mnemo_cards/tools/deploy/check-nginx.sh

#!/bin/bash

# Script to check and fix nginx configuration and service

set -e

SERVER_IP="147.45.152.129"
SERVER_USER="root"

echo "🔧 Checking and fixing nginx..."
echo ""

ssh "$SERVER_USER@$SERVER_IP" << 'ENDSSH'
    set -e

    echo "📊 Checking nginx installation..."
    if /usr/sbin/nginx -v 2>&1; then
        echo "✅ nginx is installed"
    else
        echo "❌ nginx is NOT installed"
        exit 1
    fi

    echo ""
    echo "🧹 Checking for port conflicts..."

    # Check if ports 80 and 443 are free
    if ss -tlnp | grep -q ":80 "; then
        echo "⚠️  Port 80 is already in use:"
        ss -tlnp | grep ":80 "
        echo "Attempting to free port 80..."
        # Kill processes listening on port 80 (except nginx)
        ss -tlnp | grep ":80 " | grep -v nginx | awk '{print $6}' | cut -d'=' -f2 | cut -d',' -f1 | xargs -r kill -9 2>/dev/null || true
        sleep 1
    fi

    if ss -tlnp | grep -q ":443 "; then
        echo "⚠️  Port 443 is already in use:"
        ss -tlnp | grep ":443 "
        echo "Attempting to free port 443..."
        # Kill processes listening on port 443 (except nginx)
        ss -tlnp | grep ":443 " | grep -v nginx | awk '{print $6}' | cut -d'=' -f2 | cut -d',' -f1 | xargs -r kill -9 2>/dev/null || true
        sleep 1
    fi

    echo ""
    echo "🧹 Checking for orphaned nginx processes..."
    NGINX_PIDS=$(pgrep -f nginx | wc -l)
    if [ "$NGINX_PIDS" -gt 0 ]; then
        echo "⚠️  Found $NGINX_PIDS nginx processes running"
        if ! systemctl is-active --quiet nginx; then
            echo "Systemd thinks nginx is stopped, but processes exist. Cleaning up..."
            pkill -9 nginx
            sleep 2
        fi
    fi

    echo ""
    echo "📊 Testing nginx configuration..."
    if /usr/sbin/nginx -t; then
        echo "✅ Configuration syntax is valid"
    else
        echo "❌ Configuration syntax error!"
        echo "Checking for common issues..."

        # Check for missing events block
        if ! grep -q "events {" /etc/nginx/nginx.conf; then
            echo "⚠️  Missing events block in nginx.conf"
        fi

        # Check for server blocks outside http
        if grep -q "^server {" /etc/nginx/nginx.conf; then
            echo "⚠️  Found server block outside http context in nginx.conf"
        fi

        # Check for duplicate directives
        DUPLICATE_USER=$(grep "^user " /etc/nginx/nginx.conf | wc -l)
        if [ "$DUPLICATE_USER" -gt 1 ]; then
            echo "⚠️  Found $DUPLICATE_USER 'user' directives (should be 1)"
        fi

        echo "Please fix the configuration errors and try again"
        exit 1
    fi

    echo ""
    echo "📊 Checking nginx service status..."
    if systemctl is-active --quiet nginx; then
        echo "✅ nginx service is running"
        systemctl status nginx --no-pager | head -5

        echo ""
        echo "🔄 Reloading nginx configuration..."
        if systemctl reload nginx; then
            echo "✅ nginx reloaded successfully"
        else
            echo "❌ nginx reload failed, restarting..."
            systemctl restart nginx
        fi
    else
        echo "⚠️  nginx service is not running, starting..."
        if systemctl start nginx; then
            echo "✅ nginx started successfully"
        else
            echo "❌ nginx failed to start!"
            systemctl status nginx --no-pager
            exit 1
        fi
    fi

    echo ""
    echo "📊 Checking if nginx is active..."
    if systemctl is-active --quiet nginx; then
        echo "✅ nginx is active"
    else
        echo "❌ nginx is not active"
        exit 1
    fi

    echo ""
    echo "📊 Checking site configurations..."

    # Check all expected configurations
    SITES=("vscode.mnemo-cards.online" "code.mnemo-cards.online" "mnemo-cards.online")
    for site in "${SITES[@]}"; do
        if [ -f "/etc/nginx/sites-enabled/$site" ]; then
            echo "✅ $site config is enabled"
        elif [ -f "/etc/nginx/sites-available/$site" ]; then
            echo "⚠️  $site config exists but not enabled"
            echo "Enabling $site..."
            ln -sf "/etc/nginx/sites-available/$site" "/etc/nginx/sites-enabled/"
            /usr/sbin/nginx -t && systemctl reload nginx
            echo "✅ $site enabled and reloaded"
        else
            echo "❌ $site config not found"
        fi
    done

    echo ""
    echo "📊 Checking SSL certificates..."
    if [ -d "/etc/letsencrypt/live/mnemo-cards.online" ]; then
        echo "✅ Let's Encrypt certificates found for mnemo-cards.online"
        # Ensure correct permissions
        chmod 755 /etc/letsencrypt/archive 2>/dev/null || true
        chmod 755 /etc/letsencrypt/live 2>/dev/null || true
        find /etc/letsencrypt -type d -exec chmod 755 {} \; 2>/dev/null || true
        find /etc/letsencrypt -type f -exec chmod 644 {} \; 2>/dev/null || true
        chmod 600 /etc/letsencrypt/archive/mnemo-cards.online/privkey*.pem 2>/dev/null || true
        chmod 600 /etc/letsencrypt/live/mnemo-cards.online/privkey.pem 2>/dev/null || true
    else
        echo "⚠️  Let's Encrypt certificates not found"
    fi

    echo ""
    echo "📊 Checking DNS resolution..."
    DOMAINS=("code.mnemo-cards.online" "vscode.mnemo-cards.online" "mnemo-cards.online")
    for domain in "${DOMAINS[@]}"; do
        if host "$domain" &> /dev/null; then
            echo "✅ $domain resolves correctly"
        else
            echo "⚠️  DNS resolution failed for $domain"
        fi
    done

    echo ""
    echo "📊 Testing HTTP responses..."
    for domain in "${DOMAINS[@]}"; do
        if curl -I -k "https://$domain/" --max-time 10 --silent | head -1 | grep -q "200\|301\|302"; then
            echo "✅ $domain responds correctly"
        else
            echo "⚠️  $domain not responding or returning error"
        fi
    done

ENDSSH

echo ""
echo "✅ Done!"
echo ""
echo "🌐 Test these URLs in your browser:"
echo "   https://mnemo-cards.online/ (main web app)"
echo "   https://code.mnemo-cards.online/ (Forgejo)"
echo "   https://vscode.mnemo-cards.online/ (VSCode Server)"
echo ""
echo "🔑 Password: AGktOidxrah1KVC0"