install.sh

#!/bin/bash
clear

LOG_FILE="/var/log/lxdev_setup.log"
exec > >(tee -a $LOG_FILE) 2>&1

# =========================
# CONFIG
# =========================
LXDEV_USER="CHANGE_ME"
SSH_PORT=22 #CHANGE_ME
WEBMIN_PORT=10000
HOSTNAME="CHANGE_ME"
TIMEZONE="Europe/London"
TELEGRAM_TOKEN="CHANGE_ME"
TELEGRAM_CHAT_ID="CHANGE_ME"
SSH_PUBLIC_KEY="CHANGE_ME"

SERVER_NAME=$(hostname)
IP_ADDR=$(hostname -I | awk '{print $1}')

# =========================
# FUNCTII
# =========================
check_debian_version() {
    REQUIRED_VERSION="13"

    # Detectează distribuția și versiunea
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS_NAME=$ID
        OS_VERSION=$VERSION_ID
    else
        echo "❌ Nu am putut detecta distribuția Linux."
        exit 1
    fi

    # Verifică dacă e Debian
    if [ "$OS_NAME" != "debian" ]; then
        echo "❌ Distribuția detectată este $OS_NAME, dar scriptul necesită Debian $REQUIRED_VERSION."
        exit 1
    fi

    # Verifică versiunea
    if [ "$OS_VERSION" != "$REQUIRED_VERSION" ]; then
        echo "❌ Versiunea detectată este $OS_VERSION, dar scriptul necesită Debian $REQUIRED_VERSION."
        exit 1
    fi

    echo "✅ Sistem detectat: Debian $OS_VERSION"
}
run_step() {
    DESC="$1"
    CHECK_CMD="$2"
    CMD="$3"

    echo ""
    echo "🔹 $DESC"

    if bash -c "$CHECK_CMD" > /dev/null 2>&1; then
        echo "   ✔ SKIP (deja instalat)"
        return
    fi

    bash -c "$CMD" &
    PID=$!

    SPINNER='|/-\'
    i=0
    while kill -0 $PID 2>/dev/null; do
        i=$(( (i+1) %4 ))
        printf "\r   ⏳ Se execută... ${SPINNER:$i:1}"
        sleep 0.3
    done
    wait $PID
    echo -e "\r   ✔ $DESC finalizat"
}

send_telegram(){
  MESSAGE=$1
  curl -s "https://api.telegram.org/bot$TELEGRAM_TOKEN/sendMessage" \
       -d chat_id="$TELEGRAM_CHAT_ID" \
       -d text="$MESSAGE" > /dev/null
}

create_system_user() {
    LXDEV_USER="$1"
    USER_PASS="$2"

    run_step "Creare user sistem $LXDEV_USER" \
    "id $LXDEV_USER >/dev/null 2>&1" \
    "useradd -m -s /bin/bash -G sudo $LXDEV_USER > /dev/null 2>&1; \
     printf \"%s:%s\n\" \"$LXDEV_USER\" \"$USER_PASS\" | chpasswd; \
     printf \"%s ALL=(ALL) NOPASSWD:ALL\n\" \"$LXDEV_USER\" > /etc/sudoers.d/$LXDEV_USER-nopasswd; \
     chmod 440 /etc/sudoers.d/$LXDEV_USER-nopasswd"
}
  
setup_user_with_webmin() {
    LXDEV_USER="$1"
    WEBMIN_DIR="/etc/webmin"
    USER_PASS=$(openssl rand -base64 50 | tr -dc 'A-Za-z0-9' | cut -c1-50)

    # =========================
    # Creare user sistem + sudo
    # =========================
    create_system_user "$LXDEV_USER" "$USER_PASS"

    # =========================
    # Creare / actualizare user Webmin
    # =========================
    if [ -d "$WEBMIN_DIR" ]; then
        # Dacă userul nu există în Webmin, îl creăm
        if ! grep -q "^$LXDEV_USER:" "$WEBMIN_DIR/miniserv.users" 2>/dev/null; then
            /usr/share/webmin/adduser.pl --user "$LXDEV_USER" --pass "$USER_PASS" --group root > /dev/null 2>&1
            echo -e "\r   ✔ User Webmin $LXDEV_USER creat cu root ACL"
        else
            # Dacă există, actualizează parola
            /usr/share/webmin/changepass.pl "$WEBMIN_DIR" "$LXDEV_USER" "$USER_PASS" > /dev/null 2>&1
            echo -e "\r   ✔ Parola Webmin pentru $LXDEV_USER actualizată"
        fi

