if docker compose version >/dev/null 2>&1; then

echo "docker compose"

elif command -v docker-compose >/dev/null 2>&1; then

echo "docker-compose"

else

print_error "Docker Compose not found. Install Docker Compose."

exit 1

fi

if [ "${EUID:-0}" -ne 0 ]; then

print_error "Run as root (sudo)."

exit 1

fi

if ! command -v docker >/dev/null 2>&1; then

print_error "Docker not found. Install Docker."

exit 1

fi

local ips first

ips="$(hostname -I 2>/dev/null || true)" || true

set -- $ips

first="${1:-}"

if [ -z "$first" ]; then first="127.0.0.1"; fi

echo "$first"

# Try common cloud metadata endpoints (fast timeouts)

# GCP

curl -fsS --max-time 1 -H "Metadata-Flavor: Google" \

"http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" 2>/dev/null || true

# AWS

curl -fsS --max-time 1 "http://169.254.169.254/latest/meta-data/public-ipv4" 2>/dev/null || true

# Azure

curl -fsS --max-time 1 -H "Metadata:true" \

"http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2021-02-01&format=text" 2>/dev/null || true

# OpenDNS

if command -v dig >/dev/null 2>&1; then

dig +short myip.opendns.com @resolver1.opendns.com 2>/dev/null || true

fi

# ipify / checkip (HTTP to avoid TLS issues on minimal hosts; fallback to HTTPS if needed)

curl -fsS --max-time 2 http://api.ipify.org 2>/dev/null ||

curl -fsS --max-time 2 http://checkip.amazonaws.com 2>/dev/null ||

curl -fsS --max-time 2 https://api.ipify.org 2>/dev/null ||

curl -fsS --max-time 2 https://checkip.amazonaws.com 2>/dev/null || true

# Best-effort: look at non-RFC1918 addresses on interfaces

if command -v ip >/dev/null 2>&1; then

ip -br -4 addr show 2>/dev/null | awk '{for(i=1;i<=NF;i++){if($i~"[0-9]+/[0-9]+"){gsub("/.*","",$i); print $i}}}' |

awk '!($0 ~ /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.|169\.254\.)/) {print; exit}' || true

fi

local ip

# 1) Cloud metadata

ip=$(_detect_from_cloud | pick_first_ip)

if [ -n "${ip:-}" ] && is_ip "$ip"; then

echo "$ip"

return 0

fi

# 2) DNS

ip=$(_detect_from_dns | pick_first_ip)

if [ -n "${ip:-}" ] && is_ip "$ip"; then

echo "$ip"

return 0

fi

# 3) HTTP echo

ip=$(_detect_from_http | pick_first_ip)

if [ -n "${ip:-}" ] && is_ip "$ip"; then

echo "$ip"

return 0

fi

# 4) Non-RFC1918 iface address

ip=$(_detect_public_from_ifaces)

if [ -n "${ip:-}" ] && is_ip "$ip"; then

echo "$ip"

return 0

fi

# 5) Fall back to internal

detect_internal_ip

local compose="${PROJECT_DIR}/docker-compose.yml"

local port=""

if [ -f "$compose" ]; then

port="$(grep -E '^\s*-\s*"?[0-9]+:3001"?' "$compose" 2>/dev/null | sed -E 's/.*"?([0-9]+):3001"?.*/\1/' | head -n1 || true)"

fi

if [ -n "$port" ]; then echo "$port"; else echo "$HTTPS_PORT_OUT"; fi

# Extract host used in PUBLIC_ORIGIN=https://HOST:PORT

local compose="${PROJECT_DIR}/docker-compose.yml"

[ -f "$compose" ] || {

echo ""

return 0

}

local line host

line="$(grep -E 'PUBLIC_ORIGIN=https?://[^ "]+' "$compose" | head -n1 || true)"

host="${line#*=https://}"

host="${host%%:*}"

echo "$host"

local input=""

echo -ne "${YELLOW}➜ External HTTPS port [default 4433] (5s to respond): ${NC}"

if read -t 5 -r input; then :; else input=""; fi

if [[ "$input" =~ ^[0-9]+$ ]] && [ "$input" -ge 1 ] && [ "$input" -le 65535 ]; then

HTTPS_PORT_OUT="$input"

else

HTTPS_PORT_OUT=4433

fi

print_info "Using external HTTPS port: ${HTTPS_PORT_OUT}"

local input=""

echo -ne "${YELLOW}➜ Optional domain (e.g., notes.example.com) [20s to respond, blank = use IP]: ${NC}"

if read -t 20 -r input; then :; else input=""; fi

if [ -n "$input" ]; then

if is_domain_like "$input"; then

DOMAIN_HOST="$input"

print_info "Will use domain: ${DOMAIN_HOST} (COOKIE_DOMAIN will be set)"

else

print_error "Invalid domain syntax. Falling back to IP mode."

