-
-
Notifications
You must be signed in to change notification settings - Fork 156
Expand file tree
/
Copy pathstackscript.sh
More file actions
executable file
·461 lines (419 loc) · 15.7 KB
/
stackscript.sh
File metadata and controls
executable file
·461 lines (419 loc) · 15.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
#!/bin/bash
######################################################
# centos 7 linode stackscript for centmin mod install
# written by George Liu (eva2000) centminmod.com
######################################################
# stackscript installer for latest Centmin Mod LEMP
# beta + redis installation for both remi server
######################################################
# variables
#############
#DT=$(date +"%d%m%y-%H%M%S")
#<UDF name="hostname" label="Enter main hostname for the new Linode server.">
# HOSTNAME=
#
#<UDF name="fqdn" label="Enter Server's Fully Qualified Domain Name (same as main hostname)">
# FQDN=
#
#<UDF name="mainemail" label="Enter primary email address to associate with server">
# MAINEMAIL=
#
#<UDF name="secondemail" label="Enter secondary backup email address to associate with server">
# SECONDEMAIL=
#
#<UDF name="loginalert" Label="Enable sshd login email alerts (community.centminmod.com/posts/40191/) ?" oneOf="yes,no" default="no" />
# LOGINALERT=
#
#<UDF name="loginalertemail" Label="Enter sshd login alert email address" default="none" />
# LOGINALERTEMAIL=
#
#<UDF name="letsencrypt" Label="Enable Letsencrypt SSL Integration Support (centminmod.com/acmetool) ?" oneOf="yes,no" default="no" />
# LETSENCRYPT=
#
#<UDF name="auditd" Label="Enable Auditd Support (community.centminmod.com/posts/37733/) ?" oneOf="yes,no" default="no" />
# AUDITD=
#
#<UDF name="csfblocklist" Label="Enable CSF Firewall Advance Blocklist Support (community.centminmod.com/posts/50058/) ?" oneOf="yes,no" default="no" />
# CSFBLOCKLIST=
#
#<UDF name="redis" Label="Install & Configure Redis Server from REMI YUM repo ?" oneOf="yes,no" default="yes" />
# REDIS=
#
#<UDF name="pureftp" Label="Stop & Disable Pure-FTPD Server ?" oneOf="yes,no" default="no" />
# PUREFTP=
#
#<UDF name="targetnative" Label="Build Nginx & PHP-FPM with march native ?" oneOf="yes,no" default="no" />
# TARGETNATIVE=
#
#<UDF name="compiler" Label="Build Nginx with GCC or Clang Compiler ?" oneOf="clang,gcc" default="gcc" />
# COMPILER=
#
#<UDF name="openssl" Label="Build Nginx against LibreSSL 2.8+ or OpenSSL 1.1.1+ ?" oneOf="libressl,openssl" default="openssl" />
# OPENSSL=
#
#<UDF name="zstdlogrotate" Label="Enable zstd compression for Nginx & PHP-FPM Log Rotation (https://community.centminmod.com/threads/16374/) ?" oneOf="yes,no" default="no" />
# ZSTDLOGROTATE=
#
#<UDF name="hpack" Label="Enable Cloudflare HTTP/2 HPACK Full Encoding Patch (community.centminmod.com/posts/51082/) ?" oneOf="yes,no" default="no" />
