Install and configure SonarQube for code quality analysis with PostgreSQL and SSL

#!/usr/bin/env bash
set -euo pipefail

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Configuration variables
SONAR_VERSION="10.3.0.82913"
SONAR_URL="https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-${SONAR_VERSION}.zip"
SONAR_USER="sonarqube"
SONAR_HOME="/opt/sonarqube"
SONAR_LOG_DIR="/var/log/sonarqube"
DB_NAME="sonarqube"
DB_USER="sonarqube"
DB_PASS="SecureP@ssw0rd123"
DOMAIN=""

# Usage message
usage() {
    echo "Usage: $0 [domain]"
    echo "  domain: Optional domain name for SSL configuration (e.g., sonar.example.com)"
    exit 1
}

# Error handling
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop sonarqube 2>/dev/null || true
    systemctl stop postgresql 2>/dev/null || true
    userdel $SONAR_USER 2>/dev/null || true
    rm -rf $SONAR_HOME $SONAR_LOG_DIR /tmp/sonarqube-* 2>/dev/null || true
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

# Parse arguments
if [[ $# -gt 1 ]]; then
    usage
elif [[ $# -eq 1 ]]; then
    DOMAIN="$1"
fi

# Detect distribution
echo -e "${YELLOW}[1/10] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            JAVA_PKG="openjdk-17-jre-headless"
            NGINX_CONF_DIR="/etc/nginx/sites-available"
            NGINX_ENABLED_DIR="/etc/nginx/sites-enabled"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            JAVA_PKG="java-17-openjdk-headless"
            NGINX_CONF_DIR="/etc/nginx/conf.d"
            NGINX_ENABLED_DIR="/etc/nginx/conf.d"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            JAVA_PKG="java-17-openjdk-headless"
            NGINX_CONF_DIR="/etc/nginx/conf.d"
            NGINX_ENABLED_DIR="/etc/nginx/conf.d"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"

# Update system and install prerequisites
echo -e "${YELLOW}[2/10] Installing prerequisites...${NC}"
$PKG_UPDATE
$PKG_INSTALL $JAVA_PKG wget unzip postgresql postgresql-contrib nginx certbot python3-certbot-nginx

# Install postgresql-server for RHEL-based systems
if [[ "$PKG_MGR" == "dnf" || "$PKG_MGR" == "yum" ]]; then
    $PKG_INSTALL postgresql-server
fi

# Configure system limits
echo -e "${YELLOW}[3/10] Configuring system limits...${NC}"
cat > /etc/sysctl.d/99-sonarqube.conf << 'EOF'
vm.max_map_count=524288
fs.file-max=131072
EOF
sysctl -p /etc/sysctl.d/99-sonarqube.conf

cat >> /etc/security/limits.conf << 'EOF'
sonarqube   -   nofile   131072
sonarqube   -   nproc    8192
EOF

# Initialize PostgreSQL
echo -e "${YELLOW}[4/10] Initializing PostgreSQL...${NC}"
if [[ "$PKG_MGR" == "dnf" || "$PKG_MGR" == "yum" ]]; then
    postgresql-setup --initdb 2>/dev/null || true
fi

systemctl enable postgresql
systemctl start postgresql

# Create SonarQube database and user
echo -e "${YELLOW}[5/10] Creating SonarQube database...${NC}"
sudo -u postgres createuser $DB_USER 2>/dev/null || true
sudo -u postgres createdb -O $DB_USER $DB_NAME 2>/dev/null || true
sudo -u postgres psql -c "ALTER USER $DB_USER WITH ENCRYPTED PASSWORD '$DB_PASS';" 2>/dev/null || true

# Create SonarQube system user
echo -e "${YELLOW}[6/10] Creating SonarQube system user...${NC}"
useradd --system --no-create-home --shell /bin/false $SONAR_USER 2>/dev/null || true
mkdir -p $SONAR_HOME $SONAR_LOG_DIR
chown $SONAR_USER:$SONAR_USER $SONAR_HOME $SONAR_LOG_DIR

# Download and install SonarQube
echo -e "${YELLOW}[7/10] Downloading and installing SonarQube...${NC}"
cd /tmp
wget -q $SONAR_URL -O sonarqube-${SONAR_VERSION}.zip
unzip -q sonarqube-${SONAR_VERSION}.zip
mv sonarqube-${SONAR_VERSION}/* $SONAR_HOME/
chown -R $SONAR_USER:$SONAR_USER $SONAR_HOME

