ops: add deployment scripts and nginx/systemd configs

Scripts for installing and starting the app and nginx proxy. Includes systemd user service units and nginx configs for both user-mode 8443 and system-mode 443.
2026-05-15 11:14:16 +08:00
parent a9d36e3ccf
commit 72289d2c75
9 changed files with 460 additions and 0 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -0,0 +1,89 @@
+# Local Kanban Nginx
+
+## Current User-Mode HTTPS Proxy
+
+This repo includes a user-mode Nginx config that does not require sudo:
+
+```bash
+nginx -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf \
+  -p /home/gahow/projects/kanban/.nginx
+```
+
+It listens on:
+
+```text
+https://gahow-pc.ipads-lab.se.sjtu.edu.cn:8443
+```
+
+It uses the self-signed certificate under `deploy/certs/`, so browsers will show a certificate warning unless the certificate is trusted locally.
+
+Reload it with:
+
+```bash
+nginx -s reload \
+  -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf \
+  -p /home/gahow/projects/kanban/.nginx
+```
+
+Stop it with:
+
+```bash
+nginx -s stop \
+  -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf \
+  -p /home/gahow/projects/kanban/.nginx
+```
+
+## Production 443 Proxy
+
+For port 443, install `deploy/nginx.local-kanban.conf` into the system Nginx site directory and use a trusted certificate. The root domain serves the portal page, and individual apps keep their own ports:
+
+```bash
+sudo cp deploy/nginx.local-kanban.conf /etc/nginx/sites-available/local-kanban
+sudo ln -sf /etc/nginx/sites-available/local-kanban /etc/nginx/sites-enabled/local-kanban
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+The install script intentionally does not bind port 80 by default, because another local service may already own it. Enable HTTP-to-HTTPS redirect only when port 80 is free:
+
+```bash
+KANBAN_ENABLE_HTTP_REDIRECT=1 ./scripts/install-nginx-system.sh
+```
+
+The Node app should run only on localhost behind Nginx:
+
+```bash
+KANBAN_HOST=127.0.0.1 \
+KANBAN_PORT=5180 \
+KANBAN_AUTH_SECURE_COOKIE=1 \
+KANBAN_REQUIRE_HTTPS=1 \
+npm start
+```
+
+Kanban is then normally reached through the user-mode HTTPS proxy on:
+
+```text
+https://gahow-pc.ipads-lab.se.sjtu.edu.cn:8443/
+```
+
+## Persistent User Services
+
+Use the user-level systemd units when the service should stay up without an open shell:
+
+```bash
+./scripts/install-user-systemd.sh
+```
+
+This installs and starts:
+
+```text
+local-kanban.service
+local-kanban-nginx-8443.service
+```
+
+Check them with:
+
+```bash
+systemctl --user status local-kanban.service
+systemctl --user status local-kanban-nginx-8443.service
+```
--- a/deploy/nginx.local-kanban.conf
+++ b/deploy/nginx.local-kanban.conf
@@ -0,0 +1,89 @@
+limit_req_zone $binary_remote_addr zone=kanban_login:10m rate=5r/m;
+
+server {
+    listen 443 ssl http2;
+    server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
+    root /var/www/local-kanban-portal;
+    index index.html;
+
+    ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer" always;
+
+    client_max_body_size 1m;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+
+server {
+    listen 3443 ssl http2;
+    server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
+
+    ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location / {
+        proxy_pass http://127.0.0.1:3300;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host:3443;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}
+
+server {
+    listen 5443 ssl http2;
+    server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
+
+    ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:8787;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host:5443;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:5174;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host:5443;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 8788 ssl http2;
+    server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
+
+    ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location / {
+        proxy_pass http://127.0.0.1:8787;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host:8788;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}
--- a/deploy/nginx.user-8443.conf
+++ b/deploy/nginx.user-8443.conf
@@ -0,0 +1,57 @@
+worker_processes 1;
+pid /home/gahow/projects/kanban/.nginx/nginx.pid;
+
+events {
+    worker_connections 512;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    access_log /home/gahow/projects/kanban/.nginx/logs/access.log;
+    error_log /home/gahow/projects/kanban/.nginx/logs/error.log warn;
+
+    client_body_temp_path /home/gahow/projects/kanban/.nginx/client_body_temp;
+    proxy_temp_path /home/gahow/projects/kanban/.nginx/proxy_temp;
+    fastcgi_temp_path /home/gahow/projects/kanban/.nginx/fastcgi_temp;
+    uwsgi_temp_path /home/gahow/projects/kanban/.nginx/uwsgi_temp;
+    scgi_temp_path /home/gahow/projects/kanban/.nginx/scgi_temp;
+
+    limit_req_zone $binary_remote_addr zone=kanban_login_user:10m rate=5r/m;
+
+    server {
+        listen 8443 ssl;
+        server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
+
+        ssl_certificate /home/gahow/projects/kanban/deploy/certs/local-kanban.crt;
+        ssl_certificate_key /home/gahow/projects/kanban/deploy/certs/local-kanban.key;
+        ssl_protocols TLSv1.2 TLSv1.3;
+
+        add_header Strict-Transport-Security "max-age=31536000" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer" always;
+
+        client_max_body_size 1m;
+
+        location = /api/auth/login {
+            limit_req zone=kanban_login_user burst=5 nodelay;
+            proxy_pass http://127.0.0.1:5180;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto https;
+        }
+
+        location / {
+            proxy_pass http://127.0.0.1:5180;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto https;
+        }
+    }
+}
--- a/deploy/systemd/local-kanban-nginx-8443.service
+++ b/deploy/systemd/local-kanban-nginx-8443.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Local Kanban user-mode HTTPS proxy on 8443
+After=network-online.target local-kanban.service
+Requires=local-kanban.service
+
+[Service]
+Type=forking
+WorkingDirectory=/home/gahow/projects/kanban
+PIDFile=/home/gahow/projects/kanban/.nginx/nginx.pid
+ExecStartPre=/usr/bin/mkdir -p /home/gahow/projects/kanban/.nginx/logs /home/gahow/projects/kanban/.nginx/client_body_temp /home/gahow/projects/kanban/.nginx/proxy_temp /home/gahow/projects/kanban/.nginx/fastcgi_temp /home/gahow/projects/kanban/.nginx/uwsgi_temp /home/gahow/projects/kanban/.nginx/scgi_temp
+ExecStart=/usr/sbin/nginx -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf -p /home/gahow/projects/kanban/.nginx
+ExecReload=/usr/sbin/nginx -s reload -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf -p /home/gahow/projects/kanban/.nginx
+ExecStop=/usr/sbin/nginx -s quit -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf -p /home/gahow/projects/kanban/.nginx
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=default.target
--- a/deploy/systemd/local-kanban.service
+++ b/deploy/systemd/local-kanban.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Local Kanban Node app
+After=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/gahow/projects/kanban
+ExecStart=/home/gahow/projects/kanban/scripts/start-kanban.sh
+Restart=always
+RestartSec=3
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=default.target