Initial commit - Mold Cost Calculator Application (Security Fixed)
This commit is contained in:
Gan, Jimmy
@@ -0,0 +1,40 @@
|
||||
# Flask Configuration
|
||||
FLASK_APP=run.py
|
||||
FLASK_ENV=production
|
||||
FLASK_DEBUG=0
|
||||
|
||||
# Security
|
||||
SECRET_KEY=your_production_secret_key_here
|
||||
|
||||
# Database
|
||||
DATABASE_URL=postgresql://username:password@localhost/mold_cost_calculator
|
||||
|
||||
# Email Configuration
|
||||
MAIL_SERVER=smtp.gmail.com
|
||||
MAIL_PORT=587
|
||||
MAIL_USE_TLS=True
|
||||
MAIL_USERNAME=your_production_email@gmail.com
|
||||
MAIL_PASSWORD=your_production_email_password
|
||||
MAIL_DEFAULT_SENDER=your_production_email@gmail.com
|
||||
|
||||
# Admin Account
|
||||
ADMIN_USERNAME=admin
|
||||
ADMIN_EMAIL=admin@example.com
|
||||
ADMIN_PASSWORD=change_this_to_secure_password
|
||||
ADMIN_COMPANY="System Administration"
|
||||
|
||||
# Logging
|
||||
LOG_LEVEL=INFO
|
||||
LOG_TO_STDOUT=False
|
||||
|
||||
# Redis Configuration (for rate limiting and caching)
|
||||
REDIS_URL=redis://localhost:6379/0
|
||||
RATELIMIT_STORAGE_URL=redis://localhost:6379/0
|
||||
CACHE_REDIS_URL=redis://localhost:6379/1
|
||||
|
||||
# Gunicorn Configuration
|
||||
WORKERS=4
|
||||
THREADS=2
|
||||
TIMEOUT=120
|
||||
MAX_REQUESTS=1000
|
||||
MAX_REQUESTS_JITTER=50
|
||||
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Configuration
|
||||
BACKUP_DIR="/backups"
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
DB_HOST="mold_cost_db"
|
||||
DB_NAME="mold_cost"
|
||||
DB_USER="postgres"
|
||||
DB_PASSWORD="postgres"
|
||||
|
||||
# Create backup directory if it doesn't exist
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
|
||||
# Set PostgreSQL password environment variable
|
||||
export PGPASSWORD="$DB_PASSWORD"
|
||||
|
||||
# Create backup with error handling
|
||||
echo "Creating database backup at $(date)..."
|
||||
if pg_dump -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" --no-password | gzip > "$BACKUP_DIR/backup_$TIMESTAMP.sql.gz"; then
|
||||
echo "Backup completed successfully: backup_$TIMESTAMP.sql.gz"
|
||||
|
||||
# Keep only the last 7 backups
|
||||
echo "Cleaning up old backups..."
|
||||
ls -t "$BACKUP_DIR"/backup_*.sql.gz | tail -n +8 | xargs -r rm
|
||||
|
||||
# Verify backup file exists and has content
|
||||
if [ -f "$BACKUP_DIR/backup_$TIMESTAMP.sql.gz" ] && [ -s "$BACKUP_DIR/backup_$TIMESTAMP.sql.gz" ]; then
|
||||
echo "Backup verification successful: $(du -h "$BACKUP_DIR/backup_$TIMESTAMP.sql.gz" | cut -f1)"
|
||||
else
|
||||
echo "ERROR: Backup file is empty or missing!"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "ERROR: Backup failed!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Clear password from environment
|
||||
unset PGPASSWORD
|
||||
@@ -0,0 +1,164 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Backup management script for Mold Cost Calculator
|
||||
# This script provides easy commands for backup operations
|
||||
|
||||
set -e
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# Function to print colored output
|
||||
print_status() {
|
||||
echo -e "${GREEN}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
print_warning() {
|
||||
echo -e "${YELLOW}[WARNING]${NC} $1"
|
||||
}
|
||||
|
||||
print_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
print_header() {
|
||||
echo -e "${BLUE}=== $1 ===${NC}"
|
||||
}
|
||||
|
||||
# Function to create manual backup
|
||||
create_backup() {
|
||||
print_header "Creating Manual Backup"
|
||||
if podman-compose exec backup /backup.sh; then
|
||||
print_status "Manual backup completed successfully!"
