Migrate Synapsis to embedded Turso

deploy/install.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/synapsis}"
+DATA_DIR="${DATA_DIR:-/var/lib/synapsis}"
+ENV_FILE="${ENV_FILE:-/etc/synapsis.env}"
+REPO_URL="${REPO_URL:-https://githop.xyz/GnosysLabs/Synapsis.git}"
+BRANCH="${BRANCH:-main}"
+
+if [[ ${EUID} -ne 0 ]]; then
+  echo "Run this installer as root." >&2
+  exit 1
+fi
+
+for command in git node npm openssl runuser systemctl; do
+  command -v "$command" >/dev/null || { echo "Missing required command: $command" >&2; exit 1; }
+done
+
+node_major="$(node -p 'process.versions.node.split(`.`)[0]')"
+if (( node_major < 20 )); then
+  echo "Synapsis requires Node.js 20 or newer." >&2
+  exit 1
+fi
+
+if ! id synapsis >/dev/null 2>&1; then
+  useradd --system --home-dir "$DATA_DIR" --create-home --shell /usr/sbin/nologin synapsis
+fi
+
+install -d -o synapsis -g synapsis -m 0750 "$DATA_DIR"
+
+if [[ -e "$APP_DIR" ]]; then
+  echo "$APP_DIR already exists; use deploy/update.sh for an existing installation." >&2
+  exit 1
+fi
+
+git clone --branch "$BRANCH" --single-branch "$REPO_URL" "$APP_DIR"
+chown -R synapsis:synapsis "$APP_DIR"
+
+if [[ ! -e "$ENV_FILE" ]]; then
+  auth_secret="$(openssl rand -base64 48 | tr -d '\n')"
+  port="43821"
+  install -m 0600 -o root -g synapsis /dev/null "$ENV_FILE"
+  {
+    echo "DATABASE_PATH=$DATA_DIR/synapsis.db"
+    echo "PORT=$port"
+    echo "AUTH_SECRET=$auth_secret"
+    echo "ADMIN_EMAILS=admin@example.com"
+    echo "NEXT_PUBLIC_NODE_DOMAIN=localhost:$port"
+  } > "$ENV_FILE"
+fi
+
+set -a
+source "$ENV_FILE"
+set +a
+
+runuser -u synapsis -- npm --prefix "$APP_DIR" ci
+runuser -u synapsis -- npm --prefix "$APP_DIR" run db:migrate
+runuser -u synapsis -- npm --prefix "$APP_DIR" run build
+
+install -m 0644 "$APP_DIR/deploy/synapsis.service" /etc/systemd/system/synapsis.service
+systemctl daemon-reload
+systemctl enable --now synapsis
+
+echo "Synapsis is listening on http://127.0.0.1:${PORT}"
+echo "Edit $ENV_FILE, run $APP_DIR/deploy/update.sh, then configure your own reverse proxy."

deploy/synapsis.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Synapsis node
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=synapsis
+Group=synapsis
+WorkingDirectory=/opt/synapsis
+EnvironmentFile=/etc/synapsis.env
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/env npm start
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/synapsis /opt/synapsis/.next
+
+[Install]
+WantedBy=multi-user.target

deploy/uninstall.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/synapsis}"
+DATA_DIR="${DATA_DIR:-/var/lib/synapsis}"
+ENV_FILE="${ENV_FILE:-/etc/synapsis.env}"
+
+if [[ ${EUID} -ne 0 ]]; then
+  echo "Run this uninstaller as root." >&2
+  exit 1
+fi
+
+systemctl disable --now synapsis 2>/dev/null || true
+rm -f /etc/systemd/system/synapsis.service
+systemctl daemon-reload
+rm -rf "$APP_DIR"
+
+if [[ "${1:-}" == "--purge-data" ]]; then
+  rm -rf "$DATA_DIR"
+  rm -f "$ENV_FILE"
+  userdel synapsis 2>/dev/null || true
+  echo "Synapsis and its database were removed."
+else
+  echo "Synapsis was removed; $DATA_DIR and $ENV_FILE were preserved."
+fi

deploy/update.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/synapsis}"
+DATA_DIR="${DATA_DIR:-/var/lib/synapsis}"
+ENV_FILE="${ENV_FILE:-/etc/synapsis.env}"
+
+if [[ ${EUID} -ne 0 ]]; then
+  echo "Run this updater as root." >&2
+  exit 1
+fi
+
+[[ -d "$APP_DIR/.git" ]] || { echo "No Synapsis checkout found at $APP_DIR" >&2; exit 1; }
+[[ -f "$ENV_FILE" ]] || { echo "Missing $ENV_FILE" >&2; exit 1; }
+
+set -a
+source "$ENV_FILE"
+set +a
+
+systemctl stop synapsis
+trap 'systemctl start synapsis' EXIT
+
+if [[ -f "${DATABASE_PATH:-$DATA_DIR/synapsis.db}" ]]; then
+  database_file="${DATABASE_PATH:-$DATA_DIR/synapsis.db}"
+  backup_dir="$DATA_DIR/backups/$(date -u +%Y%m%dT%H%M%SZ)"
+  install -d -o synapsis -g synapsis -m 0750 "$backup_dir"
+  cp "$database_file" "$backup_dir/synapsis.db"
+  for suffix in -wal -shm; do
+    if [[ -f "${database_file}${suffix}" ]]; then
+      cp "${database_file}${suffix}" "$backup_dir/synapsis.db${suffix}"
+    fi
+  done
+  chown -R synapsis:synapsis "$backup_dir"
+fi
+
+runuser -u synapsis -- git -C "$APP_DIR" pull --ff-only
+runuser -u synapsis -- npm --prefix "$APP_DIR" ci
+runuser -u synapsis -- npm --prefix "$APP_DIR" run db:migrate
+runuser -u synapsis -- npm --prefix "$APP_DIR" run build
+
+systemctl start synapsis
+trap - EXIT
+echo "Synapsis updated successfully."