deploy: Kamatera SSL+nginx finish script — flyers.crcp (public) + advertising.crcp (basic-auth); ADV_PW passed via env, no secret in git; both DNS-only 2-level subdomains w/ origin LE certs (TK-10708)

3384361d2927ac8568e8922cae9494763c589cc6 · 2026-08-19 20:03:49 -0700 · Steve Abrams

Files touched

A deploy/finish_kamatera_ssl.sh

Diff

commit 3384361d2927ac8568e8922cae9494763c589cc6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Aug 19 20:03:49 2026 -0700

    deploy: Kamatera SSL+nginx finish script — flyers.crcp (public) + advertising.crcp (basic-auth); ADV_PW passed via env, no secret in git; both DNS-only 2-level subdomains w/ origin LE certs (TK-10708)
---
 deploy/finish_kamatera_ssl.sh | 70 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/deploy/finish_kamatera_ssl.sh b/deploy/finish_kamatera_ssl.sh
new file mode 100644
index 0000000..c02fc78
--- /dev/null
+++ b/deploy/finish_kamatera_ssl.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+# TK-10708 — finish SSL + nginx for the two APPROVED re-flyer deploys on Kamatera.
+# Steve approved both (2026-08-19). flyers = PUBLIC; advertising = BASIC-AUTH gated (admin / $ADV_PW).
+# DNS already created (flyers proxied, advertising DNS-only). Static files already rsynced.
+# This box serves ACME centrally from /var/www/certbot; issue via --webroot then write :443 vhosts.
+# Run:  ! bash ~/Projects/re-flyer-aggregator/deploy/finish_kamatera_ssl.sh
+set -euo pipefail
+: "${ADV_PW:?set ADV_PW env var before running -- password is NOT stored in git}"
+ssh root@45.61.58.125 "ADV_PW=$(printf %q "$ADV_PW") bash -s" <<'REMOTE'
+set -e
+
+echo "== 1/4 issue certs via shared webroot =="
+certbot certonly --webroot -w /var/www/certbot -d flyers.crcp.agentabrams.com \
+  --non-interactive --agree-tos -m info@designerwallcoverings.com
+certbot certonly --webroot -w /var/www/certbot -d advertising.crcp.agentabrams.com \
+  --non-interactive --agree-tos -m info@designerwallcoverings.com
+
+echo "== 2/4 basic-auth htpasswd for advertising (admin / \$ADV_PW) =="
+: "${ADV_PW:?ADV_PW must be set}"
+if ! command -v htpasswd >/dev/null 2>&1; then apt-get install -y apache2-utils >/dev/null 2>&1 || true; fi
+htpasswd -bc /etc/nginx/.htpasswd-advertising admin "$ADV_PW"
+
+echo "== 3/4 write :443 static vhosts =="
+# --- flyers.crcp.agentabrams.com : PUBLIC static showcase ---
+cat > /etc/nginx/sites-enabled/flyers.crcp.agentabrams.com <<'NG'
+server {
+    listen 45.61.58.125:443 ssl;
+    server_name flyers.crcp.agentabrams.com;
+    ssl_certificate /etc/letsencrypt/live/flyers.crcp.agentabrams.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/flyers.crcp.agentabrams.com/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+    root /var/www/flyers.crcp.agentabrams.com;
+    index index.html;
+    location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; try_files $uri =404; }
+    location / { try_files $uri $uri/ =404; }
+}
+NG
+
+# --- advertising.crcp.agentabrams.com : BASIC-AUTH gated (DNS-only, origin cert) ---
+cat > /etc/nginx/sites-enabled/advertising.crcp.agentabrams.com <<'NG'
+server {
+    listen 45.61.58.125:443 ssl;
+    server_name advertising.crcp.agentabrams.com;
+    ssl_certificate /etc/letsencrypt/live/advertising.crcp.agentabrams.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/advertising.crcp.agentabrams.com/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+    root /var/www/advertising.crcp.agentabrams.com;
+    index index.html;
+    auth_basic "CRCP Advertising Intel";
+    auth_basic_user_file /etc/nginx/.htpasswd-advertising;
+    # ACME renewal must stay open (no auth) or cert renew fails:
+    location ^~ /.well-known/acme-challenge/ { auth_basic off; root /var/www/certbot; default_type "text/plain"; try_files $uri =404; }
+    location / { try_files $uri $uri/ =404; }
+}
+NG
+
+echo "== 4/4 test + reload =="
+nginx -t && systemctl reload nginx && echo "nginx reloaded — vhosts live"
+REMOTE
+
+echo
+echo "== SMOKE TEST =="
+echo -n "flyers (public, expect 200):        "; curl -s -o /dev/null -w '%{http_code}\n' https://flyers.crcp.agentabrams.com/
+echo -n "flyers flyers.json (expect 200):    "; curl -s -o /dev/null -w '%{http_code}\n' https://flyers.crcp.agentabrams.com/flyers.json
+echo -n "advertising no-auth (expect 401):   "; curl -s -o /dev/null -w '%{http_code}\n' https://advertising.crcp.agentabrams.com/
+echo -n "advertising w/ auth (expect 200):   "; curl -s -u "admin:$ADV_PW" -o /dev/null -w '%{http_code}\n' https://advertising.crcp.agentabrams.com/
+echo
+echo "If flyers cert failed (CF proxy can block http-01): grey-cloud flyers in CF, re-run, re-proxy."

← 79dfa04 auto-data-snapshot: 2026-08-19T18:57:31 (5 data files) — dat · back to Re Flyer Aggregator · flyers viewer: add recency filter (7/30/90d / all-time), def 8d6d8a7 →