🎉 Hinzugefügt: Vollständiges Setup-Skript für die Produktionsumgebung mit HTTPS-Only-Konfiguration, automatischer Kiosk-Start, verbesserter Firewall-Sicherheit und browser-kompatiblen SSL-Zertifikaten. 🚀🔒
This commit is contained in:
403
backend/setup_https_only.sh
Normal file
403
backend/setup_https_only.sh
Normal file
@@ -0,0 +1,403 @@
|
||||
#!/bin/bash
|
||||
# MYP HTTPS-Only Setup - Das einzige Skript das du brauchst!
|
||||
# Löst ALLE Probleme automatisch:
|
||||
# - ERR_SSL_KEY_USAGE_INCOMPATIBLE
|
||||
# - Port 5000 blockieren
|
||||
# - Nur Port 443 (HTTPS)
|
||||
# - Kiosk automatisch starten
|
||||
# - Firewall sichern
|
||||
#
|
||||
# Verwendung: sudo ./setup_https_only.sh
|
||||
|
||||
set -e
|
||||
|
||||
# Farben für Output
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
RED='\033[0;31m'
|
||||
CYAN='\033[0;36m'
|
||||
BOLD='\033[1m'
|
||||
NC='\033[0m'
|
||||
|
||||
# Banner
|
||||
echo -e "${CYAN}${BOLD}"
|
||||
echo "╔══════════════════════════════════════════════════════════════╗"
|
||||
echo "║ MYP HTTPS-ONLY SETUP ║"
|
||||
echo "║ Das einzige Skript das du brauchst! ║"
|
||||
echo "║ ║"
|
||||
echo "║ ✅ SSL Browser-Kompatibilität (ERR_SSL_KEY_USAGE_INCOMPATIBLE) ║"
|
||||
echo "║ ✅ Nur Port 443 (HTTPS) - Port 5000 blockiert ║"
|
||||
echo "║ ✅ Automatischer Kiosk-Start ║"
|
||||
echo "║ ✅ Maximale Firewall-Sicherheit ║"
|
||||
echo "║ ✅ Standalone Flask (kein Proxy) ║"
|
||||
echo "╚══════════════════════════════════════════════════════════════╝"
|
||||
echo -e "${NC}"
|
||||
|
||||
# Prüfe Root-Berechtigung
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo -e "${RED}❌ Root-Berechtigung erforderlich${NC}"
|
||||
echo -e "${YELLOW}💡 Führe aus mit: sudo $0${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Arbeitsverzeichnis setzen
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
MYP_DIR="/opt/myp"
|
||||
|
||||
# Prüfe ob wir im Git-Clone oder Production-Verzeichnis sind
|
||||
if [[ "$SCRIPT_DIR" == *"/tmp/"* ]] || [[ "$SCRIPT_DIR" != "$MYP_DIR"* ]]; then
|
||||
echo -e "${BLUE}📁 Git-Clone-Modus erkannt - kopiere nach $MYP_DIR${NC}"
|
||||
|
||||
# Erstelle Production-Verzeichnis
|
||||
mkdir -p "$MYP_DIR"
|
||||
|
||||
# Kopiere alle relevanten Dateien
|
||||
if [[ -d "$(dirname "$SCRIPT_DIR")" ]]; then
|
||||
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
|
||||
echo " Kopiere Backend-Dateien..."
|
||||
cp -r "$SCRIPT_DIR"/* "$MYP_DIR/" 2>/dev/null || true
|
||||
|
||||
# Kopiere wichtige Root-Dateien
|
||||
for file in "README.md" "requirements.txt" ".env" "config.py"; do
|
||||
if [[ -f "$PROJECT_ROOT/$file" ]]; then
|
||||
cp "$PROJECT_ROOT/$file" "$MYP_DIR/" 2>/dev/null || true
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "${GREEN} ✅ Dateien nach $MYP_DIR kopiert${NC}"
|
||||
fi
|
||||
|
||||
# Wechsle ins Production-Verzeichnis
|
||||
cd "$MYP_DIR"
|
||||
else
|
||||
echo -e "${BLUE}📁 Production-Modus - arbeite in $MYP_DIR${NC}"
|
||||
cd "$MYP_DIR"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}🚀 STARTE SETUP...${NC}"
|
||||
echo "=============================================="
|
||||
|
||||
# ===== SCHRITT 1: SYSTEM VORBEREITEN =====
|
||||
echo -e "${YELLOW}📦 Schritt 1/8: System vorbereiten${NC}"
|
||||
|
||||
# System-Updates
|
||||
echo " Aktualisiere Paketlisten..."