        # Asigură root ACL în Webmin
        WEBMIN_ACL="$WEBMIN_DIR/webmin.acl"
        if ! grep -q "^$LXDEV_USER:" "$WEBMIN_ACL" 2>/dev/null; then
            echo "$LXDEV_USER:1" | tee -a "$WEBMIN_ACL" > /dev/null
            echo -e "\r   ✔ Permisiuni root Webmin setate pentru $LXDEV_USER"
        fi
    else
        echo -e "\r   ❌ Webmin nu este instalat. Instalează-l înainte."
    fi

    # =========================
    # Trimitere date prin Telegram
    # =========================
    send_telegram "🚀 LxDev server instalat
Server: $HOSTNAME
IP: $IP_ADDR
SSH Port: $SSH_PORT
User: $LXDEV_USER
Parola: $USER_PASS"
}

setup_virtualmin_postgres() {
    DESC="Configurare sistem Virtualmin pentru PostgreSQL"
    CONFIG_BACKUP="/root/virtualmin-config-backup-$(date +%Y%m%d%H%M%S).tar.gz"

    # Verifică Virtualmin
    if [ ! -x "/usr/sbin/virtualmin" ]; then
        echo -e "\r   ❌ Virtualmin nu este instalat. Instalează-l înainte."
        return 1
    fi

    # Verifică PostgreSQL
    if ! command -v psql >/dev/null 2>&1; then
        echo -e "\r   ❌ PostgreSQL nu este instalat. Instalează-l înainte."
        return 1
    fi
    PG_CLUSTER=$(pg_lsclusters | awk '/18/ {print $1}')
    if [ -z "$PG_CLUSTER" ]; then
        echo -e "\r   ❌ PostgreSQL 18 nu are cluster activ. Creează-l mai întâi."
        return 1
    fi

    # Backup config Virtualmin
    echo -e "\r   ⏳ Fac backup la config Virtualmin..."
    tar czf "$CONFIG_BACKUP" /etc/webmin /etc/virtualmin 2>/dev/null
    echo -e "\r   ✔ Backup creat: $CONFIG_BACKUP"

    # Rulează config Virtualmin
    run_step "$DESC" \
    "grep -q 'PostgreSQL' /etc/virtualmin/virtual-server.conf 2>/dev/null" \
    "sudo virtualmin-config-system --include PostgreSQL > /dev/null 2>&1"

    echo -e "\r   ✅ Configurare Virtualmin pentru PostgreSQL finalizată"
}

install_webmin_postgresql_module() {
    WEBMIN_MODULE="webmin-postgresql"

    echo -e "\n🔹 Instalare modul Webmin PostgreSQL"

    # Verifică dacă Webmin este instalat
    if ! dpkg -l | grep -qw webmin; then
        echo "   ❌ Webmin nu este instalat. Rulează mai întâi instalarea Webmin."
        return 1
    fi

    # Verifică dacă modulul există deja
    if dpkg -l | grep -qw "$WEBMIN_MODULE"; then
        echo "   ✔ Modulul $WEBMIN_MODULE este deja instalat"
        return 0
    fi

    # Adaugă repo Webmin dacă lipsește
    if [ ! -f /etc/apt/sources.list.d/webmin.list ]; then
        echo "   ⏳ Configurare repo Webmin..."
        curl -s -o /tmp/webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
        yes | sh /tmp/webmin-setup-repo.sh > /dev/null 2>&1
    fi

    # Update apt
    DEBIAN_FRONTEND=noninteractive apt-get update -y > /dev/null 2>&1

    # Instalează modulul
    echo "   ⏳ Instalare $WEBMIN_MODULE..."
    DEBIAN_FRONTEND=noninteractive apt-get install -y "$WEBMIN_MODULE" --allow-unauthenticated > /dev/null 2>&1

    # Restart Webmin
    systemctl restart webmin > /dev/null 2>&1

    echo -e "   ✔ Modulul $WEBMIN_MODULE instalat și Webmin repornit"
}


add_sury_php_repo() {
    echo -e "\n🔹 Adăugare Sury PHP repository"

    # Instalează dependențele necesare
    DEBIAN_FRONTEND=noninteractive apt-get install -y apt-transport-https lsb-release ca-certificates curl > /dev/null 2>&1

