Merge branch 'laravel' of https://github.com/visuddhinanda/mint into laravel

deploy/.gitignore

@@ -1,2 +1,3 @@
 /clients/
+/tmp/
 *.log

deploy/README.md

@@ -18,11 +18,11 @@ ssh-copy-id -i .ssh/id_ed25519 USER@HOST
 
 ```bash
 # test ssh connections
-peony -i staging ping.yml
+peony -i clients/CLUSTER ping.yml
 # run on all hosts
-peony -i staging pi.yml
+peony -i clients/CLUSTER ping.yml
 # run on only group
-peony -i staging pi.yml -l GROUP
+peony -i clients/CLUSTER ping.yml -l GROUP
 ```
 
 ## System image

deploy/group_vars/all.yml

@@ -3,6 +3,8 @@ ansible_python_interpreter: /usr/bin/python3
 ansible_ssh_private_key_file: "{{ inventory_dir }}/.ssh/id_ed25519"
 #ansible_ssh_private_key_file: "{{inventory_dir}}/.ssh/id_rsa"
 
-app_www_deploy_target: "/var/www/{{ inventory_hostname }}/{{ ansible_date_time.iso8601_basic }}"
+app_deploy_target: "/var/www/{{ inventory_hostname }}/{{ ansible_date_time.iso8601_basic }}"
+app_downloads: "{{ ansible_env.HOME }}/downloads"
+app_backup: "{{ ansible_env.HOME }}/backups"
 app_python_version: "3.11"
-app_php_version: "8.0"
+app_php_version: "8.1"

deploy/mint.yml

@@ -1,18 +1,20 @@
 - hosts: all
   roles:
-    - os
     - ubuntu
+    - os
     - python3
     - php
-    - mint-clone
 
 - hosts: www
   roles:
+    - mint-clone
     - mint-www
+    - certbot-nginx
 
 - hosts: assets
   roles:
     - mint-assets
+    - certbot-nginx
 
 - hosts: db
   roles:

deploy/roles/certbot-nginx/tasks/main.yml

@@ -0,0 +1,24 @@
+- name: Remove file nginx default host
+  become: true
+  ansible.builtin.file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: add Let's Encrypt support
+  become: true
+  ansible.builtin.shell:
+    cmd: certbot --nginx --non-interactive --agree-tos -m {{ app_master_email }} --domains {{ inventory_hostname }}
+
+- name: restart nginx
+  become: true
+  ansible.builtin.systemd:
+    state: restarted
+    name: nginx
+
+- name: enable certbot sync
+  become: true
+  ansible.builtin.cron:
+    name: "renew certbot every month"
+    special_time: monthly
+    job: "/usr/bin/certbot renew --force-renewal"
+

deploy/roles/mint-assets/tasks/main.yml

@@ -1,16 +1,21 @@
+# - name: Upload assets folder
+#   become: true
+#   ansible.builtin.copy:
+#     src: public
+#     dest: /var/www/{{ inventory_hostname }}
+#     owner: www-data
+#     group: www-data
+
 - name: Upload assets folder
-  become: true
-  ansible.builtin.copy:
+  ansible.posix.synchronize:
     src: public
     dest: /var/www/{{ inventory_hostname }}
-    owner: www-data
-    group: www-data
 
 - name: upload nginx.conf
-  bacame: true
+  become: true
   ansible.builtin.template:
     src: nginx.conf.j2
-    dest: "/etc/nginx/sites-enabled/{{ inventory_hostname }}"
+    dest: "/etc/nginx/sites-enabled/{{ inventory_hostname }}.conf"
     owner: www-data
     group: www-data
     mode: '0400'

deploy/roles/mint-assets/templates/nginx.conf.j2

@@ -3,7 +3,7 @@ server {
 
     gzip on;
     server_name {{ inventory_hostname }};
-    root /var/www/{{ inventory_hostname }};
+    root /var/www/{{ inventory_hostname }}/public;
 
     access_log off;
     error_log /var/log/nginx/{{ inventory_hostname }}.error.log warn;

