feat(deploy): three deployment modes + prebuilt multi-arch image for robust self-hosting
Make Backspace self-hostable in any homelab environment, not just a clean host
that owns ports 80/443.
install.sh is now mode-aware and auto-detects which fits:
- allinone (default): bundled Caddy + auto-HTTPS — unchanged behavior
- proxy: behind your own reverse proxy (nginx / Traefik / Caddy / Nginx Proxy
Manager / SWAG) — app published on 127.0.0.1:APP_PORT, no bundled Caddy,
prints paste-ready proxy snippets
- tunnel: behind a tunnel (Cloudflare / Tailscale) — same, plus a 90MB upload
cap (under Cloudflare's 100MB body limit) and voice force-disabled (WebRTC
over UDP can't traverse a tunnel)
Port detection is Docker-aware (consults `docker ps` published ports, not just
`ss`), so a host whose proxy already owns 80/443 via iptables DNAT — with no
listening socket for `ss` to see — is correctly detected as "taken" instead of
dead-ending.
docker-compose.proxy.yml is a small overlay, layered via COMPOSE_FILE (written
into .env so no `-f` flags are ever needed), that publishes the loopback port and
parks Caddy in an inert profile. The base compose file is untouched, so All-in-One
behaves exactly as before.
Prebuilt image: .github/workflows/docker-publish.yml builds and pushes a
multi-arch (linux/amd64 + linux/arm64) image to ghcr.io/thezwiss/backspace on
release tags (and manual dispatch), so weak/ARM hosts skip the ~1.6GB local build
(the Vite build OOMs small ARM boxes). install.sh and docker-compose.yml default
to pulling it, fall back to an image already present on the host, and finally to a
from-source build — AGPL §13 commit stamping preserved on every path. Kept
deliberately separate from the desktop-installer workflow (release.yml).
Docs: README gains a "Deployment modes" section (all three modes, nginx / Caddy /
Traefik snippets, GUI-proxy field-by-field, cloudflared ingress, the update path,
and voice-per-mode caveats); docs/systems/deployment.md updated to match.
Verified live on a throwaway VM: proxy + all-in-one end-to-end through install.sh
(with a real Let's Encrypt cert), tunnel config generation, loopback-only binding,
and the local-image fallback path.
This commit is contained in:
Jannis Braun
+634
-138
@@ -2,13 +2,31 @@
|
||||
# ============================================================
|
||||
# Backspace — Production Installer
|
||||
# ============================================================
|
||||
# Sets up Backspace with Caddy (auto-HTTPS) and optional
|
||||
# LiveKit (voice/video) on a Linux server.
|
||||
# Sets up Backspace on a Linux server in one of three deployment modes,
|
||||
# auto-detecting which one fits your environment:
|
||||
#
|
||||
# allinone The bundled Caddy owns ports 80/443 and does automatic HTTPS
|
||||
# for your domain. The simplest setup — pick this if 80/443 are free.
|
||||
# proxy You already run a reverse proxy (nginx, Traefik, Caddy, Nginx Proxy
|
||||
# Manager, SWAG…). Backspace is published on 127.0.0.1:APP_PORT and
|
||||
# the installer prints ready-to-paste proxy config. No bundled Caddy.
|
||||
# tunnel You expose the box through a tunnel (Cloudflare Tunnel, Tailscale…).
|
||||
# Same as proxy, plus tunnel-specific guidance. (Voice does not work
|
||||
# over a tunnel — WebRTC/UDP can't traverse it.)
|
||||
#
|
||||
# Usage:
|
||||
# ./install.sh Interactive setup
|
||||
# ./install.sh Interactive setup (auto-detects the mode)
|
||||
#
|
||||
# Non-interactive — set any/all of these to skip the matching prompt:
|
||||
# DOMAIN=chat.example.com ENABLE_VOICE=true INSTANCE_NAME="My Chat" ./install.sh
|
||||
# DOMAIN=chat.example.com \
|
||||
# DEPLOY_MODE=allinone|proxy|tunnel \
|
||||
# APP_PORT=8080 \ # proxy/tunnel only; auto-picked if unset
|
||||
# ENABLE_VOICE=true \
|
||||
# INSTANCE_NAME="My Chat" \
|
||||
# ./install.sh
|
||||
#
|
||||
# BACKSPACE_BUILD=true ./install.sh Force a local from-source build instead of
|
||||
# pulling the prebuilt image (fork operators).
|
||||
# ============================================================
|
||||
|
||||
set -euo pipefail
|
||||
@@ -97,56 +115,84 @@ if ! $COMPOSE version &>/dev/null 2>&1; then
|
||||
fi
|
||||
success "Docker Compose $($COMPOSE version --short 2>/dev/null || echo 'installed')"
|
||||
|
||||
# Check if ports 80/443 are available
|
||||
check_port() {
|
||||
local port=$1
|
||||
if ss -tlnp 2>/dev/null | grep -qE ":${port}\b"; then
|
||||
local proc
|
||||
proc=$(ss -tlnp 2>/dev/null | grep -E ":${port}\b" | grep -oP 'users:\(\("\K[^"]+' | head -1 || echo "unknown")
|
||||
error "Port $port is already in use by: $proc"
|
||||
error "Free port $port before running this script."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
# ── Port helpers ────────────────────────────────────────────
|
||||
# A host port can be held in two ways this installer must detect:
|
||||
# 1. A normal listening socket (host process) → visible via `ss -tln`.
|
||||
# 2. A Docker-published port. With the userland proxy *disabled*
|
||||
# (`userland-proxy: false`, common on tuned hosts), Docker DNATs the port
|
||||
# with iptables and there is NO listening socket for `ss` to see. So we must
|
||||
# also consult `docker ps` — otherwise a box whose Caddy already owns 80/443
|
||||
# via iptables would be misreported as "ports free".
|
||||
|
||||
# Does any running container publish this host port? (matches "…:<port>->" in the
|
||||
# Ports column; the ":" before the port and "->" after pin it to the HOST port,
|
||||
# so :80 doesn't match :8080 and never matches the container-side port.)
|
||||
docker_publishes_port() {
|
||||
$DOCKER ps --format '{{.Names}} {{.Ports}}' 2>/dev/null | grep -qE ":${1}->"
