139 lines
4.7 KiB
Bash
Executable file
139 lines
4.7 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
# SSL Certificate Setup Script for All Mnemo Cards Domains
|
|
# Usage: ./setup_ssl.sh
|
|
#
|
|
# This script uses nginx webroot mode for certificate issuance/renewal
|
|
# which doesn't require stopping nginx.
|
|
|
|
set -e
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Function to print colored output
|
|
print_status() {
|
|
echo -e "${GREEN}[INFO]${NC} $1"
|
|
}
|
|
|
|
print_warning() {
|
|
echo -e "${YELLOW}[WARNING]${NC} $1"
|
|
}
|
|
|
|
print_error() {
|
|
echo -e "${RED}[ERROR]${NC} $1"
|
|
}
|
|
|
|
print_success() {
|
|
echo -e "${GREEN}[SUCCESS]${NC} $1"
|
|
}
|
|
|
|
echo "🔐 Setting up SSL certificates for all Mnemo Cards domains..."
|
|
|
|
# Check if running as root
|
|
if [ "$EUID" -ne 0 ]; then
|
|
print_error "This script must be run as root (sudo)"
|
|
exit 1
|
|
fi
|
|
|
|
# Email for Let's Encrypt (can be overridden)
|
|
LETSENCRYPT_EMAIL="${LETSENCRYPT_EMAIL:-admin@mnemo-cards.online}"
|
|
|
|
# Domains to set up certificates for (only mnemo-cards.online domains)
|
|
DOMAINS=(
|
|
"mnemo-cards.online"
|
|
"api.mnemo-cards.online"
|
|
"admin.mnemo-cards.online"
|
|
"code.mnemo-cards.online"
|
|
"vscode.mnemo-cards.online"
|
|
)
|
|
|
|
# Webroot path for ACME challenge
|
|
WEBROOT_PATH="/var/www/html"
|
|
|
|
# Check if certbot is installed
|
|
if ! command -v certbot &> /dev/null; then
|
|
print_status "Installing certbot and nginx plugin..."
|
|
apt update
|
|
apt install -y certbot python3-certbot-nginx
|
|
print_success "Certbot installed"
|
|
fi
|
|
|
|
# Ensure webroot directory exists
|
|
mkdir -p "$WEBROOT_PATH/.well-known/acme-challenge"
|
|
chmod -R 755 "$WEBROOT_PATH/.well-known"
|
|
|
|
# Clean up old/invalid certificate for hosting domain (not our domain)
|
|
if [ -d "/etc/letsencrypt/live/5492281-cf88967.twc1.net" ]; then
|
|
print_warning "Removing old hosting certificate (5492281-cf88967.twc1.net)..."
|
|
certbot delete --cert-name 5492281-cf88967.twc1.net --non-interactive 2>/dev/null || true
|
|
rm -rf /etc/letsencrypt/live/5492281-cf88967.twc1.net 2>/dev/null || true
|
|
rm -rf /etc/letsencrypt/archive/5492281-cf88967.twc1.net 2>/dev/null || true
|
|
rm -f /etc/letsencrypt/renewal/5492281-cf88967.twc1.net.conf 2>/dev/null || true
|
|
print_success "Old hosting certificate removed"
|
|
fi
|
|
|
|
# Get certificates for all domains using nginx plugin (no downtime)
|
|
for domain in "${DOMAINS[@]}"; do
|
|
if [ -d "/etc/letsencrypt/live/$domain" ] && [ -f "/etc/letsencrypt/live/$domain/fullchain.pem" ]; then
|
|
print_success "Certificate already exists for $domain"
|
|
else
|
|
print_status "Obtaining certificate for $domain..."
|
|
|
|
# Use nginx plugin - it handles configuration automatically without stopping nginx
|
|
if certbot certonly --nginx -d "$domain" --non-interactive --agree-tos --email "$LETSENCRYPT_EMAIL"; then
|
|
print_success "Certificate obtained for $domain"
|
|
else
|
|
print_warning "Nginx plugin failed for $domain, trying standalone..."
|
|
# Fallback to standalone (requires stopping nginx briefly)
|
|
systemctl stop nginx 2>/dev/null || true
|
|
if certbot certonly --standalone -d "$domain" --non-interactive --agree-tos --email "$LETSENCRYPT_EMAIL"; then
|
|
print_success "Certificate obtained for $domain (standalone)"
|
|
else
|
|
print_error "Failed to obtain certificate for $domain"
|
|
fi
|
|
systemctl start nginx 2>/dev/null || true
|
|
fi
|
|
fi
|
|
done
|
|
|
|
# Ensure nginx is running
|
|
if ! systemctl is-active --quiet nginx; then
|
|
print_status "Starting nginx..."
|
|
systemctl start nginx
|
|
fi
|
|
|
|
# Set up automatic renewal cron job (uses nginx plugin, no downtime)
|
|
print_status "Setting up automatic certificate renewal..."
|
|
|
|
# Remove old cron jobs that might cause issues
|
|
crontab -l 2>/dev/null | grep -v "certbot" | crontab - 2>/dev/null || true
|
|
|
|
# Add single renewal job that uses nginx plugin
|
|
CRON_JOB="0 3 * * * /usr/bin/certbot renew --quiet --deploy-hook \"systemctl reload nginx\""
|
|
|
|
(crontab -l 2>/dev/null | grep -v certbot; echo "$CRON_JOB") | crontab -
|
|
print_success "Automatic renewal cron job configured"
|
|
|
|
# Test renewal (dry-run)
|
|
print_status "Testing certificate renewal..."
|
|
if certbot renew --dry-run 2>&1 | grep -q "Congratulations\|would have been renewed\|No renewals were attempted"; then
|
|
print_success "Certificate renewal test passed"
|
|
else
|
|
print_warning "Certificate renewal test had issues - check /var/log/letsencrypt/letsencrypt.log"
|
|
fi
|
|
|
|
echo ""
|
|
print_success "SSL certificate setup completed!"
|
|
echo ""
|
|
echo "📋 Summary:"
|
|
echo "- Certificates configured for: ${DOMAINS[*]}"
|
|
echo "- Using nginx plugin (no downtime during renewal)"
|
|
echo "- Automatic renewal scheduled at 3:00 AM daily"
|
|
echo ""
|
|
echo "🔍 Run './check_ssl.sh' to verify certificate status"
|
|
echo "🔄 Certificates will auto-renew before expiration"
|