# HPACK=
#
#<UDF name="cloudflarezlib" Label="Enable Nginx install with Cloudflare Zlib Performance Fork (https://github.com/cloudflare/zlib) ?" oneOf="yes,no" default="yes" />
# CLOUDFLAREZLIB=
#
#<UDF name="brotli" Label="Enable ngx_brotli nginx module (community.centminmod.com/posts/45818/) ?" oneOf="yes,no" default="no" />
# BROTLI=
#
#<UDF name="pagespeed" Label="Build Nginx with ngx_pagespeed module enabled ?" oneOf="yes,no" default="no" />
# PAGESPEED=
#
#<UDF name="lua" Label="Enable OpenResty Lua Nginx mdoule support ? (auto fallback to OpenSSL 1.0.2+ for Lua Nginx compatibility)" oneOf="yes,no" default="no" />
# LUA=
#
#<UDF name="php" Label="Install Latest PHP 5.6 or 7.0 or 7.1 or 7.2 or 7.3 or 7.4 Version ?" oneOf="5.6,7.0,7.1,7.2,7.3,7.4" default="7.2" />
# PHP=
#
#<UDF name="docker" Label="Install Docker ?" oneOf="yes,no" default="no" />
# DOCKER=
#
#<UDF name="pushover" Label="Pushover.net Mobile Email Notification on StackScript completion ?" oneOf="yes,no" default="no" />
# PUSHOVER=
#
#<UDF name="pushoveremail" Label="Enter Pushover.net Email Address" default="none" />
# PUSHOVEREMAIL=
#
#<UDF name="whitelist" Label="Whitelist custom IP addresses for CSF Firewall i.e. ISP IP address, remote web or mysql servers or VPN IP etc ?" oneOf="yes,no" default="no" />
# WHITELIST=
#
#<UDF name="csfipa" label="Enter IP address to add to CSF Firewall Whitelisting." default="none" />
# CSFIPA=
#
#<UDF name="csfipb" label="Enter IP address to add to CSF Firewall Whitelisting." default="none" />
# CSFIPB=
#
#<UDF name="csfipc" label="Enter IP address to add to CSF Firewall Whitelisting." default="none" />
# CSFIPC=
#
#<UDF name="csfipd" label="Enter IP address to add to CSF Firewall Whitelisting." default="none" />
# CSFIPD=
#
#<UDF name="csfipe" label="Enter IP address to add to CSF Firewall Whitelisting." default="none" />
# CSFIPE=
#
#<UDF name="csfipf" label="Enter IP address to add to CSF Firewall Whitelisting." default="none" />
# CSFIPF=
#
#<UDF name="sshpublickey" Label="Add SSH Public Key for root user (rsa,ecdsa,ed25519)" example="ssh-rsa ..." default="none" />
# SSHPUBLICKEY=
#
#<UDF name="nginxvhosta" Label="Create Nginx Vhost Domain/Subdomain without http:// i.e. domain.com or sub.domain.com : " default="none" />
# NGINXVHOSTA=
#
#<UDF name="ftpusernamea" Label="Enter Desired Pure-FTPD Virtual FTP Username : " default="none" />
# FTPUSERNAMEA=
#
#<UDF name="mysqldbnamea" Label="Create Desired MySQL Database Named: " default="none" />
# MYSQLDBNAMEA=
#
#<UDF name="mysqlusera" Label="Create Desired MySQL Username Named: " default="none" />
# MYSQLUSERA=
#
#<UDF name="mysqlpassa" Label="Create Desired MySQL User's Password: " default="none" />
# MYSQLPASSA=
# This sets the variable $IPADDR to the IPv4 address the new Linode receives.
IPADDR=$(hostname -I | cut -f1 -d' ')
# This sets the variable $IPADDR6 to the IPv6 address the new Linode receives.
IPADDR6=$(hostname -I | cut -f2 -d' ')
