Install and configure MinIO object storage with SSL and clustering

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
MINIO_DOMAIN="${1:-minio.example.com}"
CLUSTER_NODES="${2:-1}"

# Usage message
usage() {
    echo "Usage: $0 [domain] [cluster_nodes]"
    echo "Example: $0 minio.company.com 4"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup on failure
cleanup() {
    log_error "Installation failed. Cleaning up..."
    systemctl stop minio 2>/dev/null || true
    systemctl disable minio 2>/dev/null || true
    rm -f /etc/systemd/system/minio.service
    userdel minio-user 2>/dev/null || true
    rm -rf /opt/minio /etc/minio
}

trap cleanup ERR

# Validate arguments
if [[ $# -gt 2 ]]; then
    usage
fi

if [[ ! "$CLUSTER_NODES" =~ ^[1-9][0-9]*$ ]] || [ "$CLUSTER_NODES" -lt 1 ] || [ "$CLUSTER_NODES" -gt 32 ]; then
    log_error "Cluster nodes must be between 1 and 32"
    exit 1
fi

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

log_info "[1/10] Detecting distribution and package manager..."

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            PKG_UPGRADE="apt upgrade -y"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf upgrade -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf upgrade -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum check-update || true"
            PKG_INSTALL="yum install -y"
            PKG_UPGRADE="yum upgrade -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    log_info "Detected: $PRETTY_NAME using $PKG_MGR"
else
    log_error "Cannot detect distribution. /etc/os-release not found."
    exit 1
fi

log_info "[2/10] Updating system packages..."
$PKG_UPDATE
$PKG_UPGRADE
$PKG_INSTALL wget curl unzip openssl

log_info "[3/10] Creating MinIO user and directories..."
if ! id minio-user &>/dev/null; then
    useradd -r -s /bin/false minio-user
fi

mkdir -p /opt/minio/{bin,data} /etc/minio
chown minio-user:minio-user /opt/minio/data
chmod 755 /opt/minio/data
chmod 750 /etc/minio

log_info "[4/10] Downloading and installing MinIO server..."
cd /tmp
wget -q https://dl.min.io/server/minio/release/linux-amd64/minio
wget -q https://dl.min.io/client/mc/release/linux-amd64/mc

cp minio /opt/minio/bin/
cp mc /usr/local/bin/
chmod 755 /opt/minio/bin/minio /usr/local/bin/mc
chown minio-user:minio-user /opt/minio/bin/minio

log_info "[5/10] Generating SSL certificates..."
mkdir -p /opt/minio/certs
openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=$MINIO_DOMAIN" \
    -keyout /opt/minio/certs/private.key \
    -out /opt/minio/certs/public.crt 2>/dev/null

chown -R minio-user:minio-user /opt/minio/certs
chmod 600 /opt/minio/certs/private.key
chmod 644 /opt/minio/certs/public.crt

log_info "[6/10] Configuring MinIO environment..."
MINIO_PASSWORD=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-20)

# Generate cluster volumes configuration
if [ "$CLUSTER_NODES" -gt 1 ]; then
    MINIO_VOLUMES="https://$MINIO_DOMAIN-{1...$CLUSTER_NODES}/opt/minio/data"
else
    MINIO_VOLUMES="/opt/minio/data"
fi

cat > /etc/minio/minio.conf << EOF
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=$MINIO_PASSWORD
MINIO_VOLUMES="$MINIO_VOLUMES"
MINIO_SERVER_URL="https://$MINIO_DOMAIN:9000"
MINIO_BROWSER_REDIRECT_URL="https://$MINIO_DOMAIN:9001"
MINIO_OPTS="--certs-dir /opt/minio/certs --console-address :9001"
EOF

chown minio-user:minio-user /etc/minio/minio.conf
chmod 600 /etc/minio/minio.conf

log_info "[7/10] Creating systemd service..."
cat > /etc/systemd/system/minio.service << 'EOF'
[Unit]
Description=MinIO Object Storage Server
Documentation=https://docs.min.io
Wants=network-online.target
After=network-online.target

[Service]
Type=notify
User=minio-user
Group=minio-user
EnvironmentFile=-/etc/minio/minio.conf
ExecStart=/opt/minio/bin/minio server $MINIO_OPTS $MINIO_VOLUMES
Restart=always
LimitNOFILE=65536
TimeoutStopSec=infinity
SendSIGKILL=no

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable minio

log_info "[8/10] Configuring firewall..."
case "$FIREWALL_CMD" in
    ufw)
        if command -v ufw >/dev/null 2>&1; then
            ufw --force enable 2>/dev/null || true
            ufw allow 9000/tcp comment 'MinIO Server' || true
            ufw allow 9001/tcp comment 'MinIO Console' || true
            ufw reload || true
        fi
        ;;
    firewall-cmd)
        if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active firewalld >/dev/null 2>&1; then
            firewall-cmd --permanent --add-port=9000/tcp || true
            firewall-cmd --permanent --add-port=9001/tcp || true
            firewall-cmd --reload || true
        fi
        ;;
esac

log_info "[9/10] Starting MinIO service..."
systemctl start minio

# Wait for service to be ready
sleep 5

log_info "[10/10] Verifying installation..."
if systemctl is-active minio >/dev/null 2>&1; then
    log_info "MinIO service is running"
else
    log_error "MinIO service failed to start"
    systemctl status minio
    exit 1
fi

# Test MinIO server response
if curl -k -s https://localhost:9000/minio/health/live >/dev/null 2>&1; then
    log_info "MinIO health check passed"
else
    log_warn "MinIO health check failed - service may still be starting"
fi

log_info "Installation completed successfully!"
echo ""
log_info "MinIO Configuration:"
echo "  Server URL: https://$MINIO_DOMAIN:9000"
echo "  Console URL: https://$MINIO_DOMAIN:9001"
echo "  Username: minioadmin"
echo "  Password: $MINIO_PASSWORD"
echo ""

if [ "$CLUSTER_NODES" -gt 1 ]; then
    log_warn "Cluster setup detected ($CLUSTER_NODES nodes):"
    echo "  1. Repeat this installation on all cluster nodes"
    echo "  2. Ensure DNS/hosts entries for $MINIO_DOMAIN-{1...$CLUSTER_NODES}"
    echo "  3. Use the same MINIO_ROOT_USER and MINIO_ROOT_PASSWORD on all nodes"
    echo "  4. Start all nodes simultaneously for initial cluster formation"
fi

log_warn "Important notes:"
echo "  - Self-signed SSL certificate generated (replace with CA-signed for production)"
echo "  - Save the password in a secure location"
echo "  - Configure your application to use the MinIO S3-compatible API"