#!/bin/bash # Deploy Xtream CMS on production server (194.x) — DB stays on MAIN vlan. # # bash /home/install-cms-remote.sh # USE_MIRROR=1 bash /home/install-cms-remote.sh set -euo pipefail # shellcheck source=/home/env/load-env.sh source /home/env/load-env.sh "${XTREAM_ENV:-production}" require_production_deploy CMS_ROOT="${CMS_ROOT:-/home/xtreamcodes/iptv_xtream_codes}" MAIN_ROOT="${MAIN_ROOT:-/home/xtreamcodes/iptv_xtream_codes}" MIRROR_URL="${MIRROR_URL:-http://${CMS_HOST}:8080/Files}" USE_MIRROR="${USE_MIRROR:-0}" SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=15" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" if [ -f "$SCRIPT_DIR/lib/cms-panel-bootstrap.sh" ]; then # shellcheck source=lib/cms-panel-bootstrap.sh source "$SCRIPT_DIR/lib/cms-panel-bootstrap.sh" elif [ -f /home/lib/cms-panel-bootstrap.sh ]; then # shellcheck source=/home/lib/cms-panel-bootstrap.sh source /home/lib/cms-panel-bootstrap.sh fi if [ -z "$CMS_PASS" ]; then echo "ERROR: CMS_PASS missing in /home/env/production.env" >&2 exit 1 fi echo "[*] CMS deploy [$XTREAM_ENV] -> $CMS_HOST (DB on $MAIN_HOST)" ssh_cmd() { sshpass -p "$CMS_PASS" ssh $SSH_OPTS "root@$CMS_HOST" "$@" } rsync_to_cms() { local src="$1" local dest_sub="$2" sshpass -p "$CMS_PASS" rsync -az \ -e "ssh $SSH_OPTS" "${src}" "root@${CMS_HOST}:${CMS_ROOT}/${dest_sub}" } main_ssh() { if [ -n "$MAIN_SSH_PASS" ]; then sshpass -p "$MAIN_SSH_PASS" ssh $SSH_OPTS "root@$MAIN_SSH_HOST" "$@" else "$@" fi } echo "[*] MAIN ($MAIN_SSH_HOST): initial DB firewall marker" main_ssh "echo '$CMS_VLAN' > $MAIN_ROOT/.cms_panel_host" 2>/dev/null || true echo "[*] CMS: base packages + user" ssh_cmd "apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq rsync curl openssl sshpass mariadb-client libmcrypt4 2>/dev/null || true" ssh_cmd "id xtreamcodes &>/dev/null || useradd -r -d /home/xtreamcodes -s /bin/false xtreamcodes" ssh_cmd "mkdir -p $CMS_ROOT/{admin,php,lib,pytools,nginx/conf,nginx/sbin,nginx/logs,tmp,adtools}" ssh_cmd "mkdir -p /home/backups && chown xtreamcodes:xtreamcodes /home/backups && chmod 755 /home/backups" echo "[*] IPv4 DNS preference (ffmpeg/ffprobe on CMS)" ssh_cmd "grep -q '::ffff:0:0/96' /etc/gai.conf 2>/dev/null || printf '\n# Xtream: prefer IPv4\nprecedence ::ffff:0:0/96 100\n' >> /etc/gai.conf" if [ "$USE_MIRROR" = "1" ]; then echo "[*] CMS stack from mirror $MIRROR_URL/cms.tar.gz" ssh_cmd "mkdir -p /home/xtreamcodes && curl -fsSL '${MIRROR_URL}/cms.tar.gz' | tar xzf - -C /home/xtreamcodes" else echo "[*] Rsync panel stack from MAIN..." rsync_to_cms "$MAIN_ROOT/admin/" "admin/" rsync_to_cms "$MAIN_ROOT/php/" "php/" rsync_to_cms "$MAIN_ROOT/lib/" "lib/" rsync_to_cms "$MAIN_ROOT/pytools/" "pytools/" rsync_to_cms "$MAIN_ROOT/crons/" "crons/" rsync_to_cms "$MAIN_ROOT/nginx/sbin/" "nginx/sbin/" rsync_to_cms "$MAIN_ROOT/nginx/conf/mime.types" "nginx/conf/" rsync_to_cms "$MAIN_ROOT/nginx/conf/server.crt" "nginx/conf/" rsync_to_cms "$MAIN_ROOT/nginx/conf/server.key" "nginx/conf/" rsync_to_cms "$MAIN_ROOT/nginx/conf/security_panel.conf" "nginx/conf/" rsync_to_cms "$MAIN_ROOT/nginx/conf/security_rate_limits.conf" "nginx/conf/" rsync_to_cms "$MAIN_ROOT/nginx/conf/balance.conf" "nginx/conf/" fi