deploy/roles/mint-clone/main.yml

@@ -1,63 +0,0 @@
-- name: Creates directory
-  become: true
-  file:
-    path: "/var/www/{{ inventory_hostname }}"
-    state: directory
-    owner: "{{ ansible_user }}"
-
-- name: Git checkout source code
-  ansible.builtin.git:
-    repo: 'https://github.com/iapt-platform/mint.git'
-    dest: "{{ app_www_deploy_target }}"
-    version: laravel
-
-- name: Install v2 php dependencies
-  ansible.builtin.shell: composer install
-  args:
-    chdir: "{{ app_www_deploy_target }}"
-
-- name: Install v2 nodejs dependencies
-  ansible.builtin.shell: npm install
-  args:
-    chdir: "{{ app_www_deploy_target }}"
-
-# TODO will remove in future
-- name: Install v1 php dependencies
-  ansible.builtin.shell: composer install
-  args:
-    chdir: "{{ app_www_deploy_target }}/public"
-
-# TODO will remove in future
-- name: Install v1 nodejs dependencies
-  ansible.builtin.shell: npm install
-  args:
-    chdir: "{{ app_www_deploy_target }}/public"
-
-- name: .env(v2)
-  bacame: true
-  ansible.builtin.template:
-    src: env-v2.j2
-    dest: "{{ app_www_deploy_target }}/.env"
-    owner: www-data
-    group: www-data
-    mode: '0400'
-
-# TODO will remove in future
-- name: config.php(v1)
-  bacame: true
-  ansible.builtin.template:
-    src: config-v1.php.j2
-    dest: "{{ app_www_deploy_target }}/public/app/config.php"
-    owner: www-data
-    group: www-data
-    mode: '0400'
-
-# TODO will remove in future
-- name: config.js(v1)
-  bacame: true
-  ansible.builtin.template:
-    src: config-v1.js.j2
-    dest: "{{ app_www_deploy_target }}/public/app/config.js"
-    owner: www-data
-    group: www-data
-    mode: '0400'

deploy/roles/mint-clone/tasks/main.yml

@@ -0,0 +1,98 @@
+- name: Creates deploy directory
+  become: true
+  file:
+    path: "/var/www/{{ inventory_hostname }}"
+    state: directory
+    owner: "{{ ansible_user }}"
+
+- name: Git checkout source code
+  ansible.builtin.git:
+    repo: 'https://github.com/iapt-platform/mint.git'
+    dest: "{{ app_deploy_target }}"
+    version: laravel
+
+- name: Setup storage folder
+  ansible.builtin.file:
+    path: "{{ app_deploy_target }}/storage"
+    owner: www-data
+    group: www-data
+
+- name: Install v2 php dependencies
+  ansible.builtin.shell: "php{{ app_php_version }} {{ ansible_env.HOME }}/.local/bin/composer install"
+  args:
+    chdir: "{{ app_deploy_target }}"
+
+# - name: Install v2 nodejs dependencies
+#   ansible.builtin.shell: npm install
+#   args:
+#     chdir: "{{ app_deploy_target }}"
+- name: Install v2 nodejs dependencies
+  ansible.builtin.file:
+    src: "/var/www/{{ inventory_hostname }}/node_modules/v2"
+    dest: "{{ app_deploy_target }}/node_modules"
+    state: link
+
+# TODO will remove in future
+- name: Install v1 php dependencies
+  ansible.builtin.shell: "php{{ app_php_version }} {{ ansible_env.HOME }}/.local/bin/composer install"
+  args:
+    chdir: "{{ app_deploy_target }}/public"
+
+# TODO will remove in future
+# - name: Install v1 nodejs dependencies
+#   ansible.builtin.shell: npm install
+#   args:
+#     chdir: "{{ app_deploy_target }}/public"
+- name: Install v1 nodejs dependencies
+  ansible.builtin.file:
+    src: "/var/www/{{ inventory_hostname }}/node_modules/v1"
+    dest: "{{ app_deploy_target }}/public/node_modules"
+    state: link
+
+- name: Install v2 tmp
+  ansible.builtin.file:
+    src: "/var/www/{{ inventory_hostname }}/tmp"
+    dest: "{{ app_deploy_target }}/tmp"
+    state: link
+
+# TODO will remove in future
+- name: Install v1 tmp
+  ansible.builtin.file:
+    src: "/var/www/{{ inventory_hostname }}/tmp"
+    dest: "{{ app_deploy_target }}/public/tmp"
+    state: link
+
+- name: .env(v2)
+  become: true
+  ansible.builtin.template:
+    src: env-v2.j2
+    dest: "{{ app_deploy_target }}/.env"
+    owner: www-data
+    group: www-data
+    mode: '0400'
+
+# TODO will remove in future
+- name: config.php(v1)
+  become: true
+  ansible.builtin.template:
+    src: config-v1.php.j2
+    dest: "{{ app_deploy_target }}/public/app/config.php"
+    owner: www-data
+    group: www-data
+    mode: '0400'
+
+# TODO will remove in future
+- name: config.js(v1)
+  become: true
+  ansible.builtin.template:
+    src: config-v1.js.j2
+    dest: "{{ app_deploy_target }}/public/app/config.js"
+    owner: www-data
+    group: www-data
+    mode: '0400'
+
+- name: Create a current link
+  ansible.builtin.file:
+    src: "{{ app_deploy_target }}"
+    dest: /var/www/{{ inventory_hostname }}/current
+    state: link

