`fix-remote.sh`

59 lines
#!/bin/bash
# Runs ON Kamatera. Removes the 8 target domains from the dl-batch multi-domain vhosts + disables
# duplicate hospitalitysales blocks so the per-domain landers win, then issues correct certs.
# SAFE: backs up every touched file; if `nginx -t` fails after edits, RESTORES and aborts (no reload).
set -u
TS=$(date +%s)
BAK="/root/nginx-bak-$TS"
mkdir -p "$BAK"
cd /etc/nginx/sites-available || exit 1
DOMS="protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com"
BATCH="dl-batch-1.conf dl-batch-2.conf dl-batch-3.conf dl-batch-4.conf"

echo "=== [1] backup ==="
for f in $BATCH; do [ -f "$f" ] && cp -a "$f" "$BAK/" && echo "  bak $f"; done
cp -a /etc/nginx/sites-enabled "$BAK/sites-enabled-snapshot" 2>/dev/null
ls -la /etc/nginx/sites-enabled > "$BAK/sites-enabled.list"

echo "=== [2] strip the 8 domains from dl-batch server_name lines (perl, boundary-safe) ==="
for f in $BATCH; do
  [ -f "$f" ] || continue
  for d in $DOMS; do
    d="$d" perl -i -pe 's/\s+\Q$ENV{d}\E(?=[\s;])//g' "$f"
  done
done

echo "=== [3] disable duplicate hospitalitysales blocks (keep only our .conf) ==="
rm -f /etc/nginx/sites-enabled/hospitalitysalesrepresentatives.com
rm -f /etc/nginx/sites-enabled/gap-hospitalitysalesrepresentatives-com.conf

echo "=== [4] nginx -t (auto-restore if bad) ==="
if ! nginx -t 2>&1; then
  echo "!! nginx -t FAILED — RESTORING backups, no reload"
  for f in $BATCH; do [ -f "$BAK/$f" ] && cp -a "$BAK/$f" /etc/nginx/sites-available/; done
  ln -sf /etc/nginx/sites-available/hospitalitysalesrepresentatives.com /etc/nginx/sites-enabled/ 2>/dev/null
  ln -sf /etc/nginx/sites-available/gap-hospitalitysalesrepresentatives-com.conf /etc/nginx/sites-enabled/ 2>/dev/null
  nginx -t && systemctl reload nginx
  echo "RESTORED. Backup kept at $BAK. ABORTED."
  exit 1
fi
systemctl reload nginx
echo "  reloaded ok"

echo "=== [5] certbot for the 8 (challenge now reaches our block) ==="
for d in $DOMS; do
  certbot --nginx --non-interactive --agree-tos -m info@designerwallcoverings.com --redirect -d "$d" -d "www.$d" >/dev/null 2>&1 \
    && echo "  cert ok: $d" || echo "  certbot FAILED: $d (maybe LE hourly limit from earlier fails — retry later)"
done
nginx -t && systemctl reload nginx

echo "=== [6] VERIFY ==="
for d in $DOMS; do
  code=$(curl -s -m10 -o /dev/null -w "%{http_code}" "https://$d/" 2>/dev/null)
  ours=$(curl -s -m10 "https://$d/" 2>/dev/null | grep -qi "curated domain portfolio" && echo "OUR-LANDER" || echo "old-page")
  subj=$(echo | openssl s_client -servername "$d" -connect "$d":443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null | sed -E "s/.*CN ?= ?//")
  printf "  %-38s %s  %-11s cert=%s\n" "$d" "$code" "$ours" "$subj"
done
echo "BACKUP at $BAK  (rollback: cp \$BAK/dl-batch-*.conf /etc/nginx/sites-available/ ; restore symlinks ; nginx -t && systemctl reload nginx)"
echo "FIX DONE"