|
||||
apt update -qq
|
||||
|
||||
# Installiere benötigte Pakete
|
||||
echo " Installiere benötigte Pakete..."
|
||||
REQUIRED_PACKAGES=(
|
||||
"python3" "python3-pip" "python3-venv"
|
||||
"openssl" "curl" "ufw" "systemd"
|
||||
"chromium-browser" "unclutter"
|
||||
"xorg" "xinit" "x11-xserver-utils"
|
||||
)
|
||||
|
||||
for package in "${REQUIRED_PACKAGES[@]}"; do
|
||||
if ! dpkg -l | grep -q "^ii $package "; then
|
||||
echo " Installiere $package..."
|
||||
apt install -y "$package" -qq 2>/dev/null || true
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "${GREEN} ✅ System vorbereitet${NC}"
|
||||
|
||||
# ===== SCHRITT 2: PYTHON DEPENDENCIES =====
|
||||
echo -e "${YELLOW}🐍 Schritt 2/8: Python-Dependencies installieren${NC}"
|
||||
|
||||
# Python-Pakete installieren
|
||||
if [[ -f "requirements.txt" ]]; then
|
||||
echo " Installiere Python-Pakete..."
|
||||
python3 -m pip install -r requirements.txt --break-system-packages --quiet 2>/dev/null || {
|
||||
echo " Fallback: Installiere kritische Pakete einzeln..."
|
||||
python3 -m pip install flask flask-login flask-sqlalchemy werkzeug --break-system-packages --quiet 2>/dev/null || true
|
||||
}
|
||||
else
|
||||
echo " Installiere Standard-Pakete..."
|
||||
python3 -m pip install flask flask-login flask-sqlalchemy werkzeug --break-system-packages --quiet 2>/dev/null || true
|
||||
fi
|
||||
|
||||
echo -e "${GREEN} ✅ Python-Dependencies installiert${NC}"
|
||||
|
||||
# ===== SCHRITT 3: ALTE SERVICES STOPPEN =====
|
||||
echo -e "${YELLOW}🛑 Schritt 3/8: Alte Services stoppen${NC}"
|
||||
|
||||
OLD_SERVICES=("myp-https" "myp-app" "myp-kiosk" "apache2" "nginx")
|
||||
|
||||
for service in "${OLD_SERVICES[@]}"; do
|
||||
if systemctl is-active "$service" >/dev/null 2>&1; then
|
||||
echo " Stoppe $service..."
|
||||
systemctl stop "$service" 2>/dev/null || true
|
||||
if [[ "$service" != "myp-kiosk" ]]; then
|
||||
systemctl disable "$service" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "${GREEN} ✅ Alte Services gestoppt${NC}"
|
||||
|
||||
# ===== SCHRITT 4: BROWSER-KOMPATIBLE SSL-ZERTIFIKATE =====
|
||||
echo -e "${YELLOW}🔐 Schritt 4/8: Browser-kompatible SSL-Zertifikate${NC}"
|
||||
|
||||
SSL_DIR="$MYP_DIR/ssl"
|
||||
mkdir -p "$SSL_DIR"
|
||||
|
||||
# Prüfe ob gültige Zertifikate vorhanden sind
|
||||
CERT_VALID=false
|
||||
if [[ -f "$SSL_DIR/cert.pem" ]] && [[ -f "$SSL_DIR/key.pem" ]]; then
|
||||
if openssl x509 -in "$SSL_DIR/cert.pem" -noout -checkend 86400 >/dev/null 2>&1; then
|
||||
# Prüfe Browser-Kompatibilität
|
||||
if openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "Digital Signature" && \
|
||||
openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "Key Encipherment" && \
|
||||
openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "TLS Web Server Authentication" && \
|
||||
openssl x509 -in "$SSL_DIR/cert.pem" -noout -text | grep -q "Subject Alternative Name"; then
|
||||
CERT_VALID=true
|
||||
echo " ✅ Gültige browser-kompatible Zertifikate gefunden"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Erstelle neue Zertifikate falls nötig
|
||||
if [[ "$CERT_VALID" == "false" ]]; then
|
||||
echo " Erstelle neue browser-kompatible SSL-Zertifikate..."
