← back to Abramsagency

add golive-ssl-bind.sh: bind agency vhost to specific IP so it wins SNI publicly (listen-group fix)

37781bd64a491b393abbc6d81a3e25bcd59390e0 · 2026-08-13 13:50:33 -0700 · Steve Abrams

Files touched

• A golive-ssl-bind.sh

Diff

commit 37781bd64a491b393abbc6d81a3e25bcd59390e0
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 13 13:50:33 2026 -0700

    add golive-ssl-bind.sh: bind agency vhost to specific IP so it wins SNI publicly (listen-group fix)
---
 golive-ssl-bind.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/golive-ssl-bind.sh b/golive-ssl-bind.sh
new file mode 100644
index 0000000..9d57924
--- /dev/null
+++ b/golive-ssl-bind.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Fix: bind agency vhost to the specific public IP (45.61.58.125) so it joins the
+# same listen group as the fleet default_server and wins SNI publicly.
+set -euo pipefail
+SRV=root@45.61.58.125
+IP=45.61.58.125
+HOST=agency.agentabrams.com
+PORT=9788
+ssh -o StrictHostKeyChecking=accept-new "$SRV" "cat > /etc/nginx/conf.d/$HOST.conf <<NG
+server {
+  listen $IP:80;
+  server_name $HOST;
+  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type \"text/plain\"; try_files \\\$uri =404; }
+  location / { return 301 https://\\\$host\\\$request_uri; }
+}
+server {
+  listen $IP:443 ssl http2;
+  server_name $HOST;
+  ssl_certificate     /etc/letsencrypt/live/$HOST/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/$HOST/privkey.pem;
+  location / { proxy_pass http://127.0.0.1:$PORT;
+    proxy_set_header Host \\\$host; proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \\\$scheme; }
+}
+NG
+nginx -t && systemctl reload nginx && echo RELOADED && echo '== public cert ==' && echo | openssl s_client -servername $HOST -connect $IP:443 2>/dev/null | openssl x509 -noout -subject"

← ad0e29d add restart-nginx.sh: clean restart to rebuild server_names_  ·  back to Abramsagency  ·  add golive-finish.sh: full restart (apply specific-IP bind) 155edd3 →