forked from e-m-b-a/embark
-
Notifications
You must be signed in to change notification settings - Fork 0
/
run-server.sh
executable file
·253 lines (216 loc) · 7.65 KB
/
run-server.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
#!/bin/bash
# EMBArk - The firmware security scanning environment
#
# Copyright 2020-2024 Siemens Energy AG
# Copyright 2020-2022 Siemens AG
#
# EMBArk comes with ABSOLUTELY NO WARRANTY.
#
# EMBArk is licensed under MIT
#
# Author(s): Benedikt Kuehne
# Description: Starts the EMBArk on host
export GREEN='\033[0;32m'
export RED='\033[0;31m'
export ORANGE='\033[0;33m'
export BLUE='\033[0;34m'
export BOLD='\033[1m'
export NC='\033[0m'
export HELP_DIR='helper'
export DJANGO_SETTINGS_MODULE=embark.settings.deploy
export HTTP_PORT=80
export HTTPS_PORT=443
export BIND_IP='0.0.0.0'
export FILE_SIZE=2000000000
export SERVER_ALIAS=()
export WSGI_FLAGS=()
STRICT_MODE=0
import_helper()
{
local HELPERS=()
local HELPER_COUNT=0
local HELPER_FILE=""
mapfile -d '' HELPERS < <(find "${HELP_DIR}" -iname "helper_embark_*.sh" -print0 2> /dev/null)
for HELPER_FILE in "${HELPERS[@]}" ; do
if ( file "${HELPER_FILE}" | grep -q "shell script" ) && ! [[ "${HELPER_FILE}" =~ \ |\' ]] ; then
# https://github.com/koalaman/shellcheck/wiki/SC1090
# shellcheck source=/dev/null
source "${HELPER_FILE}"
(( HELPER_COUNT+=1 ))
fi
done
echo -e "\\n""==> ""${GREEN}""Imported ""${HELPER_COUNT}"" necessary files""${NC}\\n"
}
cleaner() {
pkill -u root daphne
pkill -u root "${PWD}"/emba/emba
pkill -u root runapscheduler
fuser -k "${HTTP_PORT}"/tcp
fuser -k "${HTTPS_PORT}"/tcp
fuser -k 8000/tcp
fuser -k 8001/tcp
docker container stop embark_db
docker container stop embark_redis
# docker network rm embark_backend
# docker container prune -f --filter "label=flag"
systemctl stop embark.service
exit 1
}
# main
echo -e "\\n${ORANGE}""${BOLD}""EMBArk Startup""${NC}\\n""${BOLD}=================================================================${NC}"
while getopts "ha:" OPT ; do
case ${OPT} in
h)
echo -e "\\n""${CYAN}""USAGE""${NC}"
echo -e "${CYAN}-h${NC} Print this help message"
echo -e "${CYAN}-a <IP/Name>${NC} Add a server Domain-name alias"
echo -e "---------------------------------------------------------------------------"
if ip addr show eth0 &>/dev/null ; then
IP=$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)
echo -e "${GREEN} Suggestion:${NC} sudo ./run-server.sh -a ${IP}"
echo -e "${GREEN} nslookup helper:${NC}"
nslookup "${IP}"
fi
exit 0
;;
a)
SERVER_ALIAS+=("${OPTARG}")
WSGI_FLAGS+=(--server-alias "${OPTARG}")
;;
:)
echo -e "${CYAN} Usage: [-a <IP/HOSTNAME>] ${NC}"
exit 1
;;
*)
echo -e "\\n${ORANGE}""${BOLD}""No Alias set""${NC}\\n"
;;
esac
done
# Alias
if [[ ${#SERVER_ALIAS[@]} -ne 0 ]]; then
echo -e "${GREEN} Server-alias:${NC}"
for VAR in "${SERVER_ALIAS[@]}"; do
echo "[*] ${VAR}"
done
fi
EMBARK_BASEDIR="$(dirname "${0}")"
cd "${EMBARK_BASEDIR}" || exit 1
import_helper
enable_strict_mode "${STRICT_MODE}"
set -a
trap cleaner INT
if ! [[ ${EUID} -eq 0 ]] ; then
echo -e "\\n${RED}""Run Server script with root permissions!""${NC}\\n"
exit 1
fi
# check emba
echo -e "${BLUE}""${BOLD}""checking EMBA""${NC}"
if ! [[ -d ./emba ]]; then
echo -e "${RED}""${BOLD}""You are using the wrong installation and missing the EMBA subdirectory""${NC}"
fi
if ! (cd "${PWD}"/emba && ./emba -d 1); then
echo -e "${RED}""EMBA is not configured correctly""${NC}"
exit 1
fi
# check venv
if ! [[ -d /var/www/.venv ]]; then
echo -e "${RED}""${BOLD}""Pip-enviroment not found!""${NC}"
exit 1
fi
if ! nc -zw1 pypi.org 443 &>/dev/null ; then
(cd /var/www && pipenv check && pipenv verify)
fi
# check db and start container
check_db
# update cves
if [[ -d ./emba/external/nvd-json-data-feeds ]]; then
(cd ./emba/external/nvd-json-data-feeds && git pull)
fi
# sync emba
rsync -r -u --progress --chown=www-embark:sudo ./emba/ /var/www/emba/
