forked from
tranquil.farm/tranquil-pds
Our Personal Data Server from scratch!
1#!/bin/bash
2set -euo pipefail
3
4RED='\033[0;31m'
5GREEN='\033[0;32m'
6YELLOW='\033[1;33m'
7BLUE='\033[0;34m'
8NC='\033[0m'
9
10log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
11log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
12log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
13log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
14
15if [[ $EUID -ne 0 ]]; then
16 log_error "This script must be run as root"
17 exit 1
18fi
19
20if ! grep -qi "debian" /etc/os-release 2>/dev/null; then
21 log_warn "This script is designed for Debian. Proceed with caution on other distros."
22fi
23
24nuke_installation() {
25 log_warn "NUKING EXISTING INSTALLATION"
26 log_info "Stopping services..."
27 systemctl stop tranquil-pds 2>/dev/null || true
28 systemctl disable tranquil-pds 2>/dev/null || true
29
30 log_info "Removing Tranquil PDS files..."
31 rm -rf /opt/tranquil-pds
32 rm -rf /var/lib/tranquil-pds
33 rm -f /usr/local/bin/tranquil-pds
34 rm -f /usr/local/bin/tranquil-pds-sendmail
35 rm -f /usr/local/bin/tranquil-pds-mailq
36 rm -rf /var/spool/tranquil-pds-mail
37 rm -f /etc/systemd/system/tranquil-pds.service
38 systemctl daemon-reload
39
40 log_info "Removing Tranquil PDS configuration..."
41 rm -rf /etc/tranquil-pds
42
43 log_info "Dropping postgres database and user..."
44 sudo -u postgres psql -c "DROP DATABASE IF EXISTS pds;" 2>/dev/null || true
45 sudo -u postgres psql -c "DROP USER IF EXISTS tranquil_pds;" 2>/dev/null || true
46
47 log_info "Removing blob storage..."
48 rm -rf /var/lib/tranquil 2>/dev/null || true
49
50 log_info "Removing nginx config..."
51 rm -f /etc/nginx/sites-enabled/tranquil-pds
52 rm -f /etc/nginx/sites-available/tranquil-pds
53 systemctl reload nginx 2>/dev/null || true
54
55 log_success "Previous installation nuked"
56}
57
58if [[ -f /etc/tranquil-pds/tranquil-pds.env ]] || [[ -d /opt/tranquil-pds ]] || [[ -f /usr/local/bin/tranquil-pds ]]; then
59 log_warn "Existing installation detected"
60 echo ""
61 echo "Options:"
62 echo " 1) Nuke everything and start fresh (destroys database!)"
63 echo " 2) Continue with existing installation (idempotent update)"
64 echo " 3) Exit"
65 echo ""
66 read -p "Choose an option [1/2/3]: " INSTALL_CHOICE
67
68 case "$INSTALL_CHOICE" in
69 1)
70 echo ""
71 log_warn "This will DELETE:"
72 echo " - PostgreSQL database 'pds' and all data"
73 echo " - All Tranquil PDS configuration and credentials"
74 echo " - All source code in /opt/tranquil-pds"
75 echo " - All blobs in /var/lib/tranquil/"
76 echo ""
77 read -p "Type 'NUKE' to confirm: " CONFIRM_NUKE
78 if [[ "$CONFIRM_NUKE" == "NUKE" ]]; then
79 nuke_installation
80 else
81 log_error "Nuke cancelled"
82 exit 1
83 fi
84 ;;
85 2)
86 log_info "Continuing with existing installation..."
87 ;;
88 3)
89 exit 0
90 ;;
91 *)
92 log_error "Invalid option"
93 exit 1
94 ;;
95 esac
96fi
97
98echo ""
99log_info "Tranquil PDS Installation Script for Debian"
100echo ""
101
102get_public_ips() {
103 IPV4=$(curl -4 -s --max-time 5 ifconfig.me 2>/dev/null || curl -4 -s --max-time 5 icanhazip.com 2>/dev/null || echo "Could not detect")
104 IPV6=$(curl -6 -s --max-time 5 ifconfig.me 2>/dev/null || curl -6 -s --max-time 5 icanhazip.com 2>/dev/null || echo "")
105}
106
107log_info "Detecting public IP addresses..."
