AdvLabDB/advlabdb/scripts/setup/logged_server_setup.py

# No relative imports allowed in this file to be able to run server_setup.py without packages

import sys
from pathlib import Path

from shared import LOCAL_BIN, LOGS_DIR, install_latest_pipx, poetry_update

sys.path.insert(0, str(Path(__file__).parent.parent.absolute()))
from terminal_utils import run, step


def main():
    file_dir = Path(__file__).parent.absolute()

    step("Update system packages")
    run("sudo apt update")
    run("sudo apt dist-upgrade")

    step("Remove unused packages")
    run("sudo apt autoremove")

    step("Install needed system packages")
    run("sudo apt install python3 python3-pip python3-venv ufw nginx systemd -y")

    step("Install optional system packages")
    run("sudo apt install htop rsync sqlite3")

    step("Setup firewall")
    run("sudo ufw default allow outgoing")
    run("sudo ufw default deny incoming")
    run("sudo ufw allow ssh")
    run("sudo ufw allow http/tcp")
    run("sudo ufw allow https/tcp")
    run("sudo ufw enable")
    run("sudo ufw status")

    step("Enable Gunicorn")
    gunicorn_service_file = file_dir / "gunicorn.service"
    run(f"sudo cp -v {gunicorn_service_file} /etc/systemd/system/")
    run("sudo systemctl enable gunicorn")

    step("Setup Nginx")
    for dir_appendix in ("available", "enabled"):
        run(f"sudo rm -v /etc/nginx/sites-{dir_appendix}/default")

    nginx_conf_file = file_dir / "advlabdb.conf"
    run(f"sudo cp -v {nginx_conf_file} /etc/nginx/sites-available/")
    run("sudo ln -v -s /etc/nginx/sites-available/advlabdb.conf /etc/nginx/sites-enabled/")
    run("sudo systemctl enable nginx")

    step("Install pipx")
    install_latest_pipx()

    pipx_bin = LOCAL_BIN / "pipx"

    step("Install Poetry")
    run(f"{pipx_bin} install poetry")
    # Place virtual environments in the root directory of the project
    # The virtual environment will then be found in /home/admin/advlabdb/.venv
    poetry_bin = LOCAL_BIN / "poetry"
    run(f"{poetry_bin} config virtualenvs.in-project true")

    step("Install Certbot")
    run(f"{pipx_bin} install certbot")
    run(f"{pipx_bin} inject certbot certbot-nginx")

    step("Setup Certbot")
    certbot_bin = LOCAL_BIN / "certbot"
    run(f"sudo {certbot_bin} --nginx")
    run(
        f"echo \"0 0,12 * * * root python3 -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo {certbot_bin} renew -q\" | sudo tee -a /etc/crontab"
    )

    step("Setup update cron jobs")

    user_update_script = file_dir / "user_update.py"
    user_update_log = LOGS_DIR / "user_update.log"
    # Every Sunday at 04:00
    run(f'echo "0 4 * * 0 admin python3 -u {user_update_script} &>> {user_update_log}" | sudo tee -a /etc/crontab')

    root_update_script = file_dir / "root_update.py"
    root_update_log = LOGS_DIR / "root_update.log"
    # Every Sunday at 04:15
    run(f'echo "15 4 * * 0 root python3 -u {root_update_script} &>> {root_update_log}" | sudo tee -a /etc/crontab')

    step("Install latest Poetry packages")
    poetry_update()

    step("Deactivate the 'root' user")
    run("sudo passwd -l root")

    step("Reboot")
    run("sudo reboot")


if __name__ == "__main__":
    main()