gahow/kanban
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ops: add deployment scripts and nginx/systemd configs

Browse Source 
Scripts for installing and starting the app and nginx proxy.
Includes systemd user service units and nginx configs for
both user-mode 8443 and system-mode 443.
This commit is contained in:
Gahow Wang
2026-05-15 11:14:16 +08:00
parent a9d36e3ccf
commit 72289d2c75
9 changed files with 460 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
deploy/README.md Normal file
View File

@@ -0,0 +1,89 @@
# Local Kanban Nginx
## Current User-Mode HTTPS Proxy
This repo includes a user-mode Nginx config that does not require sudo:
```bash
nginx -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf \
-p /home/gahow/projects/kanban/.nginx
```
It listens on:
```text
https://gahow-pc.ipads-lab.se.sjtu.edu.cn:8443
```
It uses the self-signed certificate under `deploy/certs/`, so browsers will show a certificate warning unless the certificate is trusted locally.
Reload it with:
```bash
nginx -s reload \
-c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf \
-p /home/gahow/projects/kanban/.nginx
```
Stop it with:
```bash
nginx -s stop \
-c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf \
-p /home/gahow/projects/kanban/.nginx
```
## Production 443 Proxy
For port 443, install `deploy/nginx.local-kanban.conf` into the system Nginx site directory and use a trusted certificate. The root domain serves the portal page, and individual apps keep their own ports:
```bash
sudo cp deploy/nginx.local-kanban.conf /etc/nginx/sites-available/local-kanban
sudo ln -sf /etc/nginx/sites-available/local-kanban /etc/nginx/sites-enabled/local-kanban
sudo nginx -t
sudo systemctl reload nginx
```
The install script intentionally does not bind port 80 by default, because another local service may already own it. Enable HTTP-to-HTTPS redirect only when port 80 is free:
```bash
KANBAN_ENABLE_HTTP_REDIRECT=1 ./scripts/install-nginx-system.sh
```
The Node app should run only on localhost behind Nginx:
```bash
KANBAN_HOST=127.0.0.1 \
KANBAN_PORT=5180 \
KANBAN_AUTH_SECURE_COOKIE=1 \
KANBAN_REQUIRE_HTTPS=1 \
npm start
```
Kanban is then normally reached through the user-mode HTTPS proxy on:
```text
https://gahow-pc.ipads-lab.se.sjtu.edu.cn:8443/
```
## Persistent User Services
Use the user-level systemd units when the service should stay up without an open shell:
```bash
./scripts/install-user-systemd.sh
```
This installs and starts:
```text
local-kanban.service
local-kanban-nginx-8443.service
```
Check them with:
```bash
systemctl --user status local-kanban.service
systemctl --user status local-kanban-nginx-8443.service
```

89
deploy/nginx.local-kanban.conf Normal file
View File

@@ -0,0 +1,89 @@
limit_req_zone $binary_remote_addr zone=kanban_login:10m rate=5r/m;
server {
listen 443 ssl http2;
server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
root /var/www/local-kanban-portal;
index index.html;
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
client_max_body_size 1m;
location / {
try_files $uri $uri/ /index.html;
}
}
server {
listen 3443 ssl http2;
server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://127.0.0.1:3300;
proxy_http_version 1.1;
proxy_set_header Host $host:3443;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
server {
listen 5443 ssl http2;
server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
location /api/ {
proxy_pass http://127.0.0.1:8787;
proxy_http_version 1.1;
proxy_set_header Host $host:5443;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
location / {
proxy_pass http://127.0.0.1:5174;
proxy_http_version 1.1;
proxy_set_header Host $host:5443;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
server {
listen 8788 ssl http2;
server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://127.0.0.1:8787;
proxy_http_version 1.1;
proxy_set_header Host $host:8788;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}

57
deploy/nginx.user-8443.conf Normal file
View File

@@ -0,0 +1,57 @@
worker_processes 1;
pid /home/gahow/projects/kanban/.nginx/nginx.pid;
events {
worker_connections 512;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
access_log /home/gahow/projects/kanban/.nginx/logs/access.log;
error_log /home/gahow/projects/kanban/.nginx/logs/error.log warn;
client_body_temp_path /home/gahow/projects/kanban/.nginx/client_body_temp;
proxy_temp_path /home/gahow/projects/kanban/.nginx/proxy_temp;
fastcgi_temp_path /home/gahow/projects/kanban/.nginx/fastcgi_temp;
uwsgi_temp_path /home/gahow/projects/kanban/.nginx/uwsgi_temp;
scgi_temp_path /home/gahow/projects/kanban/.nginx/scgi_temp;
limit_req_zone $binary_remote_addr zone=kanban_login_user:10m rate=5r/m;
server {
listen 8443 ssl;
server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;
ssl_certificate /home/gahow/projects/kanban/deploy/certs/local-kanban.crt;
ssl_certificate_key /home/gahow/projects/kanban/deploy/certs/local-kanban.key;
ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
client_max_body_size 1m;
location = /api/auth/login {
limit_req zone=kanban_login_user burst=5 nodelay;
proxy_pass http://127.0.0.1:5180;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
location / {
proxy_pass http://127.0.0.1:5180;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
}