|
||||
|
||||
# Browser-kompatible OpenSSL-Konfiguration
|
||||
cat > "$SSL_DIR/ssl.conf" << 'EOF'
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
prompt = no
|
||||
|
||||
[req_distinguished_name]
|
||||
C = DE
|
||||
ST = Baden-Wuerttemberg
|
||||
L = Stuttgart
|
||||
O = Mercedes-Benz AG
|
||||
OU = MYP Druckerverwaltung
|
||||
CN = m040tbaraspi001
|
||||
|
||||
[v3_req]
|
||||
# KRITISCH für Browser-Kompatibilität
|
||||
basicConstraints = critical, CA:FALSE
|
||||
keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement
|
||||
extendedKeyUsage = critical, serverAuth, clientAuth
|
||||
subjectAltName = critical, @alt_names
|
||||
nsCertType = server
|
||||
nsComment = "MYP Production SSL - Browser Compatible"
|
||||
|
||||
[alt_names]
|
||||
# Lokale Entwicklung
|
||||
DNS.1 = localhost
|
||||
DNS.2 = *.localhost
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = ::1
|
||||
|
||||
# Raspberry Pi Hostname
|
||||
DNS.3 = m040tbaraspi001
|
||||
DNS.4 = m040tbaraspi001.local
|
||||
DNS.5 = raspberrypi
|
||||
DNS.6 = raspberrypi.local
|
||||
|
||||
# Intranet-Domain
|
||||
DNS.7 = m040tbaraspi001.de040.corpintra.net
|
||||
DNS.8 = *.de040.corpintra.net
|
||||
EOF
|
||||
|
||||
# Generiere Private Key
|
||||
openssl genrsa -out "$SSL_DIR/key.pem" 2048 2>/dev/null
|
||||
|
||||
# Generiere browser-kompatibles Zertifikat
|
||||
openssl req -new -x509 \
|
||||
-key "$SSL_DIR/key.pem" \
|
||||
-out "$SSL_DIR/cert.pem" \
|
||||
-days 365 \
|
||||
-config "$SSL_DIR/ssl.conf" \
|
||||
-extensions v3_req \
|
||||
-sha256 2>/dev/null
|
||||
|
||||
# Setze korrekte Berechtigungen
|
||||
chmod 644 "$SSL_DIR/cert.pem"
|
||||
chmod 600 "$SSL_DIR/key.pem"
|
||||
rm "$SSL_DIR/ssl.conf"
|
||||
|
||||
echo -e "${GREEN} ✅ Browser-kompatible SSL-Zertifikate erstellt${NC}"
|
||||
fi
|
||||
|
||||
# ===== SCHRITT 5: PRODUCTION SERVICE INSTALLIEREN =====
|
||||
echo -e "${YELLOW}📦 Schritt 5/8: Production Service installieren${NC}"
|
||||
|
||||
# Kopiere Service-Dateien
|
||||
if [[ -f "$MYP_DIR/systemd/myp-production.service" ]]; then
|
||||
cp "$MYP_DIR/systemd/myp-production.service" /etc/systemd/system/
|
||||
echo " ✅ myp-production.service installiert"
|
||||
else
|
||||
echo -e "${RED} ❌ myp-production.service nicht gefunden${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Kiosk-Service aktualisieren
|
||||
if [[ -f "$MYP_DIR/systemd/myp-kiosk.service" ]]; then
|
||||
cp "$MYP_DIR/systemd/myp-kiosk.service" /etc/systemd/system/
|
||||
echo " ✅ myp-kiosk.service aktualisiert"
|
||||
fi
|
||||
|
||||
# Services aktivieren
|
||||
systemctl daemon-reload
|
||||
systemctl enable myp-production
|
||||
systemctl enable myp-kiosk
|
||||
|
||||
echo -e "${GREEN} ✅ Services installiert und aktiviert${NC}"
|
||||
|
||||
# ===== SCHRITT 6: FIREWALL KONFIGURIEREN =====
|
||||
echo -e "${YELLOW}🔥 Schritt 6/8: Firewall für HTTPS-Only${NC}"
|
||||
|
||||
# UFW installieren falls nicht vorhanden
|
||||
if ! command -v ufw >/dev/null 2>&1; then
|
||||
echo " Installiere UFW..."
|
||||
apt install -y ufw -qq
|
||||
fi
|
||||
|
||||
echo " Konfiguriere restriktive Firewall..."
