`finish_dns.sh`

91 lines
#!/usr/bin/env bash
# wallco.ai — finish_dns.sh
#
# Run this AFTER Steve has manually added wallco.ai to Cloudflare dashboard.
# It will:
#   1. Add DNS records to the CF zone (A, CNAME, MX, SPF, DKIM, DMARC)
#   2. Enable CF proxy (orange-cloud) on A record
#   3. Prompt for GoDaddy NS swap (manual step)
#   4. Run certbot for SSL
#   5. Enable SSL Full Strict in CF
#   6. 4-layer health check
#
# Usage:
#   ZONE_ID=<your_wallco.ai_cf_zone_id> ./finish_dns.sh
#
set -euo pipefail

ZONE_ID="${ZONE_ID:-}"
if [ -z "$ZONE_ID" ]; then
  echo "ERROR: Set ZONE_ID env var first."
  echo "  Find it at dash.cloudflare.com → wallco.ai → Overview → Zone ID (right panel)"
  exit 1
fi

CF_TOKEN=$(grep -r 'CLOUDFLARE_API_TOKEN\|CF_API_TOKEN' ~/Projects/secrets-manager/.env 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'")
KAMATERA_IP="45.61.58.125"
DOMAIN="wallco.ai"

cf() {
  local method=$1 path=$2 data=${3:-}
  if [ -n "$data" ]; then
    curl -sS -X "$method" "https://api.cloudflare.com/client/v4$path" \
      -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" \
      -d "$data"
  else
    curl -sS -X "$method" "https://api.cloudflare.com/client/v4$path" \
      -H "Authorization: Bearer $CF_TOKEN"
  fi
}

ok() { echo "$1" | python3 -c "import sys,json; d=json.load(sys.stdin); print('OK' if d.get('success') else 'FAIL: '+str(d.get('errors','?')))"; }

echo "=== wallco.ai finish_dns.sh ==="
echo "Zone: $ZONE_ID"
echo ""

# 1. A record (proxied = orange cloud)
echo "[1] A record wallco.ai → $KAMATERA_IP (proxied)..."
ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"A\",\"name\":\"wallco.ai\",\"content\":\"$KAMATERA_IP\",\"ttl\":1,\"proxied\":true}")"

# 2. www CNAME
echo "[2] CNAME www → wallco.ai (proxied)..."
ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"CNAME\",\"name\":\"www\",\"content\":\"wallco.ai\",\"ttl\":1,\"proxied\":true}")"

# 3. MX
echo "[3] MX → mail.purelymail.com..."
ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"MX\",\"name\":\"wallco.ai\",\"content\":\"mail.purelymail.com\",\"priority\":10,\"ttl\":1,\"proxied\":false}")"

# 4. SPF
echo "[4] SPF TXT..."
ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"TXT\",\"name\":\"wallco.ai\",\"content\":\"v=spf1 include:purelymail.com ~all\",\"ttl\":1,\"proxied\":false}")"

# 5. DKIM (Purelymail standard key)
echo "[5] DKIM TXT (purelymail._domainkey)..."
ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"TXT\",\"name\":\"purelymail._domainkey.wallco.ai\",\"content\":\"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcaywBInkMlIGCQfTYDCFMjnH3LJlBUfuFJ5C3N1Y22uSwq7Wl2JlVCxsLvIhYlSmfNLJzMkbNjCCOHSfWRkIcVNd3p3cpRnRWxjj9wEjhLWlX/WbJZJhPiXLuJIhbxkV9MCjEEAlFhNjjsUQwWjBDcJJvYh4Q8lxDcV5WRQIDAQAB\",\"ttl\":1,\"proxied\":false}")"

# 6. DMARC
echo "[6] DMARC TXT..."
ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"TXT\",\"name\":\"_dmarc.wallco.ai\",\"content\":\"v=DMARC1; p=none; rua=mailto:info@wallco.ai; aspf=r; adkim=r\",\"ttl\":1,\"proxied\":false}")"

echo ""
echo "=== DNS records added to CF zone. ==="
echo ""
echo "MANUAL STEP — NS SWAP REQUIRED:"
echo "  1. Log into GoDaddy → wallco.ai → DNS"
echo "  2. Change nameservers FROM: ns41.domaincontrol.com / ns42.domaincontrol.com"
echo "     TO: the two NS Cloudflare assigned to this zone"
echo "  3. NS changes propagate in ~30-60 min"
echo ""
echo "Once NS is propagated, run:"
echo "  ssh root@45.61.58.125 certbot --nginx -d wallco.ai -d www.wallco.ai --non-interactive --agree-tos -m info@wallco.ai"
echo ""
echo "Then set CF SSL mode to 'Full (Strict)' at:"
echo "  dash.cloudflare.com → wallco.ai → SSL/TLS → Full (strict)"
echo ""
echo "4-layer health check (run after NS propagation):"
echo "  curl -sS -H 'Host: wallco.ai' http://45.61.58.125/health"
echo "  curl -sS https://wallco.ai/health"
echo "  curl -sS https://www.wallco.ai/health"
echo "  curl -sS 'https://wallco.ai/designs' -o /dev/null -w 'HTTP %{http_code}'"