`scripts/nginx-distributor-setup.sh`

36 lines
#!/usr/bin/env bash
# Route the 19 distributor subdomains to the japan-viewer (:9934) + issue certs.
# Serves the ACME challenge from a webroot (so certbot --webroot works even though
# location / is a proxy_pass). Idempotent. Run under Steve.
set -euo pipefail
SUBS="j-josephson eijffinger omexco goodrich p3tec vahallan la-scala-milano zambaiti-parati \
carlise-co zintra versa-design-surfaces sangetsu greenland texam texdecor zambaiti \
koroseal-sg harlequin-sg cole-son-sg"
NAMES=""; DFLAGS=""
for s in $SUBS; do NAMES="$NAMES $s.designerwallcoverings.com"; DFLAGS="$DFLAGS -d $s.designerwallcoverings.com"; done

# conf built LOCALLY ($NAMES expands; nginx runtime vars escaped as \$)
cat > /tmp/distributor-microsites.conf <<CONF
server {
  listen 80;
  server_name$NAMES;
  client_max_body_size 12m;
  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; }
  location / {
    proxy_pass http://127.0.0.1:9934;
    proxy_set_header Host \$host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
  }
}
CONF

scp /tmp/distributor-microsites.conf root@45.61.58.125:/etc/nginx/sites-available/distributor-microsites
ssh root@45.61.58.125 "mkdir -p /var/www/certbot/.well-known/acme-challenge && \
  ln -sf /etc/nginx/sites-available/distributor-microsites /etc/nginx/sites-enabled/distributor-microsites && \
  nginx -t && systemctl reload nginx && echo 'nginx routed (HTTP live)' && \
  certbot certonly --webroot -w /var/www/certbot --non-interactive --agree-tos -m steve@designerwallcoverings.com --expand$DFLAGS && \
  certbot --nginx --non-interactive --reinstall$DFLAGS && systemctl reload nginx && echo 'certs installed (HTTPS live)'"
echo "done"