4cb9ac1faa
- Added support for installing Immich and Penpot stacks, including necessary Docker images and network configurations. - Updated DockerPackageScanner to exclude Immich and Penpot related containers from app listings. - Enhanced Nginx configuration to support iframe embedding for Immich and Penpot applications, improving user experience. - Modified deployment scripts to ensure proper setup of first-boot container creation services.
124 lines
4.1 KiB
Bash
124 lines
4.1 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Set up HTTPS on Archipelago dev server for PWA installability.
|
|
# Browsers require HTTPS (or localhost) to install PWAs.
|
|
# Generates a self-signed certificate and configures nginx.
|
|
#
|
|
# Run on the target server: sudo ./setup-https-dev.sh
|
|
# Or via deploy: the deploy script runs this automatically.
|
|
#
|
|
|
|
set -e
|
|
|
|
SSL_DIR="/etc/archipelago/ssl"
|
|
NGINX_CFG="/etc/nginx/sites-available/archipelago"
|
|
CERT="$SSL_DIR/archipelago.crt"
|
|
KEY="$SSL_DIR/archipelago.key"
|
|
|
|
# Create SSL directory
|
|
mkdir -p "$SSL_DIR"
|
|
chmod 755 "$SSL_DIR"
|
|
|
|
# Generate self-signed cert if missing (valid 365 days)
|
|
# SAN includes common dev IPs so cert works when accessing via IP
|
|
if [ ! -f "$CERT" ] || [ ! -f "$KEY" ]; then
|
|
echo "Generating self-signed certificate for PWA (HTTPS)..."
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
|
-keyout "$KEY" \
|
|
-out "$CERT" \
|
|
-subj "/CN=archipelago.local/O=Archipelago/C=US" \
|
|
-addext "subjectAltName=DNS:archipelago.local,DNS:localhost,IP:127.0.0.1,IP:192.168.1.228,IP:192.168.1.198,IP:10.0.0.1"
|
|
chmod 644 "$CERT"
|
|
chmod 600 "$KEY"
|
|
echo " Certificate created at $CERT"
|
|
fi
|
|
|
|
# PWA snippet for manifest + service worker headers (required for Android install)
|
|
NGINX_SNIPPETS="/etc/nginx/snippets"
|
|
PWA_SNIPPET="$NGINX_SNIPPETS/archipelago-pwa.conf"
|
|
mkdir -p "$NGINX_SNIPPETS"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
if [ -f "$SCRIPT_DIR/nginx-pwa-snippet.conf" ]; then
|
|
cp "$SCRIPT_DIR/nginx-pwa-snippet.conf" "$PWA_SNIPPET"
|
|
echo " PWA nginx snippet installed at $PWA_SNIPPET"
|
|
fi
|
|
|
|
# Add PWA snippet include to existing HTTPS block if missing
|
|
if grep -q "listen 443 ssl" "$NGINX_CFG" 2>/dev/null && [ -f "$PWA_SNIPPET" ]; then
|
|
if ! grep -q "archipelago-pwa" "$NGINX_CFG" 2>/dev/null; then
|
|
echo " Adding PWA snippet include to HTTPS block..."
|
|
# Insert include after "index index.html;" within the HTTPS server block (listen 443 to next })
|
|
sed -i '/listen 443 ssl/,/^}$/{
|
|
/index index.html;/a\
|
|
include snippets/archipelago-pwa.conf;
|
|
}' "$NGINX_CFG" 2>/dev/null || true
|
|
fi
|
|
fi
|
|
|
|
# Check if HTTPS is already configured
|
|
if grep -q "listen 443 ssl" "$NGINX_CFG" 2>/dev/null; then
|
|
echo "HTTPS already configured in nginx."
|
|
nginx -t 2>/dev/null && systemctl reload nginx
|
|
echo ""
|
|
echo "PWA: Use https://192.168.1.228 (not http) - accept cert once, then Install app."
|
|
exit 0
|
|
fi
|
|
|
|
# Add HTTPS server block (duplicate of HTTP block with SSL)
|
|
# PWA requires HTTPS for install on Android
|
|
HTTPS_BLOCK='
|
|
# HTTPS - required for PWA install (Add to Home Screen) from dev servers
|
|
server {
|
|
listen 443 ssl;
|
|
server_name _;
|
|
|
|
ssl_certificate '"$CERT"';
|
|
ssl_certificate_key '"$KEY"';
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
|
|
root /opt/archipelago/web-ui;
|
|
index index.html;
|
|
include snippets/archipelago-pwa.conf;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location /archipelago/ {
|
|
proxy_pass http://127.0.0.1:5678;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
location /rpc/ {
|
|
proxy_pass http://127.0.0.1:5678;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_connect_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
proxy_read_timeout 600s;
|
|
}
|
|
|
|
location /ws {
|
|
proxy_pass http://127.0.0.1:5678;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_read_timeout 86400s;
|
|
}
|
|
}
|
|
'
|
|
|
|
# Append HTTPS block to nginx config
|
|
echo "$HTTPS_BLOCK" >> "$NGINX_CFG"
|
|
echo "Added HTTPS (port 443) to nginx config."
|
|
|
|
# Test and reload
|
|
nginx -t && systemctl reload nginx
|
|
echo ""
|
|
echo "HTTPS enabled. PWA install: https://192.168.1.228 (accept the certificate warning once, then Install app)."
|