207 lines
6.2 KiB
Bash
207 lines
6.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
compose_file="${1:-docker-compose.yml}"
|
|
env_file="${2:-.env}"
|
|
app_port="${APP_PORT:-1226}"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo "docker niet gevonden. Installeer Docker en probeer opnieuw."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v python >/dev/null 2>&1; then
|
|
echo "python niet gevonden. docker-deploy vereist python voor secrets."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v curl >/dev/null 2>&1; then
|
|
echo "curl niet gevonden; healthcheck wordt overgeslagen."
|
|
export SKIP_HEALTHCHECK=1
|
|
fi
|
|
|
|
if [[ ! -f "$env_file" ]]; then
|
|
: > "$env_file"
|
|
chmod 600 "$env_file"
|
|
echo "Aangemaakte $env_file"
|
|
fi
|
|
|
|
generate_secret() {
|
|
if command -v python >/dev/null 2>&1; then
|
|
python scripts/generate_secret.py
|
|
else
|
|
date +%s | sha256sum | cut -d' ' -f1
|
|
fi
|
|
}
|
|
|
|
write_env() {
|
|
local key="$1"
|
|
local value="$2"
|
|
local force="${3:-0}"
|
|
local existing_line
|
|
local existing_value
|
|
|
|
existing_line="$(grep -m1 "^${key}=" "$env_file" || true)"
|
|
if [[ -z "$existing_line" ]]; then
|
|
printf '%s=%s\n' "$key" "$value" >> "$env_file"
|
|
return
|
|
fi
|
|
|
|
existing_value="${existing_line#*=}"
|
|
if [[ "$force" != "1" && -n "$existing_value" && \
|
|
"$existing_value" != CHANGE_ME* && \
|
|
"$existing_value" != dev-only-change-me && \
|
|
"$existing_value" != codex-local-only ]]; then
|
|
return 0
|
|
fi
|
|
|
|
local temp_env
|
|
temp_env="$(mktemp)"
|
|
while IFS= read -r env_line; do
|
|
if [[ "$env_line" == "${key}="* ]]; then
|
|
printf '%s=%s\n' "$key" "$value" >> "$temp_env"
|
|
else
|
|
printf '%s\n' "$env_line" >> "$temp_env"
|
|
fi
|
|
done < "$env_file"
|
|
mv "$temp_env" "$env_file"
|
|
chmod 600 "$env_file"
|
|
}
|
|
|
|
app_host_was_explicit=0
|
|
[[ -n "${APP_HOST:-}" ]] && app_host_was_explicit=1
|
|
app_host="${APP_HOST:-${HOSTNAME:-localhost}}"
|
|
app_scheme="${APP_SCHEME:-http}"
|
|
app_public_port="${APP_PUBLIC_PORT:-}"
|
|
app_hostnames="${APP_HOSTS:-$app_host}"
|
|
app_origin="${APP_ORIGINS:-}"
|
|
app_base_url=""
|
|
|
|
# De lokale healthcheck gebruikt 127.0.0.1. Houd die host en localhost altijd
|
|
# toegestaan, ook wanneer APP_HOSTS expliciet door de runner is ingesteld.
|
|
for required_host in 127.0.0.1 localhost; do
|
|
if [[ ",$app_hostnames," != *",$required_host,"* ]]; then
|
|
app_hostnames="${app_hostnames},${required_host}"
|
|
fi
|
|
done
|
|
|
|
if [[ -z "$app_public_port" ]]; then
|
|
if [[ "$app_scheme" == "https" ]]; then
|
|
app_public_port="443"
|
|
else
|
|
app_public_port="$app_port"
|
|
fi
|
|
fi
|
|
|
|
if [[ ( "$app_scheme" == "https" && "$app_public_port" == "443" ) || \
|
|
( "$app_scheme" == "http" && "$app_public_port" == "80" ) ]]; then
|
|
app_base_url="${app_scheme}://${app_host}"
|
|
else
|
|
app_base_url="${app_scheme}://${app_host}:${app_public_port}"
|
|
fi
|
|
|
|
if [[ -z "$app_origin" ]]; then
|
|
app_origin="$app_base_url"
|
|
fi
|
|
|
|
secret_key="$(generate_secret)"
|
|
postgres_password="${POSTGRES_PASSWORD:-$(generate_secret)}"
|
|
admin_password="${VACATURERADAR_ADMIN_PASSWORD:-$(generate_secret | cut -c 1-24)}"
|
|
db_url="postgresql://vacatureradar:${postgres_password}@postgres:5432/vacatureradar"
|
|
|
|
debug="${DJANGO_DEBUG:-}"
|
|
if [[ -z "$debug" ]]; then
|
|
if [[ "$app_host_was_explicit" == "1" && "$app_scheme" == "https" ]]; then
|
|
debug="0"
|
|
else