|
||||
else
|
||||
print_error "Manual backup failed!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to list backups
|
||||
list_backups() {
|
||||
print_header "Available Backups"
|
||||
if [ -d "./backups" ]; then
|
||||
if [ "$(ls -A ./backups)" ]; then
|
||||
ls -lah ./backups/backup_*.sql.gz 2>/dev/null | while read -r line; do
|
||||
echo " $line"
|
||||
done
|
||||
else
|
||||
print_warning "No backup files found in ./backups directory"
|
||||
fi
|
||||
else
|
||||
print_warning "Backups directory does not exist"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to restore from backup
|
||||
restore_backup() {
|
||||
local backup_file="$1"
|
||||
|
||||
if [ -z "$backup_file" ]; then
|
||||
print_error "Please specify a backup file to restore from."
|
||||
echo "Usage: $0 restore <backup_file>"
|
||||
echo "Example: $0 restore ./backups/backup_20241201_120000.sql.gz"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$backup_file" ]; then
|
||||
print_error "Backup file '$backup_file' not found!"
|
||||
list_backups
|
||||
exit 1
|
||||
fi
|
||||
|
||||
print_header "Database Restore"
|
||||
print_warning "This will overwrite the current database!"
|
||||
echo "Backup file: $backup_file"
|
||||
read -p "Are you sure you want to continue? (y/N): " -n 1 -r
|
||||
echo
|
||||
|
||||
if [[ $REPLY =~ ^[Yy]$ ]]; then
|
||||
print_status "Stopping application..."
|
||||
podman-compose stop app
|
||||
|
||||
print_status "Restoring database..."
|
||||
if podman-compose exec backup /restore.sh restore "/backups/$(basename "$backup_file")"; then
|
||||
print_status "Database restored successfully!"
|
||||
print_status "Starting application..."
|
||||
podman-compose start app
|
||||
print_status "Restore completed!"
|
||||
else
|
||||
print_error "Database restore failed!"
|
||||
print_status "Starting application..."
|
||||
podman-compose start app
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
print_status "Restore cancelled."
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to show backup status
|
||||
show_status() {
|
||||
print_header "Backup Service Status"
|
||||
|
||||
# Check if backup container is running
|
||||
if podman-compose ps backup | grep -q "Up"; then
|
||||
print_status "Backup service is running"
|
||||
else
|
||||
print_error "Backup service is not running"
|
||||
fi
|
||||
|
||||
# Show recent backup logs
|
||||
print_header "Recent Backup Logs"
|
||||
podman-compose logs --tail=10 backup
|
||||
|
||||
# List available backups
|
||||
list_backups
|
||||
}
|
||||
|
||||
# Function to show help
|
||||
show_help() {
|
||||
print_header "Backup Management Script"
|
||||
echo "Usage: $0 [command] [options]"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " backup - Create a manual backup"
|
||||
echo " list - List available backups"
|
||||
echo " restore <backup_file> - Restore database from backup"
|
||||
echo " status - Show backup service status"
|
||||
echo " help - Show this help message"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " $0 backup"
|
||||
echo " $0 list"
|
||||
echo " $0 restore ./backups/backup_20241201_120000.sql.gz"
|
||||
echo " $0 status"
|
||||
}
|
||||
|
||||
# Main script logic
|
||||
case "${1:-help}" in
|
||||
"backup"|"create")
|
||||
create_backup
|
||||
;;
|
||||
"list"|"ls")
|
||||
list_backups
|
||||
;;
|
||||
"restore")
|
||||
restore_backup "$2"
|
||||
;;
|
||||
"status")
|
||||
show_status
|
||||
;;
|
||||
"help"|"--help"|"-h"|"")
|
||||
show_help
|
||||
;;
|
||||
*)
|
||||
print_error "Unknown command '$1'"
|
||||
echo ""
|
||||
show_help
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,44 @@
|
||||
import os
|
||||
import sys
|
||||
import psycopg2
|
||||
from pathlib import Path
|
||||
|
||||
def get_db_url():
|
||||
"""Get database URL from environment variables."""