deploy/roles/mint-clone/templates/config-v1.js.j2

@@ -11,4 +11,4 @@ var RPC_SERVER="https://rpc.wikipali.org";
   |------------------------
 */
 
-var ASSETS_SERVER = "https://assets-hk.wikipali.org"
+var ASSETS_SERVER = "https://assets-{{ app_cluster_id }}.wikipali.org"

deploy/roles/mint-clone/templates/config-v1.php.j2

@@ -4,6 +4,7 @@ require_once __DIR__."/config.dir.php";
 
 #域名设置
 define("RPC_SERVER","https://rpc.wikipali.org");
+define("ASSETS_SERVER","https://assets-{{ app_cluster_id }}.wikipali.org");
 /*
 电子邮件设置
 PHPMailer
@@ -11,11 +12,11 @@ PHPMailer
 define("Email", [
 				 "Host"=>"smtp.gmail.com",//Set the SMTP server to send through
 				 "SMTPAuth"=>true,//Enable SMTP authentication
-				 "Username"=>'your@gmail.com',//SMTP username
-				 "Password"=>'your_password',//SMTP password
+				 "Username"=>'{{ app_smtp_username }}',//SMTP username
+				 "Password"=>'{{ app_smtp_password }}',//SMTP password
 				 "Port"=>465,//TCP port to connect to 465; use 587 if you have set `SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS`
-				 "From"=>"your@gmail.com",
-				 "Sender"=>"sender"
+				 "From"=>"{{ app_smtp_username }}",
+				 "Sender"=>"webmaster"
 				 ]);
 
 /*
@@ -23,12 +24,12 @@ define("Email", [
 */
 define("Database",[
 	"type"=>"pgsql",
-	"server"=>"localhost",
-	"port"=>5432,
-	"name"=>"mint",
+	"server"=>"{{ app_postgresql_host }}",
+	"port"=>{{ app_postgresql_port }},
+	"name"=>"{{ app_postgresql_name }}",
 	"sslmode" => "disable",
-	"user" => "postgres",
-	"password" => "123456"
+	"user" => "{{ app_postgresql_user }}",
+	"password" => "{{ app_postgresql_password }}"
 ]);
 
 

deploy/roles/mint-clone/templates/env-v2.j2

@@ -1,26 +1,26 @@
-BASE_DIR="/workspace/.env.global"
+BASE_DIR="{{ app_deploy_target }}/.env.global"
 CACHE_DIR="${BASE_DIR}/cache"
 TMP_DIR="${BASE_DIR}/tmp"
 
