Add one-command server installer

README.md

@@ -105,6 +105,36 @@ docker compose -f docker-compose.prod.yml up -d --build
 
 O serviço `release` roda `prisma migrate deploy` e o seed idempotente antes do app iniciar. O seed cria o admin inicial usando `ADMIN_EMAIL` e `ADMIN_INITIAL_PASSWORD` somente se o usuário ainda não existir.
 
+### Instalador em um comando
+
+Depois que o repositório estiver acessível pelo servidor, você pode instalar em uma máquina limpa com Docker usando:
+
+```sh
+curl -fsSL https://gitea.seconectai.com.br/tiago/SeConectai_Web/raw/branch/main/scripts/install-server.sh \
+  | APP_DOMAIN=seu-dominio.com.br \
+    LETSENCRYPT_EMAIL=voce@dominio.com.br \
+    ADMIN_EMAIL=admin@dominio.com.br \
+    ADMIN_INITIAL_PASSWORD='troque-esta-senha' \
+    sh
+```
+
+Opcionalmente defina também:
+
+```sh
+INSTALL_DIR=/opt/seconectai-web
+POSTGRES_PASSWORD=senha-forte-do-banco
+AUTH_SECRET=segredo-auth
+CPF_ENC_KEY=base64-32-bytes
+CPF_HASH_KEY=segredo-hmac
+SMTP_HOST=smtp.exemplo.com
+SMTP_PORT=587
+SMTP_USER=usuario
+SMTP_PASS=senha
+SMTP_FROM=contato@dominio.com.br
+```
+
+Evite colocar senha em parâmetro de URL. URL pode ficar gravada em histórico, logs e proxy. Passe segredo por variável de ambiente no comando ou edite o `.env` no servidor.
+
 Para atualizar:
 
 ```sh

scripts/install-local.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+APP_DOMAIN="${APP_DOMAIN:-localhost}"
+LETSENCRYPT_EMAIL="${LETSENCRYPT_EMAIL:-admin@example.com}"
+ADMIN_EMAIL="${ADMIN_EMAIL:-admin@example.com}"
+ADMIN_INITIAL_PASSWORD="${ADMIN_INITIAL_PASSWORD:-admin12345}"
+
+APP_DOMAIN="$APP_DOMAIN" \
+LETSENCRYPT_EMAIL="$LETSENCRYPT_EMAIL" \
+ADMIN_EMAIL="$ADMIN_EMAIL" \
+ADMIN_INITIAL_PASSWORD="$ADMIN_INITIAL_PASSWORD" \
+INSTALL_DIR="${INSTALL_DIR:-$(pwd)}" \
+REPO_URL="${REPO_URL:-https://gitea.seconectai.com.br/tiago/SeConectai_Web.git}" \
+sh scripts/install-server.sh

scripts/install-server.sh

@@ -0,0 +1,129 @@
+#!/bin/sh
+set -eu
+
+REPO_URL="${REPO_URL:-https://gitea.seconectai.com.br/tiago/SeConectai_Web.git}"
+INSTALL_DIR="${INSTALL_DIR:-/opt/seconectai-web}"
+APP_DOMAIN="${APP_DOMAIN:-}"
+LETSENCRYPT_EMAIL="${LETSENCRYPT_EMAIL:-}"
+ADMIN_EMAIL="${ADMIN_EMAIL:-}"
+ADMIN_INITIAL_PASSWORD="${ADMIN_INITIAL_PASSWORD:-}"
+POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-}"
+AUTH_SECRET="${AUTH_SECRET:-}"
+CPF_ENC_KEY="${CPF_ENC_KEY:-}"
+CPF_HASH_KEY="${CPF_HASH_KEY:-}"
+SMTP_HOST="${SMTP_HOST:-}"
+SMTP_PORT="${SMTP_PORT:-587}"
+SMTP_USER="${SMTP_USER:-}"
+SMTP_PASS="${SMTP_PASS:-}"
+SMTP_FROM="${SMTP_FROM:-}"
+
+need() {