108get_public_ips
109echo " IPv4: ${IPV4}"
110[[ -n "$IPV6" ]] && echo " IPv6: ${IPV6}"
111echo ""
112
113read -p "Enter your PDS domain (eg., pds.example.com): " PDS_DOMAIN
114if [[ -z "$PDS_DOMAIN" ]]; then
115 log_error "Domain cannot be empty"
116 exit 1
117fi
118
119read -p "Enter your email for Let's Encrypt: " CERTBOT_EMAIL
120if [[ -z "$CERTBOT_EMAIL" ]]; then
121 log_error "Email cannot be empty"
122 exit 1
123fi
124
125echo ""
126log_info "DNS records required (create these now if you haven't):"
127echo ""
128echo " ${PDS_DOMAIN} A ${IPV4}"
129[[ -n "$IPV6" ]] && echo " ${PDS_DOMAIN} AAAA ${IPV6}"
130echo " *.${PDS_DOMAIN} A ${IPV4} (for user handles)"
131[[ -n "$IPV6" ]] && echo " *.${PDS_DOMAIN} AAAA ${IPV6} (for user handles)"
132echo ""
133read -p "Have you created these DNS records? (y/N): " DNS_CONFIRMED
134if [[ ! "$DNS_CONFIRMED" =~ ^[Yy]$ ]]; then
135 log_warn "Please create the DNS records and run this script again."
136 exit 0
137fi
138
139CREDENTIALS_FILE="/etc/tranquil-pds/.credentials"
140if [[ -f "$CREDENTIALS_FILE" ]]; then
141 log_info "Loading existing credentials..."
142 source "$CREDENTIALS_FILE"
143else
144 log_info "Generating secrets..."
145 JWT_SECRET=$(openssl rand -base64 48)
146 DPOP_SECRET=$(openssl rand -base64 48)
147 MASTER_KEY=$(openssl rand -base64 48)
148 DB_PASSWORD=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 32)
149
150 mkdir -p /etc/tranquil-pds
151 cat > "$CREDENTIALS_FILE" << EOF
152JWT_SECRET="$JWT_SECRET"
153DPOP_SECRET="$DPOP_SECRET"
154MASTER_KEY="$MASTER_KEY"
155DB_PASSWORD="$DB_PASSWORD"
156EOF
157 chmod 600 "$CREDENTIALS_FILE"
158 log_success "Secrets generated"
159fi
160
161log_info "Checking swap space..."
162TOTAL_MEM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
163TOTAL_SWAP_KB=$(grep SwapTotal /proc/meminfo | awk '{print $2}')
164
165if [[ $TOTAL_SWAP_KB -lt 2000000 ]]; then
166 if [[ ! -f /swapfile ]]; then
167 log_info "Adding swap space for compilation..."
168 SWAP_SIZE="4G"
169 [[ $TOTAL_MEM_KB -ge 4000000 ]] && SWAP_SIZE="2G"
170 fallocate -l $SWAP_SIZE /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=4096
171 chmod 600 /swapfile
172 mkswap /swapfile
173 swapon /swapfile
174 grep -q '/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab
175 log_success "Swap added ($SWAP_SIZE)"
176 else
177 swapon /swapfile 2>/dev/null || true
178 fi
179fi
180
181log_info "Updating system packages..."
182apt update && apt upgrade -y
183
184log_info "Installing build dependencies..."
185apt install -y curl git build-essential pkg-config libssl-dev ca-certificates gnupg lsb-release unzip xxd
186
187log_info "Installing postgres..."
188apt install -y postgresql postgresql-contrib
189systemctl enable postgresql
190systemctl start postgresql
191sudo -u postgres psql -c "CREATE USER tranquil_pds WITH PASSWORD '${DB_PASSWORD}';" 2>/dev/null || \
192 sudo -u postgres psql -c "ALTER USER tranquil_pds WITH PASSWORD '${DB_PASSWORD}';"
193sudo -u postgres psql -c "CREATE DATABASE pds OWNER tranquil_pds;" 2>/dev/null || true
194sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE pds TO tranquil_pds;"
195log_success "postgres configured"
196
197log_info "Creating blob storage directories..."
198mkdir -p /var/lib/tranquil/blobs
199log_success "Blob storage directories created"
200
201log_info "Installing rust..."