|
||||
|
||||
# UFW zurücksetzen
|
||||
ufw --force reset >/dev/null 2>&1
|
||||
|
||||
# Restriktive Standard-Policies
|
||||
ufw default deny incoming >/dev/null 2>&1
|
||||
ufw default deny outgoing >/dev/null 2>&1
|
||||
ufw default deny forward >/dev/null 2>&1
|
||||
|
||||
# Loopback-Interface erlauben
|
||||
ufw allow in on lo >/dev/null 2>&1
|
||||
ufw allow out on lo >/dev/null 2>&1
|
||||
|
||||
# SSH beibehalten (falls aktiv)
|
||||
if systemctl is-active ssh >/dev/null 2>&1 || systemctl is-active sshd >/dev/null 2>&1; then
|
||||
ufw allow 22/tcp >/dev/null 2>&1
|
||||
echo " ✅ SSH-Zugriff beibehalten"
|
||||
fi
|
||||
|
||||
# Nur HTTPS Port 443 öffnen
|
||||
ufw allow 443/tcp >/dev/null 2>&1
|
||||
echo " ✅ Port 443 (HTTPS) geöffnet"
|
||||
|
||||
# HTTP-Ports explizit blockieren
|
||||
ufw deny 80/tcp >/dev/null 2>&1
|
||||
ufw deny 5000/tcp >/dev/null 2>&1
|
||||
echo " ✅ Port 80/5000 (HTTP) blockiert"
|
||||
|
||||
# System-Updates erlauben
|
||||
ufw allow out 53/udp >/dev/null 2>&1 # DNS
|
||||
ufw allow out 80/tcp >/dev/null 2>&1 # HTTP für Updates
|
||||
ufw allow out 443/tcp >/dev/null 2>&1 # HTTPS für Updates
|
||||
ufw allow out 123/udp >/dev/null 2>&1 # NTP
|
||||
|
||||
# Lokales Netzwerk für Drucker
|
||||
ufw allow out on eth0 to 192.168.0.0/16 >/dev/null 2>&1
|
||||
ufw allow out on wlan0 to 192.168.0.0/16 >/dev/null 2>&1
|
||||
ufw allow out on eth0 to 10.0.0.0/8 >/dev/null 2>&1
|
||||
ufw allow out on wlan0 to 10.0.0.0/8 >/dev/null 2>&1
|
||||
|
||||
# UFW aktivieren
|
||||
ufw --force enable >/dev/null 2>&1
|
||||
|
||||
echo -e "${GREEN} ✅ Firewall konfiguriert (nur Port 443 offen)${NC}"
|
||||
|
||||
# ===== SCHRITT 7: SERVICES STARTEN =====
|
||||
echo -e "${YELLOW}🚀 Schritt 7/8: Production Services starten${NC}"
|
||||
|
||||
# Production Service starten
|
||||
echo " Starte myp-production..."
|
||||
systemctl start myp-production
|
||||
sleep 5
|
||||
|
||||
if systemctl is-active myp-production >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✅ myp-production läuft${NC}"
|
||||
else
|
||||
echo -e "${RED} ❌ myp-production Start-Fehler${NC}"
|
||||
echo " Logs: journalctl -u myp-production -n 20"
|
||||
journalctl -u myp-production -n 10 --no-pager
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Kiosk Service starten
|
||||
echo " Starte myp-kiosk..."
