xixu-me/x-webui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revise README and streamline setup.sh automation

Browse Source 
The README has been rewritten for clarity, modernized formatting, and improved feature documentation. The setup.sh script is streamlined: verbose output and redundant permission steps are removed, package installation is limited to essentials, the certificate renewal script is simplified, and cron job setup is improved. Unnecessary status checks and verbose messages are eliminated for a cleaner, more automated deployment process.
This commit is contained in:
xixu-me committed 2025-07-16 01:52:57 +08:00
1 parent 6f0a37af07
commit 7acbd72ed8
2 files changed
+101 -215
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+84 -108
View File
@@ -1,34 +1,24 @@
# Automated Web Deployment Script
A bash script for automating the deployment of a professional portfolio website with SSL certificate management on Ubuntu/Debian servers.
A comprehensive automation script for deploying professional portfolio websites with SSL certificates and optimized web server configuration.
## Overview
## 🚀 Features
This repository contains an automated deployment script that sets up a complete web server environment with:
- **Automated Web Server Setup**: Configures Nginx with optimized settings
- **SSL Certificate Management**: Automatic SSL certificate provisioning and renewal using acme.sh
- **Professional Portfolio Template**: Includes a beautiful, responsive portfolio website
- **System Optimization**: Configures BBR congestion control and other performance optimizations
- **Certificate Auto-Renewal**: Sets up automated certificate renewal via cron jobs
- **Security Headers**: Implements HSTS and other security best practices
- **Nginx web server** with optimized configuration
- **SSL certificate management** using acme.sh and Let's Encrypt
- **Professional portfolio website** with modern, responsive design
- **Automatic certificate renewal** via cron jobs
- **Security optimizations** and best practices
## Features
- 🚀 **One-command deployment** - Deploy everything with a single script
- 🔒 **Automatic SSL** - Generates and manages SSL certificates
- 📱 **Responsive design** - Mobile-friendly portfolio website
- 🔄 **Auto-renewal** - Certificates renew automatically
- ⚡ **Performance optimized** - BBR congestion control and optimized settings
- 🛡️ **Security hardened** - HTTPS redirects and security headers
## Prerequisites
## 📋 Prerequisites
- Ubuntu/Debian-based Linux server
- Root or sudo access
- Domain name pointing to your server's IP address
- Open ports 80 and 443
## Usage
## 🛠️ Usage
1. Log in as a non-root user and update your system:
@@ -63,111 +53,97 @@ This repository contains an automated deployment script that sets up a complete
### Example
```bash
curl -L https://github.com/xixu-me/automated-web-deployment/raw/main/setup.sh | bash -s john example.com 550e8400-e29b-41d4-a716-446655440000
./setup.sh john example.com 12345678-1234-1234-1234-123456789abc
```
## What Gets Installed
## 🎨 Portfolio Features
The script automatically installs and configures:
The included portfolio template features:
1. **System packages**: nginx, wget, unzip, openssl, cron
2. **Web server**: Nginx with optimized configuration
3. **SSL certificates**: Let's Encrypt certificates via acme.sh
4. **Portfolio website**: Professional HTML/CSS portfolio template
5. **Security settings**: System optimizations and security headers
- **Responsive Design**: Works on all devices and screen sizes
- **Modern UI**: Clean, professional design with CSS Grid and Flexbox
- **Contact Form**: Ready-to-use contact form structure
- **Project Showcase**: Grid layout for displaying projects
- **Skills Section**: Tag-based skills display
- **SEO Optimized**: Proper HTML structure and meta tags
## Post-Installation
### Customization
After the script completes:
- Your website will be accessible at `https://yourdomain.com`
- SSL certificates will auto-renew weekly
- The server will reboot automatically to apply all changes
## File Structure
```text
/var/www/html/ # Website files
~/cert/ # SSL certificates
~/cert/renew.sh # Certificate renewal script
```
## Certificate Management
- **Location**: `~/cert/x.crt` and `~/cert/x.key`
- **Renewal**: Automatic weekly check via cron
- **Logs**: Certificate renewal logs in `~/cert/renewal.log`
## Customization
To customize the portfolio website:
To customize the portfolio:
1. Edit `/var/www/html/index.html` after installation
2. Modify the content, styling, and information as needed
3. The website uses modern CSS with responsive design
2. Modify the personal information, projects, and skills
3. Update the color scheme by changing CSS custom properties
## Troubleshooting
## 🔧 What the Script Does
1. **Package Installation**: Installs required packages (cron, nginx)
2. **Web Server Configuration**: Sets up Nginx with optimized configuration
3. **SSL Certificate Setup**: Provisions SSL certificates using Let's Encrypt
4. **Portfolio Deployment**: Creates and deploys a professional portfolio website
5. **Auto-Renewal Setup**: Configures automatic certificate renewal
6. **System Optimization**: Applies performance optimizations
7. **Security Configuration**: Implements security headers and HTTPS redirect
## 📁 File Structure
```text
/var/www/html/ # Web root directory
├── index.html # Portfolio website
