Add Ubuntu production deployment script and documentation

ubuntu-install.sh

@@ -0,0 +1,162 @@
+#!/bin/bash
+
+# Ubuntu Installation Script for PDF Renamer Flask App
+# This script sets up the PDF renamer application with reverse proxy on Ubuntu
+
+set -e
+
+echo "Starting installation of PDF Renamer Flask App..."
+
+# Update system packages
+echo "Updating system packages..."
+sudo apt update && sudo apt upgrade -y
+
+# Install required packages
+echo "Installing required packages..."
+sudo apt install -y python3 python3-pip python3-venv nginx git
+
+# Clone the repository (replace with your actual repo URL if different)
+echo "Cloning the repository..."
+git clone https://gitlab.com/trbc-dev/pdf-rename-sort.git
+cd pdf-rename-sort
+
+# Create virtual environment and install dependencies
+echo "Setting up Python virtual environment..."
+python3 -m venv venv
+source venv/bin/activate
+pip install --upgrade pip
+pip install -r requirements.txt
+pip install gunicorn
+
+# Create application directory structure
+echo "Setting up application directory..."
+mkdir -p static
+# Copy logo if it exists in repo, otherwise you'll need to add it
+# cp path/to/trbc-logo-full.png static/  # Uncomment and adjust if needed
+
+# Create systemd service file
+echo "Creating systemd service..."
+sudo tee /etc/systemd/system/pdf-renamer.service > /dev/null <<EOF
+[Unit]
+Description=PDF Renamer Flask App
+After=network.target
+
+[Service]
+User=ubuntu
+WorkingDirectory=/home/ubuntu/pdf-rename-sort
+Environment="PATH=/home/ubuntu/pdf-rename-sort/venv/bin"
+Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
+Environment="TENANT_ID=your-tenant-id"
+Environment="CLIENT_ID=your-client-id"
+Environment="CLIENT_SECRET=your-client-secret"
+Environment="ADMIN_USERNAME=trbcit"
+Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
+ExecStart=/home/ubuntu/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Set proper permissions
+sudo chown -R ubuntu:ubuntu /home/ubuntu/pdf-rename-sort
+
+# Enable and start the service
+echo "Starting the application service..."
+sudo systemctl daemon-reload
+sudo systemctl enable pdf-renamer
+sudo systemctl start pdf-renamer
+
+# Configure Nginx reverse proxy
+echo "Configuring Nginx reverse proxy..."
+sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
+server {
+    listen 80;
+    server_name your-domain.com www.your-domain.com;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+    # Handle static files
+    location /static {
+        alias /home/ubuntu/pdf-rename-sort/static;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Proxy to Flask app
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+
+        # WebSocket support (if needed in future)
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Timeout settings
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    # Gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_proxied expired no-cache no-store private must-revalidate auth;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
+}
+EOF
+
+# Enable the site
+sudo ln -s /etc/nginx/sites-available/pdf-renamer /etc/nginx/sites-enabled/ 2>/dev/null || true
+
+# Remove default nginx site if it exists
+sudo rm -f /etc/nginx/sites-enabled/default
+
+# Test nginx configuration
+echo "Testing Nginx configuration..."
+sudo nginx -t
+
+# Reload nginx
+echo "Reloading Nginx..."
+sudo systemctl reload nginx
+
+# Configure firewall (UFW)
+echo "Configuring firewall..."
+sudo ufw allow ssh
+sudo ufw allow 'Nginx Full'
+sudo ufw --force enable
+
+echo ""
+echo "Installation completed successfully!"
+echo ""
+echo "Next steps:"
+echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
+echo "   - SECRET_KEY: Set a secure random key"
+echo "   - TENANT_ID, CLIENT_ID, CLIENT_SECRET: Configure for Microsoft Entra ID"
+echo "   - ADMIN_USERNAME and ADMIN_PASSWORD: Set secure admin credentials"
+echo ""
+echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer to your actual domain"
+echo ""
+echo "3. For SSL/HTTPS, install certbot:"
+echo "   sudo apt install certbot python3-certbot-nginx"
+echo "   sudo certbot --nginx -d your-domain.com"
+echo ""
+echo "4. Reload systemd after updating environment variables:"
+echo "   sudo systemctl daemon-reload"
+echo "   sudo systemctl restart pdf-renamer"
+echo ""
+echo "5. Check service status:"
+echo "   sudo systemctl status pdf-renamer"
+echo "   sudo systemctl status nginx"
+echo ""
+echo "The application should be accessible at your domain name on port 80."