202if [[ -f "$HOME/.cargo/env" ]]; then
203 source "$HOME/.cargo/env"
204fi
205if ! command -v rustc &>/dev/null; then
206 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
207 source "$HOME/.cargo/env"
208fi
209
210log_info "Installing deno..."
211export PATH="$HOME/.deno/bin:$PATH"
212if ! command -v deno &>/dev/null && [[ ! -f "$HOME/.deno/bin/deno" ]]; then
213 curl -fsSL https://deno.land/install.sh | sh
214 grep -q 'deno/bin' ~/.bashrc 2>/dev/null || echo 'export PATH="$HOME/.deno/bin:$PATH"' >> ~/.bashrc
215fi
216
217log_info "Cloning Tranquil PDS..."
218if [[ ! -d /opt/tranquil-pds ]]; then
219 git clone https://tangled.org/tranquil.farm/tranquil-pds /opt/tranquil-pds
220else
221 cd /opt/tranquil-pds && git pull
222fi
223cd /opt/tranquil-pds
224
225log_info "Building frontend..."
226"$HOME/.deno/bin/deno" task build --filter=frontend
227log_success "Frontend built"
228
229log_info "Building Tranquil PDS (this takes a while)..."
230source "$HOME/.cargo/env"
231if [[ $TOTAL_MEM_KB -lt 4000000 ]]; then
232 log_info "Low memory - limiting parallel jobs"
233 CARGO_BUILD_JOBS=1 cargo build --release
234else
235 cargo build --release
236fi
237log_success "Tranquil PDS built"
238
239log_info "Running migrations..."
240cargo install sqlx-cli --no-default-features --features postgres
241export DATABASE_URL="postgres://tranquil_pds:${DB_PASSWORD}@localhost:5432/pds"
242"$HOME/.cargo/bin/sqlx" migrate run
243log_success "Migrations complete"
244
245log_info "Setting up mail trap..."
246mkdir -p /var/spool/tranquil-pds-mail
247chmod 1777 /var/spool/tranquil-pds-mail
248
249cat > /usr/local/bin/tranquil-pds-sendmail << 'SENDMAIL_EOF'
250#!/bin/bash
251MAIL_DIR="/var/spool/tranquil-pds-mail"
252TIMESTAMP=$(date +%Y%m%d-%H%M%S)
253RANDOM_ID=$(head -c 4 /dev/urandom | xxd -p)
254MAIL_FILE="${MAIL_DIR}/${TIMESTAMP}-${RANDOM_ID}.eml"
255mkdir -p "$MAIL_DIR"
256{
257 echo "X-Tranquil-PDS-Received: $(date -Iseconds)"
258 echo "X-Tranquil-PDS-Args: $*"
259 echo ""
260 cat
261} > "$MAIL_FILE"
262chmod 644 "$MAIL_FILE"
263exit 0
264SENDMAIL_EOF
265chmod +x /usr/local/bin/tranquil-pds-sendmail
266
267cat > /usr/local/bin/tranquil-pds-mailq << 'MAILQ_EOF'
268#!/bin/bash
269MAIL_DIR="/var/spool/tranquil-pds-mail"
270case "${1:-list}" in
271 list)
272 ls -lt "$MAIL_DIR"/*.eml 2>/dev/null | head -20 || echo "No emails"
273 ;;
274 latest)
275 f=$(ls -t "$MAIL_DIR"/*.eml 2>/dev/null | head -1)
276 [[ -f "$f" ]] && cat "$f" || echo "No emails"
277 ;;
278 clear)
279 rm -f "$MAIL_DIR"/*.eml
280 echo "Cleared"
281 ;;
282 count)
283 ls -1 "$MAIL_DIR"/*.eml 2>/dev/null | wc -l
284 ;;
285 [0-9]*)
286 f=$(ls -t "$MAIL_DIR"/*.eml 2>/dev/null | sed -n "${1}p")
287 [[ -f "$f" ]] && cat "$f" || echo "Not found"
288 ;;
289 *)
290 [[ -f "$MAIL_DIR/$1" ]] && cat "$MAIL_DIR/$1" || echo "Usage: tranquil-pds-mailq [list|latest|clear|count|N]"
291 ;;
292esac
293MAILQ_EOF
294chmod +x /usr/local/bin/tranquil-pds-mailq
295
296log_info "Creating Tranquil PDS configuration..."