|
||||
db_user = os.getenv('DB_USER', 'mold_user')
|
||||
db_password = os.getenv('DB_PASSWORD', 'your_db_password_here')
|
||||
db_host = os.getenv('DB_HOST', 'localhost')
|
||||
db_port = os.getenv('DB_PORT', '5434')
|
||||
db_name = os.getenv('DB_NAME', 'mold_cost_calculator_dev')
|
||||
|
||||
return f"postgresql://{db_user}:{db_password}@{db_host}:{db_port}/{db_name}"
|
||||
|
||||
def run_migration():
|
||||
# Get database URL from environment
|
||||
db_url = get_db_url()
|
||||
|
||||
try:
|
||||
# Connect to the database
|
||||
conn = psycopg2.connect(db_url)
|
||||
conn.autocommit = True
|
||||
cur = conn.cursor()
|
||||
|
||||
# Read and execute the migration SQL
|
||||
migration_file = Path(__file__).parent / 'update_mold_types.sql'
|
||||
with open(migration_file, 'r') as f:
|
||||
sql = f.read()
|
||||
cur.execute(sql)
|
||||
|
||||
print("Migration completed successfully!")
|
||||
|
||||
except Exception as e:
|
||||
print(f"Error running migration: {str(e)}")
|
||||
sys.exit(1)
|
||||
finally:
|
||||
if 'cur' in locals():
|
||||
cur.close()
|
||||
if 'conn' in locals():
|
||||
conn.close()
|
||||
|
||||
if __name__ == '__main__':
|
||||
run_migration()
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Exit on error
|
||||
set -e
|
||||
|
||||
# Change to the migrations directory
|
||||
cd "$(dirname "$0")"
|
||||
|
||||
echo "Running database migration..."
|
||||
python3 run_migration.py
|
||||
|
||||
echo "Testing migration..."
|
||||
python3 test_mold_types.py
|
||||
|
||||
echo "Migration completed successfully!"
|
||||
@@ -0,0 +1,82 @@
|
||||
import os
|
||||
import sys
|
||||
import psycopg2
|
||||
from pathlib import Path
|
||||
|
||||
def get_db_url():
|
||||
"""Get database URL from environment variables."""
|
||||
db_user = os.getenv('DB_USER', 'mold_user')
|
||||
db_password = os.getenv('DB_PASSWORD', 'your_db_password_here')
|
||||
db_host = os.getenv('DB_HOST', 'localhost')
|
||||
db_port = os.getenv('DB_PORT', '5434')
|
||||
db_name = os.getenv('DB_NAME', 'mold_cost_calculator_dev')
|
||||
|
||||
return f"postgresql://{db_user}:{db_password}@{db_host}:{db_port}/{db_name}"
|
||||
|
||||
def test_migration():
|
||||
# Get database URL from environment
|
||||
db_url = get_db_url()
|
||||
|
||||
try:
|
||||
# Connect to the database
|
||||
conn = psycopg2.connect(db_url)
|
||||
cur = conn.cursor()
|
||||
|
||||
# Check if the column exists
|
||||
cur.execute("""
|
||||
SELECT column_name
|
||||
FROM information_schema.columns
|
||||
WHERE table_name = 'mold_quotations'
|
||||
AND column_name = 'mold_specific_type'
|
||||
""")
|
||||
|
||||
if cur.fetchone():
|
||||
print("✅ mold_specific_type column exists")
|
||||
else:
|
||||
print("❌ mold_specific_type column does not exist")
|
||||
return False
|
||||
|
||||
# Check if the column is NOT NULL
|
||||
cur.execute("""
|
||||
SELECT is_nullable
|
||||
