103 lines
2.8 KiB
Bash
103 lines
2.8 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
SERVER_IP="${1:?SERVER_IP is required}"
|
|
REMOTE_DIR="${2:-/opt/caiwuxitong}"
|
|
CERTBOT_DIR="/opt/caiwuxitong-certbot"
|
|
CERT_NAME="caiwuxitong-ip"
|
|
NGINX_SITE="/etc/nginx/sites-available/caiwuxitong"
|
|
WEBROOT="/var/www/letsencrypt"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "setup-https.sh must run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$SERVER_IP" != "218.93.190.75" ]; then
|
|
echo "Refusing to configure an unexpected server IP: $SERVER_IP" >&2
|
|
exit 1
|
|
fi
|
|
|
|
test -f "$REMOTE_DIR/host-nginx-http.conf"
|
|
test -f "$REMOTE_DIR/host-nginx.conf"
|
|
curl -fsS -o /dev/null http://127.0.0.1:18088/
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends nginx python3-venv ca-certificates
|
|
|
|
install -d -m 755 "$WEBROOT/.well-known/acme-challenge"
|
|
install -m 644 "$REMOTE_DIR/host-nginx-http.conf" "$NGINX_SITE"
|
|
ln -sfn "$NGINX_SITE" /etc/nginx/sites-enabled/caiwuxitong
|
|
rm -f /etc/nginx/sites-enabled/default
|
|
nginx -t
|
|
systemctl enable --now nginx
|
|
systemctl reload nginx
|
|
|
|
if [ ! -x "$CERTBOT_DIR/bin/certbot" ]; then
|
|
python3 -m venv "$CERTBOT_DIR"
|
|
"$CERTBOT_DIR/bin/pip" install \
|
|
--disable-pip-version-check \
|
|
--no-cache-dir \
|
|
--timeout 180 \
|
|
--index-url https://pypi.org/simple \
|
|
'certbot==5.4.0'
|
|
fi
|
|
|
|
"$CERTBOT_DIR/bin/certbot" --version
|
|
|
|
if [ ! -s "/etc/letsencrypt/live/$CERT_NAME/fullchain.pem" ]; then
|
|
"$CERTBOT_DIR/bin/certbot" certonly \
|
|
--non-interactive \
|
|
--agree-tos \
|
|
--register-unsafely-without-email \
|
|
--preferred-profile shortlived \
|
|
--webroot \
|
|
--webroot-path "$WEBROOT" \
|
|
--ip-address "$SERVER_IP" \
|
|
--cert-name "$CERT_NAME"
|
|
fi
|
|
|
|
install -m 644 "$REMOTE_DIR/host-nginx.conf" "$NGINX_SITE"
|
|
nginx -t
|
|
systemctl reload nginx
|
|
|
|
cat > /usr/local/sbin/caiwuxitong-certbot-deploy-hook <<'EOF'
|
|
#!/bin/sh
|
|
set -eu
|
|
nginx -t
|
|
systemctl reload nginx
|
|
EOF
|
|
chmod 700 /usr/local/sbin/caiwuxitong-certbot-deploy-hook
|
|
|
|
cat > /etc/systemd/system/caiwuxitong-certbot-renew.service <<EOF
|
|
[Unit]
|
|
Description=Renew CaiWuXiTong short-lived IP certificate
|
|
After=network-online.target nginx.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=$CERTBOT_DIR/bin/certbot renew --quiet --deploy-hook /usr/local/sbin/caiwuxitong-certbot-deploy-hook
|
|
EOF
|
|
|
|
cat > /etc/systemd/system/caiwuxitong-certbot-renew.timer <<'EOF'
|
|
[Unit]
|
|
Description=Check CaiWuXiTong IP certificate renewal every 8 hours
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 00,08,16:15:00
|
|
RandomizedDelaySec=30m
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now caiwuxitong-certbot-renew.timer
|
|
|
|
curl -fsS -o /dev/null "https://$SERVER_IP/"
|
|
openssl x509 -in "/etc/letsencrypt/live/$CERT_NAME/fullchain.pem" -noout -subject -issuer -dates
|
|
systemctl list-timers caiwuxitong-certbot-renew.timer --no-pager
|
|
echo "HTTPS_READY=https://$SERVER_IP"
|