DOMAIN_HOST=""

fi

else

print_info "No domain provided; using IP mode (may cause auth loop in some browsers)."

fi

local host="$1"

shift

cat >.env <<EOF

mkdir -p nginx

cat >nginx/nginx.conf <<'EOF'

cat >localstack_bootstrap.sh <<'EOF'

chmod +x localstack_bootstrap.sh

mkdir -p web-entry

cat >web-entry/50-set-sync-server.sh <<'EOF'

chmod +x web-entry/50-set-sync-server.sh

local host="$1" # domain or IP for PUBLIC_ORIGIN

local domain="${2:-}"

mkdir -p data/mysql data/redis uploads logs nginx certs

local cookie_line=""

if [ -n "$domain" ]; then

cookie_line=" - COOKIE_DOMAIN=${domain}"

fi

cat >docker-compose.yml <<EOF

local ip="$1"

shift

local domain="${1:-}"

shift || true

cat >nginx/openssl.cnf <<EOF

if [ -n "${domain}" ]; then

# Insert DNS.2 only if domain provided

sed -i '/DNS.1 = localhost/a DNS.2 = '"${domain}" nginx/openssl.cnf

fi

openssl req -x509 -nodes -days 825 -newkey rsa:2048 \

-keyout certs/server.key \

-out certs/server.crt \

-config nginx/openssl.cnf >/dev/null 2>&1

require_root

require_docker

local DCMD

DCMD=$(compose_cmd)

# Prefer PUBLIC IP

local PUB_IP

PUB_IP=$(detect_public_ip)

prompt_https_port

prompt_domain

local HOST_CHOICE

if [ -n "${DOMAIN_HOST}" ]; then

HOST_CHOICE="${DOMAIN_HOST}"

else

HOST_CHOICE="${PUB_IP}"

fi

print_info "Setting up Standard Notes at ${PROJECT_DIR} (host: ${HOST_CHOICE})"

if [ -d "$PROJECT_DIR" ]; then

print_info "Existing install found. Stopping & removing..."

(cd "$PROJECT_DIR" && $DCMD down -v || true)

rm -rf "$PROJECT_DIR"

fi

mkdir -p "$PROJECT_DIR"/{data/mysql,data/redis,uploads,logs,nginx,certs,web-entry}

cd "$PROJECT_DIR"

print_success "Directory structure created"

print_info "Generating secrets..."

AUTH_JWT_SECRET=$(openssl rand -hex 32)

AUTH_SERVER_ENCRYPTION_SERVER_KEY=$(openssl rand -hex 32)

VALET_TOKEN_SECRET=$(openssl rand -hex 32)

DB_PASSWORD=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-25)

print_success "Secrets generated"

print_info "Writing .env..."

write_env "$HOST_CHOICE"

print_success ".env written"

print_info "Generating self-signed TLS cert (SANs: ${PUB_IP}, localhost${DOMAIN_HOST:+, ${DOMAIN_HOST}})..."

write_nginx_conf

make_cert "$PUB_IP" "${DOMAIN_HOST:-}"

print_success "Cert created at certs/server.crt (import it into your OS trust store)"

print_info "Adding web runtime entry to force local sync server..."

write_web_entry

print_success "Web runtime entry added"

print_info "Writing docker-compose.yml..."

write_compose "$HOST_CHOICE" "${DOMAIN_HOST:-}"

print_success "docker-compose.yml written"

print_info "Writing LocalStack bootstrap..."

write_localstack_bootstrap

print_success "LocalStack bootstrap created"

print_info "Pulling images..."

$DCMD pull

print_success "Images pulled"

print_info "Starting services..."

$DCMD up -d

print_info "Waiting for API to respond through Nginx (treating 2xx–4xx as ready; ignoring 5xx/502)..."

wait_for_api_ready "https://localhost:$(get_current_https_port)/api" 180 || true

$DCMD ps

echo

print_success "Installed! Visit: https://${HOST_CHOICE}:${HTTPS_PORT_OUT}"

echo "API: https://${HOST_CHOICE}:${HTTPS_PORT_OUT}/api"

echo "Files: https://${HOST_CHOICE}:${HTTPS_PORT_OUT}/files"

echo

print_info "If the browser complains, import ${PROJECT_DIR}/certs/server.crt into your OS trust store."