FROM information_schema.columns
|
||||
WHERE table_name = 'mold_quotations'
|
||||
AND column_name = 'mold_specific_type'
|
||||
""")
|
||||
|
||||
is_nullable = cur.fetchone()[0]
|
||||
if is_nullable == 'NO':
|
||||
print("✅ mold_specific_type column is NOT NULL")
|
||||
else:
|
||||
print("❌ mold_specific_type column is nullable")
|
||||
return False
|
||||
|
||||
# Check if all records have a value
|
||||
cur.execute("""
|
||||
SELECT COUNT(*)
|
||||
FROM mold_quotations
|
||||
WHERE mold_specific_type IS NULL
|
||||
""")
|
||||
|
||||
null_count = cur.fetchone()[0]
|
||||
if null_count == 0:
|
||||
print("✅ All records have a mold_specific_type value")
|
||||
else:
|
||||
print(f"❌ Found {null_count} records with NULL mold_specific_type")
|
||||
return False
|
||||
|
||||
print("All tests passed!")
|
||||
return True
|
||||
|
||||
except Exception as e:
|
||||
print(f"Error testing migration: {str(e)}")
|
||||
return False
|
||||
finally:
|
||||
if 'cur' in locals():
|
||||
cur.close()
|
||||
if 'conn' in locals():
|
||||
conn.close()
|
||||
|
||||
if __name__ == '__main__':
|
||||
success = test_migration()
|
||||
sys.exit(0 if success else 1)
|
||||
@@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Configuration
|
||||
BACKUP_DIR="/backups"
|
||||
DB_HOST="mold_cost_db"
|
||||
DB_NAME="mold_cost"
|
||||
DB_USER="postgres"
|
||||
DB_PASSWORD="postgres"
|
||||
|
||||
# Set PostgreSQL password environment variable
|
||||
export PGPASSWORD="$DB_PASSWORD"
|
||||
|
||||
# Function to list available backups
|
||||
list_backups() {
|
||||
echo "Available backups:"
|
||||
ls -la "$BACKUP_DIR"/backup_*.sql.gz 2>/dev/null | while read -r line; do
|
||||
echo " $line"
|
||||
done
|
||||
}
|
||||
|
||||
# Function to restore from backup
|
||||
restore_backup() {
|
||||
local backup_file="$1"
|
||||
|
||||
if [ ! -f "$backup_file" ]; then
|
||||
echo "ERROR: Backup file '$backup_file' not found!"
|
||||
list_backups
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "WARNING: This will overwrite the current database!"
|
||||
echo "Backup file: $backup_file"
|
||||
read -p "Are you sure you want to continue? (y/N): " -n 1 -r
|
||||
echo
|
||||
|
||||
if [[ $REPLY =~ ^[Yy]$ ]]; then
|
||||
echo "Restoring database from backup..."
|
||||
|
||||
# Drop and recreate database
|
||||
echo "Dropping existing database..."
|
||||
dropdb -h "$DB_HOST" -U "$DB_USER" --no-password "$DB_NAME" 2>/dev/null || true
|
||||
|
||||
echo "Creating new database..."
|
||||
createdb -h "$DB_HOST" -U "$DB_USER" --no-password "$DB_NAME"
|
||||
|
||||
echo "Restoring data..."
|
||||
if gunzip -c "$backup_file" | psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" --no-password; then
|
||||
echo "Database restored successfully!"
|
||||
else
|
||||
echo "ERROR: Database restore failed!"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "Restore cancelled."