18
deploy/systemd/local-kanban-nginx-8443.service Normal file
View File

@@ -0,0 +1,18 @@
[Unit]
Description=Local Kanban user-mode HTTPS proxy on 8443
After=network-online.target local-kanban.service
Requires=local-kanban.service
[Service]
Type=forking
WorkingDirectory=/home/gahow/projects/kanban
PIDFile=/home/gahow/projects/kanban/.nginx/nginx.pid
ExecStartPre=/usr/bin/mkdir -p /home/gahow/projects/kanban/.nginx/logs /home/gahow/projects/kanban/.nginx/client_body_temp /home/gahow/projects/kanban/.nginx/proxy_temp /home/gahow/projects/kanban/.nginx/fastcgi_temp /home/gahow/projects/kanban/.nginx/uwsgi_temp /home/gahow/projects/kanban/.nginx/scgi_temp
ExecStart=/usr/sbin/nginx -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf -p /home/gahow/projects/kanban/.nginx
ExecReload=/usr/sbin/nginx -s reload -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf -p /home/gahow/projects/kanban/.nginx
ExecStop=/usr/sbin/nginx -s quit -c /home/gahow/projects/kanban/deploy/nginx.user-8443.conf -p /home/gahow/projects/kanban/.nginx
Restart=on-failure
RestartSec=3
[Install]
WantedBy=default.target

14
deploy/systemd/local-kanban.service Normal file
View File

@@ -0,0 +1,14 @@
[Unit]
Description=Local Kanban Node app
After=network-online.target
[Service]
Type=simple
WorkingDirectory=/home/gahow/projects/kanban
ExecStart=/home/gahow/projects/kanban/scripts/start-kanban.sh
Restart=always
RestartSec=3
Environment=NODE_ENV=production
[Install]
WantedBy=default.target

