`deploy/issue-ssl.sh`

33 lines
#!/bin/bash
# gallery.agentabrams.com — finish the go-live: issue SSL via WEBROOT (robust on
# a multi-vhost box) and install the HTTPS vhost. Run after deploy.sh created the
# DNS record + rsynced content + staged the HTTP-only vhost.
set -euo pipefail
KAMATERA=root@45.61.58.125
SITE=gallery.agentabrams.com
HERE="$(cd "$(dirname "$0")/.." && pwd)"

# 0. Confirm OUR block is the one serving :80 (so the webroot challenge is reachable)
code=$(curl -s -o /dev/null -w '%{http_code}' "http://$SITE/")
title=$(curl -s "http://$SITE/" | grep -o '<title>[^<]*' | head -1)
echo "http://$SITE -> HTTP $code  ($title)"
if [ "$code" != "200" ]; then
  echo "ABORT: http://$SITE is not served by our gallery block (got $code). Fix vhost/DNS first."
  exit 1
fi

# 1. Issue the cert with the webroot authenticator (challenge = a real file under our root)
ssh $KAMATERA "certbot certonly --webroot -w /var/www/$SITE -d $SITE \
  --non-interactive --agree-tos -m steve@designerwallcoverings.com"

# 2. Install the SSL vhost + reload
scp -q "$HERE/deploy/$SITE.ssl.nginx" $KAMATERA:/etc/nginx/sites-available/$SITE
ssh $KAMATERA "ln -sf /etc/nginx/sites-available/$SITE /etc/nginx/sites-enabled/$SITE && nginx -t && systemctl reload nginx"

# 3. Smoke test
sleep 2
code=$(curl -s -o /dev/null -w '%{http_code}' "https://$SITE/")
echo "https://$SITE -> HTTP $code"
curl -s "https://$SITE/builds.json" | head -c 160; echo
[ "$code" = "200" ] && echo "SSL DONE — gallery.agentabrams.com is LIVE" || { echo "STILL FAILING"; exit 1; }