    # Adaugă cheia oficială
    if [ ! -f /usr/share/keyrings/debsuryorg-archive-keyring.gpg ]; then
        echo "   ⏳ Descărcare cheie Sury..."
        curl -sSL -o /usr/share/keyrings/debsuryorg-archive-keyring.gpg https://packages.sury.org/php/apt.gpg
        echo "   ✔ Cheie Sury adăugată"
    else
        echo "   ✔ Cheia Sury există deja"
    fi

    # Adaugă repo-ul Sury
    LIST_FILE="/etc/apt/sources.list.d/sury-debian-php-$(lsb_release -sc).list"
    if [ ! -f "$LIST_FILE" ]; then
        echo "   ⏳ Creare fișier repo Sury..."
        sh -c "echo 'deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main' > $LIST_FILE"
        echo "   ✔ Repo Sury creat: $LIST_FILE"
    else
        echo "   ✔ Repo Sury deja există"
    fi

    # Update apt
    apt-get update -y > /dev/null 2>&1
    echo "   ✔ Repo Sury activ și apt updatat"
}

# =========================
# BANNER
# =========================
echo "========================================="
echo "        🚀 LxDev Server Setup v5          "
echo "========================================="
echo " Server : $SERVER_NAME"
echo " IP     : $IP_ADDR"
echo "========================================="

check_debian_version

# =========================
# Set hostname
# =========================
run_step "Set hostname" \
"hostnamectl | grep -q '$HOSTNAME'" \
"hostnamectl set-hostname $HOSTNAME > /dev/null 2>&1"

# =========================
# Set timezone
# =========================
run_step "Set timezone" \
"timedatectl | grep -q '$TIMEZONE'" \
"timedatectl set-timezone $TIMEZONE > /dev/null 2>&1"

# =========================
# Enable NTP sync
# =========================
run_step "Enable NTP sync" \
"timedatectl | grep -q 'System clock synchronized: yes'" \
"timedatectl set-ntp true > /dev/null 2>&1"

# =========================
# SYSTEM UPDATE
# =========================
run_step "Actualizare sistem" \
"false" \
"DEBIAN_FRONTEND=noninteractive apt-get update -y > /dev/null 2>&1; \
DEBIAN_FRONTEND=noninteractive apt-get upgrade -y > /dev/null 2>&1; \
DEBIAN_FRONTEND=noninteractive apt-get dist-upgrade -y > /dev/null 2>&1; \
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y > /dev/null 2>&1; \
DEBIAN_FRONTEND=noninteractive apt-get autoclean -y > /dev/null 2>&1"

# =========================
# BASE PACKAGES
# ========================= 
run_step "Instalare aplicații de bază" \
"dpkg -l | grep -qw vnstat" \
"DEBIAN_FRONTEND=noninteractive apt install -y curl wget sudo htop vnstat iftop iotop bc net-tools unzip redis-server cron > /dev/null 2>&1;"

 # =========================
# Instalare și activare UFW
# =========================
run_step "Instalare și activare UFW" \
"dpkg-query -W -f='${Status}' ufw 2>/dev/null | grep -q 'install ok installed'" \
"DEBIAN_FRONTEND=noninteractive apt-get install -y ufw> /dev/null 2>&1; \
 systemctl enable ufw > /dev/null 2>&1; \
 systemctl start ufw > /dev/null 2>&1; "

# =========================
# Activare vnStat
# =========================
run_step "Activare vnStat" \
"systemctl is-enabled vnstat" \
"systemctl enable vnstat > /dev/null 2>&1; \
 systemctl start vnstat > /dev/null 2>&1"

# =========================
# Activare cron
# =========================
run_step "Activare cron" \
"systemctl is-active cron" \
"systemctl enable cron > /dev/null 2>&1; \
 systemctl start cron > /dev/null 2>&1"