|
||||
}
|
||||
|
||||
# Only check ports if we're NOT already running (upgrade scenario)
|
||||
if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q '^caddy$'; then
|
||||
port_ok=true
|
||||
check_port 80 || port_ok=false
|
||||
check_port 443 || port_ok=false
|
||||
if [[ "$port_ok" == false ]]; then
|
||||
exit 1
|
||||
# Same, but ignore Backspace's own container (used when re-running on a host that
|
||||
# already runs this instance — its published port must not count as a conflict).
|
||||
docker_publishes_port_other() {
|
||||
$DOCKER ps --format '{{.Names}} {{.Ports}}' 2>/dev/null \
|
||||
| grep -vE '^backspace ' | grep -qE ":${1}->"
|
||||
}
|
||||
|
||||
# Is the port in use by anything (host socket OR any container)?
|
||||
port_in_use() {
|
||||
local port=$1
|
||||
if ss -tln 2>/dev/null | grep -qE ":${port}[[:space:]]"; then
|
||||
return 0
|
||||
fi
|
||||
success "Ports 80 and 443 are available"
|
||||
else
|
||||
success "Caddy is already running (upgrade mode)"
|
||||
docker_publishes_port "$port"
|
||||
}
|
||||
|
||||
# In use by something OTHER than our own Backspace container?
|
||||
port_in_use_by_other() {
|
||||
local port=$1
|
||||
if ss -tln 2>/dev/null | grep -qE ":${port}[[:space:]]"; then
|
||||
return 0
|
||||
fi
|
||||
docker_publishes_port_other "$port"
|
||||
}
|
||||
|
||||
# Best-effort human description of what holds a port (for helpful warnings).
|
||||
port_holder() {
|
||||
local port=$1 holder=""
|
||||
holder=$($DOCKER ps --format '{{.Names}} {{.Ports}}' 2>/dev/null \
|
||||
| grep -E ":${port}->" | awk '{print $1}' | head -1 || true)
|
||||
if [[ -n "$holder" ]]; then
|
||||
echo "docker container '$holder'"
|
||||
return
|
||||
fi
|
||||
holder=$(ss -tlnp 2>/dev/null | grep -E ":${port}[[:space:]]" \
|
||||
| grep -oP 'users:\(\("\K[^"]+' | head -1 || true)
|
||||
echo "${holder:-another process}"
|
||||
}
|
||||
|
||||
# ── openssl (needed for secret generation) ──────────────────
|
||||
if ! command -v openssl &>/dev/null; then
|
||||
error "openssl is required for generating secrets."
|
||||
error "Install: sudo apt-get install openssl"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Disk space check
|
||||
available_kb=$(df -k . 2>/dev/null | tail -1 | awk '{print $4}' || true)
|
||||
if [[ -n "$available_kb" ]] && (( available_kb < 3000000 )); then
|
||||
warn "Low disk space: $((available_kb / 1024))MB available (recommend 3GB+)"
|
||||
warn "The prebuilt image (~1.6GB pulled) needs less than a from-source build."
|
||||
else
|
||||
success "Disk space OK"
|
||||
fi
|
||||
|
||||
# Check for openssl (needed for secret generation)
|
||||
if ! command -v openssl &>/dev/null; then
|
||||
error "openssl is required for generating secrets."
|
||||
error "Install: sudo apt-get install openssl"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ── Phase 2: Configuration ─────────────────────────────────
|
||||
|
||||
step "Configuration"
|
||||
|
||||
# Detect existing installation
|
||||
EXISTING_ENV=false
|
||||
if [[ -f .env ]]; then
|
||||
EXISTING_ENV=true
|
||||
info "Existing .env detected — secrets will be preserved."
|
||||
info "Existing .env detected — secrets and settings will be preserved."
|
||||
fi
|
||||
|
||||
# Helper: read existing .env value (|| true prevents set -e from killing
|
||||
@@ -157,17 +203,131 @@ env_val() {
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Deployment mode ─────────────────────────────────────────
|
||||
# Precedence: explicit DEPLOY_MODE env → existing .env → auto-detect + prompt.
|
||||
# Auto-detect never dead-ends: if 80/443 are taken, All-in-One is simply off the
|
||||
# menu and we steer the operator to proxy/tunnel instead.
|
||||
|
||||
existing_mode=$(env_val DEPLOY_MODE)
|
||||
CADDY_RUNNING=false
|
||||
if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q '^caddy$'; then
|
||||
CADDY_RUNNING=true
|
||||
fi
|
||||
|
||||
port80_free=true; port443_free=true
|
||||
port_in_use 80 && port80_free=false
|
||||
port_in_use 443 && port443_free=false
|
||||
|
||||
choose_mode_interactively() {
|
||||
# Writes the chosen mode to the global DEPLOY_MODE.
|
||||
local choice=""
|
||||
if [[ "$port80_free" == true && "$port443_free" == true ]]; then
|
||||
echo " Ports 80 and 443 are free — All-in-One (bundled Caddy + auto-HTTPS) is available."
|
||||
echo ""
|
||||
echo " How do you want to expose Backspace?"
|
||||
echo -e " ${BOLD}1)${NC} All-in-One — bundled Caddy handles HTTPS for you ${GREEN}(recommended)${NC}"
|
||||
echo -e " ${BOLD}2)${NC} Behind my own reverse proxy (nginx, Traefik, Caddy, Nginx Proxy Manager, SWAG…)"
|
||||
echo -e " ${BOLD}3)${NC} Behind a tunnel (Cloudflare Tunnel, Tailscale…)"
|
||||
echo ""
|
||||
read -rp " Choice [1]: " choice || choice=""
|
||||
case "${choice:-1}" in
|
||||
1) DEPLOY_MODE=allinone ;;
|
||||
2) DEPLOY_MODE=proxy ;;
|
||||
3) DEPLOY_MODE=tunnel ;;
|
||||
*) DEPLOY_MODE=allinone ;;
|
||||
esac
|
||||
else
|
||||
warn "Ports 80/443 are already in use on this host:"
|
||||
[[ "$port80_free" == false ]] && echo " 80 → held by $(port_holder 80)"
|
||||
[[ "$port443_free" == false ]] && echo " 443 → held by $(port_holder 443)"
|
||||
echo ""
|
||||
info "All-in-One needs 80 and 443 free, so it's unavailable here."
|
||||
info "That's fine — run Backspace behind what already owns those ports:"
|
||||
echo ""
|
||||
echo -e " ${BOLD}1)${NC} Behind my own reverse proxy (nginx, Traefik, Caddy, Nginx Proxy Manager, SWAG…) ${GREEN}(recommended)${NC}"
|
||||
echo -e " ${BOLD}2)${NC} Behind a tunnel (Cloudflare Tunnel, Tailscale…)"
|
||||
echo -e " ${BOLD}3)${NC} Nothing yet — I'll free 80/443 and use All-in-One (exit so I can do that)"
|
||||
echo ""
|
||||
read -rp " Choice [1]: " choice || choice=""
|
||||
case "${choice:-1}" in
|
||||
1) DEPLOY_MODE=proxy ;;
|
||||
2) DEPLOY_MODE=tunnel ;;
|
||||
3)
|
||||
error "Free ports 80 and 443, then re-run ./install.sh for All-in-One mode."
