134 lines
5.5 KiB
Bash
Executable File
134 lines
5.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Wird im LXC als deploy/root ausgeführt um die App einzurichten.
|
|
# Idempotent: kann wiederholt laufen.
|
|
set -euo pipefail
|
|
|
|
REPO_URL="${REPO_URL:-https://git.cynfo.net/christian/voice-agent.git}"
|
|
APP_DIR="/var/www/voice-agent"
|
|
APP_USER="deploy"
|
|
|
|
echo "[0/7] Sicherstellen: nicht-interaktive apt"
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
echo "[1/7] System-Pakete installieren"
|
|
apt-get update -y
|
|
apt-get install -y --no-install-recommends \
|
|
git python3 python3-venv python3-pip nginx ca-certificates curl ffmpeg sudo
|
|
|
|
echo "[2/7] Deploy-User sicherstellen"
|
|
id "$APP_USER" >/dev/null 2>&1 || useradd -m -s /bin/bash "$APP_USER"
|
|
mkdir -p "$APP_DIR"
|
|
chown -R "$APP_USER:$APP_USER" "$APP_DIR"
|
|
|
|
echo "[3/7] Repo klonen/aktualisieren"
|
|
if [ -d "$APP_DIR/.git" ]; then
|
|
runuser -u "$APP_USER" -- git -C "$APP_DIR" fetch --all --prune
|
|
runuser -u "$APP_USER" -- git -C "$APP_DIR" reset --hard origin/main
|
|
else
|
|
runuser -u "$APP_USER" -- git clone "$REPO_URL" "$APP_DIR"
|
|
fi
|
|
|
|
echo "[4/7] Python-venv + Dependencies"
|
|
cd "$APP_DIR/lxc-frontend"
|
|
runuser -u "$APP_USER" -- python3 -m venv .venv
|
|
runuser -u "$APP_USER" -- .venv/bin/pip install --upgrade pip
|
|
runuser -u "$APP_USER" -- .venv/bin/pip install -r requirements.txt
|
|
|
|
echo "[5/7] .env anlegen falls fehlt"
|
|
if [ ! -f "$APP_DIR/lxc-frontend/.env" ]; then
|
|
cp "$APP_DIR/lxc-frontend/.env.example" "$APP_DIR/lxc-frontend/.env"
|
|
chown "$APP_USER:$APP_USER" "$APP_DIR/lxc-frontend/.env"
|
|
fi
|
|
chmod 600 "$APP_DIR/lxc-frontend/.env"
|
|
|
|
# SESSION_SECRET einmalig generieren, falls noch Platzhalter drinsteht
|
|
if grep -q "^SESSION_SECRET=CHANGE-ME-SET-IN-ENV" "$APP_DIR/lxc-frontend/.env"; then
|
|
SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
|
|
sed -i "s|^SESSION_SECRET=CHANGE-ME-SET-IN-ENV|SESSION_SECRET=${SECRET}|" "$APP_DIR/lxc-frontend/.env"
|
|
echo " SESSION_SECRET wurde generiert."
|
|
elif ! grep -q "^SESSION_SECRET=" "$APP_DIR/lxc-frontend/.env"; then
|
|
SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
|
|
echo "SESSION_SECRET=${SECRET}" >> "$APP_DIR/lxc-frontend/.env"
|
|
echo " SESSION_SECRET nachgetragen."
|
|
fi
|
|
|
|
# ALLOWED_EXTS sicherstellen, dass 'webm' für Browser-Aufnahmen drin ist
|
|
if grep -q "^ALLOWED_EXTS=" "$APP_DIR/lxc-frontend/.env"; then
|
|
if ! grep -E "^ALLOWED_EXTS=.*\bwebm\b" "$APP_DIR/lxc-frontend/.env" >/dev/null; then
|
|
sed -i 's|^ALLOWED_EXTS=\(.*\)$|ALLOWED_EXTS=\1,webm|' "$APP_DIR/lxc-frontend/.env"
|
|
echo " ALLOWED_EXTS um 'webm' ergänzt (für Mikrofon-Aufnahmen)."