# adaugare sury pentru php
add_sury_php_repo

# =========================
# SWAP
# =========================
run_step "Creare swap 2GB" \
"swapon --show | grep -q swapfile" \
"fallocate -l 2G /swapfile > /dev/null 2>&1; \
 chmod 600 /swapfile > /dev/null 2>&1; \
 mkswap /swapfile > /dev/null 2>&1; \
 swapon /swapfile > /dev/null 2>&1; \
 grep -q '/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab"
# =========================
# POSTGRES 18
# =========================
PG_VERSION=18

run_step "Instalare PostgreSQL $PG_VERSION și creare cluster" \
"pg_lsclusters | grep -qw $PG_VERSION" \
"DEBIAN_FRONTEND=noninteractive apt install -y wget gnupg lsb-release > /dev/null 2>&1; \
# Adaugă cheia și repo-ul oficial PostgreSQL
wget -qO- https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.gpg > /dev/null; \
echo 'deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main' | sudo tee /etc/apt/sources.list.d/pgdg.list > /dev/null; \
apt update -y > /dev/null 2>&1; \
# Instalează PostgreSQL 18 + client + contrib
DEBIAN_FRONTEND=noninteractive apt install -y postgresql-$PG_VERSION postgresql-client-$PG_VERSION postgresql-contrib-$PG_VERSION > /dev/null 2>&1; \
systemctl enable postgresql > /dev/null 2>&1; \
systemctl start postgresql > /dev/null 2>&1; \
# Creează cluster main dacă nu există
if ! pg_lsclusters | grep -qw $PG_VERSION; then
    pg_createcluster $PG_VERSION main --start
fi; \
systemctl restart postgresql > /dev/null 2>&1"

# =========================
# Configurare PostgreSQL + optimizare RAM limitată
# =========================
PG_CONF=$(find /etc/postgresql/$PG_VERSION -name postgresql.conf | head -n1)

run_step "Configurare PostgreSQL $PG_VERSION + optimizare (RAM limitat)" \
"[ -f \"$PG_CONF\" ]" \
"TOTAL_RAM_MB=\$(free -m | awk '/Mem:/ {print \$2}');
PG_RAM=\$((TOTAL_RAM_MB * 30 / 100));
[ \$PG_RAM -lt 512 ] && PG_RAM=512;
MAX_CONN=\$((PG_RAM / 10));
[ \$MAX_CONN -lt 50 ] && MAX_CONN=50;
SHARED_BUFFERS=\$((PG_RAM / 4))MB;
WORK_MEM=4MB;

# Modifică listen_addresses și timezone
sed -i 's/#listen_addresses = .*/listen_addresses = '\''*'\''/' \"$PG_CONF\"
sed -i 's/#timezone = .*/timezone = \"'$TIMEZONE'\"/' \"$PG_CONF\"

# Configurează parametrii de performanță
grep -q '^max_connections' \"$PG_CONF\" && sed -i 's/^max_connections.*/max_connections = '$MAX_CONN'/' \"$PG_CONF\" || echo 'max_connections = '$MAX_CONN >> \"$PG_CONF\"
grep -q '^shared_buffers' \"$PG_CONF\" && sed -i 's/^shared_buffers.*/shared_buffers = '$SHARED_BUFFERS'/' \"$PG_CONF\" || echo 'shared_buffers = '$SHARED_BUFFERS >> \"$PG_CONF\"
grep -q '^work_mem' \"$PG_CONF\" && sed -i 's/^work_mem.*/work_mem = '$WORK_MEM'/' \"$PG_CONF\" || echo 'work_mem = '$WORK_MEM >> \"$PG_CONF\"

systemctl restart postgresql > /dev/null 2>&1"

# =========================
# WEBMIN
# =========================
run_step "Instalare Webmin + modul PostgreSQL" \
"dpkg -l | grep -qw webmin" \
"curl -s -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh; \
 yes | sh webmin-setup-repo.sh > /dev/null 2>&1; \
 DEBIAN_FRONTEND=noninteractive apt-get update -y > /dev/null 2>&1; \
 DEBIAN_FRONTEND=noninteractive apt-get install -y webmin > /dev/null 2>&1; \
 DEBIAN_FRONTEND=noninteractive apt-get install -y postgresql postgresql-client > /dev/null 2>&1; \ 
 systemctl enable webmin > /dev/null 2>&1; \
 systemctl restart webmin > /dev/null 2>&1"

install_webmin_postgresql_module


# =========================
# Modificare port Webmin
# =========================
run_step "Setare port Webmin" \
"grep -q '^port=$WEBMIN_PORT' /etc/webmin/miniserv.conf" \
"sed -i \"s/^port=.*/port=$WEBMIN_PORT/\" /etc/webmin/miniserv.conf > /dev/null 2>&1; \
 systemctl restart webmin > /dev/null 2>&1; \
 ufw allow $WEBMIN_PORT/tcp > /dev/null 2>&1"