297cat > /etc/tranquil-pds/tranquil-pds.env << EOF
298SERVER_HOST=127.0.0.1
299SERVER_PORT=3000
300PDS_HOSTNAME=${PDS_DOMAIN}
301DATABASE_URL=postgres://tranquil_pds:${DB_PASSWORD}@localhost:5432/pds
302DATABASE_MAX_CONNECTIONS=100
303DATABASE_MIN_CONNECTIONS=10
304BLOB_STORAGE_PATH=/var/lib/tranquil/blobs
305JWT_SECRET=${JWT_SECRET}
306DPOP_SECRET=${DPOP_SECRET}
307MASTER_KEY=${MASTER_KEY}
308PLC_DIRECTORY_URL=https://plc.directory
309CRAWLERS=https://bsky.network
310AVAILABLE_USER_DOMAINS=${PDS_DOMAIN}
311MAIL_FROM_ADDRESS=noreply@${PDS_DOMAIN}
312MAIL_FROM_NAME=Tranquil PDS
313SENDMAIL_PATH=/usr/local/bin/tranquil-pds-sendmail
314EOF
315chmod 600 /etc/tranquil-pds/tranquil-pds.env
316
317log_info "Installing Tranquil PDS..."
318id -u tranquil-pds &>/dev/null || useradd -r -s /sbin/nologin tranquil-pds
319cp /opt/tranquil-pds/target/release/tranquil-server /usr/local/bin/tranquil-pds
320mkdir -p /var/lib/tranquil-pds
321cp -r /opt/tranquil-pds/frontend/dist /var/lib/tranquil-pds/frontend
322chown -R tranquil-pds:tranquil-pds /var/lib/tranquil-pds
323chown -R tranquil-pds:tranquil-pds /var/lib/tranquil
324
325cat > /etc/systemd/system/tranquil-pds.service << 'EOF'
326[Unit]
327Description=Tranquil PDS - AT Protocol PDS
328After=network.target postgresql.service
329
330[Service]
331Type=simple
332User=tranquil-pds
333Group=tranquil-pds
334EnvironmentFile=/etc/tranquil-pds/tranquil-pds.env
335ExecStart=/usr/local/bin/tranquil-pds
336Restart=always
337RestartSec=5
338ProtectSystem=strict
339ProtectHome=true
340PrivateTmp=true
341ReadWritePaths=/var/lib/tranquil
342
343[Install]
344WantedBy=multi-user.target
345EOF
346
347systemctl daemon-reload
348systemctl enable tranquil-pds
349systemctl start tranquil-pds
350log_success "Tranquil PDS service started"
351
352log_info "Installing nginx..."
353apt install -y nginx
354cat > /etc/nginx/sites-available/tranquil-pds << EOF
355server {
356 listen 80;
357 listen [::]:80;
358 server_name ${PDS_DOMAIN} *.${PDS_DOMAIN};
359
360 location /.well-known/acme-challenge/ {
361 root /var/www/html;
362 }
363
364 location / {
365 proxy_pass http://127.0.0.1:3000;
366 proxy_http_version 1.1;
367 proxy_set_header Upgrade \$http_upgrade;
368 proxy_set_header Connection "upgrade";
369 proxy_set_header Host \$host;
370 proxy_set_header X-Real-IP \$remote_addr;
371 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
372 proxy_set_header X-Forwarded-Proto \$scheme;
373 proxy_read_timeout 86400;
374 proxy_send_timeout 86400;
375 client_max_body_size 100M;
376 }
377}
378EOF
379
380ln -sf /etc/nginx/sites-available/tranquil-pds /etc/nginx/sites-enabled/
381rm -f /etc/nginx/sites-enabled/default
382nginx -t
383systemctl reload nginx
384log_success "nginx configured"
385
386log_info "Configuring firewall..."
387apt install -y ufw
388ufw --force reset
389ufw default deny incoming
390ufw default allow outgoing
391ufw allow ssh
392ufw allow 80/tcp
393ufw allow 443/tcp
394ufw --force enable
395log_success "Firewall configured"
396
397echo ""
398log_info "Obtaining wildcard SSL certificate..."
399echo ""
400echo "User handles are served as subdomains (eg., alice.${PDS_DOMAIN}),"
401echo "so you need a wildcard certificate. This requires DNS validation."