|
||||
exit 1
|
||||
;;
|
||||
*) DEPLOY_MODE=proxy ;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ -n "${DEPLOY_MODE:-}" ]]; then
|
||||
info "Deployment mode: ${DEPLOY_MODE} (from environment)"
|
||||
elif [[ -n "$existing_mode" ]]; then
|
||||
DEPLOY_MODE="$existing_mode"
|
||||
info "Deployment mode: ${DEPLOY_MODE} (from existing .env)"
|
||||
info "To switch modes, re-run with DEPLOY_MODE=allinone|proxy|tunnel."
|
||||
elif [[ -t 0 ]]; then
|
||||
echo ""
|
||||
choose_mode_interactively
|
||||
else
|
||||
# Non-interactive with no DEPLOY_MODE: pick a safe, never-dead-end default.
|
||||
if [[ "$port80_free" == true && "$port443_free" == true ]]; then
|
||||
DEPLOY_MODE=allinone
|
||||
else
|
||||
DEPLOY_MODE=proxy
|
||||
warn "Ports 80/443 are in use and no DEPLOY_MODE was given — defaulting to 'proxy'."
|
||||
fi
|
||||
info "Deployment mode: ${DEPLOY_MODE} (auto-detected)"
|
||||
fi
|
||||
|
||||
case "$DEPLOY_MODE" in
|
||||
allinone|proxy|tunnel) ;;
|
||||
*)
|
||||
error "Invalid DEPLOY_MODE='${DEPLOY_MODE}'. Use allinone, proxy, or tunnel."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# All-in-One requires 80/443 — but a re-run over an existing All-in-One instance
|
||||
# legitimately finds *its own* Caddy holding them (an upgrade), which is fine.
|
||||
if [[ "$DEPLOY_MODE" == "allinone" ]]; then
|
||||
if [[ "$CADDY_RUNNING" == true ]]; then
|
||||
success "Caddy is already running (All-in-One upgrade)"
|
||||
elif [[ "$port80_free" == false || "$port443_free" == false ]]; then
|
||||
error "All-in-One mode needs ports 80 and 443 free, but:"
|
||||
[[ "$port80_free" == false ]] && error " 80 is held by $(port_holder 80)"
|
||||
[[ "$port443_free" == false ]] && error " 443 is held by $(port_holder 443)"
|
||||
error "Free them, or re-run with DEPLOY_MODE=proxy (or =tunnel) to run behind them."
|
||||
exit 1
|
||||
else
|
||||
success "Ports 80 and 443 are available"
|
||||
fi
|
||||
fi
|
||||
|
||||
# In proxy/tunnel mode, layer the proxy override so Caddy is dropped and the app
|
||||
# is published on a loopback port. Compose reads COMPOSE_FILE (from the shell and
|
||||
# from .env) to pick up both files for every command — the operator never needs
|
||||
# to remember `-f` flags afterwards.
|
||||
if [[ "$DEPLOY_MODE" == "proxy" || "$DEPLOY_MODE" == "tunnel" ]]; then
|
||||
export COMPOSE_FILE="docker-compose.yml:docker-compose.proxy.yml"
|
||||
else
|
||||
unset COMPOSE_FILE 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# ── Domain ──────────────────────────────────────────────────
|
||||
# Required in every mode: it's the public hostname clients use and it drives the
|
||||
# federation identity + LiveKit URL. In proxy/tunnel mode TLS is terminated at
|
||||
# your edge, but the app still advertises https://DOMAIN.
|
||||
|
||||
existing_domain=$(env_val DOMAIN)
|
||||
if [[ -n "${DOMAIN:-}" ]]; then
|
||||
# Non-interactive: DOMAIN set via environment
|
||||
:
|
||||
elif [[ -n "$existing_domain" ]]; then
|
||||
read -rp "Domain [$existing_domain]: " DOMAIN
|
||||
read -rp "Domain [$existing_domain]: " DOMAIN || DOMAIN=""
|
||||
DOMAIN="${DOMAIN:-$existing_domain}"
|
||||
else
|
||||
read -rp "Domain (e.g., chat.example.com): " DOMAIN
|
||||
read -rp "Domain (e.g., chat.example.com): " DOMAIN || DOMAIN=""
|
||||
fi
|
||||
|
||||
if [[ -z "${DOMAIN:-}" ]]; then
|
||||
@@ -175,42 +335,93 @@ if [[ -z "${DOMAIN:-}" ]]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# DNS verification
|
||||
info "Verifying DNS for ${DOMAIN}..."
|
||||
# DNS verification is meaningful for All-in-One (Caddy must reach this host to
|
||||
# issue a certificate). In proxy/tunnel mode the DNS record points at your proxy
|
||||
# or tunnel edge — often NOT this host's IP (that's the whole point) — so we only
|
||||
# note what it resolves to, without warning about a mismatch.
|
||||
info "Checking DNS for ${DOMAIN}..."
|
||||
resolved_ip=""
|
||||
if command -v dig &>/dev/null; then
|
||||
resolved_ip=$(dig +short "$DOMAIN" A 2>/dev/null | tail -1 || true)
|
||||
elif command -v getent &>/dev/null; then
|
||||
# A non-resolving domain makes `getent hosts` exit 2, and with `set -o
|
||||
# pipefail` that would abort the installer here — before the graceful
|
||||
# "Could not resolve" warning below. Swallow it: an empty result is the
|
||||
# intended "not resolved yet" signal (installing before DNS is set up is
|
||||
# explicitly supported).
|
||||
resolved_ip=$(getent hosts "$DOMAIN" 2>/dev/null | awk '{print $1}' | head -1 || true)
|
||||
fi
|
||||
|
||||
my_ip=$(curl -s4 --connect-timeout 5 ifconfig.me 2>/dev/null || curl -s4 --connect-timeout 5 icanhazip.com 2>/dev/null || echo "")
|
||||
|
||||
if [[ -z "$resolved_ip" ]]; then
|
||||
warn "Could not resolve ${DOMAIN}. Ensure DNS is configured before Caddy can issue certificates."