# =========================
# VIRTUALMIN
# =========================
run_step "Instalare Virtualmin LEMP" \
"test -f /usr/sbin/virtualmin" \
"curl -s -o virtualmin-install.sh https://download.virtualmin.com/virtualmin-install.sh; chmod +x virtualmin-install.sh; yes | ./virtualmin-install.sh --bundle LEMP > /dev/null 2>&1"
# setup_virtualmin_postgres

run_step "Configurare Virtualmin pentru PostgreSQL" \
"virtualmin-config-system --include PostgreSQL | grep -q 'already configured'" \
"sudo virtualmin-config-system --include PostgreSQL > /dev/null 2>&1"

# =========================
# Instalare CrowdSec engine
# =========================
run_step "Instalare CrowdSec engine" \
"dpkg -l | grep -qw crowdsec" \
"curl -s https://install.crowdsec.net | bash > /dev/null 2>&1; \
 DEBIAN_FRONTEND=noninteractive apt-get install -y crowdsec > /dev/null 2>&1; \
 systemctl enable crowdsec > /dev/null 2>&1; \
 systemctl start crowdsec > /dev/null 2>&1"

# =========================
# Instalare CrowdSec bouncer
# =========================
run_step "Instalare CrowdSec bouncer" \
"dpkg -l | grep -qw crowdsec-firewall-bouncer-iptables" \
"DEBIAN_FRONTEND=noninteractive apt-get install -y crowdsec-firewall-bouncer-iptables > /dev/null 2>&1; \
 systemctl enable crowdsec-firewall-bouncer > /dev/null 2>&1; \
 systemctl start crowdsec-firewall-bouncer > /dev/null 2>&1"

# =========================
# SECURITY UPDATES
# =========================
run_step "Activare actualizari automate de securitate" \
"dpkg -l | grep -qw unattended-upgrades" \
"DEBIAN_FRONTEND=noninteractive apt-get install -y unattended-upgrades > /dev/null 2>&1; \
 dpkg-reconfigure -f noninteractive unattended-upgrades > /dev/null 2>&1"

# =========================
# MOTD
# =========================
cat > /etc/motd <<EOF
=========================================
        🚀 LxDev Server
=========================================

Hostname : $HOSTNAME
IP       : $IP_ADDR
SSH Port : $SSH_PORT
Webmin   : https://$IP_ADDR:$WEBMIN_PORT

System
OS       : $(lsb_release -d 2>/dev/null | awk -F"\t" '{print $2}' || cat /etc/debian_version)
Uptime   : $(uptime -p)

Hardware
CPU      : $(lscpu | awk -F: '/Model name/ {print $2}' | sed 's/^[ \t]*//')
Cores    : $(nproc)
Load     : $(uptime | awk -F'load average:' '{print $2}' | sed 's/^[ \t]*//')
RAM      : $(free -h | awk '/Mem:/ {print $3 " used / " $2 " total"}')
Disk /   : $(df -h / | awk 'NR==2 {print $3 " used / " $2 " total"}')

Security
✔ Firewall
✔ CrowdSec
✔ Auto updates

=========================================
EOF

setup_user_with_webmin "$LXDEV_USER"

# =========================
# SSH SETUP FINAL (la final!)
# =========================
run_step "Configurare SSH final" \
"grep -q \"$SSH_PUBLIC_KEY\" /home/$LXDEV_USER/.ssh/authorized_keys" \
"mkdir -p /home/$LXDEV_USER/.ssh; \
echo \"$SSH_PUBLIC_KEY\" >> /home/$LXDEV_USER/.ssh/authorized_keys; \
chown -R $LXDEV_USER:$LXDEV_USER /home/$LXDEV_USER/.ssh; \
chmod 600 /home/$LXDEV_USER/.ssh/authorized_keys; \
sed -i \"s/#Port 22/Port $SSH_PORT/\" /etc/ssh/sshd_config; \
sed -i \"s/PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; \
systemctl restart ssh; sleep 3; ufw allow $SSH_PORT/tcp; ufw delete allow 22/tcp"

# =========================
# FINAL
# ==========================
echo "========================================="
echo "        ✅ LxDev Setup complet"
echo "========================================="
echo "SSH  : $IP_ADDR:$SSH_PORT"
echo "User : $LXDEV_USER"
echo "Parola : $USER_PASS"
echo "Webmin: https://$IP_ADDR:$WEBMIN_PORT"
echo "Log: $LOG_FILE"