~/cert/ # SSL certificates directory
├── x.crt # SSL certificate
├── x.key # Private key
└── cert-renew.sh # Certificate renewal script
```
## 🔒 Security Features
- **HTTPS Redirect**: Automatic HTTP to HTTPS redirection
- **HSTS Headers**: Strict Transport Security implementation
- **SSL Configuration**: Modern TLS protocols and cipher suites
- **Secure File Permissions**: Proper file ownership and permissions
## 🔄 Maintenance
### Certificate Renewal
Certificates are automatically renewed monthly via cron job. To manually renew:
```bash
bash ~/cert/cert-renew.sh
```
### Nginx Configuration
Main configuration file: `/etc/nginx/nginx.conf`
To reload Nginx after changes:
```bash
sudo systemctl reload nginx
```
## 🐛 Troubleshooting
### Common Issues
1. **Domain not pointing to server**: Ensure your domain's DNS A record points to your server's IP
1. **Domain not pointing to server**: Ensure DNS A record points to your server's IP
2. **Firewall blocking ports**: Make sure ports 80 and 443 are open
3. **Permission errors**: Run the script as a non-root user with sudo access
3. **Permission errors**: Ensure script is run with appropriate privileges
### Service Status
### Log Files
Check if services are running:
- Nginx access logs: `/var/log/nginx/access.log`
- Nginx error logs: `/var/log/nginx/error.log`
- System logs: `journalctl -u nginx`
```bash
sudo systemctl status nginx
```
### Certificate Status
Check certificate expiration:
```bash
openssl x509 -in ~/cert/x.crt -text -noout | grep -E "(Not Before|Not After)"
```
## Security Considerations
- The script implements security best practices including HTTPS redirects
- Uses modern TLS protocols (TLSv1.2 and TLSv1.3)
- Applies security headers and optimized configurations
- Regular certificate renewals prevent expiration
## License
## 📝 License
This project is licensed under the GNU General Public License v3.0 - see the [LICENSE](LICENSE) file for details.
## Disclaimer
## ⚠️ Important Notes
⚠️ **Important Notice**
This script is provided for educational and legitimate web deployment purposes only. Users are responsible for:
- Ensuring compliance with all applicable laws and regulations
- Proper server security and maintenance
- Understanding the configurations being applied to their systems
- Regular security updates and monitoring
The authors and contributors of this project:
- Make no warranties about the security, reliability, or suitability of this script
- Are not responsible for any damage, data loss, or security breaches
- Recommend thorough testing in a development environment before production use
- Advise users to review and understand the script before execution
**Use at your own risk.** Always backup your data and test in a safe environment first.
## Support
For issues and questions:
- Review the troubleshooting section above
- Ensure you're using a supported operating system (Ubuntu/Debian)
---
**Note**: This script automatically reboots the server after installation to apply all system optimizations.
- This script will reboot the server at the end of installation
- Backup any existing Nginx configuration before running
- The script is designed for fresh server installations
- Domain validation is required for SSL certificate issuance
setup.sh
+17 -107
View File
@@ -1,7 +1,5 @@
#!/bin/bash
set -e # Exit on any error
# Check if all required parameters are provided
if [ "$#" -ne 3 ]; then
echo "Usage: $0 <username> <domain> <id>"
@@ -13,20 +11,12 @@ USERNAME="$1"
DOMAIN="$2"
ID="$3"
echo "Starting server initialization..."
echo "Username: $USERNAME"
echo "Domain: $DOMAIN"
echo "ID: $ID"
# Install required packages
echo "Installing required packages..."
sudo apt install cron nginx wget unzip openssl -y
sudo apt install cron nginx -y
# Configure web server permissions and files
echo "Configuring web server..."
sudo chown -R "$USERNAME:$USERNAME" /var/www
sudo mkdir -p /var/www/html/.well-known/acme-challenge
rm -f /var/www/html/index.nginx-debian.html
rm /var/www/html/index.nginx-debian.html
# Create index.html
cat >/var/www/html/index.html <<'EOF'
@@ -240,11 +230,6 @@ cat >/var/www/html/index.html <<'EOF'
</html>
EOF
# Set proper ownership and permissions for web files
sudo chown -R www-data:www-data /var/www/html
sudo chown -R "$USERNAME:www-data" /var/www/html/.well-known/acme-challenge
sudo chmod 775 /var/www/html/.well-known/acme-challenge
# Initial nginx configuration
sudo tee /etc/nginx/nginx.conf >/dev/null <<EOF
user www-data;
@@ -279,74 +264,39 @@ EOF
sudo systemctl reload nginx
# Install and configure acme.sh
echo "Installing and configuring acme.sh..."
curl https://get.acme.sh | sh
~/.acme.sh/acme.sh --upgrade --auto-upgrade
~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
echo "Issuing SSL certificate for $DOMAIN..."
~/.acme.sh/acme.sh --issue -d "$DOMAIN" -w /var/www/html --keylength ec-256 --force
# Install X
echo "Installing X..."
sudo bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
# Setup certificates
echo "Setting up certificates..."
mkdir ~/cert
~/.acme.sh/acme.sh --install-cert -d "$DOMAIN" --ecc --fullchain-file ~/cert/x.crt --key-file ~/cert/x.key
chmod +r ~/cert/x.key
# Create certificate renewal script
cat >~/cert/renew.sh <<EOF
cat >~/cert/cert-renew.sh <<EOF
#!/bin/bash
# Certificate renewal script for $DOMAIN
# This script renews the certificate and installs it for x
echo "Starting certificate renewal for $DOMAIN..."