-APP_NAME={{  }}
-APP_ENV=local
-APP_KEY=
-APP_DEBUG=true
-APP_URL=http://localhost
+APP_NAME=wikipali
+APP_ENV=production
+APP_KEY="{{ app_laravel_key }}"
+APP_DEBUG=false
+APP_URL="https://{{ inventory_hostname }}"
 
 LOG_CHANNEL=stack
 LOG_DEPRECATIONS_CHANNEL=null
-LOG_LEVEL=debug
+LOG_LEVEL=info
 
-DB_CONNECTION=mysql
-DB_HOST=127.0.0.1
-DB_PORT=3306
-DB_DATABASE=mint_new
-DB_USERNAME=root
-DB_PASSWORD=
+DB_CONNECTION=postgresql
+DB_HOST={{ app_postgresql_host }}
+DB_PORT={{ app_postgresql_port }}
+DB_DATABASE={{ app_postgresql_name }}
+DB_USERNAME={{ app_postgresql_user }}
+DB_PASSWORD="{{ app_postgresql_password }}"
 
 BROADCAST_DRIVER=log
-CACHE_DRIVER=file
+CACHE_DRIVER=redis
 FILESYSTEM_DRIVER=local
 QUEUE_CONNECTION=sync
 SESSION_DRIVER=file
@@ -28,18 +28,18 @@ SESSION_LIFETIME=120
 
 MEMCACHED_HOST=127.0.0.1
 
-REDIS_HOST=127.0.0.1
+REDIS_HOST={{ app_redis_host }}
 REDIS_PASSWORD=null
 REDIS_PORT=6379
 
 MAIL_MAILER=smtp
-MAIL_HOST=mailhog
-MAIL_PORT=1025
-MAIL_USERNAME=null
-MAIL_PASSWORD=null
-MAIL_ENCRYPTION=null
-MAIL_FROM_ADDRESS=null
-MAIL_FROM_NAME="${APP_NAME}"
+MAIL_HOST=smtp.gmail.com
+MAIL_PORT=465
+MAIL_USERNAME={{ app_smtp_username }}
+MAIL_PASSWORD="{{ app_smtp_password }}"
+MAIL_ENCRYPTION=ssl
+MAIL_FROM_ADDRESS={{ app_smtp_username }}
+MAIL_FROM_NAME="webmaster"
 
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
@@ -56,3 +56,4 @@ MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
 
 ASSETS_SERVER="https://assets-{{ app_cluster_id }}.wikipali.org"
+RPC_SERVER="https://rpc.wikipali.org"

deploy/roles/mint-www/tasks/main.yml

@@ -1,8 +1,8 @@
 - name: upload nginx.conf
-  bacame: true
+  become: true
   ansible.builtin.template:
     src: nginx.conf.j2
-    dest: "/etc/nginx/sites-enabled/{{ inventory_hostname }}"
+    dest: "/etc/nginx/sites-enabled/{{ inventory_hostname }}.conf"
     owner: www-data
     group: www-data
     mode: '0400'

deploy/roles/mint-www/templates/nginx.conf.j2

@@ -1,33 +1,43 @@
+# https://laravel.com/docs/8.x/deployment#nginx
+
 server {
     listen 80;
+    listen [::]:80;
+
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
 
     gzip on;
     server_name {{ inventory_hostname }};
-    root {{ app_www_deploy_target }};
+    root {{ app_deploy_target }}/public;
     client_max_body_size 16M;
+    index index.php;
+    charset utf-8;
 
-    access_log off;
+    access_log /var/log/nginx/{{ inventory_hostname }}.access.log;
     error_log /var/log/nginx/{{ inventory_hostname }}.error.log warn;
 
     location / {
-        index index.html index.php;
+        try_files $uri $uri/ /index.php?$query_string;
     }
 
-    location ~ /.git/ {
-        deny all;
+    location = /favicon.ico {
+        log_not_found off;
+    }
+    location = /robots.txt  {
+        log_not_found off;
     }
 
-    location ~ \.php$ {
-        try_files $fastcgi_script_name =404;
+    error_page 404 /index.php;
 
+    location ~ \.php$ {
+        fastcgi_pass unix:/var/run/php/php{{ app_php_version }}-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
         include fastcgi_params;
+    }
 
