70 lines
1.8 KiB
Markdown
70 lines
1.8 KiB
Markdown
# WOWATER — развёртывание ipwhitelist-app (без воды)
|
|
|
|
> Для опытных DevOps. Минимум текста, только команды.
|
|
|
|
## 1. PostgreSQL
|
|
|
|
```bash
|
|
sudo apt install -y postgresql
|
|
DB_PASS=$(openssl rand -base64 24)
|
|
sudo -u postgres psql -c "CREATE USER ipwhitelist WITH PASSWORD '${DB_PASS}';"
|
|
sudo -u postgres psql -c "CREATE DATABASE ipwhitelist OWNER ipwhitelist;"
|
|
```
|
|
|
|
## 2. Node.js + код
|
|
|
|
```bash
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
|
|
sudo apt install -y nodejs
|
|
git clone https://gitea.services.ngcloud.ru/Nail/ipwhitelist-app.git /opt/ipwhitelist
|
|
cd /opt/ipwhitelist
|
|
npm install --production
|
|
sudo -u postgres psql -d ipwhitelist -f sql/schema.sql
|
|
```
|
|
|
|
## 3. .env
|
|
|
|
```bash
|
|
cp .env.example .env && chmod 600 .env
|
|
```
|
|
|
|
Заполнить: `DB_PASS`, `SESSION_SECRET`, `KC_CLIENT_ID`, `KC_CLIENT_SECRET`, `APP_URL`, `IAM_API_URL`.
|
|
|
|
`DEV_MODE` → `false`.
|
|
|
|
## 4. nginx + Let's Encrypt
|
|
|
|
```nginx
|
|
server {
|
|
listen 443 ssl;
|
|
server_name ваш-домен.ru;
|
|
ssl_certificate /etc/letsencrypt/live/.../fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/.../privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
}
|
|
```
|
|
|
|
## 5. PM2
|
|
|
|
```bash
|
|
npm i -g pm2
|
|
pm2 start server.js --name ipwhitelist
|
|
pm2 save && pm2 startup
|
|
```
|
|
|
|
## 6. Keycloak OIDC
|
|
|
|
Создать Confidential client в Keycloak (realm `cloud`):
|
|
- `Valid Redirect URIs`: `https://ваш-домен.ru/callback`
|
|
- `Client Authentication`: On
|
|
- Записать `KC_CLIENT_ID` и `KC_CLIENT_SECRET` в `.env`
|
|
|
|
Готово. `pm2 restart ipwhitelist`.
|