|
||||
elif [[ -n "$my_ip" && "$resolved_ip" != "$my_ip" ]]; then
|
||||
warn "${DOMAIN} resolves to ${resolved_ip}, but this server appears to be ${my_ip}"
|
||||
warn "Let's Encrypt certificate issuance may fail if DNS doesn't point here."
|
||||
if [[ "$DEPLOY_MODE" == "allinone" ]]; then
|
||||
my_ip=$(curl -s4 --connect-timeout 5 ifconfig.me 2>/dev/null || curl -s4 --connect-timeout 5 icanhazip.com 2>/dev/null || echo "")
|
||||
if [[ -z "$resolved_ip" ]]; then
|
||||
warn "Could not resolve ${DOMAIN}. Ensure DNS is configured before Caddy can issue certificates."
|
||||
elif [[ -n "$my_ip" && "$resolved_ip" != "$my_ip" ]]; then
|
||||
warn "${DOMAIN} resolves to ${resolved_ip}, but this server appears to be ${my_ip}"
|
||||
warn "Let's Encrypt certificate issuance may fail if DNS doesn't point here."
|
||||
else
|
||||
success "${DOMAIN} resolves to ${resolved_ip:-verified}"
|
||||
fi
|
||||
else
|
||||
success "${DOMAIN} resolves to ${resolved_ip:-verified}"
|
||||
if [[ -n "$resolved_ip" ]]; then
|
||||
info "${DOMAIN} currently resolves to ${resolved_ip} (should point at your proxy/tunnel edge)."
|
||||
else
|
||||
info "${DOMAIN} does not resolve yet — point it at your proxy/tunnel edge when ready."
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── App port (proxy / tunnel only) ──────────────────────────
|
||||
# The loopback host port your proxy/tunnel forwards to. Auto-picked to avoid
|
||||
# common clashes (3000/8080 are frequently taken) unless APP_PORT is set.
|
||||
|
||||
pick_free_port() {
|
||||
if [[ -n "${APP_PORT:-}" ]]; then
|
||||
if port_in_use_by_other "$APP_PORT"; then
|
||||
error "Requested APP_PORT=$APP_PORT is already in use by $(port_holder "$APP_PORT")."
|
||||
exit 1
|
||||
fi
|
||||
echo "$APP_PORT"; return
|
||||
fi
|
||||
local existing; existing=$(env_val APP_PORT)
|
||||
if [[ -n "$existing" ]]; then
|
||||
# Re-run: keep the existing port so the proxy/tunnel config stays valid, even
|
||||
# though our own container is currently publishing it.
|
||||
echo "$existing"; return
|
||||
fi
|
||||
local p
|
||||
for p in 8080 8081 8082 8090 8095 3001 3002 18080 28080; do
|
||||
if ! port_in_use "$p"; then echo "$p"; return; fi
|
||||
done
|
||||
for p in $(seq 8100 8200); do
|
||||
if ! port_in_use "$p"; then echo "$p"; return; fi
|
||||
done
|
||||
error "Could not find a free host port for the app. Set APP_PORT to a free port and re-run."
|
||||
exit 1
|
||||
}
|
||||
|
||||
APP_PORT_FINAL=""
|
||||
if [[ "$DEPLOY_MODE" == "proxy" || "$DEPLOY_MODE" == "tunnel" ]]; then
|
||||
APP_PORT_FINAL="$(pick_free_port)"
|
||||
success "App will be published on 127.0.0.1:${APP_PORT_FINAL}"
|
||||
fi
|
||||
|
||||
# ── Voice/Video ─────────────────────────────────────────────
|
||||
# Voice needs open UDP media ports and (in proxy mode) a /livekit route. Over a
|
||||
# tunnel, WebRTC/UDP cannot traverse the edge at all — so voice is force-disabled
|
||||
# in tunnel mode rather than silently configured and then failing at call time.
|
||||
|
||||
existing_profiles=$(env_val COMPOSE_PROFILES)
|
||||
if [[ -n "${ENABLE_VOICE:-}" ]]; then
|
||||
# Non-interactive
|
||||
if [[ "$DEPLOY_MODE" == "tunnel" ]]; then
|
||||
if [[ "${ENABLE_VOICE:-}" == "true" ]]; then
|
||||
warn "Voice cannot work over a tunnel (WebRTC/UDP can't traverse it) — disabling it."
|
||||
fi
|
||||
ENABLE_VOICE=false
|
||||
info "Voice/video is disabled in tunnel mode (a known, unavoidable limitation)."
|
||||
elif [[ -n "${ENABLE_VOICE:-}" ]]; then
|
||||
:
|
||||
elif [[ "$existing_profiles" == *"voice"* ]]; then
|
||||
read -rp "Voice/video is currently enabled. Keep it? [Y/n] " yn
|
||||
read -rp "Voice/video is currently enabled. Keep it? [Y/n] " yn || yn=""
|
||||
ENABLE_VOICE=$([[ "${yn,,}" == "n" ]] && echo false || echo true)
|
||||
else
|
||||
read -rp "Enable voice/video? (requires open UDP ports) [Y/n] " yn
|
||||
if [[ "$DEPLOY_MODE" == "proxy" ]]; then
|
||||
info "Voice needs open UDP media ports AND a /livekit route in your proxy (snippet printed at the end)."
|
||||
fi
|
||||
read -rp "Enable voice/video? (requires open UDP ports) [Y/n] " yn || yn=""
|
||||
ENABLE_VOICE=$([[ "${yn,,}" == "n" ]] && echo false || echo true)
|
||||
fi
|
||||
ENABLE_VOICE="${ENABLE_VOICE:-true}"
|
||||
@@ -219,10 +430,26 @@ ENABLE_VOICE="${ENABLE_VOICE:-true}"
|
||||
|
||||
existing_name=$(env_val INSTANCE_NAME)
|
||||
if [[ -z "${INSTANCE_NAME:-}" ]]; then
|
||||
read -rp "Instance name [${existing_name:-Backspace}]: " INSTANCE_NAME
|
||||
read -rp "Instance name [${existing_name:-Backspace}]: " INSTANCE_NAME || INSTANCE_NAME=""
|
||||
INSTANCE_NAME="${INSTANCE_NAME:-${existing_name:-Backspace}}"
