142 lines
4.8 KiB
Bash
Executable File
142 lines
4.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="/data/aios-gitops"
|
|
WORKSPACE="$ROOT/workspace"
|
|
LOG="$ROOT/logs/g-cnnetmkt-ingress-fix.log"
|
|
BACKUP_DIR="$ROOT/backups/nginx-g-cnnetmkt-$(date +%Y%m%d-%H%M%S)"
|
|
SITE="/etc/nginx/sites-available/aios-user-portal.conf"
|
|
TRACKED="$WORKSPACE/deploy/nginx/g-cnnetmkt-gitea-server.conf"
|
|
REPORT="$ROOT/artifacts/CNNETMKT_SSL_INGRESS_STATUS.md"
|
|
mkdir -p "$ROOT/logs" "$BACKUP_DIR" "$WORKSPACE/deploy/nginx" "$ROOT/artifacts"
|
|
exec > >(tee -a "$LOG") 2>&1
|
|
|
|
echo "== backup =="
|
|
sudo cp -a "$SITE" "$BACKUP_DIR/aios-user-portal.conf"
|
|
|
|
cat > "$TRACKED" <<'NGINX'
|
|
# AIOS GitOps alias for https://g.cnnetmkt.top/
|
|
# Note: this server block intentionally keeps /git/ as the Gitea app prefix,
|
|
# matching the current Gitea ROOT_URL and avoiding a disruptive app.ini rewrite.
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name g.cnnetmkt.top;
|
|
|
|
access_log /var/log/nginx/aios-g-cnnetmkt.access.log;
|
|
error_log /var/log/nginx/aios-g-cnnetmkt.error.log;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/user.cnnetmkt.top/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/user.cnnetmkt.top/privkey.pem;
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
|
|
|
location = / {
|
|
return 302 /git/;
|
|
}
|
|
|
|
location = /git {
|
|
return 302 /git/;
|
|
}
|
|
|
|
location /git/ {
|
|
proxy_pass http://127.0.0.1:3000/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Prefix /git;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_redirect off;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name g.cnnetmkt.top;
|
|
|
|
location = / {
|
|
return 302 https://$host/git/;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
NGINX
|
|
|
|
echo "== install g.cnnetmkt server block =="
|
|
sudo cp "$TRACKED" /etc/nginx/sites-available/g-cnnetmkt-gitea.conf
|
|
sudo ln -sfn /etc/nginx/sites-available/g-cnnetmkt-gitea.conf /etc/nginx/sites-enabled/g-cnnetmkt-gitea.conf
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
|
|
echo "== local validation before cert expand =="
|
|
for h in g.cnnetmkt.top cnnetmkt.top user.cnnetmkt.top; do
|
|
echo "-- $h /"
|
|
curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/" | sed -n '1,12p' || true
|
|
grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
|
|
echo "-- $h /git/"
|
|
curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/git/" | sed -n '1,12p' || true
|
|
grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
|
|
done
|
|
|
|
echo "== certbot dry run expand for g/user/portal =="
|
|
CERTBOT_STATUS="not-run"
|
|
if sudo certbot certonly --nginx --cert-name user.cnnetmkt.top \
|
|
-d user.cnnetmkt.top -d portal.cnnetmkt.top -d g.cnnetmkt.top \
|
|
--expand --dry-run --non-interactive --agree-tos; then
|
|
CERTBOT_STATUS="dry-run-ok"
|
|
else
|
|
CERTBOT_STATUS="dry-run-failed"
|
|
fi
|
|
|
|
if [ "$CERTBOT_STATUS" = "dry-run-ok" ]; then
|
|
echo "== certbot real expand for g/user/portal =="
|
|
if sudo certbot certonly --nginx --cert-name user.cnnetmkt.top \
|
|
-d user.cnnetmkt.top -d portal.cnnetmkt.top -d g.cnnetmkt.top \
|
|
--expand --non-interactive --agree-tos; then
|
|
CERTBOT_STATUS="issued-g-user-portal"
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
else
|
|
CERTBOT_STATUS="real-issue-failed"
|
|
fi
|
|
fi
|
|
|
|
echo "== final cert and route validation =="
|
|
{
|
|
echo "# cnnetmkt SSL ingress status"
|
|
echo
|
|
echo "generated_at=$(date -Is)"
|
|
echo "g_route_status=installed"
|
|
echo "certbot_status=$CERTBOT_STATUS"
|
|
echo "apex_dns_status=blocked_until_cnnetmkt.top_has_A_record_to_1.95.164.183"
|
|
echo "wildcard_status=blocked_until_dns01_provider_credentials_available"
|
|
echo "backup_dir=$BACKUP_DIR"
|
|
echo "tracked_nginx=$TRACKED"
|
|
echo
|
|
echo "## validation"
|
|
for h in g.cnnetmkt.top cnnetmkt.top user.cnnetmkt.top; do
|
|
echo "### $h"
|
|
curl -k -sS -D - -o /tmp/aios-body --resolve "$h:443:127.0.0.1" "https://$h/" | sed -n '1,12p' || true
|
|
grep -ao '<title>[^<]*' /tmp/aios-body 2>/dev/null | head -1 || true
|
|
echo
|
|
echo | openssl s_client -connect 127.0.0.1:443 -servername "$h" 2>/dev/null \
|
|
| openssl x509 -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null || true
|
|
echo
|
|
done
|
|
echo "## certbot"
|
|
sudo certbot certificates || true
|
|
} | tee "$REPORT"
|
|
|
|
cd "$WORKSPACE"
|
|
git add deploy/nginx/g-cnnetmkt-gitea-server.conf
|
|
git commit -m "fix(ingress): add g.cnnetmkt.top GitOps alias" || true
|
|
|
|
echo "G_CNNETMKT_INGRESS_FIX_DONE certbot_status=$CERTBOT_STATUS report=$REPORT"
|