`cert-homesonspec.sh`

58 lines
#!/usr/bin/env bash
# Valid Let's Encrypt cert for homesonspec.com via webroot (works despite the proxy-all vhost).
#   ! bash ~/Projects/homesonspec/cert-homesonspec.sh
set -euo pipefail
KH=root@45.61.58.125; WEB=9975; ADMIN=9976

ssh $KH "
mkdir -p /var/www/certbot
# Phase 1 vhost: :80 serves ACME challenge from webroot (before the proxy), :443 self-signed for now
cat > /etc/nginx/sites-available/homesonspec.com <<'NGINX'
server {
    listen 45.61.58.125:80;
    server_name homesonspec.com www.homesonspec.com;
    location /.well-known/acme-challenge/ { root /var/www/certbot; }
    location / {
        proxy_pass http://127.0.0.1:$WEB;
        proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
server {
    listen 45.61.58.125:443 ssl;
    server_name homesonspec.com www.homesonspec.com;
    ssl_certificate /etc/nginx/ssl/homesonspec.crt;
    ssl_certificate_key /etc/nginx/ssl/homesonspec.key;
    location / {
        proxy_pass http://127.0.0.1:$WEB;
        proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
server {
    listen 45.61.58.125:443 ssl;
    server_name admin.homesonspec.com;
    ssl_certificate /etc/nginx/ssl/homesonspec.crt;
    ssl_certificate_key /etc/nginx/ssl/homesonspec.key;
    location / {
        proxy_pass http://127.0.0.1:$ADMIN;
        proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme;
    }
}
NGINX
nginx -t && systemctl reload nginx
echo '  requesting LE cert via webroot…'
certbot certonly --webroot -w /var/www/certbot -d homesonspec.com -d www.homesonspec.com \
  --non-interactive --agree-tos -m steve@designerwallcoverings.com 2>&1 | grep -iE 'Congratulations|Successfully|Certificate is saved|error|failed' | head -6
# Phase 2: swap the public web+redirect blocks to the LE cert
LE=/etc/letsencrypt/live/homesonspec.com
if [ -f \$LE/fullchain.pem ]; then
  sed -i 's#/etc/nginx/ssl/homesonspec.crt#'\$LE'/fullchain.pem#; s#/etc/nginx/ssl/homesonspec.key#'\$LE'/privkey.pem#' /etc/nginx/sites-available/homesonspec.com
  # add HTTP→HTTPS redirect for the public site (keep acme location working)
  nginx -t && systemctl reload nginx
  echo '  ✓ LE cert installed on nginx'
else echo '  ✗ cert not issued — leaving self-signed'; fi
echo -n '  https://homesonspec.com cert issuer: '; echo | openssl s_client -servername homesonspec.com -connect 45.61.58.125:443 2>/dev/null | openssl x509 -noout -issuer 2>/dev/null | head -1
"