alexandrev-tibco
77 lines
3.2 KiB
Bash
77 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
# ============================================================
|
|
# setup.sh — First-time deployment of medium-proxy
|
|
#
|
|
# Run once from /root/medium-proxy on the Postiz LXC (192.168.1.90).
|
|
# After this, docker compose up -d --build is enough for updates.
|
|
#
|
|
# What it does:
|
|
# 1. Generates a local CA cert + a server cert for api.medium.com
|
|
# 2. Builds and starts the medium-proxy Docker container
|
|
# 3. Prints the snippet to add to /root/postiz/docker-compose.yaml
|
|
# ============================================================
|
|
set -euo pipefail
|
|
|
|
CERT_DIR="./certs"
|
|
PROXY_IP="172.19.0.100"
|
|
POSTIZ_COMPOSE="/root/postiz/docker-compose.yaml"
|
|
|
|
# ── 1. Generate TLS certs ────────────────────────────────────────────────────
|
|
mkdir -p "$CERT_DIR"
|
|
|
|
echo "→ Generating CA certificate..."
|
|
openssl genrsa -out "$CERT_DIR/ca.key" 4096 2>/dev/null
|
|
openssl req -new -x509 \
|
|
-key "$CERT_DIR/ca.key" \
|
|
-out "$CERT_DIR/ca.crt" \
|
|
-days 3650 \
|
|
-subj "/CN=Medium Proxy CA/O=Homelab" 2>/dev/null
|
|
echo " ✓ $CERT_DIR/ca.crt"
|
|
|
|
echo "→ Generating server certificate for api.medium.com..."
|
|
openssl genrsa -out "$CERT_DIR/server.key" 2048 2>/dev/null
|
|
openssl req -new \
|
|
-key "$CERT_DIR/server.key" \
|
|
-out "$CERT_DIR/server.csr" \
|
|
-subj "/CN=api.medium.com" 2>/dev/null
|
|
|
|
# SAN extension required — modern TLS clients reject certs without it
|
|
cat > "$CERT_DIR/server.ext" <<'EXTEOF'
|
|
subjectAltName=DNS:api.medium.com
|
|
EXTEOF
|
|
|
|
openssl x509 -req \
|
|
-in "$CERT_DIR/server.csr" \
|
|
-CA "$CERT_DIR/ca.crt" \
|
|
-CAkey "$CERT_DIR/ca.key" \
|
|
-CAcreateserial \
|
|
-out "$CERT_DIR/server.crt" \
|
|
-days 3650 \
|
|
-extfile "$CERT_DIR/server.ext" 2>/dev/null
|
|
echo " ✓ $CERT_DIR/server.crt"
|
|
|
|
# ── 2. Build and start the proxy ─────────────────────────────────────────────
|
|
echo "→ Building and starting medium-proxy..."
|
|
docker compose up -d --build
|
|
echo " ✓ medium-proxy running at $PROXY_IP:443"
|
|
|
|
# ── 3. Print the Postiz docker-compose patch ─────────────────────────────────
|
|
cat << PATCHEOF
|
|
|
|
════════════════════════════════════════════════════════════════
|
|
Add this to the 'postiz' service in $POSTIZ_COMPOSE
|
|
════════════════════════════════════════════════════════════════
|
|
|
|
extra_hosts:
|
|
- "api.medium.com:${PROXY_IP}"
|
|
environment:
|
|
NODE_EXTRA_CA_CERTS: /certs/ca.crt
|
|
volumes:
|
|
- /root/medium-proxy/certs/ca.crt:/certs/ca.crt:ro
|
|
|
|
Then restart only the postiz service (no data loss):
|
|
cd /root/postiz && docker compose up -d postiz
|
|
|
|
════════════════════════════════════════════════════════════════
|
|
PATCHEOF
|