|
||||
fi
|
||||
}
|
||||
|
||||
# Main script logic
|
||||
if [ $# -eq 0 ]; then
|
||||
echo "Usage: $0 [list|restore <backup_file>]"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " list - List available backups"
|
||||
echo " restore <backup_file> - Restore database from backup file"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " $0 list"
|
||||
echo " $0 restore /backups/backup_20241201_120000.sql.gz"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case "$1" in
|
||||
"list")
|
||||
list_backups
|
||||
;;
|
||||
"restore")
|
||||
if [ -z "$2" ]; then
|
||||
echo "ERROR: Please specify a backup file to restore from."
|
||||
echo "Usage: $0 restore <backup_file>"
|
||||
exit 1
|
||||
fi
|
||||
restore_backup "$2"
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: Unknown command '$1'"
|
||||
echo "Usage: $0 [list|restore <backup_file>]"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# Clear password from environment
|
||||
unset PGPASSWORD
|
||||
@@ -0,0 +1,74 @@
|
||||
import multiprocessing
|
||||
import os
|
||||
from pathlib import Path
|
||||
|
||||
# Create logs directory if it doesn't exist
|
||||
os.makedirs('logs', exist_ok=True)
|
||||
|
||||
# Server socket
|
||||
bind = os.getenv('GUNICORN_BIND', '0.0.0.0:5002')
|
||||
backlog = 2048
|
||||
|
||||
# Worker processes
|
||||
# Formula: (2 x number_of_cores) + 1
|
||||
workers = int(os.getenv('GUNICORN_WORKERS', 13)) # Default to 13 workers
|
||||
worker_class = 'sync'
|
||||
worker_connections = 1000
|
||||
timeout = int(os.getenv('GUNICORN_TIMEOUT', 30))
|
||||
keepalive = 2
|
||||
|
||||
# Performance optimizations
|
||||
worker_tmp_dir = '/dev/shm' # Use RAM for temporary files
|
||||
limit_request_line = 4094 # Prevent large request attacks
|
||||
limit_request_fields = 100 # Limit number of request headers
|
||||
|
||||
# Logging
|
||||
accesslog = 'logs/access.log'
|
||||
errorlog = 'logs/error.log'
|
||||
loglevel = os.getenv('LOG_LEVEL', 'debug')
|
||||
|
||||
# Process naming
|
||||
proc_name = 'mold_cost_calculator'
|
||||
|
||||
# Server mechanics
|
||||
daemon = False
|
||||
pidfile = 'gunicorn.pid'
|
||||
umask = 0
|
||||
user = None
|
||||
group = None
|
||||
tmp_upload_dir = None
|
||||
|
||||
# Server hooks
|
||||
def on_starting(server):
|
||||
# Ensure instance directory exists
|
||||
os.makedirs('instance', exist_ok=True)
|
||||
|
||||
def on_reload(server):
|
||||
pass
|
||||
|
||||
def on_exit(server):
|
||||
pass
|
||||
|
||||
# Request limits
|
||||
max_requests = 1000
|
||||
max_requests_jitter = 50
|
||||
|
||||
# Worker settings
|
||||
graceful_timeout = 30
|
||||
preload_app = True
|
||||
|
||||
# Environment variables
|
||||
raw_env = [
|
||||
'FLASK_APP=run.py',
|
||||
'FLASK_ENV=production',
|
||||
'FLASK_DEBUG=0'
|
||||
]
|
||||
|
||||
# Security settings
|
||||
trusted_proxies = os.getenv('TRUSTED_PROXY_IPS', '127.0.0.1,::1').split(',')
|
||||
forwarded_allow_ips = ','.join(ip.strip() for ip in trusted_proxies)
|
||||
secure_scheme_headers = {
|
||||
'X-FORWARDED-PROTOCOL': 'ssl',
|
||||
'X-FORWARDED-PROTO': 'https',
|
||||
'X-FORWARDED-SSL': 'on'
|
||||
}
|
||||
Executable
+161
@@ -0,0 +1,161 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Function to check internet connectivity
|
||||
check_internet() {
|
||||
if ! curl -s --connect-timeout 5 https://registry-1.docker.io/v2/ > /dev/null; then
|
||||
echo "⚠️ No internet connection to Docker Hub - will use local images only"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
# Function to pull image with retries
|
||||
pull_image() {
|
||||
local image=$1
|
||||
local max_attempts=3
|
||||
local attempt=1
|
||||
local wait_time=5
|
||||
|
||||
while [ $attempt -le $max_attempts ]; do
|
||||
echo "📥 Attempting to pull $image (Attempt $attempt/$max_attempts)..."
