japan: nginx-fix-conflict.sh — strip the 19 distributor hostnames certbot added to japan.conf (incl the return-404 block) so distributor-microsites serves the ACME challenge; then --webroot certs. .bak + nginx -t gated

d2fb29e6e629fa3f04731e972750d5ec9fec619e · 2026-07-06 18:43:08 -0700 · Steve

Files touched

A scripts/nginx-fix-conflict.sh

Diff

commit d2fb29e6e629fa3f04731e972750d5ec9fec619e
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jul 6 18:43:08 2026 -0700

    japan: nginx-fix-conflict.sh — strip the 19 distributor hostnames certbot added to japan.conf (incl the return-404 block) so distributor-microsites serves the ACME challenge; then --webroot certs. .bak + nginx -t gated
---
 scripts/nginx-fix-conflict.sh | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/scripts/nginx-fix-conflict.sh b/scripts/nginx-fix-conflict.sh
new file mode 100644
index 0000000..c66b7bb
--- /dev/null
+++ b/scripts/nginx-fix-conflict.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Fix the server_name conflict: the first certbot --nginx run appended the 19 distributor
+# hostnames to japan.designerwallcoverings.com.conf (incl. a port-80 `return 404` block that
+# kills the ACME challenge). Remove them from the japan conf so ONLY distributor-microsites
+# (which has the /.well-known webroot location) serves them, then issue certs via --webroot.
+# Safe: makes a .bak, gates every reload on `nginx -t`. Run under Steve.
+set -euo pipefail
+SUBS="j-josephson eijffinger omexco goodrich p3tec vahallan la-scala-milano zambaiti-parati \
+carlise-co zintra versa-design-surfaces sangetsu greenland texam texdecor zambaiti \
+koroseal-sg harlequin-sg cole-son-sg"
+SED=""; DFLAGS=""
+for s in $SUBS; do SED="$SED s/ $s\\.designerwallcoverings\\.com//g;"; DFLAGS="$DFLAGS -d $s.designerwallcoverings.com"; done
+
+ssh root@45.61.58.125 bash -s <<REMOTE
+set -e
+CONF=/etc/nginx/sites-available/japan.designerwallcoverings.com.conf
+cp "\$CONF" "\$CONF.bak-\$(date +%s)"
+# strip the 19 distributor hostnames from japan's server_name lines
+sed -i "$SED" "\$CONF"
+echo "japan conf server_names now:"; grep -m1 server_name "\$CONF" | head -c 120; echo
+# ensure our distributor block (acme webroot + proxy) is enabled
+ln -sf /etc/nginx/sites-available/distributor-microsites /etc/nginx/sites-enabled/distributor-microsites
+mkdir -p /var/www/certbot/.well-known/acme-challenge
+nginx -t && systemctl reload nginx && echo "reloaded — conflict cleared, HTTP routing live"
+# now the challenge is served by distributor-microsites → get certs
+certbot certonly --webroot -w /var/www/certbot --non-interactive --agree-tos -m steve@designerwallcoverings.com --expand$DFLAGS
+# install the cert into an nginx 443 block for the 19
+certbot --nginx --non-interactive$DFLAGS && systemctl reload nginx && echo "HTTPS live"
+REMOTE
+echo "done"

← 0dd7b32 japan: nginx-diagnose.sh (read-only) to find the conflicting · back to Japan Enrich · japan: scrape_gg_sg_brands.py — resolve the 242 Singapore di d0a51a9 →