test_api

local url="${1:?}"

local timeout="${2:-120}"

local start now code

start=$(date +%s)

while true; do

code=$(curl -sk -o /dev/null -w "%{http_code}" "$url" || true)

if [ -n "$code" ] && [ "$code" != "000" ] && [ "$code" -ge 200 ] && [ "$code" -lt 500 ]; then

print_success "API responded at $url (HTTP ${code})."

return 0

fi

now=$(date +%s)

if [ $((now - start)) -ge "$timeout" ]; then

print_info "API not ready after ${timeout}s; continuing (you can check logs)."

return 1

fi

sleep 3

done

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

$DCMD up -d

print_success "Started"

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

$DCMD down

print_success "Stopped"

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

$DCMD restart

print_success "Restarted"

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

$DCMD ps

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

if [ "${1:-}" != "" ]; then $DCMD logs -f "$1"; else $DCMD logs -f; fi

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

mkdir -p backups

local ts="backups/$(date +%Y%m%d_%H%M%S)"

mkdir -p "$ts"

# shellcheck disable=SC1091

. ./.env

print_info "Dumping database..."

$DCMD exec -T db mysqldump -u${DB_USERNAME} -p${DB_PASSWORD} ${DB_DATABASE} >"$ts/database.sql"

cp -r ./uploads "$ts/uploads"

cp .env "$ts/.env"

print_success "Backup complete: $ts"

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

echo "WARNING: Deletes ALL data under $PROJECT_DIR/data and uploads/logs!"

read -p "Type 'yes' to continue: " y

if [ "$y" != "yes" ]; then

echo "Cancelled."

return 0

fi

$DCMD down -v

rm -rf data/mysql/* data/redis/* uploads/* logs/*

print_success "Data cleaned."

require_root

cd "$PROJECT_DIR"

local domain="${1:-}"

shift || true

local PUB_IP

PUB_IP=$(detect_public_ip)

print_info "Reissuing self-signed cert for IP ${PUB_IP}${domain:+ and domain ${domain}}..."

make_cert "$PUB_IP" "${domain:-}"

print_success "New cert generated at certs/server.crt"

restart_stack

echo "Trust the new certificate on your devices."

require_root

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

local NEW_IP

NEW_IP=$(detect_public_ip)

local CUR_PORT

CUR_PORT=$(get_current_https_port)

local CUR_HOST

CUR_HOST=$(get_current_origin_host)

print_info "Detected public IP: ${NEW_IP}"

# If CUR_HOST is a domain (contains letters), keep domain for origin but include NEW_IP in cert SANs

if echo "$CUR_HOST" | grep -Eq '[A-Za-z]'; then

print_info "Compose currently uses domain '${CUR_HOST}'. Keeping it and updating cert SANs with IP ${NEW_IP}."

reissue_cert "${CUR_HOST}"

# Ensure .env PUBLIC_FILES_SERVER_URL continues to use the domain

sed -i "s|^PUBLIC_FILES_SERVER_URL=.*|PUBLIC_FILES_SERVER_URL=https://${CUR_HOST}:${CUR_PORT}/files|" .env

$DCMD down

$DCMD up -d

sleep 8

echo "Access (domain): https://${CUR_HOST}:${CUR_PORT}"

echo "Access (IP): https://${NEW_IP}:${CUR_PORT}"

return 0

fi

print_info "Updating configs to use IP ${NEW_IP}..."

# Update .env

sed -i "s|^PUBLIC_FILES_SERVER_URL=.*|PUBLIC_FILES_SERVER_URL=https://${NEW_IP}:${CUR_PORT}/files|" .env

# Update docker-compose.yml web envs

sed -i -E "s#(PUBLIC_ORIGIN=)https://[^:]+:[0-9]+#\1https://${NEW_IP}:${CUR_PORT}#g" docker-compose.yml

sed -i -E "s#(DEFAULT_SYNC_SERVER=)https://[^:]+:[0-9]+/api#\1https://${NEW_IP}:${CUR_PORT}/api#g" docker-compose.yml

sed -i -E "s#(NEXT_PUBLIC_DEFAULT_SYNC_SERVER=)https://[^:]+:[0-9]+/api#\1https://${NEW_IP}:${CUR_PORT}/api#g" docker-compose.yml

sed -i -E "s#(SF_DEFAULT_SERVER=)https://[^:]+:[0-9]+/api#\1https://${NEW_IP}:${CUR_PORT}/api#g" docker-compose.yml

sed -i -E "s#(SF_NEXT_VERSION_SERVER=)https://[^:]+:[0-9]+/api#\1https://${NEW_IP}:${CUR_PORT}/api#g" docker-compose.yml