|
|
debug="1"
|
|
fi
|
|
fi
|
|
if [[ "$debug" == "0" ]]; then
|
|
session_secure="${SESSION_COOKIE_SECURE:-1}"
|
|
csrf_secure="${CSRF_COOKIE_SECURE:-1}"
|
|
ssl_redirect="${SECURE_SSL_REDIRECT:-1}"
|
|
hsts_seconds="${SECURE_HSTS_SECONDS:-300}"
|
|
else
|
|
session_secure="${SESSION_COOKIE_SECURE:-0}"
|
|
csrf_secure="${CSRF_COOKIE_SECURE:-0}"
|
|
ssl_redirect="${SECURE_SSL_REDIRECT:-0}"
|
|
hsts_seconds="${SECURE_HSTS_SECONDS:-0}"
|
|
fi
|
|
|
|
write_env "DJANGO_SECRET_KEY" "$secret_key"
|
|
write_env "DJANGO_DEBUG" "$debug" "$app_host_was_explicit"
|
|
write_env "DJANGO_ALLOWED_HOSTS" "$app_hostnames" "$app_host_was_explicit"
|
|
write_env "DJANGO_CSRF_TRUSTED_ORIGINS" "$app_origin" "$app_host_was_explicit"
|
|
if [[ "$app_host_was_explicit" == "1" ]]; then
|
|
write_env "PUBLIC_BASE_URL" "$app_base_url" 1
|
|
if [[ "$app_scheme" == "https" ]]; then
|
|
write_env "TRUST_PROXY_HEADERS" "1" 1
|
|
else
|
|
write_env "TRUST_PROXY_HEADERS" "0" 1
|
|
fi
|
|
write_env "USE_X_FORWARDED_HOST" "0" 1
|
|
fi
|
|
write_env "DJANGO_TIME_ZONE" "Europe/Brussels"
|
|
write_env "POSTGRES_DB" "vacatureradar"
|
|
write_env "POSTGRES_USER" "vacatureradar"
|
|
write_env "POSTGRES_PASSWORD" "$postgres_password"
|
|
write_env "POSTGRES_HOST" "postgres"
|
|
write_env "POSTGRES_PORT" "5432"
|
|
write_env "DATABASE_URL" "$db_url"
|
|
write_env "REDIS_URL" "redis://redis:6379/0"
|
|
write_env "CACHE_URL" "redis://redis:6379/1"
|
|
write_env "HEALTHCHECK_REQUIRE_CACHE" "1"
|
|
write_env "CELERY_TASK_ALWAYS_EAGER" "0"
|
|
write_env "VACATURERADAR_ADMIN_USERNAME" "admin"
|
|
write_env "VACATURERADAR_ADMIN_PASSWORD" "$admin_password"
|
|
write_env "VACATURERADAR_AUTO_BOOTSTRAP" "1"
|
|
write_env "SESSION_COOKIE_SECURE" "$session_secure"
|
|
write_env "CSRF_COOKIE_SECURE" "$csrf_secure"
|
|
write_env "SECURE_SSL_REDIRECT" "$ssl_redirect"
|
|
write_env "SECURE_HSTS_SECONDS" "$hsts_seconds"
|
|
write_env "DEMO_READ_ONLY" "1"
|
|
write_env "SEARCH_ENGINE_INDEXING_ENABLED" "0"
|
|
write_env "EMAIL_BACKEND" "django.core.mail.backends.console.EmailBackend"
|
|
write_env "DEFAULT_FROM_EMAIL" "VacatureRadar <vacatureradar@localhost>"
|
|
write_env "SOURCE_POLICY_MODE" "strict"
|
|
write_env "AUTH_LOGIN_RATE_LIMIT_MAX_ATTEMPTS" "8"
|
|
write_env "AUTH_LOGIN_RATE_LIMIT_WINDOW_SECONDS" "300"
|
|
write_env "AUTH_LOGIN_RATE_LIMIT_BLOCK_SECONDS" "300"
|
|
write_env "MANUAL_IMPORT_RATE_LIMIT_MAX_ATTEMPTS" "12"
|
|
write_env "MANUAL_IMPORT_RATE_LIMIT_WINDOW_SECONDS" "120"
|
|
write_env "MANUAL_IMPORT_RATE_LIMIT_BLOCK_SECONDS" "300"
|
|
|
|
export VACATURERADAR_ENV_FILE="$env_file"
|
|
docker compose --env-file "$env_file" -f "$compose_file" up -d --build
|
|
|
|
if [[ "${SKIP_HEALTHCHECK:-0}" != "1" ]]; then
|
|
for i in {1..30}; do
|
|
if curl -fsS "http://127.0.0.1:${app_port}/health/ready/" >/dev/null; then
|
|
echo "Healthcheck geslaagd op poort ${app_port}."
|
|
break
|
|
fi
|
|
if [[ "$i" == "30" ]]; then
|
|
echo "Healthcheck niet geslaagd binnen 60 seconden."
|
|
exit 1
|
|
fi
|
|
sleep 2
|
|
done
|
|
fi
|
|
|
|
cat <<EOF
|
|
Deploy klaargezet.
|
|
|
|
Applicatie:
|
|
- lokaal: http://127.0.0.1:${app_port}/
|
|
- publiek: ${app_base_url}
|
|
- admin: admin / waarde uit ${env_file}
|
|
|
|
Volgende stappen:
|
|
- Gebruik APP_HOST=<domein> APP_SCHEME=https DJANGO_DEBUG=0 voor publieke productie.
|
|
- APP_PORT is de interne hostpoort; APP_PUBLIC_PORT is optioneel en standaard 443 bij HTTPS.
|
|
- Hermaak de container na iedere environmentwijziging.
|
|
EOF
|