echo "[*] Remote config (db host -> MAIN vlan $MAIN_HOST)" python3 - "$MAIN_ROOT/config" "$CMS_HOST" "$CMS_PASS" "$CMS_ROOT/config" "$MAIN_HOST" \ "$MAIN_SSH_HOST" "$MAIN_SSH_PASS" <<'PY' import sys, json, base64, subprocess, tempfile, os from itertools import cycle XOR_KEY = "5709650b0d7806074842c6de575025b1" src, cms_host, cms_pass, remote_path, main_host = sys.argv[1:6] main_ssh, main_pass = (sys.argv[6], sys.argv[7]) if len(sys.argv) > 7 else ("", "") def xor_crypt(data, key): return "".join(chr(ord(c) ^ ord(k)) for c, k in zip(data, cycle(key))) if main_ssh and main_pass: raw = subprocess.check_output([ "sshpass", "-p", main_pass, "ssh", "-o", "StrictHostKeyChecking=no", "root@%s" % main_ssh, "cat /home/xtreamcodes/iptv_xtream_codes/config", ]).decode("ascii") else: raw = open(src, "rb").read().decode("ascii") plain = json.loads(xor_crypt(base64.b64decode(raw).decode("latin-1"), XOR_KEY)) plain["host"] = main_host plain["server_ip"] = main_host out = base64.b64encode(xor_crypt(json.dumps(plain), XOR_KEY).encode("latin-1")).decode("ascii") fd, tmp = tempfile.mkstemp() os.write(fd, out.encode("ascii")) os.close(fd) subprocess.check_call([ "sshpass", "-p", cms_pass, "scp", "-o", "StrictHostKeyChecking=no", tmp, "root@%s:%s" % (cms_host, remote_path), ]) os.unlink(tmp) print(" config -> %s (host=%s)" % (remote_path, main_host)) PY echo "[*] redis.json -> MAIN" ssh_cmd "python3 -c \" import json p='$CMS_ROOT/redis.json' try: d=json.load(open(p)) except: d={} d['host']='$MAIN_HOST' json.dump(d, open(p,'w'), indent=2) \"" 2>/dev/null || ssh_cmd "echo '{\"enabled\":0,\"host\":\"$MAIN_HOST\",\"port\":6379,\"password\":\"\",\"prefix\":\"xtream:\",\"db\":0}' > $CMS_ROOT/redis.json" echo "[*] CMS remote panel (cms_bootstrap.php ships with admin/)" ssh_cmd "test -f $CMS_ROOT/admin/cms_bootstrap.php || { echo 'ERROR: cms_bootstrap.php missing in admin/'; exit 1; }" echo "[*] php-fpm wrapper + socket group for system nginx" ssh_cmd "cat > $CMS_ROOT/php/sbin/php-fpm-xtream.sh <<'WRAP' #!/bin/bash XC=/home/xtreamcodes/iptv_xtream_codes export LD_LIBRARY_PATH=\"\$XC/lib/legacy:\$XC/lib/curl/lib:\$XC/lib\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}\" exec \"\$XC/php/sbin/php-fpm\" \"\$@\" WRAP chmod +x $CMS_ROOT/php/sbin/php-fpm-xtream.sh for c in $CMS_ROOT/php/etc/*.conf; do sed -i 's/^listen.group = xtreamcodes/listen.group = www-data/' \"\$c\" grep -q 'env\\[LD_LIBRARY_PATH\\]' \"\$c\" || sed -i '/^\\[xtreamcodes\\]/a env[LD_LIBRARY_PATH] = $CMS_ROOT/lib/curl/lib:$CMS_ROOT/lib' \"\$c\" done usermod -aG xtreamcodes www-data 2>/dev/null || true" echo "[*] system nginx :80 / :443 (bundled xc nginx may segfault on CMS)" ssh_cmd "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nginx openssl 2>/dev/null || true cat > /etc/nginx/sites-available/xtream-cms.conf <<'NGX' upstream xc_php { least_conn; server unix:$CMS_ROOT/php/VaiIb8.sock; server unix:$CMS_ROOT/php/JdlJXm.sock; server unix:$CMS_ROOT/php/CWcfSP.sock; server unix:$CMS_ROOT/php/A5mN2x.sock; server unix:$CMS_ROOT/php/T8pQ4k.sock; } server { listen 80 default_server; listen [::]:80 default_server; server_name _; root $CMS_ROOT/admin; index