`scripts/golive-celebsignatures.sh`

44 lines
#!/bin/bash
# celebsignatures.com go-live — aligned to the FLEET nginx pattern (2026-08-03).
# The box has a central ACME handler (00-acme-default-80.conf, IP-bound
# `listen 45.61.58.125:80 default_server`) that serves HTTP-01 challenges from
# /var/www/certbot and 301s everything else to https. A generic `listen 80`
# vhost NEVER wins against that IP-bound default — so we DON'T ship our own :80
# block; we issue the cert via the shared webroot and serve the app from an
# IP-BOUND :443 block only (same rule that keeps other fleet vhosts from 301ing
# to the default cert).  Idempotent / re-runnable.
# Run:  cd ~/Projects/CelebritySignatures && bash scripts/golive-celebsignatures.sh
set -euo pipefail
H=root@45.61.58.125
IP=45.61.58.125
D=celebsignatures.com

# 1) Issue the cert through the fleet's central ACME webroot (both names resolve here).
ssh $H "certbot certonly --webroot -w /var/www/certbot \
  -d $D -d www.$D \
  --non-interactive --agree-tos -m steve@designerwallcoverings.com --keep-until-expiring"

# 2) App vhost: IP-BOUND :443 only (http->https handled centrally).
ssh $H "cat > /etc/nginx/sites-available/$D <<'NGINX'
server {
    listen $IP:443 ssl;
    server_name $D www.$D;
    ssl_certificate     /etc/letsencrypt/live/$D/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$D/privkey.pem;
    location / {
        proxy_pass http://127.0.0.1:9956;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
NGINX
ln -sf /etc/nginx/sites-available/$D /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx && sleep 2 && systemctl reload nginx"

echo '── smoke ──'
curl -s -o /dev/null -w "https://$D → %{http_code}\n" https://$D/
curl -s -o /dev/null -w "https://www.$D → %{http_code}\n" https://www.$D/
curl -s -o /dev/null -w "http://$D (central 301) → %{http_code}\n" http://$D/
curl -s https://$D/api/signatures | python3 -c "import json,sys;print('live signatures:',len(json.load(sys.stdin)))" 2>/dev/null || true