# Try to renew the certificate using acme.sh (will skip if not due for renewal)
RENEW_OUTPUT=\$(/home/$USERNAME/.acme.sh/acme.sh --renew -d $DOMAIN --ecc 2>&1)
RENEW_EXIT_CODE=\$?
echo "\$RENEW_OUTPUT"
# If renewal was successful (exit code 0) or skipped (exit code 2), proceed with installation
if [ \$RENEW_EXIT_CODE -eq 0 ] || [ \$RENEW_EXIT_CODE -eq 2 ]; then
# Install/reinstall the certificate
/home/$USERNAME/.acme.sh/acme.sh --install-cert -d $DOMAIN --ecc \\
--fullchain-file /home/$USERNAME/cert/x.crt \\
--key-file /home/$USERNAME/cert/x.key
echo "X Certificates Renewed/Reinstalled"
# Set proper permissions for the private key
chmod +r /home/$USERNAME/cert/x.key
echo "Read Permission Granted for Private Key"
# Restart x service to use the certificate
sudo systemctl restart xray
echo "X Restarted"
# Verify the certificate
echo "Certificate details:"
openssl x509 -in /home/$USERNAME/cert/x.crt -text -noout | grep -E "(Subject:|Issuer:|Not Before|Not After)"
echo "Certificate renewal/installation completed successfully!"
else
echo "Certificate renewal failed with exit code \$RENEW_EXIT_CODE"
exit 1
fi
/home/$USERNAME/.acme.sh/acme.sh --install-cert -d $DOMAIN --ecc --fullchain-file /home/$USERNAME/cert/x.crt --key-file /home/$USERNAME/cert/x.key
echo "X Certificates Renewed"
chmod +r /home/$USERNAME/cert/x.key
echo "Read Permission Granted for Private Key"
sudo systemctl restart xray
echo "X Restarted"
EOF
chmod +x ~/cert/renew.sh
chmod +x ~/cert/cert-renew.sh
# Setup cron jobs
(crontab -l 2>/dev/null; echo "0 2 * * 0 /home/$USERNAME/cert/renew.sh >> /home/$USERNAME/cert/renewal.log 2>&1") | crontab -
# Setup cron job
crontab -l >temp_cron
echo "0 1 1 * * bash /home/$USERNAME/cert/cert-renew.sh" >>temp_cron
crontab temp_cron
rm temp_cron
# Configure X
echo "Configuring X..."
sudo tee /usr/local/etc/xray/config.json >/dev/null <<EOF
{
"dns": {
@@ -420,18 +370,16 @@ sudo tee /usr/local/etc/xray/config.json >/dev/null <<EOF
EOF
# Start and enable X
echo "Starting and enabling X service..."
sudo systemctl start xray
sudo systemctl enable xray
# Configure system settings
echo "Optimizing system settings..."
sudo tee /etc/sysctl.conf >/dev/null <<'EOF'
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
# Final nginx configuration with ACME challenge support
# Final nginx configuration
sudo tee /etc/nginx/nginx.conf >/dev/null <<EOF
user www-data;
worker_processes auto;
@@ -445,17 +393,7 @@ http {
server {
listen 80;
server_name $DOMAIN;
# Allow ACME challenge for certificate renewal
location ^~ /.well-known/acme-challenge/ {
root /var/www/html;
try_files \$uri =404;
}
# Redirect everything else to HTTPS
location / {
return 301 https://\$http_host\$request_uri;
}
return 301 https://\$http_host\$request_uri;
}
server {
listen 8888;
@@ -478,33 +416,5 @@ http {
EOF
# Restart services and system
echo "Restarting services..."
sudo systemctl restart nginx
# Verify certificate installation
echo "Verifying certificate installation..."
if [ -f ~/cert/x.crt ]; then
echo "Certificate details:"
openssl x509 -in ~/cert/x.crt -text -noout | grep -E "(Subject:|Issuer:|Not Before|Not After)"
else
echo "Warning: Certificate file not found"
fi
# Check service status
echo "Checking service status..."
sudo systemctl is-active --quiet nginx && echo "✓ Nginx is running" || echo "✗ Nginx is not running"
sudo systemctl is-active --quiet xray && echo "✓ X is running" || echo "✗ X is not running"
echo "Server initialization completed successfully!"
echo "=============================================="
echo "Domain: $DOMAIN"
echo "ID: $ID"
echo "Certificate location: ~/cert/"
echo "Nginx configuration: /etc/nginx/nginx.conf"
echo "X configuration: /usr/local/etc/xray/config.json"
echo "Certificate renewal script: ~/cert/renew.sh"
echo "Automatic renewal: Configured via cron (weekly check)"
echo "=============================================="
echo "The system will reboot in 10 seconds..."
sleep 10
sudo reboot