`golive-ssl-fix.sh`

32 lines
#!/usr/bin/env bash
# Fix: agency.agentabrams.com :443 vhost isn't matching SNI because the box's
# server_names_hash can't register all names (the long-standing
# "could not build optimal server_names_hash" warning). Recommended remedy:
# raise server_names_hash_bucket_size. Idempotent + backed up + nginx -t gated.
# Run from Mac2:  bash ~/Projects/abramsagency/golive-ssl-fix.sh
set -euo pipefail
SRV=root@45.61.58.125
HOST=agency.agentabrams.com

ssh -o StrictHostKeyChecking=accept-new "$SRV" 'bash -s' <<'EOS'
set -e
C=/etc/nginx/nginx.conf
cp -n "$C" "$C.bak-ssl-agency2" 2>/dev/null || true
set_dir() { # $1=directive $2=value : set if present, else insert after first http {
  local d="$1" v="$2"
  if grep -qE "^\s*${d}\b" "$C"; then
    sed -i -E "s/^\s*${d}[[:space:]]+[0-9]+;/    ${d} ${v};/" "$C"
  else
    awk -v ins="    ${d} ${v};" 'f{print;next} /http[[:space:]]*\{/{print;print ins;f=1;next} {print}' "$C" > "$C.tmp" && mv "$C.tmp" "$C"
  fi
}
set_dir server_names_hash_max_size 8192
set_dir server_names_hash_bucket_size 128
echo "== directives now:"; grep -nE 'server_names_hash_(max_size|bucket_size)' "$C" || echo "(not found)"
nginx -t && systemctl reload nginx && echo NGINX_RELOADED
EOS

echo "== verify the cert served for $HOST SNI (want CN=$HOST, not 1800swallpaper) =="
echo | timeout 12 openssl s_client -servername "$HOST" -connect 45.61.58.125:443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null || true
curl -s -m 15 -o /dev/null -w "https status=%{http_code}\n" "https://$HOST/" || true