165 lines
4.8 KiB
Bash
165 lines
4.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
compose_file="${1:-docker-compose.yml}"
|
|
env_file="${2:-.env}"
|
|
app_port="${APP_PORT:-1226}"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo "docker niet gevonden. Installeer Docker en probeer opnieuw."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v python >/dev/null 2>&1; then
|
|
echo "python niet gevonden. docker-deploy vereist python voor secrets."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v curl >/dev/null 2>&1; then
|
|
echo "curl niet gevonden; healthcheck wordt overgeslagen."
|
|
export SKIP_HEALTHCHECK=1
|
|
fi
|
|
|
|
if [[ ! -f "$env_file" ]]; then
|
|
: > "$env_file"
|
|
chmod 600 "$env_file"
|
|
echo "Aangemaakte $env_file"
|
|
fi
|
|
|
|
generate_secret() {
|
|
if command -v python >/dev/null 2>&1; then
|
|
python scripts/generate_secret.py
|
|
else
|
|
date +%s | sha256sum | cut -d' ' -f1
|
|
fi
|
|
}
|
|
|
|
ensure_env() {
|
|
local key="$1"
|
|
local value="$2"
|
|
local existing_line
|
|
local existing_value
|
|
|
|
existing_line="$(grep -m1 "^${key}=" "$env_file" || true)"
|
|
if [[ -z "$existing_line" ]]; then
|
|
printf '%s=%s\n' "$key" "$value" >> "$env_file"
|
|
return
|
|
fi
|
|
|
|
existing_value="${existing_line#*=}"
|
|
if [[ -n "$existing_value" && \
|
|
"$existing_value" != CHANGE_ME* && \
|
|
"$existing_value" != dev-only-change-me && \
|
|
"$existing_value" != codex-local-only ]]; then
|
|
return 0
|
|
fi
|
|
|
|
local temp_env
|
|
temp_env="$(mktemp)"
|
|
while IFS= read -r env_line; do
|
|
if [[ "$env_line" == "${key}="* ]]; then
|
|
printf '%s=%s\n' "$key" "$value" >> "$temp_env"
|
|
else
|
|
printf '%s\n' "$env_line" >> "$temp_env"
|
|
fi
|
|
done < "$env_file"
|
|
mv "$temp_env" "$env_file"
|
|
}
|
|
|
|
app_host="${APP_HOST:-${HOSTNAME:-localhost}}"
|
|
app_scheme="${APP_SCHEME:-http}"
|
|
app_hostnames="${APP_HOSTS:-$app_host}"
|
|
app_origin="${APP_ORIGINS:-}"
|
|
|
|
if [[ -z "$app_origin" ]]; then
|
|
if [[ "$app_scheme" == "https" ]]; then
|
|
if [[ "$app_port" == "443" ]]; then
|
|
app_origin="https://$app_host"
|
|
else
|
|
app_origin="https://$app_host:$app_port"
|
|
fi
|
|
else
|
|
app_origin="http://$app_host:$app_port"
|
|
fi
|
|
fi
|
|
|
|
secret_key="$(generate_secret)"
|
|
postgres_password="${POSTGRES_PASSWORD:-$(generate_secret)}"
|
|
admin_password="${VACATURERADAR_ADMIN_PASSWORD:-$(generate_secret | cut -c 1-24)}"
|
|
db_url="postgresql://vacatureradar:${postgres_password}@postgres:5432/vacatureradar"
|
|
|
|
debug="${DJANGO_DEBUG:-1}"
|
|
if [[ "$debug" == "0" ]]; then
|
|
session_secure="${SESSION_COOKIE_SECURE:-1}"
|
|
csrf_secure="${CSRF_COOKIE_SECURE:-1}"
|
