chore: portola.crcp onboard script (server_name + cert --expand, lookbehind-guarded) — session close

e8797da6d47a479f4cb58a11a17d268dcfbb0236 · 2026-08-22 11:21:44 -0700 · Steve Abrams

Files touched

A onboard_portola.sh

Diff

commit e8797da6d47a479f4cb58a11a17d268dcfbb0236
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Aug 22 11:21:44 2026 -0700

    chore: portola.crcp onboard script (server_name + cert --expand, lookbehind-guarded) — session close
---
 onboard_portola.sh | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/onboard_portola.sh b/onboard_portola.sh
new file mode 100644
index 0000000..1d98d7c
--- /dev/null
+++ b/onboard_portola.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Onboard portola.crcp.agentabrams.com — Steve-approved 2026-08-22. Fire with:
+#   ! bash ~/Projects/commercialrealestate/onboard_portola.sh
+# Adds portola to the BASE crcp vhost server_name (lookbehind-guarded so it never stamps a
+# city FQDN like encino.crcp…) + --expand the EXISTING crcp LE cert (NOT a new cert — 50/wk cap)
+# via webroot, then reload nginx + verify 401 (up + gated).
+set -euo pipefail
+ssh root@45.61.58.125 'bash -s' <<'REMOTE'
+set -euo pipefail
+NEW=portola.crcp.agentabrams.com
+V=/etc/nginx/sites-enabled/crcp.agentabrams.com.conf
+[ -f "$V" ] || { echo "ABORT: base vhost $V not found"; exit 1; }
+
+if grep -q "$NEW" "$V"; then
+  echo "portola already in vhost — skipping server_name edit"
+else
+  cp -a "$V" "$V.bak-portola-$(date +%Y%m%d-%H%M%S)"
+  # Append $NEW after the BARE base host only. (?<![.\w]) ensures we never match the 'crcp' inside
+  # a city subdomain (encino.crcp.agentabrams.com), so we don't stamp every city vhost.
+  perl -0777 -i -pe 's/(server_name[^;]*?(?<![.\w])crcp\.agentabrams\.com\b)/$1 portola.crcp.agentabrams.com/g' "$V"
+  echo "server_name lines now mentioning portola:"; grep -c "$NEW" "$V"
+fi
+
+echo "== nginx -t =="; nginx -t
+
+# Read the existing crcp cert's current SAN list, then --expand to add portola (keeps ONE cert).
+CN=$(certbot certificates 2>/dev/null | awk '/Certificate Name: crcp.agentabrams.com/{f=1} f&&/Domains:/{sub(/.*Domains: /,"");print;exit}')
+[ -n "$CN" ] || { echo "ABORT: could not read existing crcp cert domains (check: certbot certificates)"; exit 1; }
+if echo "$CN" | tr ' ' '\n' | grep -qx "$NEW"; then
+  echo "cert already covers $NEW"
+else
+  DARGS=""; for d in $CN $NEW; do DARGS="$DARGS -d $d"; done
+  echo "== certbot --expand (webroot) adding $NEW =="
+  certbot certonly --webroot -w /var/www/certbot --cert-name crcp.agentabrams.com --expand $DARGS --non-interactive --keep-until-expiring
+fi
+
+echo "== reload nginx =="; systemctl reload nginx
+sleep 2
+echo "== verify (expect 401 = up + gated) =="
+curl -s -o /dev/null -w "portola HTTP %{http_code}\n" "https://$NEW/" --max-time 12
+REMOTE

← 1b8bf17 condos.html: add page-level Reset button (clears all filters · back to Commercialrealestate · auto-data-snapshot: 2026-08-22T12:23:53 (3 data files) — dat c45ea49 →