auto-save: 2026-07-22T14:44:58 (1 files) — cert-homesonspec.sh

ab1a33058f5af8a2e3d44603988c1bb51b898a97 · 2026-07-22 14:45:05 -0700 · Steve Abrams
Files touched

A cert-homesonspec.sh
Diff

commit ab1a33058f5af8a2e3d44603988c1bb51b898a97
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 22 14:45:05 2026 -0700

    auto-save: 2026-07-22T14:44:58 (1 files) — cert-homesonspec.sh
---
 cert-homesonspec.sh | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/cert-homesonspec.sh b/cert-homesonspec.sh
new file mode 100644
index 0000000..80420a9
--- /dev/null
+++ b/cert-homesonspec.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Valid Let's Encrypt cert for homesonspec.com via webroot (works despite the proxy-all vhost).
+#   ! bash ~/Projects/spechomes/cert-homesonspec.sh
+set -euo pipefail
+KH=root@45.61.58.125; WEB=9975; ADMIN=9976
+
+ssh $KH "
+mkdir -p /var/www/certbot
+# Phase 1 vhost: :80 serves ACME challenge from webroot (before the proxy), :443 self-signed for now
+cat > /etc/nginx/sites-available/spechomes.com <<'NGINX'
+server {
+    listen 45.61.58.125:80;
+    server_name homesonspec.com www.homesonspec.com;
+    location /.well-known/acme-challenge/ { root /var/www/certbot; }
+    location / {
+        proxy_pass http://127.0.0.1:$WEB;
+        proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+server {
+    listen 45.61.58.125:443 ssl;
+    server_name homesonspec.com www.homesonspec.com;
+    ssl_certificate /etc/nginx/ssl/homesonspec.crt;
+    ssl_certificate_key /etc/nginx/ssl/homesonspec.key;
+    location / {
+        proxy_pass http://127.0.0.1:$WEB;
+        proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+server {
+    listen 45.61.58.125:443 ssl;
+    server_name admin.homesonspec.com;
+    ssl_certificate /etc/nginx/ssl/homesonspec.crt;
+    ssl_certificate_key /etc/nginx/ssl/homesonspec.key;
+    location / {
+        proxy_pass http://127.0.0.1:$ADMIN;
+        proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+NGINX
+nginx -t && systemctl reload nginx
+echo '  requesting LE cert via webroot…'
+certbot certonly --webroot -w /var/www/certbot -d homesonspec.com -d www.homesonspec.com \
+  --non-interactive --agree-tos -m steve@designerwallcoverings.com 2>&1 | grep -iE 'Congratulations|Successfully|Certificate is saved|error|failed' | head -6
+# Phase 2: swap the public web+redirect blocks to the LE cert
+LE=/etc/letsencrypt/live/homesonspec.com
+if [ -f \$LE/fullchain.pem ]; then
+  sed -i 's#/etc/nginx/ssl/homesonspec.crt#'\$LE'/fullchain.pem#; s#/etc/nginx/ssl/homesonspec.key#'\$LE'/privkey.pem#' /etc/nginx/sites-available/spechomes.com
+  # add HTTP→HTTPS redirect for the public site (keep acme location working)
+  nginx -t && systemctl reload nginx
+  echo '  ✓ LE cert installed on nginx'
+else echo '  ✗ cert not issued — leaving self-signed'; fi
+echo -n '  https://homesonspec.com cert issuer: '; echo | openssl s_client -servername homesonspec.com -connect 45.61.58.125:443 2>/dev/null | openssl x509 -noout -issuer 2>/dev/null | head -1
+"
← 1a42593 rebrand SpecHomes → HomesOnSpec; add /builders directory (al · back to Homesonspec · Add live national map to homepage hero (loads on page load) 13c6b83 →