`ops/fix443.sh`

60 lines
#!/bin/bash
# Add a :443 server block (reusing the domain's existing LE cert) to any dead vhost that is port-80-only.
# MODE: dry (default) = report only; apply = write + nginx -t + reload.
MODE="${1:-dry}"
SA=/etc/nginx/sites-available
TS=$(date +%Y%m%d-%H%M%S)
BK=/root/nginx-443fix-backup-$TS
mkdir -p "$BK"
fixed=0; skip_nocert=0; skip_has443=0; skip_novhost=0; nocert_list=""; novhost_list=""
while read d; do
  [ -z "$d" ] && continue
  conf="$SA/$d.conf"
  [ -f "$conf" ] || conf=$(grep -rlE "server_name[^;]*\b${d//./\\.}\b" "$SA"/ 2>/dev/null | grep -v typo-redirect | head -1)
  if [ -z "$conf" ] || [ ! -f "$conf" ]; then skip_novhost=$((skip_novhost+1)); novhost_list="$novhost_list $d"; continue; fi
  # already has a 443 listener?
  if grep -qE 'listen[^;]*443' "$conf"; then skip_has443=$((skip_has443+1)); continue; fi
  # cert present?
  if [ ! -s "/etc/letsencrypt/live/$d/fullchain.pem" ]; then skip_nocert=$((skip_nocert+1)); nocert_list="$nocert_list $d"; continue; fi
  # extract upstream + server_name from the existing :80 block
  upstream=$(grep -oE 'proxy_pass\s+http://[^;]+' "$conf" | head -1 | awk '{print $2}')
  snames=$(grep -m1 -E '^\s*server_name' "$conf" | sed -E 's/^\s*server_name\s+//; s/;.*//')
  [ -z "$upstream" ] && { echo "  ! $d: no proxy_pass found, skipping"; continue; }
  block=$(cat <<EOF

# --- 443 added by fix443.sh $TS ---
server {
    listen 45.61.58.125:443 ssl http2;
    server_name $snames;
    ssl_certificate /etc/letsencrypt/live/$d/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$d/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    location / {
        proxy_pass $upstream;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
EOF
)
  echo "  ✓ $d -> 443 block (upstream $upstream, names: $snames)"
  if [ "$MODE" = apply ]; then
    cp "$conf" "$BK/$(basename "$conf")"
    printf '%s\n' "$block" >> "$conf"
  fi
  fixed=$((fixed+1))
done < "${LIST:-/tmp/dead52.txt}"
echo
echo "SUMMARY: would-fix=$fixed | skip(has443)=$skip_has443 | skip(no-cert)=$skip_nocert | skip(no-vhost)=$skip_novhost"
[ -n "$nocert_list" ] && echo "NEED CERT ISSUANCE:$nocert_list"
[ -n "$novhost_list" ] && echo "NEED VHOST FROM SCRATCH:$novhost_list"
if [ "$MODE" = apply ]; then
  echo; echo "=== nginx -t after changes ==="
  if nginx -t 2>&1 | tail -3; then echo "backups in $BK"; else echo "!! nginx -t FAILED — NOT reloading. restore: cp $BK/* $SA/"; fi
fi