|
|
fi
|
|
else
|
|
echo "ALLOWED_EXTS=mp3,wav,m4a,mp4,ogg,flac,webm" >> "$APP_DIR/lxc-frontend/.env"
|
|
fi
|
|
|
|
mkdir -p /var/lib/voice-agent/uploads /var/lib/voice-agent/results
|
|
chown -R "$APP_USER:$APP_USER" /var/lib/voice-agent
|
|
|
|
echo "[6/7] systemd-Service installieren"
|
|
cp "$APP_DIR/deploy/systemd/voice-agent.service" /etc/systemd/system/voice-agent.service
|
|
systemctl daemon-reload
|
|
systemctl enable voice-agent
|
|
systemctl restart voice-agent
|
|
|
|
echo "[7/8] Selbst-signiertes TLS-Zertifikat (für Mikrofon-Zugriff via HTTPS)"
|
|
SSL_DIR="/etc/ssl/voice-agent"
|
|
SSL_CRT="$SSL_DIR/voice-agent.crt"
|
|
SSL_KEY="$SSL_DIR/voice-agent.key"
|
|
mkdir -p "$SSL_DIR"
|
|
|
|
if [ ! -f "$SSL_CRT" ] || [ ! -f "$SSL_KEY" ]; then
|
|
apt-get install -y --no-install-recommends openssl >/dev/null
|
|
HOST_NAME="$(hostname --fqdn 2>/dev/null || hostname)"
|
|
HOST_SHORT="$(hostname)"
|
|
HOST_IP="$(hostname -I | awk '{print $1}')"
|
|
SAN="DNS:${HOST_NAME},DNS:${HOST_SHORT},DNS:voice-agent.local,IP:${HOST_IP}"
|
|
echo " Erzeuge Cert für: $SAN"
|
|
openssl req -x509 -nodes -newkey rsa:4096 -days 825 \
|
|
-keyout "$SSL_KEY" -out "$SSL_CRT" \
|
|
-subj "/CN=${HOST_NAME}" -addext "subjectAltName=${SAN}" \
|
|
-addext "extendedKeyUsage=serverAuth" \
|
|
-addext "basicConstraints=CA:FALSE" 2>/dev/null
|
|
chmod 0644 "$SSL_CRT"
|
|
chmod 0600 "$SSL_KEY"
|
|
echo " Cert erzeugt: $SSL_CRT"
|
|
else
|
|
echo " Cert bereits vorhanden, behalte: $SSL_CRT"
|
|
fi
|
|
|
|
echo "[8/8] Nginx-Reverse-Proxy (HTTPS + HTTP-Redirect)"
|
|
cp "$APP_DIR/deploy/nginx/voice-agent.conf" /etc/nginx/sites-available/voice-agent
|
|
ln -sf /etc/nginx/sites-available/voice-agent /etc/nginx/sites-enabled/voice-agent
|
|
rm -f /etc/nginx/sites-enabled/default
|
|
nginx -t
|
|
systemctl reload nginx
|
|
|
|
echo "[+] CLI-Wrapper /usr/local/bin/voice-agent-admin"
|
|
cat > /usr/local/bin/voice-agent-admin <<'WRAPPER'
|
|
#!/usr/bin/env bash
|
|
exec sudo -u deploy /var/www/voice-agent/lxc-frontend/.venv/bin/python \
|
|
/var/www/voice-agent/lxc-frontend/app/cli.py "$@"
|
|
WRAPPER
|
|
chmod 0755 /usr/local/bin/voice-agent-admin
|
|
|
|
echo
|
|
echo "Fertig. Health-Check:"
|
|
echo " curl -sk https://localhost/health"
|
|
echo
|
|
echo "Aufruf im Browser: https://<LXC-IP>/ (HTTP wird auf HTTPS umgeleitet)"
|
|
echo "Beim ersten Aufruf wird der initiale Admin angelegt."
|
|
echo
|
|
echo "── Mikrofon-Aufnahme von Handys ──────────────────────────────────────"
|
|
echo "Damit iOS/Android das Mikrofon freigibt, MUSS die Seite über HTTPS laufen."
|
|
echo "Das selbst-signierte Zertifikat einmalig auf jedem Gerät installieren:"
|
|
echo
|
|
echo " iPhone: Safari öffnen, http://<LXC-IP>/ssl/voice-agent.crt aufrufen"
|
|
echo " → Profil herunterladen → Einstellungen → Profil installieren"
|
|
echo " → Allgemein → Info → Zertifikatsvertrauen → 'voice-agent' aktivieren"
|
|
echo
|
|
echo " Android: Browser öffnen, http://<LXC-IP>/ssl/voice-agent.crt aufrufen"
|
|
echo " → Cert installieren als 'VPN/Apps' (Variiert je nach Hersteller)"
|
|
echo
|
|
echo "Falls noch nicht geschehen: MAC_API_URL in $APP_DIR/lxc-frontend/.env setzen"
|
|
echo "und Service neu starten: sudo systemctl restart voice-agent"
|