`golive-ssl-diag.sh`

13 lines
#!/usr/bin/env bash
# READ-ONLY diagnostic: why does agency.agentabrams.com :443 serve the default cert?
# Run from Mac2:  bash ~/Projects/abramsagency/golive-ssl-diag.sh
set -euo pipefail
SRV=root@45.61.58.125
ssh -o StrictHostKeyChecking=accept-new "$SRV" 'bash -s' <<'EOS'
echo "== conf.d files mentioning agency =="; grep -rl agency.agentabrams.com /etc/nginx/ 2>/dev/null
echo "== loaded server blocks for agency (from nginx -T) =="; nginx -T 2>/dev/null | grep -nE "server_name agency.agentabrams.com|listen .*443|ssl_certificate .*agency" | grep -iA0 -B0 agency -n || true
echo "== full agency block(s) in running config =="; nginx -T 2>/dev/null | awk '/server_name[[:space:]]+agency.agentabrams.com/{p=1} p{print} p&&/}/{c++; if(c>0){p=0;c=0;print "----"}}' | head -60
echo "== is there a 443 default_server? =="; nginx -T 2>/dev/null | grep -nE "listen[[:space:]]+443.*default_server" | head
echo "== cert files present? =="; ls -la /etc/letsencrypt/live/agency.agentabrams.com/ 2>/dev/null || echo "NO cert dir"
EOS