Initial deploy setup

2026-07-21 14:00:00 +02:00
commit b8091e59bd
285 changed files with 27854 additions and 0 deletions
@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+compose_file="${1:-docker-compose.yml}"
+env_file="${2:-.env}"
+app_port="${APP_PORT:-1226}"
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "docker niet gevonden. Installeer Docker en probeer opnieuw."
+  exit 1
+fi
+
+if ! command -v python >/dev/null 2>&1; then
+  echo "python niet gevonden. docker-deploy vereist python voor secrets."
+  exit 1
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl niet gevonden; healthcheck wordt overgeslagen."
+  export SKIP_HEALTHCHECK=1
+fi
+
+if [[ ! -f "$env_file" ]]; then
+  : > "$env_file"
+  chmod 600 "$env_file"
+  echo "Aangemaakte $env_file"
+fi
+
+generate_secret() {
+  if command -v python >/dev/null 2>&1; then
+    python scripts/generate_secret.py
+  else
+    date +%s | sha256sum | cut -d' ' -f1
+  fi
+}
+
+ensure_env() {
+  local key="$1"
+  local value="$2"
+  local existing_line
+  local existing_value
+
+  existing_line="$(grep -m1 "^${key}=" "$env_file" || true)"
+  if [[ -z "$existing_line" ]]; then
+    printf '%s=%s\n' "$key" "$value" >> "$env_file"
+    return
+  fi
+
+  existing_value="${existing_line#*=}"
+  if [[ -n "$existing_value" && \
+    "$existing_value" != CHANGE_ME* && \
+    "$existing_value" != dev-only-change-me && \
+    "$existing_value" != codex-local-only ]]; then
+    return 0
+  fi
+
+  local temp_env
+  temp_env="$(mktemp)"
+  while IFS= read -r env_line; do
+    if [[ "$env_line" == "${key}="* ]]; then
+      printf '%s=%s\n' "$key" "$value" >> "$temp_env"
+    else
+      printf '%s\n' "$env_line" >> "$temp_env"
+    fi
+  done < "$env_file"
+  mv "$temp_env" "$env_file"
+}
+
+app_host="${APP_HOST:-${HOSTNAME:-localhost}}"
+app_scheme="${APP_SCHEME:-http}"
+app_hostnames="${APP_HOSTS:-$app_host}"
+app_origin="${APP_ORIGINS:-}"
+
+if [[ -z "$app_origin" ]]; then
+  if [[ "$app_scheme" == "https" ]]; then
+    if [[ "$app_port" == "443" ]]; then
+      app_origin="https://$app_host"
+    else
+      app_origin="https://$app_host:$app_port"
+    fi
+  else
+    app_origin="http://$app_host:$app_port"
+  fi
+fi
+
+secret_key="$(generate_secret)"
+postgres_password="${POSTGRES_PASSWORD:-$(generate_secret)}"
+admin_password="${VACATURERADAR_ADMIN_PASSWORD:-$(generate_secret | cut -c 1-24)}"
+db_url="postgresql://vacatureradar:${postgres_password}@postgres:5432/vacatureradar"
+
+debug="${DJANGO_DEBUG:-1}"
+if [[ "$debug" == "0" ]]; then
+  session_secure="${SESSION_COOKIE_SECURE:-1}"
+  csrf_secure="${CSRF_COOKIE_SECURE:-1}"
+  ssl_redirect="${SECURE_SSL_REDIRECT:-1}"
+  hsts_seconds="${SECURE_HSTS_SECONDS:-31536000}"
+else
+  session_secure="${SESSION_COOKIE_SECURE:-0}"
+  csrf_secure="${CSRF_COOKIE_SECURE:-0}"
+  ssl_redirect="${SECURE_SSL_REDIRECT:-0}"
+  hsts_seconds="${SECURE_HSTS_SECONDS:-0}"
+fi
+
+ensure_env "DJANGO_SECRET_KEY" "$secret_key"
+ensure_env "DJANGO_DEBUG" "$debug"
+ensure_env "DJANGO_ALLOWED_HOSTS" "$app_hostnames"
+ensure_env "DJANGO_CSRF_TRUSTED_ORIGINS" "$app_origin"
+ensure_env "DJANGO_TIME_ZONE" "Europe/Brussels"
+ensure_env "POSTGRES_DB" "vacatureradar"
+ensure_env "POSTGRES_USER" "vacatureradar"
+ensure_env "POSTGRES_PASSWORD" "$postgres_password"
+ensure_env "POSTGRES_HOST" "postgres"
+ensure_env "POSTGRES_PORT" "5432"
+ensure_env "DATABASE_URL" "$db_url"
+ensure_env "REDIS_URL" "redis://redis:6379/0"
+ensure_env "CELERY_TASK_ALWAYS_EAGER" "0"
+ensure_env "VACATURERADAR_ADMIN_USERNAME" "admin"
+ensure_env "VACATURERADAR_ADMIN_PASSWORD" "$admin_password"
+ensure_env "VACATURERADAR_AUTO_BOOTSTRAP" "1"
+ensure_env "SESSION_COOKIE_SECURE" "$session_secure"
+ensure_env "CSRF_COOKIE_SECURE" "$csrf_secure"
+ensure_env "SECURE_SSL_REDIRECT" "$ssl_redirect"
+ensure_env "SECURE_HSTS_SECONDS" "$hsts_seconds"
+ensure_env "EMAIL_BACKEND" "django.core.mail.backends.console.EmailBackend"
+ensure_env "DEFAULT_FROM_EMAIL" "VacatureRadar <vacatureradar@localhost>"
+ensure_env "SOURCE_POLICY_MODE" "strict"
+ensure_env "AUTH_LOGIN_RATE_LIMIT_MAX_ATTEMPTS" "8"
+ensure_env "AUTH_LOGIN_RATE_LIMIT_WINDOW_SECONDS" "300"
+ensure_env "AUTH_LOGIN_RATE_LIMIT_BLOCK_SECONDS" "300"
+ensure_env "MANUAL_IMPORT_RATE_LIMIT_MAX_ATTEMPTS" "12"
+ensure_env "MANUAL_IMPORT_RATE_LIMIT_WINDOW_SECONDS" "120"
+ensure_env "MANUAL_IMPORT_RATE_LIMIT_BLOCK_SECONDS" "300"
+
+docker compose -f "$compose_file" up -d --build
+
+if [[ "${SKIP_HEALTHCHECK:-0}" != "1" ]]; then
+  for i in {1..30}; do
+    if curl -fsS "http://127.0.0.1:${app_port}/health/ready/" >/dev/null; then
+      echo "Healthcheck geslaagd op poort ${app_port}."
+      break
+    fi
+    if [[ "$i" == "30" ]]; then
+      echo "Healthcheck niet geslaagd binnen 60 seconden."
+      exit 1
+    fi
+    sleep 2
+  done
+fi
+
+docker compose -f "$compose_file" exec -T web python manage.py collectstatic --noinput
+
+cat <<"EOF"
+Deploy klaargezet.
+
+Applicatie:
+- open http://127.0.0.1:1226/
+- admin: admin / waarde uit $env_file
+
+Volgende stappen:
+- Zet APP_HOST en APP_SCHEME=HTTPS voor publieke domeinstandaard.
+- Zet APP_ORIGINS en DJANGO_DEBUG=0 voor echte productie.
+EOF