|
||||
fi
|
||||
|
||||
# ── Max upload size ─────────────────────────────────────────
|
||||
# Cloudflare (free/pro) hard-caps request bodies at 100MB, so a 100MB app limit
|
||||
# lets uploads fail at the edge instead of in-app. In tunnel mode we default the
|
||||
# cap below that (90MB) with headroom for multipart overhead. An explicit
|
||||
# MAX_UPLOAD_SIZE (env or existing .env) always wins.
|
||||
existing_max=$(env_val MAX_UPLOAD_SIZE)
|
||||
if [[ -n "${MAX_UPLOAD_SIZE:-}" ]]; then
|
||||
:
|
||||
elif [[ -n "$existing_max" ]]; then
|
||||
MAX_UPLOAD_SIZE="$existing_max"
|
||||
elif [[ "$DEPLOY_MODE" == "tunnel" ]]; then
|
||||
MAX_UPLOAD_SIZE=94371840 # 90 MB — under Cloudflare's 100MB body cap
|
||||
else
|
||||
MAX_UPLOAD_SIZE=104857600 # 100 MB
|
||||
fi
|
||||
|
||||
# ── Phase 3: Generate Secrets ───────────────────────────────
|
||||
|
||||
step "Generating configuration"
|
||||
@@ -259,12 +486,31 @@ step "Writing configuration files"
|
||||
|
||||
# ── .env ────────────────────────────────────────────────────
|
||||
|
||||
cat > .env << EOF
|
||||
{
|
||||
cat << EOF
|
||||
# Backspace Configuration
|
||||
# Generated by install.sh on $(date -u +"%Y-%m-%dT%H:%M:%SZ")
|
||||
|
||||
DOMAIN=${DOMAIN}
|
||||
|
||||
# Deployment mode: allinone | proxy | tunnel (see ./install.sh --help / README)
|
||||
DEPLOY_MODE=${DEPLOY_MODE}
|
||||
EOF
|
||||
|
||||
if [[ "$DEPLOY_MODE" == "proxy" || "$DEPLOY_MODE" == "tunnel" ]]; then
|
||||
cat << EOF
|
||||
|
||||
# Reverse-proxy / tunnel mode: layer the proxy override so the bundled Caddy is
|
||||
# dropped and the app is published on 127.0.0.1:APP_PORT for your edge to reach.
|
||||
# COMPOSE_FILE makes every 'docker compose' command in this directory use both
|
||||
# files automatically — no -f flags needed.
|
||||
COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml
|
||||
APP_PORT=${APP_PORT_FINAL}
|
||||
EOF
|
||||
fi
|
||||
|
||||
cat << EOF
|
||||
|
||||
# Server
|
||||
PORT=3000
|
||||
HOST=0.0.0.0
|
||||
@@ -275,12 +521,12 @@ JWT_SECRET=${JWT_SECRET}
|
||||
# Registration
|
||||
REGISTRATION_OPEN=true
|
||||
|
||||
# Max upload size in bytes (100MB)
|
||||
MAX_UPLOAD_SIZE=104857600
|
||||
# Max upload size in bytes
|
||||
MAX_UPLOAD_SIZE=${MAX_UPLOAD_SIZE}
|
||||
EOF
|
||||
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
cat >> .env << EOF
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
cat << EOF
|
||||
|
||||
# LiveKit Voice/Video
|
||||
LIVEKIT_URL=wss://${DOMAIN}/livekit
|
||||
@@ -290,8 +536,8 @@ LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}
|
||||
# Activate the LiveKit service in Docker Compose
|
||||
COMPOSE_PROFILES=voice
|
||||
EOF
|
||||
else
|
||||
cat >> .env << EOF
|
||||
else
|
||||
cat << EOF
|
||||
|
||||
# LiveKit Voice/Video (disabled)
|
||||
# To enable: fill in credentials and add COMPOSE_PROFILES=voice
|
||||
@@ -299,7 +545,8 @@ else
|
||||
# LIVEKIT_API_KEY=
|
||||
# LIVEKIT_API_SECRET=
|
||||
EOF
|
||||
fi
|
||||
fi
|
||||
} > .env
|
||||
|
||||
success ".env"
|
||||
|
||||
@@ -382,14 +629,43 @@ step "Deploying Backspace"
|
||||
# so GET /api/instance/info advertises the exact source version. Passed straight
|
||||
# to the build as --build-arg (survives the sudo/non-sudo $COMPOSE split, unlike
|
||||
# an exported env var). Empty when this isn't a git checkout (e.g. tarball
|
||||
# install) or git is unavailable → the server treats the commit as null.
|
||||
# install) or git is unavailable → the server treats the commit as null. A pulled
|
||||
# prebuilt image already carries the commit baked at CI build time.
|
||||
BUILD_COMMIT="$(git rev-parse --short HEAD 2>/dev/null || echo '')"
|
||||
if [[ -n "$BUILD_COMMIT" ]]; then
|
||||
info "Building Backspace image from commit ${BUILD_COMMIT} (this may take a few minutes on first run)..."
|
||||
|
||||
build_from_source() {
|
||||
if [[ -n "$BUILD_COMMIT" ]]; then
|
||||
info "Building Backspace image from commit ${BUILD_COMMIT} (first build takes a few minutes)..."
|
||||
else
|
||||
info "Building Backspace image (first build takes a few minutes)..."
|
||||
fi
|
||||
$COMPOSE build --build-arg BACKSPACE_COMMIT="$BUILD_COMMIT"
|
||||
}
|
||||
|
||||
# Default path: pull the prebuilt multi-arch image (fast, and it spares weak/ARM
|
||||
# hosts the ~1.6GB local build that OOMs small boxes). Fall back to a from-source
|
||||
# build if the image can't be pulled (not published yet, private, or offline), or
|
||||
# if the operator forces a build (BACKSPACE_BUILD=true — e.g. running a fork).
|
||||
if [[ "${BACKSPACE_BUILD:-false}" == "true" ]]; then
|
||||
info "BACKSPACE_BUILD=true — building from source (skipping the prebuilt image)."
|
||||
build_from_source
|
||||
else
|
||||
info "Building Backspace image (this may take a few minutes on first run)..."
|
||||
image_ref="${BACKSPACE_IMAGE:-ghcr.io/thezwiss/backspace}:${BACKSPACE_IMAGE_TAG:-latest}"
|
||||
info "Fetching prebuilt image ${image_ref} ..."
|
||||
if $COMPOSE pull backspace; then
|
||||
success "Pulled prebuilt image"
|
||||
elif $DOCKER image inspect "$image_ref" >/dev/null 2>&1; then
|
||||
# Pull failed (offline / registry hiccup / private) but a usable copy is
|
||||
# already on this host (a prior run, an air-gapped `docker load`, or a
|
||||
# previous from-source build tagged under this ref) — use it instead of
|
||||
# forcing a needless multi-hundred-MB rebuild.
|
||||
warn "Could not pull ${image_ref} — using the copy already present on this host."
