From be5e6b51c0de54e54e5681db9f2f5dc6b4532d4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=92=D0=B8=D0=BA=D1=82=D0=BE=D1=80?=
 <78488229+viktor138irk@users.noreply.github.com>
Date: Fri, 8 May 2026 15:47:30 +0900
Subject: [PATCH] Add Raspberry Pi bootstrap script

---
 deploy/raspberry/bootstrap.sh | 85 +++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 deploy/raspberry/bootstrap.sh

diff --git a/deploy/raspberry/bootstrap.sh b/deploy/raspberry/bootstrap.sh
new file mode 100644
index 0000000..fc6f048
--- /dev/null
+++ b/deploy/raspberry/bootstrap.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PROJECT_DIR="${PROJECT_DIR:-$HOME/apps/chat}"
+NODE_MAJOR="${NODE_MAJOR:-20}"
+
+log() {
+  printf '\n[raspi-chat] %s\n' "$1"
+}
+
+if [[ "${EUID}" -eq 0 ]]; then
+  echo "Do not run this script as root. Run as the normal Raspberry Pi user."
+  exit 1
+fi
+
+log "Updating system packages"
+sudo apt update
+sudo apt upgrade -y
+
+log "Installing base packages"
+sudo apt install -y git curl sqlite3 ufw fail2ban wireguard rsync ca-certificates gnupg
+
+if ! command -v node >/dev/null 2>&1 || ! node -v | grep -q "^v${NODE_MAJOR}\."; then
+  log "Installing Node.js ${NODE_MAJOR}.x"
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | sudo -E bash -
+  sudo apt install -y nodejs
+else
+  log "Node.js ${NODE_MAJOR}.x already installed"
+fi
+
+log "Node version: $(node -v)"
+log "NPM version: $(npm -v)"
+
+if ! command -v pm2 >/dev/null 2>&1; then
+  log "Installing PM2"
+  sudo npm install -g pm2
+else
+  log "PM2 already installed"
+fi
+
+mkdir -p "$HOME/apps"
+
+if [[ ! -d "$PROJECT_DIR/.git" ]]; then
+  log "Project directory not found at $PROJECT_DIR"
+  echo "Clone the repository manually:"
+  echo "  mkdir -p $HOME/apps"
+  echo "  cd $HOME/apps"
+  echo "  git clone https://github.com/viktor138irk/chat.git"
+else
+  log "Project found at $PROJECT_DIR"
+  cd "$PROJECT_DIR"
+  log "Installing npm dependencies"
+  npm install
+
+  if [[ ! -f backend/.env ]]; then
+    log "Creating backend/.env from example"
+    cp backend/.env.example backend/.env
+    echo "Edit backend/.env before production run."
+  fi
+
+  mkdir -p backend/data
+fi
+
+log "Configuring UFW firewall"
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+# Allow SSH from common private LAN ranges. Adjust later if needed.
+sudo ufw allow from 192.168.0.0/16 to any port 22 proto tcp
+sudo ufw allow from 10.0.0.0/8 to any port 22 proto tcp
+sudo ufw allow from 172.16.0.0/12 to any port 22 proto tcp
+
+# Backend should be reachable only from VPS over WireGuard.
+# Default VPS WireGuard IP is expected to be 10.8.0.1.
+sudo ufw allow from 10.8.0.1 to any port 3000 proto tcp
+
+sudo ufw --force enable
+sudo ufw status verbose
+
+log "Bootstrap finished"
+echo "Next steps:"
+echo "1. Edit backend/.env"
+echo "2. Configure WireGuard"
+echo "3. Start backend with PM2: pm2 start backend/src/server.js --name raspi-chat-backend"
+echo "4. Run: pm2 save && pm2 startup"