# YOURIP=""
######################################################
# Redirect output of this script to our logfile
exec &> /root/stackscript.log
# This section sets the hostname.
hostnamectl set-hostname $HOSTNAME
# This section sets the Fully Qualified Domain Name (FQDN) in the hosts file.
echo $IPADDR $FQDN $HOSTNAME >> /etc/hosts
echo $IPADDR6 $FQDN $HOSTNAME >> /etc/hosts
# Centmin Mod 123.09beta01
mkdir -p /etc/centminmod
touch /etc/centminmod/custom_config.inc
# Build Nginx with GCC or Clang compiler
if [[ "$COMPILER" = 'gcc' ]]; then
echo
echo "Set CLANG='n'"
echo "Set DEVTOOLSETEIGHT='y'"
echo "Set NGINX_DEVTOOLSETGCC='y'"
echo "CLANG='n'" >> /etc/centminmod/custom_config.inc
echo "DEVTOOLSETEIGHT='y'" >> /etc/centminmod/custom_config.inc
echo "NGINX_DEVTOOLSETGCC='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Build Nginx with OpenResty Nginx Lua module support
if [[ "$LUA" = 'yes' ]]; then
echo
echo "Set ORESTY_LUANGINX='y'"
echo "Set NGXDYNAMIC_LUA='y'"
echo "Set NGXDYNAMIC_DEVELKIT='y'"
echo "ORESTY_LUANGINX='y'" >> /etc/centminmod/custom_config.inc
echo "NGXDYNAMIC_LUA='y'" >> /etc/centminmod/custom_config.inc
echo "NGXDYNAMIC_DEVELKIT='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Enable Cloudflare HPACK patch
# https://community.centminmod.com/posts/51082/
if [[ "$HPACK" = 'yes' ]]; then
echo
echo "Set NGINX_HPACK='y'"
echo "NGINX_HPACK='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Enable zstd compression for Nginx & PHP-FPM log rotation
# https://community.centminmod.com/threads/16374/
if [[ "$ZSTDLOGROTATE" = 'yes' ]]; then
echo
echo "Set ZSTD_LOGROTATE_NGINX='y'"
echo "Set ZSTD_LOGROTATE_PHPFPM='y'"
echo "ZSTD_LOGROTATE_NGINX='y'" >> /etc/centminmod/custom_config.inc
echo "ZSTD_LOGROTATE_PHPFPM='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Enable Cloudflare zlib library install for Nginx server
# https://community.centminmod.com/threads/13521/
# https://community.centminmod.com/threads/13498/
if [[ "$CLOUDFLAREZLIB" = 'yes' ]]; then
echo
echo "Set CLOUDFLARE_ZLIB='y'"
echo "CLOUDFLARE_ZLIB='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Linode host vps nodes can use different intel based processor
# models and march=native optimises performance for the specific
# cpu model family only. If you migrate linode vps to a different
# host node with different cpu model, you need to recompile nginx
# & php-fpm for the new cpu if you have the usual march=native
# compile flag. Setting MARCH_TARGETNATIVE='n' disables march=native
# so you do not need to recompile after migrating to different
# linode host node with different cpu model
if [[ "$TARGETNATIVE" = 'no' ]]; then
echo
echo "Disable march=native"
echo "MARCH_TARGETNATIVE='n'" >> /etc/centminmod/custom_config.inc
fi
# Build Nginx with LibreSSL or OpenSSL
if [[ "$OPENSSL" = 'openssl' ]]; then
echo
echo "Set LIBRESSL_SWITCH='n'"
echo "LIBRESSL_SWITCH='n'" >> /etc/centminmod/custom_config.inc
echo
fi
# Enable ngx_brolti nginx module
# https://community.centminmod.com/posts/45818/
if [[ "BROTLI" = 'yes' ]]; then
echo
echo "Set NGXDYNAMIC_BROTLI='y'
NGXDYNAMIC_ZSTD='n'"
echo "Set NGINX_LIBBROTLI='y'"
echo "NGXDYNAMIC_BROTLI='y'" >> /etc/centminmod/custom_config.inc
echo "NGXDYNAMIC_ZSTD='n'" >> /etc/centminmod/custom_config.inc
echo "NGINX_LIBBROTLI='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Build Nginx with ngx_pagespeed
if [[ "$PAGESPEED" = 'yes' ]]; then
echo
echo "Set NGXDYNAMIC_NGXPAGESPEED='y'"
