<commit_before><?php

namespace Deployer;

use Deployer\Exception\GracefulShutdownException;
use function Deployer\Support\starts_with;

set('php_version', '7.4');
set('sudo_password', '<PASSWORD>');

desc('Provision server with nginx, php, php-fpm');
task('provision', [
    'provision:check',
    'provision:upgrade',
    'provision:install',
    'provision:ssh',
    'provision:ssh',
    'provision:user:deployer',
    'provision:firewall',
    'provision:install:php',
    'provision:install:composer',
    'provision:config:php-cli',
    'provision:config:php-fpm',
    'provision:config:php-fpm:pool',
    'provision:config:php:sessions',
    'provision:nginx:dhparam',
    'provision:nginx',
]);

desc('Ensure what provision run as root');
task('provision:switch-user', function () {
    run('whoami');
    if (get('remote_user') !== 'root') {
        set('remote_user', 'root');
    }
});

//Deployer::get()->preTask->add('provision:*', 'provision:switch-user');

desc('Check pre-required state');
task('provision:check', function () {
    $ok = true;
    if (get('php_version') !== '7.4') {
        $ok = false;
        warning("Only php 7.4 currently supported.");
    }

    $release = run('cat /etc/os-release');
    ['NAME' => $name, 'VERSION' => $version] = parse_ini_string($release);

    if ($name !== 'Ubuntu' || !starts_with($version, '20.04 LTS')) {
        $ok = false;
        warning('Only Ubuntu 20.04 LTS supported for now.');
    }

    if (!$ok) {
        throw new GracefulShutdownException('Missing some pre-required state. Please check warnings.');
    }
});

desc('Upgrade all packages');
task('provision:upgrade', function () {
    run('apt-get update', ['env' => ['DEBIAN_FRONTEND' => 'noninteractive']]);
    run('apt-get upgrade -y', ['env' => ['DEBIAN_FRONTEND' => 'noninteractive']]);
});

desc('Install base packages');
task('provision:install', function () {
    $packages = [
        'build-essential',
        'curl',
        'fail2ban',
        'gcc',
        'git',
        'libmcrypt4',
        'libpcre3-dev',
        'make',
        'ncdu',
        'nginx',
        'pkg-config',
        'sendmail',
        'ufw',
        'unzip',
        'uuid-runtime',
        'whois',
    ];
    run('apt-get install -y --allow-downgrades --allow-remove-essential --allow-change-held-packages ' . implode(' ', $packages), ['env' => ['DEBIAN_FRONTEND' => 'noninteractive']]);
});

desc('Configure SSH');
task('provision:ssh', function () {
    run('sed -i "/PasswordAuthentication yes/d" /etc/ssh/sshd_config');
    run('echo "" | sudo tee -a /etc/ssh/sshd_config');
    run('echo "" | sudo tee -a /etc/ssh/sshd_config');
    run('echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config');
    run('ssh-keygen -A');
    run('service ssh restart');
    if (test('[ ! -d /root/.ssh ]')) {
        run('mkdir -p /root/.ssh');
        run('touch /root/.ssh/authorized_keys');
    }
});

desc('Setup deployer user');
task('provision:user:deployer', function () {
    if (test('id deployer >/dev/null 2>&1')) {
        info('deployer user already exist');
    } else {
        run('useradd deployer');
        run('mkdir -p /home/deployer/.ssh');
        run('mkdir -p /home/deployer/.deployer');
        run('adduser deployer sudo');

        run('chsh -s /bin/bash deployer');
        run('cp /root/.profile /home/deployer/.profile');
        run('cp /root/.bashrc /home/deployer/.bashrc');

        $password = run('mkpasswd -m sha-512 {{sudo_password}}');
        run("usermod --password $password deployer");

        // TODO: Copy current ssh-key.
        run('echo >> /root/.ssh/authorized_keys');
        run('cp /root/.ssh/authorized_keys /home/deployer/.ssh/authorized_keys');

        run('ssh-keygen -f /home/deployer/.ssh/id_rsa -t rsa -N ""');

        run('chown -R deployer:deployer /home/deployer');
        run('chmod -R 755 /home/deployer');
        run('chmod 700 /home/deployer/.ssh/id_rsa');

        run('echo "deployer ALL=NOPASSWD: /usr/sbin/service php-fpm reload" > /etc/sudoers.d/php-fpm');

        run('usermod -a -G www-data deployer');
        run('id deployer');
        run('groups deployer');
    }
});

desc('Setup firewall');
task('provision:firewall', function () {
    run('ufw allow 22');
    run('ufw allow 80');<commit_msg>Ask password for deployer user<commit_after><?php

namespace Deployer;