|
||||
else
|
||||
warn "Prebuilt image unavailable (not published yet, private, or offline)."
|
||||
warn "Falling back to a from-source build — slower, and heavy on low-RAM/ARM hosts."
|
||||
build_from_source
|
||||
fi
|
||||
fi
|
||||
$COMPOSE build --quiet --build-arg BACKSPACE_COMMIT="$BUILD_COMMIT"
|
||||
|
||||
info "Starting services..."
|
||||
$COMPOSE up -d
|
||||
@@ -427,92 +703,312 @@ if [[ "$healthy" == true && -n "$INSTANCE_NAME" && "$INSTANCE_NAME" != "Backspac
|
||||
' 2>/dev/null && success "Instance name set to: ${INSTANCE_NAME}" || warn "Could not set instance name (set it manually in admin settings)"
|
||||
fi
|
||||
|
||||
# ── Phase 7.5: Verify HTTPS reachability ───────────────────
|
||||
# The internal healthcheck only proves the app is up *inside* Docker. What the
|
||||
# operator actually cares about is whether https://DOMAIN works — which needs
|
||||
# Caddy to have obtained a publicly-trusted TLS certificate, and that only
|
||||
# happens once DNS points here AND ports 80/443 are reachable from the internet.
|
||||
#
|
||||
# We test this hairpin-safely with `curl --resolve DOMAIN:443:127.0.0.1`: it
|
||||
# connects to the LOCAL Caddy but presents the real SNI/Host and performs full
|
||||
# certificate verification. Success means Caddy is serving a valid, publicly-
|
||||
# trusted certificate for DOMAIN *and* the app answers over it — which is only
|
||||
# possible once issuance has succeeded. Crucially this avoids a false negative
|
||||
# on self-hosted boxes that can't reach their own public address (router NAT
|
||||
# hairpin), where a plain external request would time out even though the site
|
||||
# is perfectly reachable for everyone else.
|
||||
# ── Phase 7.5: Post-deploy reachability check ──────────────
|
||||
# What's verifiable differs by mode:
|
||||
# allinone → prove https://DOMAIN works end-to-end (Caddy has a valid,
|
||||
# publicly-trusted certificate AND the app answers over it).
|
||||
# proxy/tunnel → prove the app answers on its loopback port (your edge then
|
||||
# fronts it); TLS is your proxy/tunnel's job, not ours to test.
|
||||
|
||||
https_status="skipped"
|
||||
if [[ "$healthy" == true ]]; then
|
||||
step "Verifying HTTPS"
|
||||
https_status="pending"
|
||||
app_reachable="unknown"
|
||||
|
||||
info "Checking for a valid TLS certificate on ${DOMAIN} (Caddy issues it on first start)..."
|
||||
for i in $(seq 1 15); do
|
||||
if curl -fsS --max-time 6 --resolve "${DOMAIN}:443:127.0.0.1" "https://${DOMAIN}/api/health" >/dev/null 2>&1; then
|
||||
https_status="live"
|
||||
break
|
||||
if [[ "$DEPLOY_MODE" == "allinone" ]]; then
|
||||
if [[ "$healthy" == true ]]; then
|
||||
step "Verifying HTTPS"
|
||||
https_status="pending"
|
||||
# `curl --resolve DOMAIN:443:127.0.0.1` connects to the LOCAL Caddy but
|
||||
# presents the real SNI/Host and does full certificate verification. A pass
|
||||
# proves a valid public cert is installed AND the app answers over it — and
|
||||
# it's hairpin-safe (many self-hosted boxes can't reach their own public IP).
|
||||
info "Checking for a valid TLS certificate on ${DOMAIN} (Caddy issues it on first start)..."
|
||||
for i in $(seq 1 15); do
|
||||
if curl -fsS --max-time 6 --resolve "${DOMAIN}:443:127.0.0.1" "https://${DOMAIN}/api/health" >/dev/null 2>&1; then
|
||||
https_status="live"
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
if [[ "$https_status" == "live" ]]; then
|
||||
success "HTTPS is live — a valid TLS certificate is installed and Backspace is serving over it."
|
||||
else
|
||||
warn "HTTPS is not live yet — Caddy hasn't obtained a publicly-trusted certificate."
|
||||
fi
|
||||
fi
|
||||
else
|
||||
if [[ "$healthy" == true ]]; then
|
||||
step "Verifying the app"
|
||||
app_reachable="no"
|
||||
for i in $(seq 1 10); do
|
||||
if curl -fsS --max-time 6 "http://127.0.0.1:${APP_PORT_FINAL}/api/health" >/dev/null 2>&1; then
|
||||
app_reachable="yes"
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if [[ "$app_reachable" == "yes" ]]; then
|
||||
success "Backspace is answering on http://127.0.0.1:${APP_PORT_FINAL} — point your $( [[ "$DEPLOY_MODE" == tunnel ]] && echo tunnel || echo 'reverse proxy') at it."
|
||||
else
|
||||
warn "Could not reach http://127.0.0.1:${APP_PORT_FINAL}/api/health yet — check: docker compose logs backspace"
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
|
||||
if [[ "$https_status" == "live" ]]; then
|
||||
success "HTTPS is live — a valid TLS certificate is installed and Backspace is serving over it."
|
||||
else
|
||||
warn "HTTPS is not live yet — Caddy hasn't obtained a publicly-trusted certificate."
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Reverse-proxy / tunnel snippet generators ──────────────
|
||||
# Paste-ready configs with WebSocket upgrade, X-Forwarded-*, and a body-size cap
|
||||
# already correct. Printed for proxy/tunnel modes so the operator's edge routes
|
||||
# to 127.0.0.1:APP_PORT (and, if voice is on, /livekit → the host LiveKit).
|
||||
|
||||
hr() { echo -e "${CYAN}────────────────────────────────────────────────────────────${NC}"; }