# Remove COOKIE_DOMAIN in IP mode (if present)

sed -i '/COOKIE_DOMAIN=/d' docker-compose.yml || true

# Reissue cert for new IP

make_cert "$NEW_IP" ""

print_success "IP updated to ${NEW_IP}"

$DCMD down

$DCMD up -d

sleep 8

echo "Access: https://${NEW_IP}:${CUR_PORT}"

require_root

local host="" ip="" port="$(get_current_https_port)"

while [ $# -gt 0 ]; do

case "$1" in

--host)

host="${2:-}"

shift 2

;;

--ip)

ip="${2:-}"

shift 2

;;

--port)

port="${2:-}"

shift 2

;;

*)

print_error "Unknown option: $1"

exit 1

;;

esac

done

if [ -z "$host" ]; then

print_error "--host is required (e.g., notes.example.com)"

exit 1

fi

if [ -z "$ip" ]; then ip=$(detect_public_ip); fi

if ! is_ip "$ip"; then

print_error "Invalid IP to embed in cert SANs: '$ip'"

exit 1

fi

local DCMD

DCMD=$(compose_cmd)

cd "$PROJECT_DIR"

print_info "Stopping stack..."

$DCMD down || true

print_info "Updating .env/.yml to host=${host}, port=${port}"

sed -i "s|^PUBLIC_FILES_SERVER_URL=.*|PUBLIC_FILES_SERVER_URL=https://${host}:${port}/files|" .env

sed -i -E "s#(PUBLIC_ORIGIN=)https://[^\"]+#\1https://${host}:${port}#" docker-compose.yml

sed -i -E "s#(DEFAULT_SYNC_SERVER=)https://[^\"]+/api#\1https://${host}:${port}/api#" docker-compose.yml

sed -i -E "s#(NEXT_PUBLIC_DEFAULT_SYNC_SERVER=)https://[^\"]+/api#\1https://${host}:${port}/api#" docker-compose.yml

sed -i -E "s#(SF_DEFAULT_SERVER=)https://[^\"]+/api#\1https://${host}:${port}/api#" docker-compose.yml

sed -i -E "s#(SF_NEXT_VERSION_SERVER=)https://[^\"]+/api#\1https://${host}:${port}/api#" docker-compose.yml

# Ensure COOKIE_DOMAIN is set for domain mode

sed -i '/COOKIE_DOMAIN=/d' docker-compose.yml || true

sed -i '/AUTH_SERVER_DISABLE_USER_REGISTRATION=/a\ - COOKIE_DOMAIN='"${host}" docker-compose.yml

print_info "Regenerating self-signed cert with SANs: IP=${ip}, DNS=${host}"

make_cert "$ip" "$host"

print_info "Starting stack..."

$DCMD up -d

echo "Access: https://${host}:${port} (DNS)"

echo "Access: https://${ip}:${port} (IP)"

local DCMD

DCMD=$(compose_cmd)

echo "WARNING: This will STOP and REMOVE ${PROJECT_DIR} entirely."

read -p "Type 'delete' to proceed: " conf

if [ "$conf" != "delete" ]; then

echo "Cancelled."

return 0

fi

if [ -d "$PROJECT_DIR" ]; then

(cd "$PROJECT_DIR" && $DCMD down -v || true)

(cd /root && rm -rf "$PROJECT_DIR")

fi

print_success "Uninstalled."

echo

print_info "Testing via Nginx proxy (HTTPS, self-signed; -k used)..."

local port base code

port=$(get_current_https_port)

base="https://localhost:${port}"

for p in "/api" "/files" "/"; do

code=$(curl -sk -o /dev/null -w "%{http_code}" "${base}${p}" || true)

if [ -n "$code" ] && [ "$code" != "000" ]; then

print_success "Proxy responded at ${p} (HTTP ${code})."

else

print_error "No response at ${p}."

fi

done

cat <<MENU

read -p "Select an option: " choice

case "$choice" in

1) install_stack ;;

2) start_stack ;;

3) stop_stack ;;

4) restart_stack ;;

5) status_stack ;;

6) logs_stack ;;

7)

read -p "Service name (db|cache|localstack|server|web|nginx): " svc

logs_stack "$svc"

;;

8) backup_stack ;;

9) clean_stack ;;

10) update_ip ;;

11)

read -p "Optional domain for SAN (blank to skip): " d

reissue_cert "${d:-}"

;;

12) uninstall_stack ;;

13)

read -p "Domain (e.g., notes.example.com): " dom

read -p "Port [default $(get_current_https_port)]: " prt

prt="${prt:-$(get_current_https_port)}"

configure_origin --host "$dom" --port "$prt"

;;

0) exit 0 ;;

*) echo "Unknown choice" ;;

esac

cat <<USAGE