golive: fix SSL — serve ACME challenge from webroot (not proxied), obtain via certbot certonly + install :443 vhost

11c96399e4e86ac8eae04f98f90c3f8596b4c3d7 · 2026-08-13 13:11:18 -0700 · Steve Abrams

Files touched

M golive.sh

Diff

commit 11c96399e4e86ac8eae04f98f90c3f8596b4c3d7
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 13 13:11:18 2026 -0700

    golive: fix SSL — serve ACME challenge from webroot (not proxied), obtain via certbot certonly + install :443 vhost
---
 golive.sh | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/golive.sh b/golive.sh
index 1003669..5d6f14d 100755
--- a/golive.sh
+++ b/golive.sh
@@ -21,11 +21,12 @@ echo "==> 3/6 install + (re)start pm2 on :$PORT"
 ssh "$SRV" "cd $DIR && npm install --omit=dev --no-audit --no-fund \
   && (pm2 restart $APP --update-env || PORT=$PORT pm2 start server.js --name $APP) && pm2 save"
 
-echo "==> 4/6 nginx vhost (conf.d — the include dir this box actually loads)"
-ssh "$SRV" "cat > /etc/nginx/conf.d/$HOST.conf <<NG
+echo "==> 4/6 nginx vhost (conf.d) with a real ACME webroot so the challenge isn't proxied to the app"
+ssh "$SRV" "mkdir -p /var/www/certbot && cat > /etc/nginx/conf.d/$HOST.conf <<NG
 server {
   listen 80;
   server_name $HOST;
+  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type \"text/plain\"; try_files \\\$uri =404; }
   location / {
     proxy_pass http://127.0.0.1:$PORT;
     proxy_set_header Host \\\$host;
@@ -36,8 +37,19 @@ server {
 NG
 nginx -t && systemctl reload nginx"
 
-echo "==> 5/6 SSL (Let's Encrypt via certbot --nginx)"
-ssh "$SRV" "certbot --nginx -d $HOST --non-interactive --agree-tos -m steve@designerwallcoverings.com --redirect || echo 'certbot: rerun once DNS has propagated'"
+echo "==> 5/6 SSL — obtain via webroot, then install a :443 server block + http->https redirect"
+ssh "$SRV" "certbot certonly --webroot -w /var/www/certbot -d $HOST --non-interactive --agree-tos -m steve@designerwallcoverings.com && \
+cat > /etc/nginx/conf.d/$HOST.conf <<NG2
+server { listen 80; server_name $HOST;
+  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type \"text/plain\"; try_files \\\$uri =404; }
+  location / { return 301 https://\\\$host\\\$request_uri; } }
+server { listen 443 ssl http2; server_name $HOST;
+  ssl_certificate     /etc/letsencrypt/live/$HOST/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/$HOST/privkey.pem;
+  location / { proxy_pass http://127.0.0.1:$PORT;
+    proxy_set_header Host \\\$host; proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \\\$scheme; } }
+NG2
+nginx -t && systemctl reload nginx && echo SSL_INSTALLED"
 
 echo "==> 6/6 verify"
 ssh "$SRV" "curl -s -o /dev/null -w 'origin :$PORT -> %{http_code}\n' http://127.0.0.1:$PORT/healthz"

← b0ab28a repoint agency site to agency.agentabrams.com (owned CF zone · back to Abramsagency · add golive-ssl-fix.sh: raise server_names_hash_bucket_size s 55142be →