|
||||
snip() { echo -e "${BOLD}$*${NC}"; }
|
||||
|
||||
# Body-size cap in the proxy should match the app's MAX_UPLOAD_SIZE. Express it in
|
||||
# MB for the human-facing proxy directives (round up so the proxy never rejects a
|
||||
# body the app would accept).
|
||||
max_mb=$(( (MAX_UPLOAD_SIZE + 1048575) / 1048576 ))
|
||||
|
||||
print_nginx_snippet() {
|
||||
snip "nginx — add the map once inside http { }, then a server block:"
|
||||
hr
|
||||
cat << EOF
|
||||
# --- inside http { } (once) --------------------------------
|
||||
map \$http_upgrade \$connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name ${DOMAIN};
|
||||
|
||||
# Your TLS certs (certbot, your proxy manager, etc.):
|
||||
# ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
|
||||
# ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
|
||||
|
||||
client_max_body_size ${max_mb}m; # match MAX_UPLOAD_SIZE (${MAX_UPLOAD_SIZE} bytes)
|
||||
EOF
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
cat << EOF
|
||||
|
||||
# Voice signaling → host-networked LiveKit (strips the /livekit prefix):
|
||||
location /livekit/ {
|
||||
proxy_pass http://127.0.0.1:7880/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection \$connection_upgrade;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
cat << EOF
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:${APP_PORT_FINAL};
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
proxy_set_header X-Forwarded-Host \$host;
|
||||
# WebSocket upgrade (chat, live events, voice signaling):
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection \$connection_upgrade;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
hr
|
||||
}
|
||||
|
||||
print_caddy_snippet() {
|
||||
snip "Caddy — if you run your OWN Caddy (it auto-handles WebSocket + HTTPS):"
|
||||
hr
|
||||
cat << EOF
|
||||
${DOMAIN} {
|
||||
EOF
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
cat << EOF
|
||||
handle_path /livekit/* {
|
||||
reverse_proxy 127.0.0.1:7880
|
||||
}
|
||||
handle {
|
||||
reverse_proxy 127.0.0.1:${APP_PORT_FINAL}
|
||||
}
|
||||
EOF
|
||||
else
|
||||
cat << EOF
|
||||
reverse_proxy 127.0.0.1:${APP_PORT_FINAL}
|
||||
EOF
|
||||
fi
|
||||
cat << EOF
|
||||
request_body {
|
||||
max_size ${max_mb}MB
|
||||
}
|
||||
}
|
||||
EOF
|
||||
hr
|
||||
}
|
||||
|
||||
print_traefik_snippet() {
|
||||
snip "Traefik — dynamic (file-provider) config; Traefik handles WebSocket itself:"
|
||||
hr
|
||||
cat << EOF
|
||||
http:
|
||||
routers:
|
||||
backspace:
|
||||
rule: "Host(\`${DOMAIN}\`)"
|
||||
entryPoints: [websecure]
|
||||
service: backspace
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
EOF
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
cat << EOF
|
||||
backspace-livekit:
|
||||
rule: "Host(\`${DOMAIN}\`) && PathPrefix(\`/livekit\`)"
|
||||
entryPoints: [websecure]
|
||||
service: backspace-livekit
|
||||
priority: 100
|
||||
middlewares: [strip-livekit]
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
middlewares:
|
||||
strip-livekit:
|
||||
stripPrefix:
|
||||
prefixes: ["/livekit"]
|
||||
EOF
|
||||
fi
|
||||
cat << EOF
|
||||
services:
|
||||
backspace:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://127.0.0.1:${APP_PORT_FINAL}"
|
||||
EOF
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
cat << EOF
|
||||
backspace-livekit:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://127.0.0.1:7880"
|
||||
EOF
|
||||
fi
|
||||
hr
|
||||
}
|
||||
|
||||
print_tunnel_snippet() {
|
||||
snip "Cloudflare Tunnel — ingress rule (cloudflared config.yml):"
|
||||
hr
|
||||
cat << EOF
|
||||
tunnel: <YOUR-TUNNEL-ID>
|
||||
credentials-file: /root/.cloudflared/<YOUR-TUNNEL-ID>.json
|
||||
|
||||
ingress:
|
||||
- hostname: ${DOMAIN}
|
||||
service: http://127.0.0.1:${APP_PORT_FINAL}
|
||||
- service: http_status:404
|
||||
EOF
|
||||
hr
|
||||
echo " Then map the hostname to the tunnel (once):"
|
||||
echo -e " ${BOLD}cloudflared tunnel route dns <YOUR-TUNNEL-ID> ${DOMAIN}${NC}"
|
||||
}
|
||||
|
||||
# ── Phase 8: Summary ───────────────────────────────────────
|
||||
|
||||
step "Backspace is running"
|
||||
|
||||
echo -e " ${BOLD}URL:${NC} https://${DOMAIN}"
|
||||
echo -e " ${BOLD}Instance:${NC} ${INSTANCE_NAME}"
|
||||
echo -e " ${BOLD}Mode:${NC} ${DEPLOY_MODE}"
|
||||
echo -e " ${BOLD}Voice:${NC} $(if [[ "$ENABLE_VOICE" == true ]]; then echo 'Enabled'; else echo 'Disabled'; fi)"
|
||||
case "$https_status" in
|
||||
live) echo -e " ${BOLD}HTTPS:${NC} ${GREEN}Live${NC}" ;;
|
||||
pending) echo -e " ${BOLD}HTTPS:${NC} ${YELLOW}Not live yet${NC}" ;;
|
||||
esac
|
||||
echo ""
|
||||
|
||||
if [[ "$https_status" == "pending" ]]; then
|
||||
echo -e " ${YELLOW}The app is up, but HTTPS isn't live yet — Caddy is still trying to get a certificate.${NC}"
|
||||
echo -e " ${YELLOW}This is normal right after install; it comes up automatically once BOTH are true:${NC}"
|
||||
echo " 1. ${DOMAIN} resolves to THIS host's public IP"
|
||||
echo " 2. Ports 80 and 443 are open and forwarded to this host from the internet"
|
||||
echo -e " Watch progress: ${BOLD}docker compose logs -f caddy${NC}"
|
||||
if [[ "$DEPLOY_MODE" == "allinone" ]]; then
|
||||
case "$https_status" in
|
||||
live) echo -e " ${BOLD}HTTPS:${NC} ${GREEN}Live${NC}" ;;
|
||||
pending) echo -e " ${BOLD}HTTPS:${NC} ${YELLOW}Not live yet${NC}" ;;
|
||||
esac
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Then open https://${DOMAIN} and create the first account — it becomes the instance admin.${NC}"
|
||||
else
|
||||
echo -e " ${YELLOW}Open https://${DOMAIN} and create the first account — it becomes the instance admin.${NC}"
|
||||
if [[ "$https_status" == "pending" ]]; then
|
||||
echo -e " ${YELLOW}The app is up, but HTTPS isn't live yet — Caddy is still trying to get a certificate.${NC}"
|
||||
echo -e " ${YELLOW}This is normal right after install; it comes up automatically once BOTH are true:${NC}"
|
||||
echo " 1. ${DOMAIN} resolves to THIS host's public IP"
|
||||
echo " 2. Ports 80 and 443 are open and forwarded to this host from the internet"
|
||||
echo -e " Watch progress: ${BOLD}docker compose logs -f caddy${NC}"
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Then open https://${DOMAIN} and create the first account — it becomes the instance admin.${NC}"
|
||||
else
|
||||
echo -e " ${YELLOW}Open https://${DOMAIN} and create the first account — it becomes the instance admin.${NC}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
