WOWATER — развёртывание ipwhitelist-app (без воды)

Для опытных DevOps. Минимум текста, только команды.

1. PostgreSQL

sudo apt install -y postgresql
DB_PASS=$(openssl rand -base64 24)
sudo -u postgres psql -c "CREATE USER ipwhitelist WITH PASSWORD '${DB_PASS}';"
sudo -u postgres psql -c "CREATE DATABASE ipwhitelist OWNER ipwhitelist;"

2. Node.js + код

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
sudo apt install -y nodejs
git clone https://gitea.services.ngcloud.ru/Nail/ipwhitelist-app.git /opt/ipwhitelist
cd /opt/ipwhitelist
npm install --production
sudo -u postgres psql -d ipwhitelist -f sql/schema.sql

3. .env

cp .env.example .env && chmod 600 .env

Заполнить: DB_PASS, SESSION_SECRET, KC_CLIENT_ID, KC_CLIENT_SECRET, APP_URL, IAM_API_URL.

DEV_MODE → false.

4. nginx + Let's Encrypt

server {
    listen 443 ssl;
    server_name ваш-домен.ru;
    ssl_certificate /etc/letsencrypt/live/.../fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/.../privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

5. PM2

npm i -g pm2
pm2 start server.js --name ipwhitelist
pm2 save && pm2 startup

6. Keycloak OIDC

Создать Confidential client в Keycloak (realm cloud):

Valid Redirect URIs: https://ваш-домен.ru/callback
Client Authentication: On
Записать KC_CLIENT_ID и KC_CLIENT_SECRET в .env

Готово. pm2 restart ipwhitelist.

1.8 KiB Raw Permalink Blame History