chown -R www-embark /var/www/emba/
# logs
if ! [[ -d ./docker_logs ]]; then
mkdir docker_logs
fi
# container-logs (2 jobs)
echo -e "\n[""${BLUE} JOB""${NC}""] Redis logs are copied to ./docker_logs/redis.log"
docker container logs embark_redis -f &> ./docker_logs/redis.log &
echo -e "\n[""${BLUE} JOB""${NC}""] DB logs are copied to ./embark/logs/mysql.log"
docker container logs embark_db -f &> ./docker_logs/mysql.log &
# start the supervisor
systemctl enable embark.service
systemctl start embark.service
# copy django server
rsync -r -u --progress --chown=www-embark:sudo ./embark/ /var/www/embark/
# config apache
# add all modules we want (mod_ssl mod_auth_basic etc)
# post_max_size increase
if ! [[ -d /var/www/conf ]]; then
mkdir /var/www/conf
fi
{
echo -e ''
} > /var/www/conf/embark.conf
# certs
if ! [[ -d /var/www/conf/cert ]]; then
mkdir /var/www/conf/cert
fi
copy_file "${PWD}"/cert/embark.local.crt /var/www/conf/cert
copy_file "${PWD}"/cert/embark.local.key /var/www/conf/cert
copy_file "${PWD}"/cert/embark-ws.local.key /var/www/conf/cert
copy_file "${PWD}"/cert/embark-ws.local.crt /var/www/conf/cert
# cp .env
copy_file ./.env /var/www/embark/embark/settings/
# !DIRECTORY-CHANGE!
cd /var/www/embark/ || exit 1
# start venv (ignore source in script)
# shellcheck disable=SC1091
source /var/www/.venv/bin/activate || exit 1
export PIPENV_VERBOSITY=-1
# logs
if ! [[ -d /var/www/logs ]]; then
mkdir /var/www/logs
fi
# db_init
echo -e "\n[""${BLUE} JOB""${NC}""] Starting migrations - log to embark/logs/migration.log"
pipenv run ./manage.py makemigrations | tee -a /var/www/logs/migration.log
pipenv run ./manage.py migrate | tee -a /var/www/logs/migration.log
# collect staticfiles and make accesable for server
echo -e "\n[""${BLUE} JOB""${NC}""] Collecting static files"
pipenv run ./manage.py collectstatic --no-input
chown www-embark /var/www/ -R
chmod 760 /var/www/media/ -R
echo -e "\n[""${BLUE} JOB""${NC}""] Starting runapscheduler"
pipenv run ./manage.py runapscheduler | tee -a /var/www/logs/scheduler.log &
sleep 5
echo -e "\n[""${BLUE} JOB""${NC}""] Starting Apache"
pipenv run ./manage.py runmodwsgi --user www-embark --group sudo \
--host "${BIND_IP}" --port="${HTTP_PORT}" --limit-request-body "${FILE_SIZE}" \
--url-alias /static/ /var/www/static/ \
--url-alias /media/ /var/www/media/ \
--allow-localhost --working-directory /var/www/embark/ --server-root /var/www/httpd80/ \
--include-file /var/www/conf/embark.conf \
--processes 4 --threads 4 \
--graceful-timeout 5 \
--log-level debug \
--server-name embark.local "${WSGI_FLAGS[@]}" &
# --ssl-certificate /var/www/conf/cert/embark.local --ssl-certificate-key-file /var/www/conf/cert/embark.local.key \
# --https-port "${HTTPS_PORT}" &
# --https-only --enable-debugger \
sleep 5
echo -e "\n[""${BLUE} JOB""${NC}""] Starting daphne(ASGI) - log to /embark/logs/daphne.log"
pipenv run daphne --access-log /var/www/logs/daphne.log -e ssl:8000:privateKey=/var/www/conf/cert/embark-ws.local.key:certKey=/var/www/conf/cert/embark-ws.local.crt -b "${BIND_IP}" -p 8001 -s embark-ws.local --root-path=/var/www/embark embark.asgi:application &
sleep 5
echo -e "\n""${ORANGE}${BOLD}""=============================================================""${NC}"
echo -e "\n""${ORANGE}${BOLD}""EMBA logs are under /var/www/emba_logs/<id> ""${NC}"
# echo -e "\n\n""${GREEN}${BOLD}""the trusted rootCA.key for the ssl encryption is in ./cert""${NC}"
if [[ ${#SERVER_ALIAS[@]} -ne 0 ]]; then
echo -e "\n""${ORANGE}${BOLD}""Server started on http://embark.local with alias:""${SERVER_ALIAS[*]}""${NC}"
else
echo -e "\n""${ORANGE}${BOLD}""Server started on http://embark.local""${NC}"
fi
# echo -e "\n""${ORANGE}${BOLD}""For SSL you may use https://embark.local (Not recommended for local use)""${NC}"
wait
# sync migrations with pwd
rsync -r -u --progress --chown="${SUDO_USER}" . "${EMBARK_BASEDIR}/embark"