nextgenpdf/nextgenpdf-install.sh

#!/bin/bash

# NextGen PDF Installation Script for PDF Renamer Flask App
# This script sets up the PDF renamer application with reverse proxy on Ubuntu
# Domain: nextgenpdf.trbc.org

set -e

echo "Starting installation of PDF Renamer Flask App..."

# Check if already installed
if systemctl is-active --quiet pdf-renamer 2>/dev/null; then
    echo "WARNING: PDF Renamer service is already running."
    echo "This will reinstall/update the application."
    echo "Press Ctrl+C to cancel or Enter to continue..."
    read -r || exit 1
fi

# Check if running with sudo
if [ "$EUID" -ne 0 ]; then
    echo "ERROR: This script must be run with sudo privileges"
    echo "Usage: sudo ./ubuntu-install.sh"
    exit 1
fi

# Update system packages
echo "Updating system packages..."
sudo apt update && sudo apt upgrade -y

# Install required packages
echo "Installing required packages..."
sudo apt install -y python3 python3-pip python3-venv nginx git

# Clone the repository (replace with your actual repo URL if different)
echo "Cloning the repository..."
# Check if we're already in the repository directory
if [ -d ".git" ]; then
    echo "Already in repository directory, skipping clone..."
else
    # Try HTTPS first, fallback to SSH if available
    if git clone https://gitlab.com/trbc-dev/pdf-rename-sort.git 2>/dev/null; then
        echo "Cloned via HTTPS"
        cd pdf-rename-sort
    elif git clone git@gitlab.com:trbc-dev/pdf-rename-sort.git 2>/dev/null; then
        echo "Cloned via SSH"
        cd pdf-rename-sort
    else
        echo "ERROR: Could not clone repository. Please check:"
        echo "1. Repository URL is correct"
        echo "2. SSH keys are configured (for SSH clone)"
        echo "3. Internet connection is working"
        exit 1
    fi
fi

# Create virtual environment and install dependencies
echo "Setting up Python virtual environment..."
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
pip install gunicorn

# Create application directory structure
echo "Setting up application directory..."
mkdir -p static
# Copy logo if it exists in repo, otherwise you'll need to add it
# cp path/to/trbc-logo-full.png static/  # Uncomment and adjust if needed

# Get the actual user who invoked sudo (not root)
if [ -n "$SUDO_USER" ]; then
    CURRENT_USER=$SUDO_USER
elif [ -n "$LOGNAME" ] && [ "$LOGNAME" != "root" ]; then
    CURRENT_USER=$LOGNAME
else
    CURRENT_USER=ubuntu
fi

echo "Installing for user: $CURRENT_USER"

# Create systemd service file
echo "Creating systemd service..."
sudo tee /etc/systemd/system/pdf-renamer.service > /dev/null <<EOF
[Unit]
Description=PDF Renamer Flask App
After=network.target

[Service]
User=$CURRENT_USER
WorkingDirectory=/home/$CURRENT_USER/pdf-rename-sort
Environment="PATH=/home/$CURRENT_USER/pdf-rename-sort/venv/bin"
Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
Environment="TENANT_ID=YOUR_MICROSOFT_ENTRA_TENANT_ID"
Environment="CLIENT_ID=YOUR_MICROSOFT_ENTRA_CLIENT_ID"
Environment="CLIENT_SECRET=YOUR_MICROSOFT_ENTRA_CLIENT_SECRET"
Environment="ADMIN_USERNAME=trbcit"
Environment="ADMIN_PASSWORD=CHANGE_THIS_PASSWORD"
ExecStart=/home/$CURRENT_USER/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
Restart=always

[Install]
WantedBy=multi-user.target
EOF

# Set proper permissions
sudo chown -R $CURRENT_USER:$CURRENT_USER /home/$CURRENT_USER/pdf-rename-sort

# Enable and start the service
echo "Starting the application service..."
sudo systemctl daemon-reload
sudo systemctl enable pdf-renamer
sudo systemctl start pdf-renamer

# Configure Nginx reverse proxy for PDF Renamer (multi-domain setup)
echo "Configuring Nginx reverse proxy for PDF Renamer..."
sudo tee /etc/nginx/sites-available/pdf-renamer > /dev/null <<EOF
server {
    listen 80;
    server_name nextgenpdf.trbc.org;  # Production domain

    # Handle large file uploads (500MB)
    client_max_body_size 500M;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # Handle static files
    location /static {
        alias /home/$CURRENT_USER/pdf-rename-sort/static;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Proxy to Flask app on port 3000
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;

        # WebSocket support (if needed in future)
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeout settings for large files
        proxy_connect_timeout 60s;
        proxy_send_timeout 300s;  # Increased for large uploads
        proxy_read_timeout 300s;  # Increased for large uploads
    }

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied expired no-cache no-store private must-revalidate auth;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss;
}
EOF

# Enable the PDF Renamer site (doesn't remove existing sites)
sudo ln -s /etc/nginx/sites-available/pdf-renamer /etc/nginx/sites-enabled/ 2>/dev/null || true

# Don't remove default nginx site - let existing apps continue working
# sudo rm -f /etc/nginx/sites-enabled/default

# Test nginx configuration
echo "Testing Nginx configuration..."
sudo nginx -t

# Reload nginx
echo "Reloading Nginx..."
sudo systemctl reload nginx

# Configure firewall (UFW)
echo "Configuring firewall..."
sudo ufw allow ssh
sudo ufw allow 'Nginx Full'
sudo ufw --force enable

echo ""
echo "Installation completed successfully!"
echo ""
echo "IMPORTANT: Configure Microsoft Entra ID authentication:"
echo "1. Go to Azure Portal > Microsoft Entra ID > App registrations"
echo "2. Create a new registration or use existing one"
echo "3. Note the Application (client) ID and Directory (tenant) ID"
echo "4. Add a client secret under Certificates & secrets"
echo "5. Add redirect URI: https://nextgenpdf.trbc.org/auth/microsoft/callback"
echo "6. Grant appropriate permissions if needed"
echo ""
echo "Next steps:"
echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
echo "   - SECRET_KEY: Set a secure random key (use: openssl rand -hex 32)"
echo "   - TENANT_ID: Your Microsoft Entra tenant ID"
echo "   - CLIENT_ID: Your Microsoft Entra application ID"
echo "   - CLIENT_SECRET: Your Microsoft Entra client secret"
echo "   - ADMIN_USERNAME and ADMIN_PASSWORD: Set secure admin credentials"
echo ""
echo "2. Update the server_name in /etc/nginx/sites-available/pdf-renamer:"
echo "   - Change 'pdf-renamer.your-domain.com' to 'nextgenpdf.trbc.org'"
echo "   - Point your DNS for nextgenpdf.trbc.org to this server's IP"
echo ""
echo "3. For SSL/HTTPS, install certbot:"
echo "   sudo apt install certbot python3-certbot-nginx"
echo "   sudo certbot --nginx -d nextgenpdf.trbc.org"
echo ""
echo "4. Reload systemd after updating environment variables:"
echo "   sudo systemctl daemon-reload"
echo "   sudo systemctl restart pdf-renamer"
echo ""
echo "5. Check service status:"
echo "   sudo systemctl status pdf-renamer"
echo "   sudo systemctl status nginx"
echo ""
echo "NOTE: This setup runs alongside your existing app on port 5000."
echo "The PDF Renamer will be accessible at https://nextgenpdf.trbc.org."
echo "Installed for user: $CURRENT_USER"