sh Ubuntu Server 16.04 - 使用VestaCP和GitLab配置Web服务器

Posted 2021-05-07

# Server Config: KVM VPS CPU 2 cores, 4 Gb RAM, 30 Gb SSD
# Installs:
# GitLab CE
# VestaCP (PHP 7)
# Python 3.5 + virtualenv + Django
# NGINX + Apache (backend)
# PostgreSQL (with phpPgAdmin)
# iptables + fail2ban + vsftpd + exim
# LetsEncrypt with Apache and nginx support

cd
read -p 'Vesta Domian: ' vestadomian
read -p 'Gitlab Domian: ' gitlabdomian
read -p 'Gitlab App ID: ' gitlabappid
read -sp 'Gitlab App Secret: ' gitlabappsecret
read -sp 'PostgreSQL postgres Password: ' postgrespassword
read -p 'Admin Email: ' email

# Install VestaCP
curl -O http://vestacp.com/pub/vst-install.sh
sudo bash vst-install.sh --nginx yes --apache yes --phpfpm no --named no --remi no --vsftpd yes --proftpd no --iptables yes --fail2ban yes --quota no --exim yes --dovecot no --spamassassin no --clamav no --mysql no --postgresql yes

# Install Neofetch and Certbot with integrations
sudo add-apt-repository -y ppa:dawidd0811/neofetch
sudo add-apt-repository -y ppa:certbot/certbot
sudo apt update
sudo apt install -y neofetch
sudo apt install -y tree man
sudo apt install -y python-certbot-apache python-certbot-nginx

# Configure LetsEncrypt certs for VestaCP
sudo certbot certonly --non-interactive --agree-tos --standalone --email="$email" -d "$vestadomian"
sudo mv /usr/local/vesta/ssl/certificate.crt /usr/local/vesta/ssl/certificate.crt.old
sudo mv /usr/local/vesta/ssl/certificate.key /usr/local/vesta/ssl/certificate.key.old
sudo ln -s /etc/letsencrypt/live/vesta.domian.org/cert.pem /usr/local/vesta/ssl/certificate.crt
sudo ln -s /etc/letsencrypt/live/vesta.domian.org/privkey.pem /usr/local/vesta/ssl/certificate.key
sudo touch /var/log/le-renew.log
# CRON: 15 5 * * 5 certbot renew >> /var/log/le-renew.log
# https://toster.ru/q/58444
# https://forum.vestacp.com/viewtopic.php?t=12988
# http://blog.timetofree.com/vesta-cp-port-change/

# Install GitLab CE
sudo apt install -y curl openssh-server ca-certificates
curl -sS https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash
sudo apt install -y gitlab-ce
sudo gitlab-ctl reconfigure
# sudo nano /etc/gitlab/gitlab.rb
# external_url 'http://gitlab.domian.org'
# https://about.gitlab.com/installation/#ubuntu

# Configure GitLab to work with Apache
sudo su -c 'echo """nginx['enable'] = false
web_server['external_users'] = ['www-data']
gitlab_workhorse['listen_network'] = "tcp"
gitlab_workhorse['listen_addr'] = "127.0.0.1:8181"
gitlab_rails['omniauth_providers'] = [
  {
    "name" => "gitlab",
    "app_id" => "$gitlabappid",
    "app_secret" => "$gitlabappsecret",
    "args" => { "scope" => "api" }
  }
]""" >> /etc/gitlab/gitlab.rb'
sudo gitlab-ctl reconfigure

#https://www.digitalocean.com/community/tutorials/how-to-secure-gitlab-with-let-s-encrypt-on-ubuntu-16-04

# Configure Apache to work with GitLab
sudo useradd -G gitlab-www www-data
sudo certbot certonly --non-interactive --agree-tos --standalone --email=--email="$email" -d "$gitlabdomian"
# sudo wget https://gitlab.com/gitlab-org/gitlab-recipes/raw/master/web-server/apache/gitlab-omnibus-ssl-apache24.conf -O /etc/apache2/sites-available/gitlab.conf
# With Vesta you should manually create a subdomian and copy the config into /home/admin/conf/web/sapache2.conf
sudo a2ensite gitlab
sudo a2enmod proxy
sudo a2enmod proxy_http
sudo a2enmod headers
sudo a2enmod ssl

# Install Gitlab Runner
# curl -L https://packages.gitlab.com/install/repositories/runner/gitlab-ci-multi-runner/script.deb.sh | sudo bash
# sudo apt -y install gitlab-ci-multi-runner
# echo "Go to $gitlabdomian/admin/runners and get a token for the runner"
# sudo gitlab-runner register

# Install VestaCP WSGI template
sudo apt install -y python3-pip libapache2-mod-wsgi-py3 virtualenv
cd /usr/local/vesta/data/templates/web/apache2
ls wsgi.*
# https://forum.vestacp.com/viewtopic.php?f=19&t=10867&p=40758
# https://forum.vestacp.com/viewtopic.php?t=3777&start=10
sudo a2enmod wsgi
cd /usr/local/vesta/data/templates/web
sudo wget http://c.vestacp.com/0.9.8/ubuntu/wsgi/apache2.tar.gz
sudo tar -xzvf apache2.tar.gz
sudo rm -f apache2.tar.gz

# Install VestaCP nginx force-https template
cd /usr/local/vesta/data/templates/web
sudo wget http://c.vestacp.com/0.9.8/rhel/force-https/nginx.tar.gz
sudo tar -xzvf nginx.tar.gz
sudo rm -f nginx.tar.gz

# sudo -u postgres psql
# alter user postgres password '$postgrespassword';
# \q
v-change-database-host-password pgsql localhost postgres "$postgrespassword"

# nano /usr/share/phppgadmin/conf/config.inc.php
# $conf['extra_login_security'] = false; # Change to false

sudo service apache2 restart
sudo service nginx restart
sudo service vesta restart
sudo service postgresql restart