Amaliy loyiha - to'liq server sozlash

systemctl stop sr-ilova 2>/dev/null
systemctl disable sr-ilova 2>/dev/null
systemctl reset-failed sr-ilova 2>/dev/null
rm -f /etc/systemd/system/sr-ilova.service
[ -f logs/nginx.pid ] && kill -QUIT "$(cat logs/nginx.pid)" 2>/dev/null
sleep 0.3

id sr-app >/dev/null 2>&1 || useradd --system --no-create-home \
    --shell /usr/sbin/nologin sr-app

rm -rf /srv/sr-loyiha
mkdir -p /srv/sr-loyiha/ilova
cat > /srv/sr-loyiha/ilova/ilova.py <<'PY'
import http.server, json

class Ishlovchi(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        javob = json.dumps({"xizmat": "softromeda", "yol": self.path}).encode()
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(javob)))
        self.end_headers()
        self.wfile.write(javob)

    def log_message(self, *argumentlar):
        pass

http.server.HTTPServer(("127.0.0.1", 8080), Ishlovchi).serve_forever()
PY

mkdir -p conf/tls logs html temp
echo "<h1>Softromeda</h1>" > html/index.html
openssl req -x509 -newkey rsa:2048 \
    -keyout conf/tls/kalit.pem -out conf/tls/sert.pem \
    -days 365 -nodes -subj "/CN=sinov.local" >/dev/null 2>&1
chmod 600 conf/tls/kalit.pem

cat > /etc/systemd/system/sr-ilova.service <<'EOF'
[Unit]
Description=Softromeda ilovasi
After=network.target

[Service]
Type=simple
User=sr-app
Group=sr-app
ExecStart=/usr/bin/python3 /srv/sr-loyiha/ilova/ilova.py
Restart=on-failure
RestartSec=2

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
MemoryMax=128M
TasksMax=64

[Install]
WantedBy=multi-user.target
EOF

cat > conf/nginx.conf <<'EOF'
worker_processes 1;
error_log logs/error.log warn;
pid logs/nginx.pid;
events { worker_connections 64; }
http {
    access_log logs/access.log;
    client_body_temp_path temp;
    proxy_temp_path temp/proxy;
    fastcgi_temp_path temp/fastcgi;
    uwsgi_temp_path temp/uwsgi;
    scgi_temp_path temp/scgi;
    default_type text/html;
    server_tokens off;

    server {
        listen 127.0.0.1:8080 default_server;
        server_name _;
        return 444;
    }

    server {
        listen 127.0.0.1:8443 ssl;
        server_name sinov.local;

        ssl_certificate     tls/sert.pem;
        ssl_certificate_key tls/kalit.pem;
        ssl_protocols       TLSv1.2 TLSv1.3;

        add_header Strict-Transport-Security "max-age=300" always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;

        root html;
        client_max_body_size 20m;

        location / {
            try_files $uri $uri/ =404;
        }

        location /api/ {
            proxy_pass http://127.0.0.1:8081/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_read_timeout 30s;
        }

        location ~ /\. {
            deny all;
            access_log off;
        }
    }
}
EOF

systemctl daemon-reload

chown -R root:sr-app /srv/sr-loyiha
find /srv/sr-loyiha -type d -exec chmod 750 {} +
find /srv/sr-loyiha -type f -exec chmod 640 {} +
stat -c "%U:%G %a %n" /srv/sr-loyiha /srv/sr-loyiha/ilova/ilova.py

cat > /etc/systemd/system/sr-ilova.service <<'EOF'
[Unit]
Description=Softromeda ilovasi
After=network.target

[Service]
Type=simple
User=sr-app
Group=sr-app
ExecStart=/usr/bin/python3 /srv/sr-loyiha/ilova/ilova.py
Restart=on-failure
RestartSec=2

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
MemoryMax=128M
TasksMax=64

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemd-analyze verify /etc/systemd/system/sr-ilova.service && echo "unit fayl to'g'ri"

systemctl start sr-ilova
sleep 2
systemctl is-active sr-ilova
curl -s http://127.0.0.1:8080/salom
echo
ss -tln 'sport = :8080' | tail -1 | awk '{print $4}'
systemctl stop sr-ilova

cat > conf/nginx.conf <<'EOF'
worker_processes 1;
error_log logs/error.log warn;
pid logs/nginx.pid;
events { worker_connections 64; }
http {
    access_log logs/access.log;
    client_body_temp_path temp;
    proxy_temp_path temp/proxy;
    fastcgi_temp_path temp/fastcgi;
    uwsgi_temp_path temp/uwsgi;
    scgi_temp_path temp/scgi;
    default_type text/html;
    server_tokens off;

    server {
        listen 127.0.0.1:8080 default_server;
        server_name _;
        return 444;
    }

    server {
        listen 127.0.0.1:8443 ssl;
        server_name sinov.local;

        ssl_certificate     tls/sert.pem;
        ssl_certificate_key tls/kalit.pem;
        ssl_protocols       TLSv1.2 TLSv1.3;

        add_header Strict-Transport-Security "max-age=300" always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;

        root html;
        client_max_body_size 20m;

        location / {
            try_files $uri $uri/ =404;
        }

        location /api/ {
            proxy_pass http://127.0.0.1:8081/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_read_timeout 30s;
        }

        location ~ /\. {
            deny all;
            access_log off;
        }
    }
}
EOF
nginx -p "$PWD" -c conf/nginx.conf -t 2>&1 | tail -1 | sed "s|$PWD/||g"

