113 lines
2.7 KiB
Bash
Executable File
113 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install Spark SNI vhosts into the shared host nginx (do not replace nginx.conf).
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")" && pwd)"
|
|
HOST_DIR="$ROOT/host"
|
|
BACKUP="/root/nginx-backup-$(date +%Y%m%d%H%M%S)"
|
|
DOMAINS=(sparkapi.wyrs365.com sparkim.wyrs365.com sparkr.wyrs365.com)
|
|
|
|
cert_ok() {
|
|
[[ -f "/etc/letsencrypt/live/$1/fullchain.pem" ]]
|
|
}
|
|
|
|
all_certs_ok() {
|
|
local d
|
|
for d in "${DOMAINS[@]}"; do
|
|
cert_ok "$d" || return 1
|
|
done
|
|
}
|
|
|
|
install_acme_domain() {
|
|
local d=$1
|
|
mkdir -p /var/www/certbot
|
|
cat > "/etc/nginx/conf.d/spark-acme-${d}.conf" <<EOF
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ${d};
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|
|
EOF
|
|
nginx -t
|
|
systemctl reload nginx
|
|
}
|
|
|
|
issue_missing_certs() {
|
|
local d
|
|
for d in "${DOMAINS[@]}"; do
|
|
if cert_ok "$d"; then
|
|
continue
|
|
fi
|
|
install_acme_domain "$d"
|
|
certbot certonly --webroot -w /var/www/certbot \
|
|
--non-interactive --agree-tos --keep-until-expiring \
|
|
-d "$d"
|
|
rm -f "/etc/nginx/conf.d/spark-acme-${d}.conf"
|
|
done
|
|
}
|
|
|
|
rewrite_http_443() {
|
|
local f
|
|
for f in /etc/nginx/conf.d/*.conf; do
|
|
case "$(basename "$f")" in
|
|
sparkapi.conf|sparkr.conf|spark-acme.conf|00-spark-http.conf) continue ;;
|
|
spark-acme-*) continue ;;
|
|
esac
|
|
if grep -qE 'listen[[:space:]]+127\.0\.0\.1:8443' "$f"; then
|
|
continue
|
|
fi
|
|
if grep -qE 'listen[[:space:]]+443[[:space:]]+ssl' "$f"; then
|
|
sed -i \
|
|
-e 's/listen 443 ssl;/listen 127.0.0.1:8443 ssl proxy_protocol;/' \
|
|
-e 's/listen \[::\]:443 ssl;/listen [::1]:8443 ssl proxy_protocol;/' \
|
|
"$f"
|
|
fi
|
|
done
|
|
}
|
|
|
|
install_sni() {
|
|
rewrite_http_443
|
|
rm -f /etc/nginx/conf.d/spark-acme.conf
|
|
rm -f /etc/nginx/conf.d/spark-acme-*.conf
|
|
cp "$HOST_DIR/00-spark-http.conf" /etc/nginx/conf.d/00-spark-http.conf
|
|
cp "$HOST_DIR/sparkapi.conf" /etc/nginx/conf.d/sparkapi.conf
|
|
cp "$HOST_DIR/sparkr.conf" /etc/nginx/conf.d/sparkr.conf
|
|
cp "$HOST_DIR/spark-sni.conf" /etc/nginx/stream.d/spark-sni.conf
|
|
mkdir -p /etc/letsencrypt/renewal-hooks/deploy
|
|
cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'HOOK'
|
|
#!/bin/sh
|
|
systemctl reload nginx
|
|
HOOK
|
|
chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
|
|
if grep -RInE 'listen[[:space:]]+(\[::\]:)?443[[:space:]]+ssl' /etc/nginx/conf.d; then
|
|
echo "http still binds public 443" >&2
|
|
exit 1
|
|
fi
|
|
nginx -t
|
|
systemctl reload nginx
|
|
}
|
|
|
|
mkdir -p "$BACKUP"
|
|
cp -a /etc/nginx "$BACKUP/nginx"
|
|
echo "backup $BACKUP"
|
|
|
|
if ! all_certs_ok; then
|
|
issue_missing_certs
|
|
fi
|
|
|
|
if ! all_certs_ok; then
|
|
echo "certificates missing" >&2
|
|
exit 1
|
|
fi
|
|
|
|
install_sni
|
|
echo "nginx sni ready"
|