|
ssl_redirect="${SECURE_SSL_REDIRECT:-1}"
|
|
hsts_seconds="${SECURE_HSTS_SECONDS:-31536000}"
|
|
else
|
|
session_secure="${SESSION_COOKIE_SECURE:-0}"
|
|
csrf_secure="${CSRF_COOKIE_SECURE:-0}"
|
|
ssl_redirect="${SECURE_SSL_REDIRECT:-0}"
|
|
hsts_seconds="${SECURE_HSTS_SECONDS:-0}"
|
|
fi
|
|
|
|
ensure_env "DJANGO_SECRET_KEY" "$secret_key"
|
|
ensure_env "DJANGO_DEBUG" "$debug"
|
|
ensure_env "DJANGO_ALLOWED_HOSTS" "$app_hostnames"
|
|
ensure_env "DJANGO_CSRF_TRUSTED_ORIGINS" "$app_origin"
|
|
ensure_env "DJANGO_TIME_ZONE" "Europe/Brussels"
|
|
ensure_env "POSTGRES_DB" "vacatureradar"
|
|
ensure_env "POSTGRES_USER" "vacatureradar"
|
|
ensure_env "POSTGRES_PASSWORD" "$postgres_password"
|
|
ensure_env "POSTGRES_HOST" "postgres"
|
|
ensure_env "POSTGRES_PORT" "5432"
|
|
ensure_env "DATABASE_URL" "$db_url"
|
|
ensure_env "REDIS_URL" "redis://redis:6379/0"
|
|
ensure_env "CELERY_TASK_ALWAYS_EAGER" "0"
|
|
ensure_env "VACATURERADAR_ADMIN_USERNAME" "admin"
|
|
ensure_env "VACATURERADAR_ADMIN_PASSWORD" "$admin_password"
|
|
ensure_env "VACATURERADAR_AUTO_BOOTSTRAP" "1"
|
|
ensure_env "SESSION_COOKIE_SECURE" "$session_secure"
|
|
ensure_env "CSRF_COOKIE_SECURE" "$csrf_secure"
|
|
ensure_env "SECURE_SSL_REDIRECT" "$ssl_redirect"
|
|
ensure_env "SECURE_HSTS_SECONDS" "$hsts_seconds"
|
|
ensure_env "EMAIL_BACKEND" "django.core.mail.backends.console.EmailBackend"
|
|
ensure_env "DEFAULT_FROM_EMAIL" "VacatureRadar <vacatureradar@localhost>"
|
|
ensure_env "SOURCE_POLICY_MODE" "strict"
|
|
ensure_env "AUTH_LOGIN_RATE_LIMIT_MAX_ATTEMPTS" "8"
|
|
ensure_env "AUTH_LOGIN_RATE_LIMIT_WINDOW_SECONDS" "300"
|
|
ensure_env "AUTH_LOGIN_RATE_LIMIT_BLOCK_SECONDS" "300"
|
|
ensure_env "MANUAL_IMPORT_RATE_LIMIT_MAX_ATTEMPTS" "12"
|
|
ensure_env "MANUAL_IMPORT_RATE_LIMIT_WINDOW_SECONDS" "120"
|
|
ensure_env "MANUAL_IMPORT_RATE_LIMIT_BLOCK_SECONDS" "300"
|
|
|
|
docker compose -f "$compose_file" up -d --build
|
|
|
|
if [[ "${SKIP_HEALTHCHECK:-0}" != "1" ]]; then
|
|
for i in {1..30}; do
|
|
if curl -fsS "http://127.0.0.1:${app_port}/health/ready/" >/dev/null; then
|
|
echo "Healthcheck geslaagd op poort ${app_port}."
|
|
break
|
|
fi
|
|
if [[ "$i" == "30" ]]; then
|
|
echo "Healthcheck niet geslaagd binnen 60 seconden."
|
|
exit 1
|
|
fi
|
|
sleep 2
|
|
done
|
|
fi
|
|
|
|
docker compose -f "$compose_file" exec -T web python manage.py collectstatic --noinput
|
|
|
|
cat <<"EOF"
|
|
Deploy klaargezet.
|
|
|
|
Applicatie:
|
|
- open http://127.0.0.1:1226/
|
|
- admin: admin / waarde uit $env_file
|
|
|
|
Volgende stappen:
|
|
- Zet APP_HOST en APP_SCHEME=HTTPS voor publieke domeinstandaard.
|
|
- Zet APP_ORIGINS en DJANGO_DEBUG=0 voor echte productie.
|
|
EOF
|