`scripts/nginx-final-fix.sh`

37 lines
#!/usr/bin/env bash
# THE fix: our distributor-microsites block used `listen 80` (wildcard 0.0.0.0:80), but every
# other vhost on this box uses `listen 45.61.58.125:80` (IP-specific), which nginx prefers —
# so our block was never selected → 404 (default). Rewrite the conf with the IP-specific listen,
# reload, then issue certs via --webroot (challenge now served by OUR block). Run under Steve.
set -euo pipefail
SUBS="j-josephson eijffinger omexco goodrich p3tec vahallan la-scala-milano zambaiti-parati \
carlise-co zintra versa-design-surfaces sangetsu greenland texam texdecor zambaiti \
koroseal-sg harlequin-sg cole-son-sg"
NAMES=""; DFLAGS=""
for s in $SUBS; do NAMES="$NAMES $s.designerwallcoverings.com"; DFLAGS="$DFLAGS -d $s.designerwallcoverings.com"; done

cat > /tmp/distributor-microsites.conf <<CONF
server {
  listen 45.61.58.125:80;
  server_name$NAMES;
  client_max_body_size 12m;
  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; }
  location / {
    proxy_pass http://127.0.0.1:9934;
    proxy_set_header Host \$host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
  }
}
CONF

scp /tmp/distributor-microsites.conf root@45.61.58.125:/etc/nginx/sites-available/distributor-microsites
ssh root@45.61.58.125 "mkdir -p /var/www/certbot/.well-known/acme-challenge && \
  ln -sf /etc/nginx/sites-available/distributor-microsites /etc/nginx/sites-enabled/distributor-microsites && \
  nginx -t && systemctl reload nginx && echo 'routing live (IP-specific listen)' && \
  curl -s -o /dev/null -w 'self-test http koroseal-sg: %{http_code}\n' -H 'Host: koroseal-sg.designerwallcoverings.com' http://127.0.0.1/ && \
  certbot certonly --webroot -w /var/www/certbot --non-interactive --agree-tos -m steve@designerwallcoverings.com --expand$DFLAGS && \
  certbot --nginx --non-interactive$DFLAGS && systemctl reload nginx && echo 'HTTPS live'"
echo "done"