`fix2-remote.sh`

81 lines
#!/bin/bash
# Runs ON Kamatera. Rebind our 8 confs to the specific IP (45.61.58.125) + webroot ACME,
# self-test the challenge path, then issue certs (webroot) + add :443. Touches only OUR confs.
set -u
IP="45.61.58.125"
TS=$(date +%s); BAK="/root/nginx-bak2-$TS"; mkdir -p "$BAK"
DOMS="protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com"
cd /etc/nginx/sites-available || exit 1

echo "=== [1] backup our confs -> $BAK ==="
for d in $DOMS; do [ -f "$d.conf" ] && cp -a "$d.conf" "$BAK/"; done

echo "=== [2] rewrite each conf: IP-bound :80 + acme webroot ==="
for d in $DOMS; do
  cat > "$d.conf" <<CONF
server {
    listen $IP:80;
    server_name $d www.$d;
    root /var/www/parked-landers/$d;
    index index.html;
    location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; }
    location / { try_files \$uri \$uri/ /index.html; }
}
CONF
done
if ! nginx -t 2>&1; then
  echo "!! nginx -t FAILED — restoring our confs"; for d in $DOMS; do [ -f "$BAK/$d.conf" ] && cp -a "$BAK/$d.conf" ./; done
  nginx -t && systemctl reload nginx; echo "RESTORED. ABORT."; exit 1
fi
systemctl reload nginx; echo "  reloaded"

echo "=== [3] ACME self-test (prove path before spending LE attempts) ==="
mkdir -p /var/www/certbot/.well-known/acme-challenge
TOK="probe-$TS"; echo "$TOK" > /var/www/certbot/.well-known/acme-challenge/$TOK
OK=""
for d in $DOMS; do
  r=$(curl -s -m10 "http://$d/.well-known/acme-challenge/$TOK" 2>/dev/null)
  w=$(curl -s -m10 "http://www.$d/.well-known/acme-challenge/$TOK" 2>/dev/null)
  if [ "$r" = "$TOK" ] && [ "$w" = "$TOK" ]; then echo "  probe OK: $d (+www)"; OK="$OK $d"
  else echo "  probe FAIL: $d  (apex='${r:0:20}' www='${w:0:20}')"; fi
done
rm -f /var/www/certbot/.well-known/acme-challenge/$TOK

echo "=== [4] certbot (webroot) for probe-OK domains only ==="
for d in $OK; do
  certbot certonly --webroot -w /var/www/certbot --non-interactive --agree-tos -m info@designerwallcoverings.com -d "$d" -d "www.$d" >/dev/null 2>&1 \
    && echo "  cert ok: $d" || echo "  cert FAILED: $d (LE hourly limit? retry in ~1h)"
done

echo "=== [5] add :443 block for domains that now have a cert ==="
for d in $DOMS; do
  if [ -f "/etc/letsencrypt/live/$d/fullchain.pem" ] && ! grep -q "$IP:443" "$d.conf"; then
    cat >> "$d.conf" <<CONF

server {
    listen $IP:443 ssl http2;
    server_name $d www.$d;
    root /var/www/parked-landers/$d;
    index index.html;
    ssl_certificate /etc/letsencrypt/live/$d/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$d/privkey.pem;
    location / { try_files \$uri \$uri/ /index.html; }
}
CONF
    echo "  :443 added: $d"
  fi
done
if ! nginx -t 2>&1; then echo "!! nginx -t failed after :443 add — restoring"; for d in $DOMS; do [ -f "$BAK/$d.conf" ] && cp -a "$BAK/$d.conf" ./; done; nginx -t && systemctl reload nginx; echo "RESTORED"; exit 1; fi
systemctl reload nginx

echo "=== [6] VERIFY ==="
for d in $DOMS; do
  h=$(curl -s -m10 -o /dev/null -w "%{http_code}" "http://$d/" 2>/dev/null)
  s=$(curl -sk -m10 -o /dev/null -w "%{http_code}" "https://$d/" 2>/dev/null)
  ours=$(curl -s -m10 "http://$d/" 2>/dev/null | grep -qi "curated domain portfolio" && echo "OUR-LANDER" || echo "other")
  subj=$(echo | openssl s_client -servername "$d" -connect "$d":443 2>/dev/null | openssl x509 -noout -subject 2>/dev/null | sed -E "s/.*CN ?= ?//")
  printf "  %-38s http=%s https=%s %-10s cert=%s\n" "$d" "$h" "$s" "$ours" "$subj"
done
echo "BACKUP2 at $BAK"
echo "FIX2 DONE"