-        fastcgi_pass			unix:/run/php/php{{ app_php_version }}-fpm.sock;
-        fastcgi_index			index.php;
-        fastcgi_buffers			8 16k;
-        fastcgi_buffer_size		32k;
-
-        fastcgi_param DOCUMENT_ROOT     $realpath_root;
-        fastcgi_param SCRIPT_FILENAME   $realpath_root$fastcgi_script_name;
+    location ~ /\.(?!well-known).* {
+        deny all;
     }
+
 }

deploy/roles/os/tasks/init.yml

@@ -1,10 +1,3 @@
-- name: create deploy folder
-  become: true
-  ansible.builtin.file:
-    path: "{{ app_deploy_target }}"
-    state: directory
-    owner: "{{ ansible_user }}"
-
 - name: create downloads folder
   become: true
   ansible.builtin.file:

deploy/roles/os/tasks/main.yml

@@ -1,8 +1,8 @@
-- include: init.yml
-- include: sshd.yml
-- include: ulimits.yml
+- import_tasks: init.yml
+- import_tasks: sshd.yml
+- import_tasks: ulimits.yml
 
-- name: Setup sudo without password 
+- name: Setup sudo without password
   become: true
   ansible.builtin.template:
     src: sudo.conf.j2
@@ -25,7 +25,7 @@
   become: true
   shell: timedatectl set-timezone UTC
 
-- name: Setup journald storage 
+- name: Setup journald storage
   become: true
   lineinfile:
     path: /etc/systemd/journald.conf

deploy/roles/os/tasks/ulimits.yml

@@ -56,17 +56,17 @@
     path: /etc/security/limits.conf
     line: root        soft nofile 10240
 
-- name: Set user level ppen file limits for {{ansible_user}}
+- name: Set user level open file limits for {{ ansible_user }}
   become: true
   lineinfile:
     path: /etc/security/limits.conf
-    line: "{{ansible_user}}        soft nofile 10240"
+    line: "{{ ansible_user }}        soft nofile 10240"
 
 # https://docs.oracle.com/en/database/oracle/oracle-database/12.2/ladbi/changing-kernel-parameter-values.html#GUID-FB0CC366-61C9-4AA2-9BE7-233EB6810A31
 - name: Setup file max
   become: true
   lineinfile:
-    path: "/etc/sysctl.d/100-{{app_vendor}}.conf"
+    path: "/etc/sysctl.d/100-fs.conf"
     state: present
     line: fs.file-max = 6815744
     create: true
@@ -74,7 +74,7 @@
 - name: Setup file max
   become: true
   lineinfile:
-    path: "/etc/sysctl.d/100-{{app_vendor}}.conf"
+    path: "/etc/sysctl.d/100-fs.conf"
     state: present
     line: fs.inotify.max_user_watches = 512000
     create: true

deploy/roles/php/tasks/main.yml

@@ -24,14 +24,17 @@
       - php{{ app_php_version }}-redis
       - php{{ app_php_version }}-bcmath
 
+- name: Creates composer install directory
+  file:
+    path: "{{ ansible_env.HOME }}/.local/bin"
+    state: directory
+
 # https://getcomposer.org/doc/00-intro.md#installation-linux-unix-macos
 - name: Download composer
   get_url:
     url: https://getcomposer.org/download/latest-stable/composer.phar
     dest: "{{ ansible_env.HOME }}/.local/bin/composer"
     mode: 0755
-  args:
-    creates: "{{ ansible_env.HOME }}/.local/bin/composer"
 
 - name: Restart php-fpm
   become: true

deploy/roles/ubuntu/tasks/main.yml

@@ -79,6 +79,7 @@
       - unzip
       - nginx
       - certbot
+      - python3-certbot-nginx
       - openvpn
       - snmpd
       - systemd-cron
@@ -90,12 +91,15 @@
       - python3-pip
       - python3-distutils
       - python3-dev
+      - nodejs
+      - npm
+      - yarnpkg
       - libssl-dev
       - libpq-dev
       - libmysqlclient-dev
 