(cd /srv/sr-loyiha && exec python3 -c "
import http.server, json
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        b = json.dumps({'xizmat': 'softromeda', 'yol': self.path}).encode()
        self.send_response(200); self.send_header('Content-Length', str(len(b)))
        self.end_headers(); self.wfile.write(b)
    def log_message(self, *a): pass
http.server.HTTPServer(('127.0.0.1', 8081), H).serve_forever()
" >/dev/null 2>&1) &
BE=$!
nginx -p "$PWD" -c conf/nginx.conf
sleep 1.5
echo "statik: $(curl -sk https://127.0.0.1:8443/)"
echo "ilova:  $(curl -sk https://127.0.0.1:8443/api/holat)"
echo "yashirin fayl: $(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:8443/.env)"
echo "so'ralmagan domen: $(curl -s -o /dev/null -w '%{http_code}' --max-time 3 http://127.0.0.1:8080/; echo " kod=$?")"
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null
kill "$BE" 2>/dev/null

sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input ct state invalid drop
sudo nft add rule inet filter input iif lo accept
sudo nft add rule inet filter input tcp dport 22 ct state new limit rate 6/minute accept
sudo nft add rule inet filter input tcp dport { 80, 443 } accept
sudo nft list ruleset > /etc/nftables.conf
sudo systemctl enable nftables

cat > /srv/sr-loyiha/zaxira.sh <<'EOF'
#!/bin/bash
set -euo pipefail
umask 077
exec > >(systemd-cat -t zaxira -p info) 2>&1

MANBA="/srv/sr-loyiha"
NUSXA="/var/backups/sr-loyiha"
mkdir -p "$NUSXA"
SANA=$(date +%F)

nice -n 19 ionice -c 3 \
    tar -czf "$NUSXA/loyiha-$SANA.tar.gz" -C /srv sr-loyiha

tar -tzf "$NUSXA/loyiha-$SANA.tar.gz" > /dev/null
[ "$(stat -c %s "$NUSXA/loyiha-$SANA.tar.gz")" -gt 100 ]

find "$NUSXA" -name 'loyiha-*.tar.gz' -mtime +14 -delete
echo "zaxira tayyor: $SANA"
EOF
chmod 750 /srv/sr-loyiha/zaxira.sh
bash -n /srv/sr-loyiha/zaxira.sh && echo "zaxira skripti to'g'ri"
bash /srv/sr-loyiha/zaxira.sh
sleep 1
journalctl -t zaxira -n 1 --no-pager -o cat | grep -c 'zaxira tayyor'

cat > tekshiruv.sh <<'EOF'
#!/bin/bash
ok() { printf '  [ok]   %s\n' "$1"; }
xato() { printf '  [XATO] %s\n' "$1"; }

echo "Kirish:"
[ "$(getent shadow root | cut -d: -f2)" != "" ] && ok "root paroli holati tekshirildi"
grep -qs '^PasswordAuthentication no' /etc/ssh/sshd_config \
    && ok "SSH paroli o'chirilgan" || xato "SSH paroli hali yoqiq"

echo "Xizmatlar:"
[ "$(systemctl --failed --no-legend | wc -l)" -eq 0 ] \
    && ok "yiqilgan xizmat yo'q" || xato "yiqilgan xizmatlar bor"

echo "Disk:"
band=$(df --output=pcent / | tail -1 | tr -dc '0-9')
[ "$band" -lt 85 ] && ok "ildiz diski ${band}% band" || xato "disk ${band}% - chegaradan oshdi"
inode=$(df -i / | tail -1 | awk '{print $5}' | tr -dc '0-9')
[ "$inode" -lt 85 ] && ok "inode ${inode}% band" || xato "inode ${inode}%"

echo "Jurnal:"
[ -d /var/log/journal ] && ok "jurnal doimiy saqlanadi" || xato "jurnal xotirada - qayta yuklashda yo'qoladi"
EOF
chmod 755 tekshiruv.sh
bash tekshiruv.sh | grep -c '\[ok\]\|\[XATO\]'

systemctl stop sr-ilova 2>/dev/null
systemctl disable sr-ilova 2>/dev/null
rm -f /etc/systemd/system/sr-ilova.service
systemctl daemon-reload
rm -rf /srv/sr-loyiha /var/backups/sr-loyiha
userdel sr-app 2>/dev/null
id sr-app >/dev/null 2>&1 && echo "hali bor" || echo "muhit tozalandi"