echo "Set NGINX_PAGESPEED='y'"
echo "NGXDYNAMIC_NGXPAGESPEED='y'" >> /etc/centminmod/custom_config.inc
echo "NGINX_PAGESPEED='y'" >> /etc/centminmod/custom_config.inc
echo
fi
# Build PHP version
if [[ "$PHP" = '7.4' ]]; then
echo
yum -y update
echo
curl -O https://centminmod.com/betainstaller74.sh && chmod 0700 betainstaller74.sh && bash betainstaller74.sh
echo
fi
# Build PHP version
if [[ "$PHP" = '7.3' ]]; then
echo
yum -y update
echo
curl -O https://centminmod.com/betainstaller73.sh && chmod 0700 betainstaller73.sh && bash betainstaller73.sh
echo
fi
# Build PHP version
if [[ "$PHP" = '7.2' ]]; then
echo
yum -y update
echo
curl -O https://centminmod.com/betainstaller72.sh && chmod 0700 betainstaller72.sh && bash betainstaller72.sh
echo
fi
# Build PHP version
if [[ "$PHP" = '7.1' ]]; then
echo
yum -y update
echo
curl -O https://centminmod.com/betainstaller71.sh && chmod 0700 betainstaller71.sh && bash betainstaller71.sh
echo
fi
if [[ "$PHP" = '7.0' ]]; then
echo
yum -y update
echo
curl -O https://centminmod.com/betainstaller7.sh && chmod 0700 betainstaller7.sh && bash betainstaller7.sh
echo
fi
if [[ "$PHP" = '5.6' ]]; then
echo
yum -y update
echo
curl -O https://centminmod.com/betainstaller.sh && chmod 0700 betainstaller.sh && bash betainstaller.sh
echo
fi
echo "Primary: $MAINEMAIL"
echo "$MAINEMAIL" > /etc/centminmod/email-primary.ini
echo "setup at /etc/centminmod/email-primary.ini"
echo "Secondary: $SECONDEMAIL"
echo "$SECONDEMAIL" > /etc/centminmod/email-secondary.ini
echo "setup at /etc/centminmod/email-secondary.ini"
# Allow your IP on YOUR.FQDN.COM/nginx-status
#sed -i "s/.*#allow youripaddress;.*/allow ${YOURIP}; \#Your IP/" /usr/local/nginx/conf/conf.d/virtual.conf
# pure-ftpd dhparam
openssl dhparam -out /etc/ssl/private/pure-ftpd-dhparams.pem 2048
# Enable addons/acmetool.sh letsencrypt integration support
# https://centminmod.com/acmetool
if [[ "$LETSENCRYPT" = 'yes' ]]; then
echo
echo "Enable addons/acmetool.sh support"
echo "LETSENCRYPT_DETECT='y'" >> /etc/centminmod/custom_config.inc
fi
# Enable tools/auditd.sh support
# https://community.centminmod.com/posts/37733/
if [[ "$AUDITD" = 'yes' ]]; then
echo
echo "Enable tools/auditd.sh support"
echo "AUDITD_ENABLE='y'" >> /etc/centminmod/custom_config.inc
/usr/local/src/centminmod/tools/auditd.sh setup
fi
# Enable CSF advance blocklist support
# https://community.centminmod.com/posts/50058/
# extending blocklists in /etc/csf/csf.blocklists
if [[ "$CSFBLOCKLIST" = 'yes' ]]; then
echo
echo "Enable CSF Firewall Advance Blocklist support"
/usr/local/src/centminmod/tools/csf-advancetweaks.sh
csf -r; service lfd restart
fi
# Disables Pure-ftpd
if [[ "$PUREFTP" = 'yes' ]]; then
echo
service pure-ftpd stop
chkconfig pure-ftpd off
fi
# Install docker
# https://docs.docker.com/install/linux/docker-ce/centos/
if [[ "$DOCKER" = 'yes' ]]; then
echo
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum -y install yum-utils device-mapper-persistent-data lvm2
yum -y install docker-ce
mkdir -p /etc/systemd/system/docker.service.d
touch /etc/systemd/system/docker.service.d/docker.conf
mkdir -p /etc/docker
wget${ipv_forceopt_wget} -O /etc/docker/daemon.json https://gist.githubusercontent.com/centminmod/e3d1095c78b6e3b3ed02f5367e345d68/raw/daemon.json
systemctl daemon-reload
systemctl start docker
systemctl enable docker
echo
systemctl status docker --no-pager
echo
journalctl -u docker --no-pager
echo
docker info
fi
# Install redis
if [[ "$REDIS" = 'yes' ]]; then
