`golive-ssl-bind.sh`

26 lines
#!/usr/bin/env bash
# Fix: bind agency vhost to the specific public IP (45.61.58.125) so it joins the
# same listen group as the fleet default_server and wins SNI publicly.
set -euo pipefail
SRV=root@45.61.58.125
IP=45.61.58.125
HOST=agency.agentabrams.com
PORT=9788
ssh -o StrictHostKeyChecking=accept-new "$SRV" "cat > /etc/nginx/conf.d/$HOST.conf <<NG
server {
  listen $IP:80;
  server_name $HOST;
  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type \"text/plain\"; try_files \\\$uri =404; }
  location / { return 301 https://\\\$host\\\$request_uri; }
}
server {
  listen $IP:443 ssl http2;
  server_name $HOST;
  ssl_certificate     /etc/letsencrypt/live/$HOST/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/$HOST/privkey.pem;
  location / { proxy_pass http://127.0.0.1:$PORT;
    proxy_set_header Host \\\$host; proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \\\$scheme; }
}
NG
nginx -t && systemctl reload nginx && echo RELOADED && echo '== public cert ==' && echo | openssl s_client -servername $HOST -connect $IP:443 2>/dev/null | openssl x509 -noout -subject"