deploy/install.sh

#!/bin/sh
# git-trace one-shot install on the Aruba box (Debian/Ubuntu).
# Usage: ./install.sh git.yourdomain.tld
# Run as root.  Idempotent: safe to re-run.
set -e

DOMAIN=${1:?usage: $0 <domain>  e.g. git.example.com}
ROOT=/srv/git-trace
BIN=/usr/local/bin/git-trace

# --- 1. OS user + layout ------------------------------------------------
# account 'git' must not be locked (sshd refuses pubkey auth on '!'
# shadow entries) and needs a real shell to run the forced command —
# access is confined by sshd's ForceCommand + key options, not by the
# login shell.
if ! id git >/dev/null 2>&1; then
    useradd -r -m -d $ROOT -s /bin/sh git
    usermod -p '*' git
fi
mkdir -p $ROOT/repos $ROOT/var $ROOT/bin /srv/backups/git-trace
chown -R git:git $ROOT

# --- 2. binary -----------------------------------------------------------
# build locally (make) or copy the release binary alongside this script
install -m755 ./git-trace $BIN

# --- 3. forge sshd on :2222 ----------------------------------------------
install -d -m755 /etc/git-trace
install -m644 ./sshd-forge.conf /etc/git-trace/sshd-forge.conf
[ -f $ROOT/var/ssh_host_ed25519_key ] || \
    ssh-keygen -q -t ed25519 -N '' -f $ROOT/var/ssh_host_ed25519_key
[ -f $ROOT/var/ssh_host_rsa_key ] || \
    ssh-keygen -q -t rsa -b 3072 -N '' -f $ROOT/var/ssh_host_rsa_key
chown git:git $ROOT/var/ssh_host_*

# empty authorized_keys so sshd -t passes before the first signup
touch $ROOT/var/authorized_keys
chown git:git $ROOT/var/authorized_keys

# --- 4. units ------------------------------------------------------------
sed "s/git\.example\.com/$DOMAIN/" ./git-trace.service \
    > /etc/systemd/system/git-trace.service
install -m644 ./git-trace-sshd.service /etc/systemd/system/

# --- 5. backup cron ------------------------------------------------------
install -m755 ./backup.sh $ROOT/bin/backup.sh
( crontab -l 2>/dev/null | grep -v git-trace/bin/backup.sh; \
  echo "30 3 * * * $ROOT/bin/backup.sh" ) | crontab -

systemctl daemon-reload
systemctl enable --now git-trace git-trace-sshd

cat <<EOF

== git-trace installed ==

  forge    : http://127.0.0.1:8081  (Caddy → https://$DOMAIN)
  ssh      : ssh://git@$DOMAIN:2222
  state    : $ROOT/{repos,var}
  backups  : /srv/backups/git-trace  (nightly 03:30)

next:
  1. point DNS:  $DOMAIN A/AAAA → this host
  2. append the Caddy block (Caddyfile.snippet, s/example/$DOMAIN/)
     and `caddy reload`
  3. open firewall: 443 (80 already needed for ACME), 2222
  4. create your account:
       su -s /bin/sh git -c 'echo <pw> | $BIN useradd --admin \
           --email=you@x $(whoami)'
     then add your SSH pubkey via /account once logged in
  5. migrating an existing instance? rsync the old
     repos/ + var/git-trace.db here, then:
       su -s /bin/sh git -c 'GIT_TRACE_REPOS=$ROOT/repos \
           GIT_TRACE_DB=$ROOT/var/git-trace.db \
           $BIN rehook && $BIN keyfile --write'
EOF