`deploy/finish_kamatera_ssl.sh`

71 lines
#!/bin/bash
# TK-10708 — finish SSL + nginx for the two APPROVED re-flyer deploys on Kamatera.
# Steve approved both (2026-08-19). flyers = PUBLIC; advertising = BASIC-AUTH gated (admin / $ADV_PW).
# DNS already created (flyers proxied, advertising DNS-only). Static files already rsynced.
# This box serves ACME centrally from /var/www/certbot; issue via --webroot then write :443 vhosts.
# Run:  ! bash ~/Projects/re-flyer-aggregator/deploy/finish_kamatera_ssl.sh
set -euo pipefail
: "${ADV_PW:?set ADV_PW env var before running -- password is NOT stored in git}"
ssh root@45.61.58.125 "ADV_PW=$(printf %q "$ADV_PW") bash -s" <<'REMOTE'
set -e

echo "== 1/4 issue certs via shared webroot =="
certbot certonly --webroot -w /var/www/certbot -d flyers.crcp.agentabrams.com \
  --non-interactive --agree-tos -m info@designerwallcoverings.com
certbot certonly --webroot -w /var/www/certbot -d advertising.crcp.agentabrams.com \
  --non-interactive --agree-tos -m info@designerwallcoverings.com

echo "== 2/4 basic-auth htpasswd for advertising (admin / \$ADV_PW) =="
: "${ADV_PW:?ADV_PW must be set}"
if ! command -v htpasswd >/dev/null 2>&1; then apt-get install -y apache2-utils >/dev/null 2>&1 || true; fi
htpasswd -bc /etc/nginx/.htpasswd-advertising admin "$ADV_PW"

echo "== 3/4 write :443 static vhosts =="
# --- flyers.crcp.agentabrams.com : PUBLIC static showcase ---
cat > /etc/nginx/sites-enabled/flyers.crcp.agentabrams.com <<'NG'
server {
    listen 45.61.58.125:443 ssl;
    server_name flyers.crcp.agentabrams.com;
    ssl_certificate /etc/letsencrypt/live/flyers.crcp.agentabrams.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/flyers.crcp.agentabrams.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    root /var/www/flyers.crcp.agentabrams.com;
    index index.html;
    location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; default_type "text/plain"; try_files $uri =404; }
    location / { try_files $uri $uri/ =404; }
}
NG

# --- advertising.crcp.agentabrams.com : BASIC-AUTH gated (DNS-only, origin cert) ---
cat > /etc/nginx/sites-enabled/advertising.crcp.agentabrams.com <<'NG'
server {
    listen 45.61.58.125:443 ssl;
    server_name advertising.crcp.agentabrams.com;
    ssl_certificate /etc/letsencrypt/live/advertising.crcp.agentabrams.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/advertising.crcp.agentabrams.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    root /var/www/advertising.crcp.agentabrams.com;
    index index.html;
    auth_basic "CRCP Advertising Intel";
    auth_basic_user_file /etc/nginx/.htpasswd-advertising;
    # ACME renewal must stay open (no auth) or cert renew fails:
    location ^~ /.well-known/acme-challenge/ { auth_basic off; root /var/www/certbot; default_type "text/plain"; try_files $uri =404; }
    location / { try_files $uri $uri/ =404; }
}
NG

echo "== 4/4 test + reload =="
nginx -t && systemctl reload nginx && echo "nginx reloaded — vhosts live"
REMOTE

echo
echo "== SMOKE TEST =="
echo -n "flyers (public, expect 200):        "; curl -s -o /dev/null -w '%{http_code}\n' https://flyers.crcp.agentabrams.com/
echo -n "flyers flyers.json (expect 200):    "; curl -s -o /dev/null -w '%{http_code}\n' https://flyers.crcp.agentabrams.com/flyers.json
echo -n "advertising no-auth (expect 401):   "; curl -s -o /dev/null -w '%{http_code}\n' https://advertising.crcp.agentabrams.com/
echo -n "advertising w/ auth (expect 200):   "; curl -s -u "admin:$ADV_PW" -o /dev/null -w '%{http_code}\n' https://advertising.crcp.agentabrams.com/
echo
echo "If flyers cert failed (CF proxy can block http-01): grey-cloud flyers in CF, re-run, re-proxy."