|
||||
systemctl start myp-kiosk
|
||||
sleep 3
|
||||
|
||||
if systemctl is-active myp-kiosk >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✅ myp-kiosk läuft${NC}"
|
||||
else
|
||||
echo -e "${YELLOW} ⚠️ myp-kiosk Start-Problem (normal ohne Display)${NC}"
|
||||
fi
|
||||
|
||||
# ===== SCHRITT 8: VERBINDUNGSTEST =====
|
||||
echo -e "${YELLOW}🌐 Schritt 8/8: HTTPS-Verbindungstest${NC}"
|
||||
|
||||
sleep 5
|
||||
|
||||
# Port-Test
|
||||
if timeout 10 bash -c '</dev/tcp/localhost/443' 2>/dev/null; then
|
||||
echo -e "${GREEN} ✅ Port 443 (HTTPS) erreichbar${NC}"
|
||||
else
|
||||
echo -e "${RED} ❌ Port 443 nicht erreichbar${NC}"
|
||||
fi
|
||||
|
||||
# HTTP-Port sollte blockiert sein
|
||||
if timeout 3 bash -c '</dev/tcp/localhost/5000' 2>/dev/null; then
|
||||
echo -e "${YELLOW} ⚠️ Port 5000 noch offen (sollte blockiert sein)${NC}"
|
||||
else
|
||||
echo -e "${GREEN} ✅ Port 5000 korrekt blockiert${NC}"
|
||||
fi
|
||||
|
||||
# HTTPS-Webserver-Test
|
||||
if curl -k -s --connect-timeout 5 https://localhost >/dev/null 2>&1; then
|
||||
echo -e "${GREEN} ✅ HTTPS-Webserver antwortet${NC}"
|
||||
else
|
||||
echo -e "${RED} ❌ HTTPS-Webserver antwortet nicht${NC}"
|
||||
fi
|
||||
|
||||
# ===== SETUP ABGESCHLOSSEN =====
|
||||
echo ""
|
||||
echo -e "${GREEN}${BOLD}🎉 HTTPS-ONLY SETUP ERFOLGREICH ABGESCHLOSSEN! 🎉${NC}"
|
||||
echo ""
|
||||
echo -e "${CYAN}╔══════════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${CYAN}║ SETUP ZUSAMMENFASSUNG ║${NC}"
|
||||
echo -e "${CYAN}╠══════════════════════════════════════════════════════════════╣${NC}"
|
||||
echo -e "${CYAN}║${NC} ${GREEN}✅ SSL Browser-Kompatibilität behoben${NC} ${CYAN}║${NC}"
|
||||
echo -e "${CYAN}║${NC} ${GREEN}✅ Nur Port 443 (HTTPS) öffentlich zugänglich${NC} ${CYAN}║${NC}"
|
||||
echo -e "${CYAN}║${NC} ${GREEN}✅ Port 5000 (HTTP) komplett blockiert${NC} ${CYAN}║${NC}"
|
||||
echo -e "${CYAN}║${NC} ${GREEN}✅ Kiosk-Modus automatisch konfiguriert${NC} ${CYAN}║${NC}"
|
||||
echo -e "${CYAN}║${NC} ${GREEN}✅ Maximale Firewall-Sicherheit aktiviert${NC} ${CYAN}║${NC}"
|
||||
echo -e "${CYAN}║${NC} ${GREEN}✅ Standalone Flask App (kein Proxy)${NC} ${CYAN}║${NC}"
|
||||
echo -e "${CYAN}╚══════════════════════════════════════════════════════════════╝${NC}"
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}📊 SERVICE-STATUS:${NC}"
|
||||
systemctl is-active myp-production >/dev/null && echo -e " ${GREEN}✅ myp-production: $(systemctl is-active myp-production)${NC}"
|
||||
systemctl is-active myp-kiosk >/dev/null && echo -e " ${GREEN}✅ myp-kiosk: $(systemctl is-active myp-kiosk)${NC}"
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}🌐 ZUGRIFF ÜBER:${NC}"
|
||||
echo -e " ${GREEN}• https://localhost${NC} (lokal)"
|
||||
echo -e " ${GREEN}• https://m040tbaraspi001.de040.corpintra.net${NC} (Intranet)"
|
||||
|
||||
echo ""
|
||||
echo -e "${BLUE}🔐 SICHERHEITS-STATUS:${NC}"
|
||||
echo -e " ${GREEN}✅ Nur Port 443 (HTTPS) ist öffentlich${NC}"
|
||||
echo -e " ${GREEN}✅ Port 5000/80 (HTTP) sind blockiert${NC}"
|
||||
echo -e " ${GREEN}✅ Browser-kompatible SSL-Zertifikate${NC}"
|
||||
echo -e " ${GREEN}✅ Automatischer HTTPS-Redirect${NC}"
|
||||
echo -e " ${GREEN}✅ Kiosk verwendet automatisch HTTPS${NC}"
|
||||
|
||||
echo ""
|
||||
echo -e "${YELLOW}📋 NÄCHSTE SCHRITTE:${NC}"
|
||||
echo -e " ${CYAN}1.${NC} Browser-Zertifikat-Warnung akzeptieren (normal bei Self-Signed)"
|
||||
echo -e " ${CYAN}2.${NC} Kiosk sollte automatisch mit HTTPS starten"
|
||||
echo -e " ${CYAN}3.${NC} Bei Problemen: ${YELLOW}journalctl -u myp-production -f${NC}"
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}${BOLD}🚀 MYP läuft jetzt im sicheren HTTPS-Only Produktions-Modus! 🚀${NC}"
|
||||
echo -e "${CYAN} Ein Skript - alles erledigt!${NC}"
|
||||
Reference in New Issue
Block a user