Add Ubuntu production deployment script and documentation
This commit is contained in:
nmemmert committed
1 parent
a4b8a5c728
commit
d1a94d3378
3 files changed
+199
No files matched your search
@@ -114,6 +114,42 @@ Users can choose their preferred login method on the login page.
|
||||
- All processing happens server-side with temporary file storage
|
||||
- Maximum upload size is limited to 100MB
|
||||
|
||||
## Production Deployment
|
||||
|
||||
For production deployment on Ubuntu with reverse proxy:
|
||||
|
||||
1. **Run the automated installation script**:
|
||||
```bash
|
||||
# On your Ubuntu server
|
||||
wget https://gitlab.com/trbc-dev/pdf-rename-sort/-/raw/main/ubuntu-install.sh
|
||||
chmod +x ubuntu-install.sh
|
||||
sudo ./ubuntu-install.sh
|
||||
```
|
||||
|
||||
2. **Configure environment variables**:
|
||||
Edit `/etc/systemd/system/pdf-renamer.service` and update:
|
||||
- `SECRET_KEY`: Generate a secure random key
|
||||
- `TENANT_ID`, `CLIENT_ID`, `CLIENT_SECRET`: From Azure AD app registration
|
||||
- `ADMIN_USERNAME` and `ADMIN_PASSWORD`: Set secure credentials
|
||||
|
||||
3. **Update domain configuration**:
|
||||
Edit `/etc/nginx/sites-available/pdf-renamer` and replace `your-domain.com` with your actual domain
|
||||
|
||||
4. **Enable SSL (recommended)**:
|
||||
```bash
|
||||
sudo apt install certbot python3-certbot-nginx
|
||||
sudo certbot --nginx -d your-domain.com
|
||||
```
|
||||
|
||||
5. **Reload services**:
|
||||
```bash
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl restart pdf-renamer
|
||||
sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
The application will be accessible at your domain on ports 80 (HTTP) and 443 (HTTPS after SSL setup).
|
||||
|
||||
## Development
|
||||
|
||||
To contribute or modify:
|
||||
|
||||
@@ -286,6 +286,7 @@ def upload_files():
|
||||
@app.route('/jobs')
|
||||
@login_required
|
||||
def jobs():
|
||||
global jobs
|
||||
return render_template_string('''
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
@@ -0,0 +1,162 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Ubuntu Installation Script for PDF Renamer Flask App
|
||||
# This script sets up the PDF renamer application with reverse proxy on Ubuntu
|
||||
|
||||
set -e
|
||||
|
||||
echo "Starting installation of PDF Renamer Flask App..."
|
||||
|
||||
# Update system packages
|
||||
echo "Updating system packages..."
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
|
||||
# Install required packages
|
||||
echo "Installing required packages..."
|
||||
sudo apt install -y python3 python3-pip python3-venv nginx git
|
||||
|
||||
# Clone the repository (replace with your actual repo URL if different)
|
||||
echo "Cloning the repository..."
|
||||
git clone https://gitlab.com/trbc-dev/pdf-rename-sort.git
|
||||
cd pdf-rename-sort
|
||||
|
||||
# Create virtual environment and install dependencies
|
||||
echo "Setting up Python virtual environment..."
|
||||
python3 -m venv venv
|
||||
source venv/bin/activate
|
||||
pip install --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
pip install gunicorn
|
||||
|
||||
# Create application directory structure
|
||||
echo "Setting up application directory..."
|
||||
mkdir -p static
|
||||
# Copy logo if it exists in repo, otherwise you'll need to add it
|
||||
# cp path/to/trbc-logo-full.png static/ # Uncomment and adjust if needed
|
||||
|
||||
# Create systemd service file
|
||||
echo "Creating systemd service..."
|
||||
sudo tee /etc/systemd/system/pdf-renamer.service > /dev/null <<EOF
|
||||
[Unit]
|
||||
Description=PDF Renamer Flask App
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User=ubuntu
|
||||
WorkingDirectory=/home/ubuntu/pdf-rename-sort
|
||||
Environment="PATH=/home/ubuntu/pdf-rename-sort/venv/bin"
|
||||
Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
|
||||
Environment="TENANT_ID=your-tenant-id"
|
||||
Environment="CLIENT_ID=your-client-id"
|
||||
Environment="CLIENT_SECRET=your-client-secret"
|
||||
Environment="ADMIN_USERNAME=trbcit"
|
||||
Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
|
||||
ExecStart=/home/ubuntu/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
# Set proper permissions
|
||||
sudo chown -R ubuntu:ubuntu /home/ubuntu/pdf-rename-sort
|
||||
|
||||
# Enable and start the service
|
||||
echo "Starting the application service..."
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable pdf-renamer
|
||||
sudo systemctl start pdf-renamer
|
||||
|
||||
# Configure Nginx reverse proxy
|
||||
echo "Configuring Nginx reverse proxy..."
|
||||
sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
server_name your-domain.com www.your-domain.com;
|
||||
|
||||
# Security headers
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
|
||||
|
||||
# Handle static files
|
||||
location /static {
|
||||
alias /home/ubuntu/pdf-rename-sort/static;
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
# Proxy to Flask app
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:3000;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
|
||||
# WebSocket support (if needed in future)
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
# Timeout settings
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# Gzip compression
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 1024;
|
||||
gzip_proxied expired no-cache no-store private must-revalidate auth;
|
||||
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
|
||||
}
|
||||
EOF
|
||||
|
||||
# Enable the site
|
||||
sudo ln -s /etc/nginx/sites-available/pdf-renamer /etc/nginx/sites-enabled/ 2>/dev/null || true
|
||||
|
||||
# Remove default nginx site if it exists
|
||||
sudo rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
# Test nginx configuration
|
||||
echo "Testing Nginx configuration..."
|
||||
sudo nginx -t
|
||||
|
||||
# Reload nginx
|
||||
echo "Reloading Nginx..."
|
||||
sudo systemctl reload nginx
|
||||
|
||||
# Configure firewall (UFW)
|
||||
echo "Configuring firewall..."
|
||||
sudo ufw allow ssh
|
||||
sudo ufw allow 'Nginx Full'
|
||||
sudo ufw --force enable
|
||||
|
||||
echo ""
|
||||
echo "Installation completed successfully!"
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
|
||||
echo " - SECRET_KEY: Set a secure random key"
|
||||
echo " - TENANT_ID, CLIENT_ID, CLIENT_SECRET: Configure for Microsoft Entra ID"
|
||||
echo " - ADMIN_USERNAME and ADMIN_PASSWORD: Set secure admin credentials"
|
||||
echo ""
|
||||
echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer to your actual domain"
|
||||
echo ""
|
||||
echo "3. For SSL/HTTPS, install certbot:"
|
||||
echo " sudo apt install certbot python3-certbot-nginx"
|
||||
echo " sudo certbot --nginx -d your-domain.com"
|
||||
echo ""
|
||||
echo "4. Reload systemd after updating environment variables:"
|
||||
echo " sudo systemctl daemon-reload"
|
||||
echo " sudo systemctl restart pdf-renamer"
|
||||
echo ""
|
||||
echo "5. Check service status:"
|
||||
echo " sudo systemctl status pdf-renamer"
|
||||
echo " sudo systemctl status nginx"
|
||||
echo ""
|
||||
echo "The application should be accessible at your domain name on port 80."
|
||||
Reference in new issue
Block a user