# Configure SonarQube
echo -e "${YELLOW}[8/10] Configuring SonarQube...${NC}"
cat > $SONAR_HOME/conf/sonar.properties << EOF
# Database Configuration
sonar.jdbc.username=$DB_USER
sonar.jdbc.password=$DB_PASS
sonar.jdbc.url=jdbc:postgresql://localhost:5432/$DB_NAME

# Web Server Configuration
sonar.web.host=127.0.0.1
sonar.web.port=9000
sonar.web.context=/

# System Configuration
sonar.path.data=$SONAR_HOME/data
sonar.path.temp=$SONAR_HOME/temp
sonar.path.logs=$SONAR_LOG_DIR

# Security
sonar.forceAuthentication=true
sonar.security.realm=sonar
EOF

chown $SONAR_USER:$SONAR_USER $SONAR_HOME/conf/sonar.properties
chmod 640 $SONAR_HOME/conf/sonar.properties

# Create systemd service
echo -e "${YELLOW}[9/10] Creating systemd service...${NC}"
cat > /etc/systemd/system/sonarqube.service << EOF
[Unit]
Description=SonarQube service
After=syslog.target network.target postgresql.service
Requires=postgresql.service

[Service]
Type=forking
ExecStart=$SONAR_HOME/bin/linux-x86-64/sonar.sh start
ExecStop=$SONAR_HOME/bin/linux-x86-64/sonar.sh stop
User=$SONAR_USER
Group=$SONAR_USER
Restart=always
LimitNOFILE=131072
LimitNPROC=8192
TimeoutStartSec=300
SuccessExitStatus=143
KillMode=mixed

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable sonarqube

# Configure NGINX
echo -e "${YELLOW}[10/10] Configuring NGINX reverse proxy...${NC}"
if [[ "$ID" == "ubuntu" || "$ID" == "debian" ]]; then
    NGINX_CONF="$NGINX_CONF_DIR/sonarqube"
else
    NGINX_CONF="$NGINX_CONF_DIR/sonarqube.conf"
fi

if [[ -n "$DOMAIN" ]]; then
    cat > $NGINX_CONF << EOF
server {
    listen 80;
    server_name $DOMAIN;
    return 301 https://\$server_name\$request_uri;
}

server {
    listen 443 ssl http2;
    server_name $DOMAIN;
    
    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
    
    client_max_body_size 50M;
}
EOF
else
    cat > $NGINX_CONF << EOF
server {
    listen 80;
    server_name _;
    
    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
    
    client_max_body_size 50M;
}
EOF
fi

# Enable site for Ubuntu/Debian
if [[ "$ID" == "ubuntu" || "$ID" == "debian" ]]; then
    ln -sf $NGINX_CONF $NGINX_ENABLED_DIR/sonarqube
fi

# Start services
systemctl enable nginx
systemctl start nginx
systemctl start sonarqube

# Configure firewall
if command -v ufw >/dev/null 2>&1; then
    ufw allow 80/tcp
    ufw allow 443/tcp
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=http
    firewall-cmd --permanent --add-service=https
    firewall-cmd --reload
fi

# Clean up
rm -rf /tmp/sonarqube-*

# Verification
echo -e "${GREEN}Installation completed successfully!${NC}"
echo -e "${YELLOW}Verifying installation...${NC}"

# Wait for SonarQube to start
echo "Waiting for SonarQube to start..."
sleep 30

# Check services
if systemctl is-active --quiet postgresql; then
    echo -e "${GREEN}✓ PostgreSQL is running${NC}"
else
    echo -e "${RED}✗ PostgreSQL is not running${NC}"
fi

if systemctl is-active --quiet nginx; then
    echo -e "${GREEN}✓ NGINX is running${NC}"
else
    echo -e "${RED}✗ NGINX is not running${NC}"
fi

if systemctl is-active --quiet sonarqube; then
    echo -e "${GREEN}✓ SonarQube is running${NC}"
else
    echo -e "${RED}✗ SonarQube is not running${NC}"
fi

# Display access information
echo -e "\n${GREEN}SonarQube Installation Summary:${NC}"
echo "================================"
if [[ -n "$DOMAIN" ]]; then
    echo "URL: https://$DOMAIN"
    echo "Run 'certbot --nginx -d $DOMAIN' to obtain SSL certificate"
else
    echo "URL: http://$(hostname -I | awk '{print $1}')"
fi
echo "Default credentials: admin/admin"
echo "Database: PostgreSQL ($DB_NAME)"
echo "Logs: $SONAR_LOG_DIR"