84 lines
2.1 KiB
Bash
Executable File
84 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Parked alias: nginx 301 from parked apex+www to the canonical storefront.
|
|
# SSL is issued separately via ssl.sh (certbot --nginx) so the cert is in
|
|
# certbot's auto-renewal list.
|
|
set -euo pipefail
|
|
|
|
HOST="${1:-}"
|
|
CANONICAL="${2:-}"
|
|
|
|
if [[ -z "$HOST" || -z "$CANONICAL" ]]; then
|
|
echo "usage: park.sh <parked-host> <canonical-host>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! "$HOST" =~ ^[a-z0-9.-]+$ || ! "$CANONICAL" =~ ^[a-z0-9.-]+$ ]]; then
|
|
echo "invalid host" >&2
|
|
exit 1
|
|
fi
|
|
|
|
NGINX_AVAILABLE="/etc/nginx/sites-available/$HOST"
|
|
NGINX_ENABLED="/etc/nginx/sites-enabled/$HOST"
|
|
SSL_DIR="/etc/nginx/ssl/$HOST"
|
|
LIST_FILE="/opt/websites-agent/parked-hosts.txt"
|
|
|
|
mkdir -p "$SSL_DIR" /opt/websites-agent /var/www/certbot
|
|
|
|
if [[ ! -f "$SSL_DIR/fullchain.pem" || ! -f "$SSL_DIR/privkey.pem" ]]; then
|
|
openssl req -x509 -nodes -newkey rsa:2048 -days 825 \
|
|
-keyout "$SSL_DIR/privkey.pem" \
|
|
-out "$SSL_DIR/fullchain.pem" \
|
|
-subj "/CN=$HOST" \
|
|
-addext "subjectAltName=DNS:$HOST,DNS:www.$HOST" \
|
|
>/dev/null 2>&1
|
|
echo "origin self-signed cert created: $SSL_DIR"
|
|
fi
|
|
|
|
# If certbot already issued a live cert, prefer it.
|
|
LE_LIVE="/etc/letsencrypt/live/$HOST"
|
|
if [[ -f "$LE_LIVE/fullchain.pem" && -f "$LE_LIVE/privkey.pem" ]]; then
|
|
CERT="$LE_LIVE/fullchain.pem"
|
|
KEY="$LE_LIVE/privkey.pem"
|
|
else
|
|
CERT="$SSL_DIR/fullchain.pem"
|
|
KEY="$SSL_DIR/privkey.pem"
|
|
fi
|
|
|
|
cat >"$NGINX_AVAILABLE" <<NGINX
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ${HOST} www.${HOST};
|
|
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://${CANONICAL}\$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name ${HOST} www.${HOST};
|
|
|
|
ssl_certificate ${CERT};
|
|
ssl_certificate_key ${KEY};
|
|
|
|
return 301 https://${CANONICAL}\$request_uri;
|
|
}
|
|
NGINX
|
|
|
|
ln -sfn "$NGINX_AVAILABLE" "$NGINX_ENABLED"
|
|
nginx -t
|
|
systemctl reload nginx
|
|
|
|
touch "$LIST_FILE"
|
|
if ! grep -qxF "$HOST" "$LIST_FILE" 2>/dev/null; then
|
|
echo "$HOST" >>"$LIST_FILE"
|
|
fi
|
|
|
|
echo "park ok: $HOST → https://$CANONICAL (apex+www)"
|