`onboard_portola.sh`

42 lines
#!/usr/bin/env bash
# Onboard portola.crcp.agentabrams.com — Steve-approved 2026-08-22. Fire with:
#   ! bash ~/Projects/commercialrealestate/onboard_portola.sh
# Adds portola to the BASE crcp vhost server_name (lookbehind-guarded so it never stamps a
# city FQDN like encino.crcp…) + --expand the EXISTING crcp LE cert (NOT a new cert — 50/wk cap)
# via webroot, then reload nginx + verify 401 (up + gated).
set -euo pipefail
ssh root@45.61.58.125 'bash -s' <<'REMOTE'
set -euo pipefail
NEW=portola.crcp.agentabrams.com
V=/etc/nginx/sites-enabled/crcp.agentabrams.com.conf
[ -f "$V" ] || { echo "ABORT: base vhost $V not found"; exit 1; }

if grep -q "$NEW" "$V"; then
  echo "portola already in vhost — skipping server_name edit"
else
  cp -a "$V" "$V.bak-portola-$(date +%Y%m%d-%H%M%S)"
  # Append $NEW after the BARE base host only. (?<![.\w]) ensures we never match the 'crcp' inside
  # a city subdomain (encino.crcp.agentabrams.com), so we don't stamp every city vhost.
  perl -0777 -i -pe 's/(server_name[^;]*?(?<![.\w])crcp\.agentabrams\.com\b)/$1 portola.crcp.agentabrams.com/g' "$V"
  echo "server_name lines now mentioning portola:"; grep -c "$NEW" "$V"
fi

echo "== nginx -t =="; nginx -t

# Read the existing crcp cert's current SAN list, then --expand to add portola (keeps ONE cert).
CN=$(certbot certificates 2>/dev/null | awk '/Certificate Name: crcp.agentabrams.com/{f=1} f&&/Domains:/{sub(/.*Domains: /,"");print;exit}')
[ -n "$CN" ] || { echo "ABORT: could not read existing crcp cert domains (check: certbot certificates)"; exit 1; }
if echo "$CN" | tr ' ' '\n' | grep -qx "$NEW"; then
  echo "cert already covers $NEW"
else
  DARGS=""; for d in $CN $NEW; do DARGS="$DARGS -d $d"; done
  echo "== certbot --expand (webroot) adding $NEW =="
  certbot certonly --webroot -w /var/www/certbot --cert-name crcp.agentabrams.com --expand $DARGS --non-interactive --keep-until-expiring
fi

echo "== reload nginx =="; systemctl reload nginx
sleep 2
echo "== verify (expect 401 = up + gated) =="
curl -s -o /dev/null -w "portola HTTP %{http_code}\n" "https://$NEW/" --max-time 12
REMOTE