# Best-effort primary LAN IP (the address a router would port-forward to).
|
||||
LAN_IP=$(ip route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[0-9.]+' | head -1 || true)
|
||||
echo -e " ${BOLD}Ports to open${NC} — on this host's firewall (ufw / firewalld / cloud"
|
||||
echo -e " security group)${BOLD} and,${NC} if the host is behind a router, also"
|
||||
echo -e " port-forward them to this host${LAN_IP:+ (${LAN_IP})}:"
|
||||
echo ""
|
||||
echo " 80/TCP HTTP — cert challenge + HTTP→HTTPS redirect (required)"
|
||||
echo " 443/TCP HTTPS — web app, API, WebSocket, LiveKit signal (required)"
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
echo " 3478/UDP TURN — WebRTC NAT traversal (voice)"
|
||||
echo " 7881/TCP WebRTC TCP fallback (voice)"
|
||||
echo " 50000-60000/UDP WebRTC media — voice / video / screen-share (voice)"
|
||||
fi
|
||||
echo ""
|
||||
echo -e " ${YELLOW}80 and 443 must be reachable from the internet before HTTPS can come up.${NC}"
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
echo -e " ${YELLOW}Voice/video won't connect until the voice ports above are reachable too.${NC}"
|
||||
fi
|
||||
echo -e " LiveKit's own signaling port (7880) stays internal — do ${BOLD}not${NC} forward it."
|
||||
|
||||
elif [[ "$DEPLOY_MODE" == "proxy" ]]; then
|
||||
echo ""
|
||||
echo -e " Backspace listens on ${BOLD}127.0.0.1:${APP_PORT_FINAL}${NC} (loopback only — never expose it directly)."
|
||||
echo -e " Point your reverse proxy at it, then open ${BOLD}https://${DOMAIN}${NC} and register the first account (it becomes admin)."
|
||||
echo ""
|
||||
echo -e " ${BOLD}Paste one of these into your reverse proxy${NC} (WebSocket, X-Forwarded-*, and body cap already set):"
|
||||
echo ""
|
||||
print_nginx_snippet
|
||||
echo ""
|
||||
print_caddy_snippet
|
||||
echo ""
|
||||
print_traefik_snippet
|
||||
echo ""
|
||||
echo -e " ${BOLD}Nginx Proxy Manager / other GUI proxies:${NC} see the field-by-field guide"
|
||||
echo -e " in the README → 'Deployment modes' (forward to 127.0.0.1:${APP_PORT_FINAL}, enable"
|
||||
echo -e " 'Websockets Support', and set client_max_body_size ${max_mb}m in the Advanced tab)."
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Voice is enabled — in addition to the /livekit route above, open these UDP/TCP${NC}"
|
||||
echo -e " ${YELLOW}media ports on the firewall and forward them to this host:${NC}"
|
||||
echo " 3478/UDP TURN — WebRTC NAT traversal"
|
||||
echo " 7881/TCP WebRTC TCP fallback"
|
||||
echo " 50000-60000/UDP WebRTC media — voice / video / screen-share"
|
||||
echo -e " ${YELLOW}Media flows host→client directly, NOT through your reverse proxy.${NC}"
|
||||
fi
|
||||
|
||||
elif [[ "$DEPLOY_MODE" == "tunnel" ]]; then
|
||||
echo ""
|
||||
echo -e " Backspace listens on ${BOLD}127.0.0.1:${APP_PORT_FINAL}${NC} (loopback only). Your tunnel fronts it."
|
||||
echo -e " Once the ingress rule is live, open ${BOLD}https://${DOMAIN}${NC} and register the first account (it becomes admin)."
|
||||
echo ""
|
||||
print_tunnel_snippet
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Upload cap:${NC} MAX_UPLOAD_SIZE is set to ${max_mb}MB to stay under Cloudflare's 100MB"
|
||||
echo -e " request-body limit. Raising it above ~100MB will make large uploads fail at the edge."
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Voice/video is not available over a tunnel${NC} — WebRTC/UDP media can't traverse it."
|
||||
echo -e " If you need voice, run Backspace behind a reverse proxy (proxy mode) with the"
|
||||
echo -e " media ports opened, or use All-in-One with ports 80/443."
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e " ${BOLD}Commands:${NC}"
|
||||
echo -e " ${BOLD}Commands${NC} (run from this directory):"
|
||||
echo " docker compose logs -f # Watch logs"
|
||||
echo " docker compose restart # Restart all services"
|
||||
echo " docker compose down # Stop everything"
|
||||
echo " docker compose up -d --build # Rebuild after code changes"
|
||||
|
||||
echo ""
|
||||
# Best-effort primary LAN IP (the address a router would port-forward to).
|
||||
LAN_IP=$(ip route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[0-9.]+' | head -1 || true)
|
||||
echo -e " ${BOLD}Ports to open${NC} — on this host's firewall (ufw / firewalld / cloud"
|
||||
echo -e " security group)${BOLD} and,${NC} if the host is behind a router, also"
|
||||
echo -e " port-forward them to this host${LAN_IP:+ (${LAN_IP})}:"
|
||||
echo ""
|
||||
echo " 80/TCP HTTP — cert challenge + HTTP→HTTPS redirect (required)"
|
||||
echo " 443/TCP HTTPS — web app, API, WebSocket, LiveKit signal (required)"
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
echo " 3478/UDP TURN — WebRTC NAT traversal (voice)"
|
||||
echo " 7881/TCP WebRTC TCP fallback (voice)"
|
||||
echo " 50000-60000/UDP WebRTC media — voice / video / screen-share (voice)"
|
||||
fi
|
||||
echo ""
|
||||
echo -e " ${YELLOW}80 and 443 must be reachable from the internet before HTTPS can come up.${NC}"
|
||||
if [[ "$ENABLE_VOICE" == true ]]; then
|
||||
echo -e " ${YELLOW}Voice/video won't connect until the voice ports above are reachable too.${NC}"
|
||||
fi
|
||||
echo -e " LiveKit's own signaling port (7880) stays internal — do ${BOLD}not${NC} forward it."
|
||||
|
||||
echo " docker compose pull && docker compose up -d # Update to the latest prebuilt image"
|
||||
echo ""
|
||||
|
||||
Reference in New Issue
Block a user