|
||||
if podman pull $image; then
|
||||
echo "✅ Successfully pulled $image"
|
||||
return 0
|
||||
fi
|
||||
echo "⚠️ Pull attempt $attempt failed. Waiting before retry..."
|
||||
sleep $wait_time
|
||||
attempt=$((attempt + 1))
|
||||
wait_time=$((wait_time * 2))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# Function to clean up while preserving base images
|
||||
cleanup_with_preserve() {
|
||||
echo "🧹 Cleaning up while preserving base images..."
|
||||
# Save the base image IDs if they exist
|
||||
local python_image_id=$(podman images -q python:3.12-slim)
|
||||
local postgres_image_id=$(podman images -q postgres:16-alpine)
|
||||
|
||||
# Run system prune
|
||||
podman system prune -af
|
||||
|
||||
# If we had base images, pull them again
|
||||
if [ ! -z "$python_image_id" ]; then
|
||||
echo "🔄 Restoring Python base image..."
|
||||
pull_image python:3.12-slim
|
||||
fi
|
||||
if [ ! -z "$postgres_image_id" ]; then
|
||||
echo "🔄 Restoring PostgreSQL base image..."
|
||||
pull_image postgres:16-alpine
|
||||
fi
|
||||
}
|
||||
|
||||
echo "🚀 Starting local deployment process..."
|
||||
|
||||
# Check available disk space
|
||||
echo "💾 Checking disk space..."
|
||||
AVAILABLE_SPACE=$(df -h . | awk 'NR==2 {print $4}' | tr -d 'G' | tr -d 'i')
|
||||
if [ "$AVAILABLE_SPACE" -lt 10 ]; then
|
||||
echo "⚠️ Low disk space detected (${AVAILABLE_SPACE}G available). Cleaning up..."
|
||||
cleanup_with_preserve
|
||||
echo "✅ Cleanup complete"
|
||||
fi
|
||||
|
||||
# Check for required base images
|
||||
echo "🔍 Checking for required base images..."
|
||||
for image in "python:3.12-slim" "postgres:16-alpine"; do
|
||||
if podman images | grep -q "$image"; then
|
||||
echo "✅ $image found locally"
|
||||
else
|
||||
echo "⚠️ $image not found locally"
|
||||
if ! check_internet; then
|
||||
echo "⚠️ No internet connection - attempting to build without base image"
|
||||
else
|
||||
echo "📦 Pulling $image from Docker Hub..."
|
||||
if ! pull_image "$image"; then
|
||||
echo "⚠️ Failed to pull $image - attempting to build without it"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
# Create necessary directories and set permissions
|
||||
echo "📁 Setting up directories..."
|
||||
mkdir -p instance logs db_data db_backups
|
||||
chmod -R 777 instance logs db_data db_backups
|
||||
|
||||
# Generate a secure secret key if not exists
|
||||
if [ ! -f .env ]; then
|
||||
echo "🔑 Generating new secret key..."
|
||||
echo "SECRET_KEY=$(openssl rand -hex 32)" > .env
|
||||
echo "DATABASE_URL=postgresql://mold_user:mold_password@db:5432/mold_cost_calculator" >> .env
|
||||
fi
|
||||
|
||||
# Clear template cache
|
||||
echo "🧹 Clearing template cache..."
|
||||
find . -type d -name "__pycache__" -exec rm -r {} +
|
||||
find . -type f -name "*.pyc" -delete
|
||||
|
||||
# Stop and remove existing containers
|
||||
echo "🧹 Cleaning up existing containers..."
