`golive.sh`

57 lines
#!/usr/bin/env bash
# One-shot go-live for agency.agentabrams.com → Kamatera (deploy + pm2 + nginx + SSL).
# DNS is already done (Cloudflare A agency.agentabrams.com → 45.61.58.125).
# Run from Mac2:  bash ~/Projects/abramsagency/golive.sh
set -euo pipefail
SRV=root@45.61.58.125
APP=abramsagency
DIR=/var/www/agency.agentabrams.com
PORT=9788
HOST=agency.agentabrams.com

echo "==> 1/6 prep remote dir"
ssh -o StrictHostKeyChecking=accept-new "$SRV" "mkdir -p $DIR"

echo "==> 2/6 rsync build up"
rsync -az --delete \
  --exclude node_modules --exclude .git --exclude '.env*' --exclude 'data/leads.jsonl' \
  ~/Projects/abramsagency/ "$SRV:$DIR/"

echo "==> 3/6 install + (re)start pm2 on :$PORT"
ssh "$SRV" "cd $DIR && npm install --omit=dev --no-audit --no-fund \
  && (pm2 restart $APP --update-env || PORT=$PORT pm2 start server.js --name $APP) && pm2 save"

echo "==> 4/6 nginx vhost (conf.d) with a real ACME webroot so the challenge isn't proxied to the app"
ssh "$SRV" "mkdir -p /var/www/certbot && cat > /etc/nginx/conf.d/$HOST.conf <<NG
server {
  listen 80;
  server_name $HOST;
  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type \"text/plain\"; try_files \\\$uri =404; }
  location / {
    proxy_pass http://127.0.0.1:$PORT;
    proxy_set_header Host \\\$host;
    proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \\\$scheme;
  }
}
NG
nginx -t && systemctl reload nginx"

echo "==> 5/6 SSL — obtain via webroot, then install a :443 server block + http->https redirect"
ssh "$SRV" "certbot certonly --webroot -w /var/www/certbot -d $HOST --non-interactive --agree-tos -m steve@designerwallcoverings.com && \
cat > /etc/nginx/conf.d/$HOST.conf <<NG2
server { listen 80; server_name $HOST;
  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type \"text/plain\"; try_files \\\$uri =404; }
  location / { return 301 https://\\\$host\\\$request_uri; } }
server { listen 443 ssl http2; server_name $HOST;
  ssl_certificate     /etc/letsencrypt/live/$HOST/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/$HOST/privkey.pem;
  location / { proxy_pass http://127.0.0.1:$PORT;
    proxy_set_header Host \\\$host; proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \\\$scheme; } }
NG2
nginx -t && systemctl reload nginx && echo SSL_INSTALLED"

echo "==> 6/6 verify"
ssh "$SRV" "curl -s -o /dev/null -w 'origin :$PORT -> %{http_code}\n' http://127.0.0.1:$PORT/healthz"
echo "Done. Try: https://$HOST"