[object Object]

← back to Gallery Agentabrams

deploy: webroot SSL issuance script + HTTPS vhost (nginx-plugin ACME 404 fix)

11ef5bae5d01a19896ebdc28f27f8c85ab881d64 · 2026-09-01 10:11:50 -0700 · Steve Abrams

Files touched

Diff

commit 11ef5bae5d01a19896ebdc28f27f8c85ab881d64
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Sep 1 10:11:50 2026 -0700

    deploy: webroot SSL issuance script + HTTPS vhost (nginx-plugin ACME 404 fix)
---
 deploy/gallery.agentabrams.com.ssl.nginx | 39 ++++++++++++++++++++++++++++++++
 deploy/issue-ssl.sh                      | 32 ++++++++++++++++++++++++++
 2 files changed, 71 insertions(+)

diff --git a/deploy/gallery.agentabrams.com.ssl.nginx b/deploy/gallery.agentabrams.com.ssl.nginx
new file mode 100644
index 0000000..862c2f0
--- /dev/null
+++ b/deploy/gallery.agentabrams.com.ssl.nginx
@@ -0,0 +1,39 @@
+# gallery.agentabrams.com — SSL vhost (installed after the webroot cert exists)
+server {
+    server_name gallery.agentabrams.com;
+
+    access_log /var/log/nginx/gallery.agentabrams.com.access.log;
+    error_log /var/log/nginx/gallery.agentabrams.com.error.log;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    root /var/www/gallery.agentabrams.com;
+    index index.html;
+    autoindex off;
+
+    location ~* \.(mp4|webm|jpg|jpeg|png|webp)$ {
+        expires 30d;
+        add_header Cache-Control "public, max-age=2592000";
+        try_files $uri =404;
+    }
+
+    location /.well-known/acme-challenge/ { root /var/www/gallery.agentabrams.com; }
+
+    location / {
+        try_files $uri $uri/ $uri.html =404;
+    }
+
+    listen 45.61.58.125:443 ssl;
+    ssl_certificate /etc/letsencrypt/live/gallery.agentabrams.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/gallery.agentabrams.com/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+
+server {
+    listen 45.61.58.125:80;
+    server_name gallery.agentabrams.com;
+    location /.well-known/acme-challenge/ { root /var/www/gallery.agentabrams.com; }
+    location / { return 301 https://$host$request_uri; }
+}
diff --git a/deploy/issue-ssl.sh b/deploy/issue-ssl.sh
new file mode 100755
index 0000000..962e53f
--- /dev/null
+++ b/deploy/issue-ssl.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+# gallery.agentabrams.com — finish the go-live: issue SSL via WEBROOT (robust on
+# a multi-vhost box) and install the HTTPS vhost. Run after deploy.sh created the
+# DNS record + rsynced content + staged the HTTP-only vhost.
+set -euo pipefail
+KAMATERA=root@45.61.58.125
+SITE=gallery.agentabrams.com
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+
+# 0. Confirm OUR block is the one serving :80 (so the webroot challenge is reachable)
+code=$(curl -s -o /dev/null -w '%{http_code}' "http://$SITE/")
+title=$(curl -s "http://$SITE/" | grep -o '<title>[^<]*' | head -1)
+echo "http://$SITE -> HTTP $code  ($title)"
+if [ "$code" != "200" ]; then
+  echo "ABORT: http://$SITE is not served by our gallery block (got $code). Fix vhost/DNS first."
+  exit 1
+fi
+
+# 1. Issue the cert with the webroot authenticator (challenge = a real file under our root)
+ssh $KAMATERA "certbot certonly --webroot -w /var/www/$SITE -d $SITE \
+  --non-interactive --agree-tos -m steve@designerwallcoverings.com"
+
+# 2. Install the SSL vhost + reload
+scp -q "$HERE/deploy/$SITE.ssl.nginx" $KAMATERA:/etc/nginx/sites-available/$SITE
+ssh $KAMATERA "ln -sf /etc/nginx/sites-available/$SITE /etc/nginx/sites-enabled/$SITE && nginx -t && systemctl reload nginx"
+
+# 3. Smoke test
+sleep 2
+code=$(curl -s -o /dev/null -w '%{http_code}' "https://$SITE/")
+echo "https://$SITE -> HTTP $code"
+curl -s "https://$SITE/builds.json" | head -c 160; echo
+[ "$code" = "200" ] && echo "SSL DONE — gallery.agentabrams.com is LIVE" || { echo "STILL FAILING"; exit 1; }

← 79c078d auto-data-snapshot: 2026-09-01T08:28:16 (1 data files) — dep  ·  back to Gallery Agentabrams  ·  deploy: make deploy.sh idempotent + SSL-safe (installs HTTPS 49e3ef9 →