145
scripts/install-nginx-system.sh Executable file
View File

@@ -0,0 +1,145 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
DOMAIN="${KANBAN_DOMAIN:-gahow-pc.ipads-lab.se.sjtu.edu.cn}"
UPSTREAM_PORT="${KANBAN_PORT:-5180}"
ENABLE_HTTP_REDIRECT="${KANBAN_ENABLE_HTTP_REDIRECT:-0}"
GITEA_PORT="${KANBAN_GITEA_PORT:-3443}"
STOCK_FRONTEND_PORT="${KANBAN_STOCK_FRONTEND_PORT:-5443}"
STOCK_API_PORT="${KANBAN_STOCK_API_PORT:-8788}"
if [[ "${EUID}" -ne 0 ]]; then
exec sudo -E bash "$0" "$@"
fi
mkdir -p /etc/nginx/certs
mkdir -p /var/www/local-kanban-portal
cp "${ROOT_DIR}/deploy/certs/local-kanban.crt" /etc/nginx/certs/gahow-pc.fullchain.pem
cp "${ROOT_DIR}/deploy/certs/local-kanban.key" /etc/nginx/certs/gahow-pc.key
cp "${ROOT_DIR}/portal/index.html" /var/www/local-kanban-portal/index.html
cp "${ROOT_DIR}/portal/portal.css" /var/www/local-kanban-portal/portal.css
rm -f /var/www/local-kanban-portal/portal.js
chmod 600 /etc/nginx/certs/gahow-pc.key
{
cat <<EOF
limit_req_zone \$binary_remote_addr zone=kanban_login:10m rate=5r/m;
EOF
if [[ "${ENABLE_HTTP_REDIRECT}" == "1" ]]; then
cat <<EOF
server {
listen 80;
server_name ${DOMAIN};
return 301 https://\$host\$request_uri;
}
EOF
fi
cat <<EOF
server {
listen 443 ssl http2;
server_name ${DOMAIN};
root /var/www/local-kanban-portal;
index index.html;
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
client_max_body_size 1m;
location / {
try_files \$uri \$uri/ /index.html;
}
}
server {
listen ${GITEA_PORT} ssl http2;
server_name ${DOMAIN};
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://127.0.0.1:3300;
proxy_http_version 1.1;
proxy_set_header Host \$host:${GITEA_PORT};
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
server {
listen ${STOCK_FRONTEND_PORT} ssl http2;
server_name ${DOMAIN};
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
location /api/ {
proxy_pass http://127.0.0.1:8787;
proxy_http_version 1.1;
proxy_set_header Host \$host:${STOCK_FRONTEND_PORT};
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
location / {
proxy_pass http://127.0.0.1:5174;
proxy_http_version 1.1;
proxy_set_header Host \$host:${STOCK_FRONTEND_PORT};
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
}
}
server {
listen ${STOCK_API_PORT} ssl http2;
server_name ${DOMAIN};
ssl_certificate /etc/nginx/certs/gahow-pc.fullchain.pem;
ssl_certificate_key /etc/nginx/certs/gahow-pc.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://127.0.0.1:8787;
proxy_http_version 1.1;
proxy_set_header Host \$host:${STOCK_API_PORT};
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
EOF
} >/etc/nginx/sites-available/local-kanban
ln -sf /etc/nginx/sites-available/local-kanban /etc/nginx/sites-enabled/local-kanban
rm -f /etc/nginx/sites-enabled/default
nginx -t
systemctl reload nginx || systemctl restart nginx
echo "Nginx portal is configured for https://${DOMAIN}/"
echo "Kanban remains available on its own port, for example https://${DOMAIN}:8443/"
echo "Gitea HTTPS is configured for https://${DOMAIN}:${GITEA_PORT}/"
echo "Stock Agent HTTPS is configured for https://${DOMAIN}:${STOCK_FRONTEND_PORT}/"
echo "Stock Agent API HTTPS is configured for https://${DOMAIN}:${STOCK_API_PORT}/"
if [[ "${ENABLE_HTTP_REDIRECT}" != "1" ]]; then
echo "Port 80 redirect is disabled. Set KANBAN_ENABLE_HTTP_REDIRECT=1 only if port 80 is free."
fi

17
scripts/install-user-systemd.sh Executable file
View File

@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
USER_UNIT_DIR="${HOME}/.config/systemd/user"
mkdir -p "${USER_UNIT_DIR}"
install -m 0644 "${ROOT_DIR}/deploy/systemd/local-kanban.service" "${USER_UNIT_DIR}/local-kanban.service"
install -m 0644 "${ROOT_DIR}/deploy/systemd/local-kanban-nginx-8443.service" "${USER_UNIT_DIR}/local-kanban-nginx-8443.service"
systemctl --user daemon-reload
systemctl --user enable --now local-kanban.service
systemctl --user enable --now local-kanban-nginx-8443.service
echo "Local Kanban is managed by user systemd:"
echo " systemctl --user status local-kanban.service"
echo " systemctl --user status local-kanban-nginx-8443.service"

12
scripts/start-kanban.sh Executable file
View File

@@ -0,0 +1,12 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${ROOT_DIR}"
export KANBAN_HOST="${KANBAN_HOST:-127.0.0.1}"
export KANBAN_PORT="${KANBAN_PORT:-5180}"
export KANBAN_AUTH_SECURE_COOKIE="${KANBAN_AUTH_SECURE_COOKIE:-1}"
export KANBAN_REQUIRE_HTTPS="${KANBAN_REQUIRE_HTTPS:-1}"
exec npm start

19
scripts/start-user-nginx-8443.sh Executable file
View File

@@ -0,0 +1,19 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
mkdir -p \
"${ROOT_DIR}/.nginx/logs" \
"${ROOT_DIR}/.nginx/client_body_temp" \
"${ROOT_DIR}/.nginx/proxy_temp" \
"${ROOT_DIR}/.nginx/fastcgi_temp" \
"${ROOT_DIR}/.nginx/uwsgi_temp" \
"${ROOT_DIR}/.nginx/scgi_temp"
if [[ -f "${ROOT_DIR}/.nginx/nginx.pid" ]] && kill -0 "$(cat "${ROOT_DIR}/.nginx/nginx.pid")" 2>/dev/null; then
nginx -s reload -c "${ROOT_DIR}/deploy/nginx.user-8443.conf" -p "${ROOT_DIR}/.nginx"
else
nginx -c "${ROOT_DIR}/deploy/nginx.user-8443.conf" -p "${ROOT_DIR}/.nginx"
fi
echo "User-mode Nginx is running at https://gahow-pc.ipads-lab.se.sjtu.edu.cn:8443/"