+  if [ -z "$2" ]; then
+    echo "Variavel obrigatoria ausente: $1" >&2
+    exit 1
+  fi
+}
+
+gen_secret() {
+  if command -v openssl >/dev/null 2>&1; then
+    openssl rand -base64 32
+  else
+    head -c 32 /dev/urandom | base64
+  fi
+}
+
+need APP_DOMAIN "$APP_DOMAIN"
+need LETSENCRYPT_EMAIL "$LETSENCRYPT_EMAIL"
+need ADMIN_EMAIL "$ADMIN_EMAIL"
+need ADMIN_INITIAL_PASSWORD "$ADMIN_INITIAL_PASSWORD"
+
+if [ -z "$POSTGRES_PASSWORD" ]; then
+  POSTGRES_PASSWORD="$(gen_secret)"
+fi
+
+if [ -z "$AUTH_SECRET" ]; then
+  AUTH_SECRET="$(gen_secret)"
+fi
+
+if [ -z "$CPF_ENC_KEY" ]; then
+  CPF_ENC_KEY="$(gen_secret)"
+fi
+
+if [ -z "$CPF_HASH_KEY" ]; then
+  CPF_HASH_KEY="$(gen_secret)"
+fi
+
+if ! command -v git >/dev/null 2>&1; then
+  echo "Instale git antes de continuar." >&2
+  exit 1
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "Instale Docker antes de continuar." >&2
+  exit 1
+fi
+
+if docker compose version >/dev/null 2>&1; then
+  COMPOSE="docker compose"
+elif command -v docker-compose >/dev/null 2>&1; then
+  COMPOSE="docker-compose"
+else
+  echo "Instale Docker Compose antes de continuar." >&2
+  exit 1
+fi
+
+if [ -d "$INSTALL_DIR/.git" ]; then
+  echo "Atualizando projeto em $INSTALL_DIR"
+  git -C "$INSTALL_DIR" pull --ff-only
+else
+  echo "Clonando projeto em $INSTALL_DIR"
+  mkdir -p "$(dirname "$INSTALL_DIR")"
+  git clone "$REPO_URL" "$INSTALL_DIR"
+fi
+
+cd "$INSTALL_DIR"
+
+cat > .env <<EOF
+POSTGRES_DB=briefing
+POSTGRES_USER=briefing
+POSTGRES_PASSWORD=$POSTGRES_PASSWORD
+DATABASE_URL=postgresql://briefing:$POSTGRES_PASSWORD@db:5432/briefing?schema=public
+AUTH_SECRET=$AUTH_SECRET
+APP_URL=https://$APP_DOMAIN
+APP_DOMAIN=$APP_DOMAIN
+LETSENCRYPT_EMAIL=$LETSENCRYPT_EMAIL
+CPF_ENC_KEY=$CPF_ENC_KEY
+CPF_HASH_KEY=$CPF_HASH_KEY
+SMTP_HOST=$SMTP_HOST
+SMTP_PORT=$SMTP_PORT
+SMTP_USER=$SMTP_USER
+SMTP_PASS=$SMTP_PASS
+SMTP_FROM=$SMTP_FROM
+ADMIN_EMAIL=$ADMIN_EMAIL
+ADMIN_INITIAL_PASSWORD=$ADMIN_INITIAL_PASSWORD
+EVOLUTION_API_URL=
+EVOLUTION_API_KEY=
+EVOLUTION_API_INSTANCE=
+ADMIN_WHATSAPP=
+UPLOAD_DIR=/app/storage/uploads
+UPLOAD_MAX_MB=25
+BACKUP_DIR=./backups
+BACKUP_RETENTION_DAYS=14
+EOF
+
+chmod 600 .env
+
+echo "Construindo e subindo banco"
+$COMPOSE -f docker-compose.prod.yml up -d db
+
+echo "Rodando migrations e seed"
+$COMPOSE -f docker-compose.prod.yml run --rm release
+
+echo "Subindo app e proxy HTTPS"
+$COMPOSE -f docker-compose.prod.yml up -d --build app caddy
+
+echo
+echo "Instalacao concluida."
+echo "Acesse: https://$APP_DOMAIN"
+echo "Admin: $ADMIN_EMAIL"
+echo "O Postgres nao foi exposto publicamente."