7rnx-proxy / setup-7rnx-server.sh

#!/bin/bash
# Run this on 7rnx.net (10.22.0.3) as fleeky
# One-time setup: sudoers + migrate inline proxy rules to Include file

set -e

VHOST="/etc/apache2/sites-enabled/000-default-le-ssl.conf"
PROXY_CONF="/etc/apache2/7rnx-proxy.conf"

echo "=== Step 1: Sudoers rules ==="

# Stage to a temp file, VALIDATE, then install. Never write /etc/sudoers.d
# directly: this block used to `tee` straight to the live path and only run
# `visudo -c` afterwards, so a malformed write was already installed by the time
# it was caught. That is exactly how the live file ended up containing a stray
# `EOF` + `sudo chmod ...` (a paste where the heredoc delimiter never closed),
# emitting a syntax error on every sudo call for weeks. Validate first.
SUDOERS_TMP="$(mktemp)"
cat > "$SUDOERS_TMP" << 'EOF'
# Allow fleeky to deploy proxy config and reload Apache (no password)
fleeky ALL=(root) NOPASSWD: /bin/cp /tmp/7rnx-proxy.conf /etc/apache2/7rnx-proxy.conf
# Host-routed vhosts (vhost mode) — a top-level sites-enabled file (VirtualHost blocks).
fleeky ALL=(root) NOPASSWD: /bin/cp /tmp/7rnx-proxy-vhosts.conf /etc/apache2/sites-enabled/7rnx-proxy-vhosts.conf
fleeky ALL=(root) NOPASSWD: /usr/sbin/apachectl configtest
fleeky ALL=(root) NOPASSWD: /bin/systemctl reload apache2
EOF

if ! sudo visudo -c -f "$SUDOERS_TMP"; then
    rm -f "$SUDOERS_TMP"
    echo "Sudoers: STAGED FILE IS INVALID — refusing to install. Live file untouched." >&2
    exit 1
fi

# install(1) is atomic and sets owner/mode in one step, so there is no window
# where the file exists with the wrong permissions (sudo ignores a sudoers.d
# file that is group/world writable).
sudo install -m 0440 -o root -g root "$SUDOERS_TMP" /etc/sudoers.d/7rnx-proxy
rm -f "$SUDOERS_TMP"
sudo visudo -c -f /etc/sudoers.d/7rnx-proxy
echo "Sudoers: OK"

echo ""
echo "=== Step 2: Add Include to SSL vhost ==="

if grep -q "Include /etc/apache2/7rnx-proxy.conf" "$VHOST"; then
    echo "Include already present, skipping."
else
    # Backup first
    sudo cp "$VHOST" "${VHOST}.pre-7rnx-backup"
    echo "Backup: ${VHOST}.pre-7rnx-backup"

    # Add Include just before </VirtualHost> closing tag
    sudo sed -i '/<\/VirtualHost>/i\    # 7rnx-proxy managed config\n    Include /etc/apache2/7rnx-proxy.conf' "$VHOST"
    echo "Include directive added."
fi

echo ""
echo "=== Step 3: Create empty proxy conf ==="

if [ ! -f "$PROXY_CONF" ]; then
    echo "# Placeholder — will be replaced by 7rnx deploy" | sudo tee "$PROXY_CONF" > /dev/null
    echo "Created empty $PROXY_CONF"
else
    echo "$PROXY_CONF already exists, skipping."
fi

echo ""
echo "=== Step 4: Validate ==="

sudo apachectl configtest

echo ""
echo "=== Done ==="
echo ""
echo "Next steps:"
echo "  1. Review the vhost: cat $VHOST"
echo "  2. From tabertron, run: 7rnx deploy"
echo "  3. Verify services still work"
echo "  4. Once confirmed, remove inline proxy rules from $VHOST"
echo "     (the inline rules and 7rnx-proxy.conf will coexist safely — same targets)"