|
||||
podman-compose down 2>/dev/null || true
|
||||
|
||||
# Build the containers with retry logic
|
||||
echo "📦 Building containers..."
|
||||
max_build_attempts=3
|
||||
build_attempt=1
|
||||
|
||||
while [ $build_attempt -le $max_build_attempts ]; do
|
||||
echo "🏗️ Build attempt $build_attempt/$max_build_attempts..."
|
||||
if podman-compose build; then
|
||||
echo "✅ Build successful"
|
||||
break
|
||||
fi
|
||||
if [ $build_attempt -eq $max_build_attempts ]; then
|
||||
echo "❌ Build failed after $max_build_attempts attempts"
|
||||
exit 1
|
||||
fi
|
||||
echo "⚠️ Build attempt $build_attempt failed. Waiting before retry..."
|
||||
sleep $((build_attempt * 5))
|
||||
build_attempt=$((build_attempt + 1))
|
||||
done
|
||||
|
||||
# Start the containers
|
||||
echo "🚀 Starting containers..."
|
||||
podman-compose up -d
|
||||
|
||||
# Wait for database to be ready
|
||||
echo "⏳ Waiting for database to be ready..."
|
||||
max_wait=30
|
||||
wait_count=0
|
||||
while [ $wait_count -lt $max_wait ]; do
|
||||
if podman exec mold_cost_db pg_isready -U mold_user -d mold_cost_calculator >/dev/null 2>&1; then
|
||||
echo "✅ Database is ready"
|
||||
break
|
||||
fi
|
||||
echo "⏳ Waiting for database... ($((wait_count + 1))/$max_wait)"
|
||||
sleep 1
|
||||
wait_count=$((wait_count + 1))
|
||||
done
|
||||
|
||||
if [ $wait_count -eq $max_wait ]; then
|
||||
echo "❌ Database failed to start within timeout"
|
||||
echo "📝 Checking container logs..."
|
||||
podman-compose logs db
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if the containers are running
|
||||
if podman-compose ps | grep -q "Up"; then
|
||||
echo "✅ Deployment complete!"
|
||||
echo "🌐 Application is available at: http://localhost:5003"
|
||||
echo "📝 To view logs: podman-compose logs"
|
||||
echo "📝 To view app logs: podman-compose logs web"
|
||||
echo "📝 To view db logs: podman-compose logs db"
|
||||
echo "🛑 To stop: podman-compose down"
|
||||
else
|
||||
echo "❌ Containers failed to start. Check logs with: podman-compose logs"
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,16 @@
|
||||
[Unit]
|
||||
Description=Mold Cost Calculator
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User=jimmyg
|
||||
Group=jimmyg
|
||||
WorkingDirectory=/home/jimmyg/mold_cost_online_app
|
||||
Environment="PATH=/home/jimmyg/mold_cost_online_app/venv/bin"
|
||||
Environment="FLASK_APP=run.py"
|
||||
Environment="FLASK_ENV=production"
|
||||
ExecStart=/home/jimmyg/mold_cost_online_app/venv/bin/gunicorn -c gunicorn_config.py run:app
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,59 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name moldcost.jimmygan.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name moldcost.jimmygan.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/moldcost.jimmygan.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/moldcost.jimmygan.com/privkey.pem;
|
||||
|
||||
# SSL 配置
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
# HSTS
|
||||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||
|
||||
# 其他安全头
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:;" always;
|
||||
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
|
||||
|
||||
# 代理设置
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:5002;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# WebSocket 支持
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
# 超时设置
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# 静态文件
|
||||
location /static {
|
||||
alias /home/jimmyg/mold_cost_online_tool/app/static;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, no-transform";
|
||||
}
|
||||
|
||||
# 日志
|
||||
access_log /var/log/nginx/moldcost_access.log;
|
||||
error_log /var/log/nginx/moldcost_error.log;
|
||||
}
|
||||
Reference in New Issue
Block a user