`normalize-remote.sh`

45 lines
#!/bin/bash
# Runs ON Kamatera. Make all 8 uniform: :80 = ACME webroot + http->https redirect; :443 = lander.
# Only rewrites a conf if its cert exists. Backup + nginx -t gate + auto-restore.
set -u
IP="45.61.58.125"
TS=$(date +%s); BAK="/root/nginx-bak-norm-$TS"; mkdir -p "$BAK"
DOMS="protectyourspec.com cannabisofthemonthclub.com hempofthemonthclub.com marijuanaofthemonthclub.com potofthemonthclub.com weedofthemonthclub.com mymemosamples.com hospitalitysalesrepresentatives.com"
cd /etc/nginx/sites-available || exit 1
for d in $DOMS; do
  [ -f "/etc/letsencrypt/live/$d/fullchain.pem" ] || { echo "skip $d (no cert)"; continue; }
  cp -a "$d.conf" "$BAK/" 2>/dev/null
  cat > "$d.conf" <<CONF
server {
    listen $IP:80;
    server_name $d www.$d;
    location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; }
    location / { return 301 https://\$host\$request_uri; }
}
server {
    listen $IP:443 ssl http2;
    server_name $d www.$d;
    root /var/www/parked-landers/$d;
    index index.html;
    ssl_certificate /etc/letsencrypt/live/$d/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$d/privkey.pem;
    location / { try_files \$uri \$uri/ /index.html; }
}
CONF
  echo "normalized: $d"
done
if ! nginx -t 2>&1; then
  echo "!! nginx -t FAILED — restoring"; for d in $DOMS; do [ -f "$BAK/$d.conf" ] && cp -a "$BAK/$d.conf" ./; done
  nginx -t && systemctl reload nginx; echo "RESTORED. ABORT."; exit 1
fi
systemctl reload nginx
echo "=== VERIFY (http should now be 301 -> https 200 everywhere) ==="
for d in $DOMS; do
  h=$(curl -s -m10 -o /dev/null -w "%{http_code}" "http://$d/" 2>/dev/null)
  s=$(curl -s -m10 -o /dev/null -w "%{http_code}" "https://$d/" 2>/dev/null)
  ours=$(curl -s -m10 "https://$d/" 2>/dev/null | grep -qi "curated domain portfolio" && echo "OUR-LANDER" || echo "other")
  printf "  %-38s http=%s https=%s %s\n" "$d" "$h" "$s" "$ours"
done
echo "BACKUP at $BAK"
echo "NORMALIZE DONE"