Add parked alias domains with Arvan or Cloudflare DNS and websites SSL.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-31 18:09:09 +03:30
parent 5813e9fc53
commit d1f60b5313
18 changed files with 1007 additions and 29 deletions
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Parked alias: nginx 301 from parked apex+www to the canonical storefront.
+# SSL is issued separately via ssl.sh (certbot --nginx) so the cert is in
+# certbot's auto-renewal list.
+set -euo pipefail
+
+HOST="${1:-}"
+CANONICAL="${2:-}"
+
+if [[ -z "$HOST" || -z "$CANONICAL" ]]; then
+  echo "usage: park.sh <parked-host> <canonical-host>" >&2
+  exit 1
+fi
+
+if [[ ! "$HOST" =~ ^[a-z0-9.-]+$ || ! "$CANONICAL" =~ ^[a-z0-9.-]+$ ]]; then
+  echo "invalid host" >&2
+  exit 1
+fi
+
+NGINX_AVAILABLE="/etc/nginx/sites-available/$HOST"
+NGINX_ENABLED="/etc/nginx/sites-enabled/$HOST"
+SSL_DIR="/etc/nginx/ssl/$HOST"
+LIST_FILE="/opt/websites-agent/parked-hosts.txt"
+
+mkdir -p "$SSL_DIR" /opt/websites-agent /var/www/certbot
+
+if [[ ! -f "$SSL_DIR/fullchain.pem" || ! -f "$SSL_DIR/privkey.pem" ]]; then
+  openssl req -x509 -nodes -newkey rsa:2048 -days 825 \
+    -keyout "$SSL_DIR/privkey.pem" \
+    -out "$SSL_DIR/fullchain.pem" \
+    -subj "/CN=$HOST" \
+    -addext "subjectAltName=DNS:$HOST,DNS:www.$HOST" \
+    >/dev/null 2>&1
+  echo "origin self-signed cert created: $SSL_DIR"
+fi
+
+# If certbot already issued a live cert, prefer it.
+LE_LIVE="/etc/letsencrypt/live/$HOST"
+if [[ -f "$LE_LIVE/fullchain.pem" && -f "$LE_LIVE/privkey.pem" ]]; then
+  CERT="$LE_LIVE/fullchain.pem"
+  KEY="$LE_LIVE/privkey.pem"
+else
+  CERT="$SSL_DIR/fullchain.pem"
+  KEY="$SSL_DIR/privkey.pem"
+fi
+
+cat >"$NGINX_AVAILABLE" <<NGINX
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ${HOST} www.${HOST};
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://${CANONICAL}\$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name ${HOST} www.${HOST};
+
+    ssl_certificate ${CERT};
+    ssl_certificate_key ${KEY};
+
+    return 301 https://${CANONICAL}\$request_uri;
+}
+NGINX
+
+ln -sfn "$NGINX_AVAILABLE" "$NGINX_ENABLED"
+nginx -t
+systemctl reload nginx
+
+touch "$LIST_FILE"
+if ! grep -qxF "$HOST" "$LIST_FILE" 2>/dev/null; then
+  echo "$HOST" >>"$LIST_FILE"
+fi
+
+echo "park ok: $HOST → https://$CANONICAL (apex+www)"