "   sudo certbot --nginx -d your-domain.com"
+echo ""
+echo "4. Reload systemd after updating environment variables:"
+echo "   sudo systemctl daemon-reload"
+echo "   sudo systemctl restart pdf-renamer"
+echo ""
+echo "5. Check service status:"
+echo "   sudo systemctl status pdf-renamer"
+echo "   sudo systemctl status nginx"
+echo ""
+echo "The application should be accessible at your domain name on port 80."
\ No newline at end of file