`scripts/nginx-fix-conflict.sh`

31 lines
#!/usr/bin/env bash
# Fix the server_name conflict: the first certbot --nginx run appended the 19 distributor
# hostnames to japan.designerwallcoverings.com.conf (incl. a port-80 `return 404` block that
# kills the ACME challenge). Remove them from the japan conf so ONLY distributor-microsites
# (which has the /.well-known webroot location) serves them, then issue certs via --webroot.
# Safe: makes a .bak, gates every reload on `nginx -t`. Run under Steve.
set -euo pipefail
SUBS="j-josephson eijffinger omexco goodrich p3tec vahallan la-scala-milano zambaiti-parati \
carlise-co zintra versa-design-surfaces sangetsu greenland texam texdecor zambaiti \
koroseal-sg harlequin-sg cole-son-sg"
SED=""; DFLAGS=""
for s in $SUBS; do SED="$SED s/ $s\\.designerwallcoverings\\.com//g;"; DFLAGS="$DFLAGS -d $s.designerwallcoverings.com"; done

ssh root@45.61.58.125 bash -s <<REMOTE
set -e
CONF=/etc/nginx/sites-available/japan.designerwallcoverings.com.conf
cp "\$CONF" "\$CONF.bak-\$(date +%s)"
# strip the 19 distributor hostnames from japan's server_name lines
sed -i "$SED" "\$CONF"
echo "japan conf server_names now:"; grep -m1 server_name "\$CONF" | head -c 120; echo
# ensure our distributor block (acme webroot + proxy) is enabled
ln -sf /etc/nginx/sites-available/distributor-microsites /etc/nginx/sites-enabled/distributor-microsites
mkdir -p /var/www/certbot/.well-known/acme-challenge
nginx -t && systemctl reload nginx && echo "reloaded — conflict cleared, HTTP routing live"
# now the challenge is served by distributor-microsites → get certs
certbot certonly --webroot -w /var/www/certbot --non-interactive --agree-tos -m steve@designerwallcoverings.com --expand$DFLAGS
# install the cert into an nginx 443 block for the 19
certbot --nginx --non-interactive$DFLAGS && systemctl reload nginx && echo "HTTPS live"
REMOTE
echo "done"