provision.sh

#!/usr/bin/env bash
set -euo pipefail

# Server provisioning script — run as root (once, or when config changes).

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "$SCRIPT_DIR/deploy.env"

REMOTE_USER="root"

ssh_cmd() {
    ssh "$REMOTE_USER@$DROPLET_IP" "$@"
}

echo "=== 1. Creating service user ==="
ssh_cmd bash -s <<'REMOTE'
# Create system user with a real shell for SSH access
if id wikirev &>/dev/null; then
    # Ensure existing user has a login shell
    usermod --shell /bin/bash wikirev
    echo "  User wikirev already exists (updated shell)."
else
    useradd --system --create-home --shell /bin/bash wikirev
    echo "  Created user wikirev."
fi
REMOTE

echo ""
echo "=== 2. Setting up SSH access for wikirev ==="
LOCAL_KEY=$(cat ~/.ssh/id_ed25519.pub 2>/dev/null || cat ~/.ssh/id_rsa.pub 2>/dev/null) || {
    echo "ERROR: No local SSH public key found. Generate one with ssh-keygen." >&2
    exit 1
}
ssh_cmd bash -s <<REMOTE
KEY="$LOCAL_KEY"
mkdir -p ~wikirev/.ssh
chmod 700 ~wikirev/.ssh
AUTH=~wikirev/.ssh/authorized_keys
if [ -f "\$AUTH" ] && grep -qF "\$KEY" "\$AUTH"; then
    echo "  SSH key already installed."
else
    echo "\$KEY" >> "\$AUTH"
    chmod 600 "\$AUTH"
    echo "  SSH key installed."
fi
chown -R wikirev:wikirev ~wikirev/.ssh
REMOTE

echo ""
echo "=== 3. Creating data directory ==="
ssh_cmd "mkdir -p $REMOTE_DIR/revisions $REMOTE_DIR/cache/web && chown -R wikirev:wikirev $REMOTE_DIR"

echo ""
echo "=== 4. Installing systemd service ==="
ssh_cmd bash -s <<'REMOTE'
cat > /etc/systemd/system/wikirev.service <<'EOF'
[Unit]
Description=Wikipedia Revision Viewer
After=network.target
StartLimitIntervalSec=10
StartLimitBurst=5

[Service]
Type=simple
User=wikirev
Group=wikirev
Environment=PORT=80
ExecStart=/opt/wikirev/web_server /opt/wikirev/revisions --cache-dir /opt/wikirev/cache/web
WorkingDirectory=/opt/wikirev
Restart=always
RestartSec=0
LimitNOFILE=65536
LimitNPROC=4096
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/opt/wikirev
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable wikirev
echo "  Service installed and enabled."
REMOTE

echo ""
echo "=== 5. Allowing wikirev to reset failed service state ==="
ssh_cmd bash -s <<'REMOTE'
echo 'wikirev ALL=(root) NOPASSWD: /usr/bin/systemctl reset-failed wikirev.service, /usr/bin/systemctl start wikirev.service' > /etc/sudoers.d/wikirev
chmod 440 /etc/sudoers.d/wikirev
echo "  sudoers drop-in installed."
REMOTE

echo ""
echo "=== 6. Opening firewall port ==="
ssh_cmd "firewall-cmd --add-port=80/tcp --permanent 2>/dev/null && firewall-cmd --reload 2>/dev/null || true"

echo ""
echo "=== Done! ==="
echo "Server provisioned. Run deploy.sh to deploy."