mirror of
https://github.com/Sea-Haven-Industries/file-share.git
synced 2026-09-30 10:03:17 +00:00
Adam Moussa
7cb3f6510f
The prod host will live on a subnet in the syslog VPC. The data volume stays unmanaged and is attached only after a snapshot copy.
111 lines
3.1 KiB
Text
111 lines
3.1 KiB
Text
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
until lsblk -dno NAME | grep -v "$(lsblk -no PKNAME "$(findmnt -n -o SOURCE /)" 2>/dev/null || echo xvda)" | grep -q .; do
|
|
echo "Waiting for data volume..."
|
|
sleep 5
|
|
done
|
|
DATA_DEVICE="/dev/$(lsblk -dno NAME | grep -v "$(lsblk -no PKNAME "$(findmnt -n -o SOURCE /)" 2>/dev/null || echo xvda)" | head -1)"
|
|
if ! blkid "$DATA_DEVICE"; then
|
|
mkfs.ext4 -L file-share-data "$DATA_DEVICE"
|
|
fi
|
|
mkdir -p /data
|
|
grep -q 'LABEL=file-share-data /data ' /etc/fstab || echo "LABEL=file-share-data /data ext4 defaults,nofail 0 2" >> /etc/fstab
|
|
mount -a
|
|
mkdir -p /data/share
|
|
|
|
dnf install -y samba samba-common
|
|
|
|
useradd --system --no-create-home --shell /sbin/nologin adam || true
|
|
chown adam:adam /data/share
|
|
|
|
SMB_PASSWORD="$(aws secretsmanager get-secret-value --secret-id file-share/smb-password --query SecretString --output text --region ${aws_region})"
|
|
(printf '%s\n' "$SMB_PASSWORD"; printf '%s\n' "$SMB_PASSWORD") | smbpasswd -s -a adam
|
|
if passwd --help 2>&1 | grep -q -- '--stdin'; then
|
|
printf '%s\n' "$SMB_PASSWORD" | passwd --stdin adam
|
|
else
|
|
printf 'adam:%s\n' "$SMB_PASSWORD" | chpasswd
|
|
fi
|
|
unset SMB_PASSWORD
|
|
|
|
cat > /etc/samba/smb.conf << 'SMBEOF'
|
|
[global]
|
|
workgroup = SEAHAVEN
|
|
server string = Sea Haven File Share
|
|
security = user
|
|
map to guest = never
|
|
log file = /var/log/samba/log.%m
|
|
max log size = 1000
|
|
server min protocol = SMB3
|
|
|
|
# macOS Finder optimizations
|
|
vfs objects = catia fruit streams_xattr
|
|
fruit:metadata = stream
|
|
fruit:model = MacSamba
|
|
fruit:posix_rename = yes
|
|
fruit:veto_appledouble = no
|
|
fruit:nfs_aces = no
|
|
fruit:wipe_intentionally_left_blank_rfork = yes
|
|
fruit:delete_empty_adfiles = yes
|
|
|
|
[files]
|
|
path = /data/share
|
|
browseable = yes
|
|
writable = yes
|
|
valid users = adam
|
|
create mask = 0644
|
|
directory mask = 0755
|
|
SMBEOF
|
|
|
|
systemctl enable --now smb nmb
|
|
|
|
curl -sfL "https://github.com/filebrowser/filebrowser/releases/download/${filebrowser_version}/linux-arm64-filebrowser.tar.gz" | tar xz -C /usr/local/bin filebrowser
|
|
chmod +x /usr/local/bin/filebrowser
|
|
|
|
mkdir -p /etc/filebrowser
|
|
FB_PASSWORD="$(aws secretsmanager get-secret-value --secret-id file-share/filebrowser-password --query SecretString --output text --region ${aws_region})"
|
|
|
|
cat > /etc/filebrowser/config.json << 'FBEOF'
|
|
{
|
|
"address": "0.0.0.0",
|
|
"port": 8080,
|
|
"root": "/data/share",
|
|
"database": "/etc/filebrowser/filebrowser.db",
|
|
"log": "/var/log/filebrowser.log"
|
|
}
|
|
FBEOF
|
|
|
|
filebrowser config init --config /etc/filebrowser/config.json
|
|
filebrowser users add admin "$FB_PASSWORD" --config /etc/filebrowser/config.json --perm.admin
|
|
unset FB_PASSWORD
|
|
|
|
cat > /etc/systemd/system/filebrowser.service << 'SVCEOF'
|
|
[Unit]
|
|
Description=FileBrowser
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/filebrowser --config /etc/filebrowser/config.json
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
SVCEOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now filebrowser
|
|
|
|
usermod -s /bin/bash -d /data/share adam
|
|
if ! grep -q 'Match User adam' /etc/ssh/sshd_config; then
|
|
cat >> /etc/ssh/sshd_config << 'SSHEOF'
|
|
|
|
Match User adam
|
|
ForceCommand internal-sftp
|
|
PasswordAuthentication yes
|
|
AllowTcpForwarding no
|
|
X11Forwarding no
|
|
SSHEOF
|
|
fi
|
|
systemctl restart sshd
|