402echo ""
403echo "You'll need to add a TXT record to your DNS when prompted."
404echo ""
405read -p "Ready to proceed? (y/N): " CERT_READY
406
407if [[ "$CERT_READY" =~ ^[Yy]$ ]]; then
408 apt install -y certbot python3-certbot-nginx
409
410 log_info "Running certbot with DNS challenge..."
411 echo ""
412 echo "When prompted, add the TXT record to your DNS, wait a minute"
413 echo "for propagation, then press Enter to continue."
414 echo ""
415
416 if certbot certonly --manual --preferred-challenges dns \
417 -d "${PDS_DOMAIN}" -d "*.${PDS_DOMAIN}" \
418 --email "${CERTBOT_EMAIL}" --agree-tos; then
419
420 cat > /etc/nginx/sites-available/tranquil-pds << EOF
421server {
422 listen 80;
423 listen [::]:80;
424 server_name ${PDS_DOMAIN} *.${PDS_DOMAIN};
425
426 location /.well-known/acme-challenge/ {
427 root /var/www/html;
428 }
429
430 location / {
431 return 301 https://\$host\$request_uri;
432 }
433}
434
435server {
436 listen 443 ssl http2;
437 listen [::]:443 ssl http2;
438 server_name ${PDS_DOMAIN} *.${PDS_DOMAIN};
439
440 ssl_certificate /etc/letsencrypt/live/${PDS_DOMAIN}/fullchain.pem;
441 ssl_certificate_key /etc/letsencrypt/live/${PDS_DOMAIN}/privkey.pem;
442 ssl_protocols TLSv1.2 TLSv1.3;
443 ssl_ciphers HIGH:!aNULL:!MD5;
444 ssl_prefer_server_ciphers on;
445 ssl_session_cache shared:SSL:10m;
446
447 location / {
448 proxy_pass http://127.0.0.1:3000;
449 proxy_http_version 1.1;
450 proxy_set_header Upgrade \$http_upgrade;
451 proxy_set_header Connection "upgrade";
452 proxy_set_header Host \$host;
453 proxy_set_header X-Real-IP \$remote_addr;
454 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
455 proxy_set_header X-Forwarded-Proto \$scheme;
456 proxy_read_timeout 86400;
457 proxy_send_timeout 86400;
458 client_max_body_size 100M;
459 }
460}
461EOF
462 nginx -t && systemctl reload nginx
463 log_success "Wildcard SSL certificate installed"
464
465 echo ""
466 log_warn "Certificate renewal note:"
467 echo "Manual DNS challenges don't auto-renew. Before expiry, run:"
468 echo " certbot renew --manual"
469 echo ""
470 echo "For auto-renewal, consider using a DNS provider plugin:"
471 echo " apt install python3-certbot-dns-cloudflare # or your provider"
472 echo ""
473 else
474 log_warn "Wildcard cert failed. You can retry later with:"
475 echo " certbot certonly --manual --preferred-challenges dns \\"
476 echo " -d ${PDS_DOMAIN} -d '*.${PDS_DOMAIN}'"
477 fi
478else
479 log_warn "Skipping SSL. Your PDS is running on HTTP only."
480 echo "To add SSL later, run:"
481 echo " certbot certonly --manual --preferred-challenges dns \\"
482 echo " -d ${PDS_DOMAIN} -d '*.${PDS_DOMAIN}'"
483fi
484
485log_info "Verifying installation..."
486sleep 3
487if curl -s "http://localhost:3000/xrpc/_health" | grep -q "version"; then
488 log_success "Tranquil PDS is responding"
489else
490 log_warn "Tranquil PDS may still be starting. Check: journalctl -u tranquil-pds -f"
491fi
492
493echo ""
494log_success "Installation complete"
495echo ""
496echo "PDS: https://${PDS_DOMAIN}"
497echo ""
498echo "Credentials (also in /etc/tranquil-pds/.credentials):"
499echo " DB password: ${DB_PASSWORD}"
500echo ""
501echo "Data locations:"
502echo " Blobs: /var/lib/tranquil/blobs"
503echo ""
504echo "Commands:"
505echo " journalctl -u tranquil-pds -f # logs"
506echo " systemctl restart tranquil-pds # restart"
507echo " tranquil-pds-mailq # view trapped emails"
508echo ""