mirror of
https://github.com/KeaBase/kea-research.git
synced 2026-10-17 10:13:23 +00:00
103 lines
3.5 KiB
Bash
103 lines
3.5 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
DOMAIN="${DOMAIN:-localhost}"
|
|
ACME_EMAIL="${ACME_EMAIL:-}"
|
|
USE_OWN_CERT="${USE_OWN_CERT:-false}"
|
|
OWN_CERT="/etc/nginx/ssl/fullchain.crt"
|
|
OWN_KEY="/etc/nginx/ssl/private.key"
|
|
LE_CERT="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
|
|
|
|
# Create webroot for ACME challenge
|
|
mkdir -p /var/www/html
|
|
|
|
echo "========================================"
|
|
echo " Nginx Auto-SSL Entrypoint"
|
|
echo "========================================"
|
|
echo "DOMAIN: $DOMAIN"
|
|
|
|
# Case 1: Localhost - HTTP only
|
|
if [[ "$DOMAIN" == "localhost" || "$DOMAIN" == "127.0.0.1" ]]; then
|
|
echo "→ Mode: HTTP only (localhost)"
|
|
envsubst '${DOMAIN}' < /etc/nginx/templates/http.conf.template > /etc/nginx/conf.d/default.conf
|
|
|
|
# Case 2: Own certificate (USE_OWN_CERT=true)
|
|
elif [[ "$USE_OWN_CERT" == "true" ]]; then
|
|
if [[ -f "$OWN_CERT" && -f "$OWN_KEY" ]]; then
|
|
echo "→ Mode: Own certificate"
|
|
echo " Cert: $OWN_CERT"
|
|
echo " Key: $OWN_KEY"
|
|
export SSL_CERT="$OWN_CERT"
|
|
export SSL_KEY="$OWN_KEY"
|
|
envsubst '${DOMAIN} ${SSL_CERT} ${SSL_KEY}' < /etc/nginx/templates/https.conf.template > /etc/nginx/conf.d/default.conf
|
|
else
|
|
echo "→ WARNING: USE_OWN_CERT=true but certificate files not found!"
|
|
echo " Expected: $OWN_CERT"
|
|
echo " Expected: $OWN_KEY"
|
|
echo " Falling back to HTTP only"
|
|
envsubst '${DOMAIN}' < /etc/nginx/templates/http.conf.template > /etc/nginx/conf.d/default.conf
|
|
fi
|
|
|
|
# Case 3: Let's Encrypt cert exists - use it
|
|
elif [[ -f "$LE_CERT" ]]; then
|
|
echo "→ Mode: Let's Encrypt (existing)"
|
|
export SSL_CERT="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
|
|
export SSL_KEY="/etc/letsencrypt/live/${DOMAIN}/privkey.pem"
|
|
envsubst '${DOMAIN} ${SSL_CERT} ${SSL_KEY}' < /etc/nginx/templates/https.conf.template > /etc/nginx/conf.d/default.conf
|
|
|
|
# Case 4: Real domain, no cert - get Let's Encrypt
|
|
else
|
|
echo "→ Mode: Let's Encrypt (new)"
|
|
echo " Obtaining certificate for $DOMAIN..."
|
|
|
|
# Start nginx temporarily for ACME challenge
|
|
envsubst '${DOMAIN}' < /etc/nginx/templates/http.conf.template > /etc/nginx/conf.d/default.conf
|
|
nginx &
|
|
NGINX_PID=$!
|
|
sleep 3
|
|
|
|
# Get certificate
|
|
if [[ -n "$ACME_EMAIL" ]]; then
|
|
EMAIL_FLAG="--email $ACME_EMAIL"
|
|
else
|
|
EMAIL_FLAG="--register-unsafely-without-email"
|
|
fi
|
|
CERT_OK=false
|
|
if certbot certonly --webroot -w /var/www/html -d "$DOMAIN" $EMAIL_FLAG --agree-tos --non-interactive; then
|
|
echo " Certificate obtained successfully!"
|
|
CERT_OK=true
|
|
else
|
|
echo " ERROR: Failed to obtain certificate"
|
|
echo " Falling back to HTTP only"
|
|
fi
|
|
|
|
# Stop temporary nginx
|
|
nginx -s quit 2>/dev/null || kill $NGINX_PID 2>/dev/null || true
|
|
sleep 2
|
|
|
|
# Configure with cert if obtained
|
|
if [[ "$CERT_OK" == "true" ]]; then
|
|
export SSL_CERT="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
|
|
export SSL_KEY="/etc/letsencrypt/live/${DOMAIN}/privkey.pem"
|
|
envsubst '${DOMAIN} ${SSL_CERT} ${SSL_KEY}' < /etc/nginx/templates/https.conf.template > /etc/nginx/conf.d/default.conf
|
|
fi
|
|
fi
|
|
|
|
# Test nginx configuration
|
|
echo "========================================"
|
|
echo " Testing Nginx configuration..."
|
|
echo "========================================"
|
|
if nginx -t; then
|
|
echo " ✓ Configuration OK"
|
|
else
|
|
echo " ✗ Configuration FAILED"
|
|
exit 1
|
|
fi
|
|
|
|
# Start cron for auto-renewal (background)
|
|
crond
|
|
|
|
echo "========================================"
|
|
echo " Starting Nginx..."
|
|
echo "========================================"
|
|
exec "$@"
|