echo
mkdir -p /root/tools
git clone https://github.com/centminmod/centminmod-redis
cd centminmod-redis
./redis-install.sh install
fi
# CSF Whitelisting
# https://centminmod.com/csf_firewall.html
if [[ "$WHITELIST" = 'yes' ]]; then
echo
CSFIP_ARRAY="${CSFIPA} ${CSFIPB} ${CSFIPC} ${CSFIPD} ${CSFIPE} ${CSFIPF}"
for ip in ${CSFIP_ARRAY[@]}; do
if [[ "$ip" != 'none' ]]; then
csf -a $ip # stackscript-whitelisted
echo "$ip" >> /etc/csf/csf.ignore
fi
done
fi
# fix ups
wget -O /root/mysqlreport https://centminmod.com/centminmodparts/mysqlreport/mysqlreport
# clean up
yum clean all
find /svr-setup -maxdepth 1 -type d ! -wholename "/svr-setup" -exec rm -rf {} \;
if [[ "$LUA" = 'yes' ]]; then
sed -i '/OPENSSL_VERSION=/d' /etc/centminmod/custom_config.inc
fi
# ssh public keys
if [[ "$SSHPUBLICKEY" != 'none' ]]; then
echo Setting up ssh public keys
mkdir -p /root/.ssh
echo "$SSHPUBLICKEY" > /root/.ssh/authorized_keys
chmod -R 700 /root/.ssh
chmod 0644 /root/.ssh/authorized_keys
systemctl restart sshd
cat /root/.ssh/authorized_keys
fi
# sshd login alert centmin mod style
# https://community.centminmod.com/posts/40191/
if [[ "$LOGINALERT" = 'yes' ]]; then
if [[ "$LOGINALERTEMAIL" != 'none' ]]; then
echo "SSH_ALERTEMAIL=$LOGINALERTEMAIL" >> /root/.bashrc
echo "SSH_ALERTIP=\$(echo \$SSH_CLIENT | awk '{print \$1}')" >> /root/.bashrc
echo "SSH_ALERTGEO=\$(curl -sL https://ipinfo.io/\$SSH_ALERTIP/geo | sed -e 's|[{}]||' -e 's/\(^"\|"\)//g' -e 's|,||')" >> /root/.bashrc
echo "echo -e \"ALERT: \$(whoami) Shell Access \$(hostname): \$(date)\n\$SSH_ALERTGEO\" | mail -s \"Alert: \$(whoami) Shell Access \$(hostname) from \$SSH_ALERTIP\" \$SSH_ALERTEMAIL" >> /root/.bashrc
fi
fi
# mysql db, user setup
if [[ "$MYSQLDBNAMEA" != 'none' && "$MYSQLUSERA" != 'none' && "$MYSQLPASSA" != 'none' && -f /usr/local/src/centminmod/addons/mysqladmin_shell.sh ]]; then
/usr/local/src/centminmod/addons/mysqladmin_shell.sh createuserdb "$MYSQLDBNAMEA" "$MYSQLUSERA" "$MYSQLPASSA"
DBINFO="DBNAME: "$MYSQLDBNAMEA"
DBUSER: "$MYSQLUSERA"
DBPASS: "$MYSQLPASSA""
else
DBINFO=""
fi
# nginx vhost setup
if [[ "$NGINXVHOSTA" != 'none' && "$FTPUSERNAMEA" != 'none' && -f /usr/bin/nv ]]; then
echo "/usr/bin/nv -d "$NGINXVHOSTA" -s n -u "$FTPUSERNAMEA""
/usr/bin/nv -d "$NGINXVHOSTA" -s n -u "$FTPUSERNAMEA"
echo
NVHOSTLOG=$(ls /root/centminlogs/ | grep 'nginx_addvhost_nv.log' | tail -1)
echo
NVHOSTINFO=$(echo "$NGINXVHOSTA log: /root/centminlogs/$NVHOSTLOG")
echo
FTPINFO=$(cat "/root/centminlogs/$NVHOSTLOG" | grep --color=never -A5 'FTP hostname ')
echo
else
NVHOSTINFO=""
FTPINFO=""
fi
# And we are done
echo
if [[ "$PUSHOVER" = 'yes' ]]; then
if [[ "$PUSHOVEREMAIL" = 'none' ]]; then
echo -e "$(date)\nStackscript Setup Complete For $HOSTNAME\nstackscript log: /root/stackscript.log\ncentmin mod logs: /root/centminlogs\n$NVHOSTINFO\n$FTPINFO\n$DBINFO"
else
DT=$(date)
echo -e "${DT}\nStackscript Setup Complete For $HOSTNAME\nstackscript log: /root/stackscript.log\ncentmin mod logs: /root/centminlogs\n$NVHOSTINFO\n$FTPINFO\n$DBINFO" | mail -s "$HOSTNAME StackScript Setup Done ${DT}" -r "$PUSHOVEREMAIL" "$PUSHOVEREMAIL"
echo -e "${DT}\nStackscript Setup Complete For $HOSTNAME\nstackscript log: /root/stackscript.log\ncentmin mod logs: /root/centminlogs\n$NVHOSTINFO\n$FTPINFO\n$DBINFO"
fi
else
echo -e "$(date)\nStackscript Setup Complete For $HOSTNAME\nstackscript log: /root/stackscript.log\ncentmin mod logs: /root/centminlogs\n$NVHOSTINFO\n$FTPINFO\n$DBINFO"
fi