use Deployer\Exception\GracefulShutdownException;
use function Deployer\Support\starts_with;

set('php_version', '7.4');
set('sudo_password', function () {
    return askHiddenResponse('Type new password:');
});

desc('Provision server with nginx, php, php-fpm');
task('provision', [
    'provision:check',
    'provision:upgrade',
    'provision:install',
    'provision:ssh',
    'provision:ssh',
    'provision:user:deployer',
    'provision:firewall',
    'provision:install:php',
    'provision:install:composer',
    'provision:config:php-cli',
    'provision:config:php-fpm',
    'provision:config:php-fpm:pool',
    'provision:config:php:sessions',
    'provision:nginx:dhparam',
    'provision:nginx',
]);

desc('Check pre-required state');
task('provision:check', function () {
    $ok = true;
    if (get('php_version') !== '7.4') {
        $ok = false;
        warning("Only php 7.4 currently supported.");
    }

    $release = run('cat /etc/os-release');
    ['NAME' => $name, 'VERSION_ID' => $version] = parse_ini_string($release);

    if ($name !== 'Ubuntu' || $version !== '20.04') {
        $ok = false;
        warning('Only Ubuntu 20.04 LTS supported for now.');
    }

    if (!$ok) {
        throw new GracefulShutdownException('Missing some pre-required state. Please check warnings.');
    }
});

desc('Upgrade all packages');
task('provision:upgrade', function () {
    run('apt-get update', ['env' => ['DEBIAN_FRONTEND' => 'noninteractive']]);
    run('apt-get upgrade -y', ['env' => ['DEBIAN_FRONTEND' => 'noninteractive']]);
});

desc('Install base packages');
task('provision:install', function () {
    $packages = [
        'build-essential',
        'curl',
        'fail2ban',
        'gcc',
        'git',
        'libmcrypt4',
        'libpcre3-dev',
        'make',
        'ncdu',
        'nginx',
        'pkg-config',
        'sendmail',
        'ufw',
        'unzip',
        'uuid-runtime',
        'whois',
    ];
    run('apt-get install -y --allow-downgrades --allow-remove-essential --allow-change-held-packages ' . implode(' ', $packages), ['env' => ['DEBIAN_FRONTEND' => 'noninteractive']]);
});

desc('Configure SSH');
task('provision:ssh', function () {
    run('sed -i "/PasswordAuthentication yes/d" /etc/ssh/sshd_config');
    run('echo "" | sudo tee -a /etc/ssh/sshd_config');
    run('echo "" | sudo tee -a /etc/ssh/sshd_config');
    run('echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config');
    run('ssh-keygen -A');
    run('service ssh restart');
    if (test('[ ! -d /root/.ssh ]')) {
        run('mkdir -p /root/.ssh');
        run('touch /root/.ssh/authorized_keys');
    }
});

desc('Setup deployer user');
task('provision:user:deployer', function () {
    if (test('id deployer >/dev/null 2>&1')) {
        info('deployer user already exist');
    } else {
        run('useradd deployer');
        run('mkdir -p /home/deployer/.ssh');
        run('mkdir -p /home/deployer/.deployer');
        run('adduser deployer sudo');

        run('chsh -s /bin/bash deployer');
        run('cp /root/.profile /home/deployer/.profile');
        run('cp /root/.bashrc /home/deployer/.bashrc');

        $password = run("mkpasswd -m <PASSWORD> '%secret%'", ['secret' => get('sudo_password')]);
        run("usermod --password '%secret%' deployer", ['secret' => $password]);

        // TODO: Copy current ssh-key.
        run('echo >> /root/.ssh/authorized_keys');
        run('cp /root/.ssh/authorized_keys /home/deployer/.ssh/authorized_keys');

        run('ssh-keygen -f /home/deployer/.ssh/id_rsa -t rsa -N ""');

        run('chown -R deployer:deployer /home/deployer');
        run('chmod -R 755 /home/deployer');
        run('chmod 700 /home/deployer/.ssh/id_rsa');

        run('echo "deployer ALL=NOPASSWD: /usr/sbin/service php-fpm reload" > /etc/sudoers.d/php-fpm');

        run('usermod -a -G www-data deployer');
        run('id deployer');
        run('groups deployer');
    }
});

desc('Setup firewall');
task('provision:firewall', function () {
    run('ufw allow 22');
    run('ufw allow 80');
{'fraction_non_alphanumeric': 0.19354457318515014, 'fraction_numerical': 0.0072121068810593525, 'mean_word_length': 2.9583528310715956, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 35, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3926873', 'n_tokens_mistral': 3002, 'n_tokens_neox': 2808, 'n_words': 568}