 
-- include: locales.yml
+- import_tasks: locales.yml
 
 - name: Set default editor to vim
   become: true
@@ -109,7 +113,7 @@
   become: true
   shell: git config --global pull.rebase false
 
-- include: zsh.yml
+- import_tasks: zsh.yml
 
 # ---------------------------------------------------
 
@@ -118,7 +122,7 @@
     path: /etc/friendlyelec-release
   register: app_os_friendlyelec
 
-- include: friendly-core.yml
+- import_tasks: friendly-core.yml
   when: app_os_friendlyelec.stat.islnk is defined and app_os_friendlyelec.stat.isreg
 
 - name: check if armbian
@@ -126,13 +130,13 @@
     path: /etc/armbian-release
   register: app_os_armbian
 
-- include: armbian.yml
+- import_tasks: armbian.yml
   when: app_os_armbian.stat.islnk is defined and app_os_armbian.stat.isreg
 
-- include: raspbian.yml
+- import_tasks: raspbian.yml
   when: ansible_distribution == 'Raspbian'
 
-- include: pi.yml
+- import_tasks: pi.yml
   when: ansible_distribution == 'Raspbian' or (app_os_armbian.stat.islnk is defined and app_os_armbian.stat.isreg) or (app_os_friendlyelec.stat.islnk is defined and app_os_friendlyelec.stat.isreg)
 
 # ---------------------------------------------------
@@ -147,16 +151,10 @@
 - name: enable cron service
   become: true
   ansible.builtin.systemd:
-    name: cron-target
+    name: cron
     enabled: yes
     masked: no
 
-- name: enable certbot sync
-  ansible.builtin.cron:
-    name: "renew certbot"
-    special_time: monthly
-    job: "/usr/bin/certbot renew --force-renewal"
-
 - name: enable ssh service
   become: true
   ansible.builtin.systemd:
@@ -172,4 +170,4 @@
     masked: no
 
 
-- include: clean.yml
+- import_tasks: clean.yml

deploy/roles/ubuntu/tasks/zsh.yml

@@ -21,6 +21,11 @@
     remote_src: true
     mode: 0600
 
+- name: Enable $HOME/.local
+  ansible.builtin.lineinfile:
+    path: "{{ansible_env.HOME}}/.zshrc"
+    line: 'export PATH=$HOME/.local/bin:$PATH'
+
 - name: Use zsh
   become: true
   shell: chsh -s /bin/zsh {{ansible_user}}

deploy/scripts/assets.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -e
+
+# rclone copy --drive-shared-with-me $1:assets assets
+
+export WORKSPACE=$PWD
+
+function build_book(){
+    local target=$WORKSPACE/tmp/$1/$2
+    local dist=$WORKSPACE/roles/mint-assets/files/public/$1/$2
+    if [ ! -d $target ]
+    then
+        git clone -b $2 "https://github.com/iapt-platform/$1.git" $target
+    fi
+    cd $target
+    git pull
+    if [ -d $dist ]
+    then
+        rm -r $dist
+    fi
+    mkdir -p $dist
+    $HOME/.local/bin/mdbook build --dest-dir $dist
+}
+
+declare -a languages=(
+    "zh-Hans"
+)
+
+declare -a books=(
+    "pali-handbook"
+    "help"
+)
+
+for b in "${books[@]}"
+do
+    for l in "${languages[@]}"
+    do
+        build_book $b $l
+    done
+done
+
+echo 'done.'
+exit 0

deploy/staging/hosts

@@ -14,4 +14,10 @@
 app_vendor="iapt-platform.mint"
 ; openssl rand -base64 32
 app_secret_key="4i3WKUvKtSGl59htK7XjUNsjalhkG5s7RJCmZruT2m4="
+; php artisan key:generate --show
+app_laravel_key="base64:IQD4vkmAN1oEsc8rVu1nRadQWPUX/LH/jaSbyFbmf/w="
+app_postgresql_host="db-hk-1.wikipali.org"
+app_postgresql_port=5433
+app_postgresql_password=change-me
+app_redis_host="ch-hk-1.wikipali.org"