Kokkoja: first public assembly

Assembled from the development repository by tools/make_release.sh.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/setup_vps.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# Set up, or bring up to date, the Kokkoja server on this machine.  Run as
+# root ON THE SERVER, after deploy/deploy.sh has copied the files to
+# /opt/kokkoja/incoming.  Safe to run again: every step checks first.
+#
+# What it makes:
+#   /opt/kokkoja/relay/      the relay's code
+#   /opt/kokkoja/venv/       Python with the websockets library
+#   /var/www/kokkoja/        the client, with config.json
+#   kokkoja-relay.service    the relay, as the system user "kokkoja"
+#   nginx site "kokkoja"     the web site and the relay behind TLS
+#
+# TLS is the one step left to a person, once the name resolves to this
+# machine (see deploy/README.md):
+#   certbot --nginx -d kokkoja.andykopra.com
+
+set -euo pipefail
+incoming=/opt/kokkoja/incoming
+test -d "$incoming" || { echo "nothing in $incoming: run deploy/deploy.sh first" >&2; exit 1; }
+
+if ! id kokkoja >/dev/null 2>&1; then
+    useradd --system --no-create-home --shell /usr/sbin/nologin kokkoja
+fi
+
+# Python with the websockets library, in a virtual environment of its own.
+if ! python3 -c 'import ensurepip' >/dev/null 2>&1; then
+    apt-get install -y python3-venv
+fi
+if [ ! -x /opt/kokkoja/venv/bin/python ]; then
+    python3 -m venv /opt/kokkoja/venv
+fi
+/opt/kokkoja/venv/bin/pip install --quiet --upgrade pip
+/opt/kokkoja/venv/bin/pip install --quiet -r "$incoming/relay/requirements.txt"
+
+# The relay's code, and the client.
+rm -rf /opt/kokkoja/relay
+cp -r "$incoming/relay" /opt/kokkoja/relay
+chmod -R a+rX /opt/kokkoja/relay
+mkdir -p /var/www/kokkoja
+rsync -a --delete "$incoming/client/" /var/www/kokkoja/
+chmod -R a+rX /var/www/kokkoja
+
+# The service.
+install -m 644 "$incoming/deploy/kokkoja-relay.service" /etc/systemd/system/kokkoja-relay.service
+systemctl daemon-reload
+systemctl enable --quiet kokkoja-relay.service
+systemctl restart kokkoja-relay.service
+
+# The nginx site.  Once certbot has edited the installed copy, it is not
+# replaced: certbot's additions would be lost.
+if [ ! -e /etc/nginx/sites-available/kokkoja ]; then
+    install -m 644 "$incoming/deploy/nginx-site.conf" /etc/nginx/sites-available/kokkoja
+elif ! grep -q "managed by Certbot" /etc/nginx/sites-available/kokkoja; then
+    install -m 644 "$incoming/deploy/nginx-site.conf" /etc/nginx/sites-available/kokkoja
+else
+    echo "nginx site left as certbot made it; compare with deploy/nginx-site.conf by hand"
+fi
+ln -sf ../sites-available/kokkoja /etc/nginx/sites-enabled/kokkoja
+nginx -t
+systemctl reload nginx
+
+systemctl --no-pager --lines=3 status kokkoja-relay.service || true
+echo "Kokkoja server is set up."