Repository navigation
feat: one-line installer with Podman, HTTPS, backups and a management command - #3
Open
najuna-brian wants to merge 5 commits into
Open
najuna-brian wants to merge 5 commits into
najuna-brian wants to merge 5 commits into
Conversation
…ment command Add get.sh, a single command that sets up a complete Synkronus server (PostgreSQL, Synkronus and Caddy) on a fresh Ubuntu 24.04 or Debian 12 server. It supports three routes: paste one line, paste cloud-init.sh at server creation (no terminal), or run behind a Cloudflare Tunnel. - Podman by default, Docker when already installed or Podman is too old - Generated secrets kept in /opt/synkronus/.env, credentials saved to CREDENTIALS.txt - Pre-flight checks for memory, disk, ports 80/443 and the domain's DNS - Synkronus and Postgres are not published; only Caddy listens publicly - Real client IPs passed to Synkronus so login rate limits are per user - Starts again after reboot, nightly backups kept 7 days - synkronus command: status, credentials, backup, restore, update with rollback, reset-admin-password, logs, uninstall - Running it again changes nothing Also fix two quickstart issues: - install.sh refuses to run a second time instead of printing new passwords that are never applied - docker-compose.yml publishes port 8080 on 127.0.0.1 only, so the server is not reachable over plain HTTP around Caddy
…uninstall and final summary
…eate --quick-tunnel gives a free temporary https://*.trycloudflare.com address with no domain, account or open ports, for trying Synkronus on a laptop or a server behind a router. The installer now stops before starting if containers named synkronus, synkronus-db, synkronus-caddy or synkronus-tunnel already exist and belong to something else.
cloudflared defaults to QUIC, which needs outbound UDP. Many office and mobile networks block it, and the tunnel then never connects. HTTP/2 over TCP 443 works on those networks. Existing installs pick this up on their next synkronus restart or update.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
get.sh, a one-line installer that takes a fresh Ubuntu 24.04 or Debian 12 server to a working Synkronus with HTTPS, so people without a developer background can run their own server.curl -fsSL https://raw.githubusercontent.com/OpenDataEnsemble/synkronus-quickstart/main/get.sh | sudo bashThree routes, all using the same script:
cloud-init.shinto the provider's "User data" box when creating the server--tunnel-tokenWhat the installer does:
/opt/synkronus/.env, saves the login toCREDENTIALS.txt.SYNKRONUS_AUTH_TRUSTED_PROXY_CIDRSis set to the internal network, so login rate limits apply per client instead of to everyone at once.https://<ip>.sslip.iowhen there is no domain.synkronuscommand:status,credentials,backup,restore,update(backs up first, rolls back if the new version does not start),reset-admin-password(uses the recovery variables and removes them again),logs,start/stop/restart,uninstall.Also fixes two bugs in the existing quickstart (see the linked issue):
install.shstops on a second run instead of printing passwords that are never applied.docker-compose.ymlpublishes 8080 on127.0.0.1only, so the API is no longer reachable over plain HTTP around Caddy (the override'sports: []does not remove it).create_sync_db.shis left alone because #1 rewrites it.Type of Change
Related Issue(s)
Closes: #2
Testing
On Ubuntu 24.04 with Podman 4.9.3 / podman-compose 1.0.6, and with Docker 29 / Compose v5:
',:and#backupthenrestore(database rows and attachment files come back)reset-admin-password(new password works, recovery variables removed afterwards)stopthen start again as on bootpodman-compose configshellcheckcleanBreaking Changes