`deploy-nph-cert-TK10428.sh`

50 lines
#!/usr/bin/env bash
# TK-10428 cert fix. The full deploy landed steps 1-3 (measure route live on :9765);
# step 4 aborted because DNS-01 hit the DW Cloudflare 200-record cap
# ("CloudFlareAPIError: Record quota exceeded"). Fix = HTTP-01 webroot instead —
# creates NO DNS record, so the cap is irrelevant. The box's :80 default server
# (00-acme-default-80.conf) already serves /.well-known/acme-challenge/ from
# /var/www/certbot. Idempotent; safe to re-run. Run from Mac2 via: ! bash /tmp/nphcert
set -euo pipefail
K=root@45.61.58.125; IP=45.61.58.125; DOMAIN=nph.designerwallcoverings.com; PORT=9765
BTN="w=55.0&sku=DWLA-435111-Sample&mode=width"

echo "== [0/3] pre-flight: does the :80 webroot serve HTTP-01 for $DOMAIN? =="
ssh "$K" 'T=preflight-$(date +%s); D=/var/www/certbot/.well-known/acme-challenge
  mkdir -p "$D"; echo "$T" > "$D/$T"
  code=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: '"$DOMAIN"'" "http://'"$IP"'/.well-known/acme-challenge/$T")
  rm -f "$D/$T"
  echo "  webroot self-test -> HTTP $code (want 200)"
  [ "$code" = "200" ] || { echo "  ABORT: webroot not serving challenges"; exit 1; }'

echo "== [1/3] issue LE cert via HTTP-01 webroot (bypasses the CF record cap) =="
ssh "$K" "certbot certonly --webroot -w /var/www/certbot -d $DOMAIN \
  --non-interactive --agree-tos -m steve@designerwallcoverings.com --keep-until-expiring \
  && echo '  cert issued:' && ls /etc/letsencrypt/live/$DOMAIN/"

echo "== [2/3] write IP-bound :443 vhost + reload nginx (:80 stays with the central ACME default) =="
ssh "$K" "cat > /etc/nginx/sites-available/$DOMAIN.conf <<'NGINX'
server {
    server_name $DOMAIN;
    location / {
        proxy_pass http://127.0.0.1:$PORT;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
    listen $IP:443 ssl http2;
    ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
NGINX
ln -sf /etc/nginx/sites-available/$DOMAIN.conf /etc/nginx/sites-enabled/$DOMAIN.conf
nginx -t && systemctl reload nginx && sleep 2 && systemctl reload nginx && echo '  nginx reloaded (x2)'"

echo "== [3/3] verify LIVE over HTTPS (the exact PDP button URL) =="
curl -s -o /dev/null -w "  https://$DOMAIN/measure -> HTTP %{http_code}\n" "https://$DOMAIN/measure?$BTN"
echo -n "  cert subject: "; echo | openssl s_client -servername "$DOMAIN" -connect "$IP:443" 2>/dev/null | openssl x509 -noout -subject
echo "== DONE. Expect: HTTPS 200 + subject CN=$DOMAIN =="