login.php; server_tokens off; location ~ \\.php\$ { try_files \$uri =404; include fastcgi_params; fastcgi_pass xc_php; fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name; } } server { listen 443 ssl default_server; listen [::]:443 ssl default_server; server_name _; ssl_certificate $CMS_ROOT/nginx/conf/server.crt; ssl_certificate_key $CMS_ROOT/nginx/conf/server.key; ssl_protocols TLSv1.2 TLSv1.3; root $CMS_ROOT/admin; index login.php; server_tokens off; location ~ \\.php\$ { try_files \$uri =404; include fastcgi_params; fastcgi_pass xc_php; fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name; } } NGX ln -sf /etc/nginx/sites-available/xtream-cms.conf /etc/nginx/sites-enabled/xtream-cms.conf rm -f /etc/nginx/sites-enabled/default nginx -t && systemctl enable nginx" echo "[*] Permissions + start services" ssh_cmd "chown -R xtreamcodes:xtreamcodes /home/xtreamcodes chmod 600 $CMS_ROOT/config cat > $CMS_ROOT/php/sbin/start-fpm-pools.sh <<'START' #!/bin/bash set -euo pipefail XC=/home/xtreamcodes/iptv_xtream_codes WRAP=\"\$XC/php/sbin/php-fpm-xtream.sh\" for c in \"\$XC/php/etc/\"*.conf; do [ -f \"\$c\" ] || continue sock=\$(grep -m1 '^listen = ' \"\$c\" | sed 's/^listen = //;s/^[[:space:]]*//') [ -n \"\$sock\" ] && [ -S \"\$sock\" ] && continue \"\$WRAP\" --daemonize --fpm-config \"\$c\" done [ \"\$(ls -1 \"\$XC/php/\"*.sock 2>/dev/null | wc -l)\" -ge 1 ] || exit 1 START cat > $CMS_ROOT/php/sbin/stop-fpm-pools.sh <<'STOP' #!/bin/bash XC=/home/xtreamcodes/iptv_xtream_codes pkill -f \"\$XC/php/etc/.*\\.conf\" 2>/dev/null || true sleep 1 rm -f \"\$XC/php/\"*.sock 2>/dev/null || true STOP chmod +x $CMS_ROOT/php/sbin/start-fpm-pools.sh $CMS_ROOT/php/sbin/stop-fpm-pools.sh cat > $CMS_ROOT/php/sbin/restart-fpm-pools.sh <<'RST' #!/bin/bash set -euo pipefail D=/home/xtreamcodes/iptv_xtream_codes/php/sbin \"\$D/stop-fpm-pools.sh\" sleep 1 \"\$D/start-fpm-pools.sh\" RST chmod +x $CMS_ROOT/php/sbin/restart-fpm-pools.sh cat > /etc/systemd/system/xtream-php-fpm.service </dev/null 2>&1; then cms_panel_bootstrap "$CMS_HOST" "$CMS_PASS" "$CMS_VLAN" "$MAIN_HOST" \ "$MAIN_SSH_HOST" "$MAIN_SSH_PASS" "$CMS_ROOT" "$MAIN_ROOT" else echo "WARN: cms-panel-bootstrap.sh missing — run fix-cms-production.sh after install" >&2 fi echo "[*] Daily backup cron (03:00) + log dir" ssh_cmd "mkdir -p $CMS_ROOT/logs $CMS_ROOT/tmp /home/backups chown xtreamcodes:xtreamcodes /home/backups $CMS_ROOT/logs $CMS_ROOT/tmp 2>/dev/null || true chmod +x $CMS_ROOT/crons/run_panel_backup.sh 2>/dev/null || true CRON_LINE='0 3 * * * $CMS_ROOT/crons/run_panel_backup.sh >> $CMS_ROOT/logs/panel_backup.log 2>&1' ( crontab -u xtreamcodes -l 2>/dev/null | grep -v run_panel_backup.sh || true echo \"\$CRON_LINE\" ) | crontab -u xtreamcodes - crontab -u xtreamcodes -l | grep -q run_panel_backup.sh && echo ' cron: daily 03:00 OK' || echo ' cron: install failed — add manually'" echo "[*] Test DB from CMS" ssh_cmd "export LD_LIBRARY_PATH=$CMS_ROOT/lib/curl/lib $CMS_ROOT/php/bin/php -r \" chdir('$CMS_ROOT/admin'); define('MAIN_DIR','$CMS_ROOT/'); define('CONFIG_CRYPT_KEY','5709650b0d7806074842c6de575025b1'); function xor_parse(\$d,\$k){\\\$o='';for(\\\$i=0;\\\$i