Merge branch '4-refactor-createvhosts-sh' into 'master'
Resolve "Refactor createVhosts.sh" Closes #4 See merge request lhprojects-information-network/scripts!3
This commit is contained in:
Lutchy Horace
commit
a44a673758
10
bootstrap.sh
10
bootstrap.sh
|
|
@ -127,7 +127,7 @@ function run_cmd {
|
|||
fi
|
||||
|
||||
## Check if command exists on system
|
||||
if ! command -v $1; then
|
||||
if ! cmd_exists $1; then
|
||||
err "$1: command not found"
|
||||
fi
|
||||
|
||||
|
|
@ -154,3 +154,11 @@ function run_cmd {
|
|||
|
||||
|
||||
}
|
||||
|
||||
function cmd_exists
|
||||
{
|
||||
if ! command -v $1 > /dev/null 2>&1; then
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
212
createVhosts.sh
212
createVhosts.sh
|
|
@ -7,20 +7,26 @@
|
|||
|
||||
function usage
|
||||
{
|
||||
echo "Usage: ${0}"
|
||||
echo " --domain domain.tld"
|
||||
echo " Domain to use when creating vhost"
|
||||
echo "Usage: ${0}"
|
||||
echo " --domain domain.tld"
|
||||
echo " Domain to use when creating vhost"
|
||||
echo " --root /var/www/html"
|
||||
echo " Root directory of this vhost"
|
||||
echo " --backend http://127.0.0.1"
|
||||
echo " Hostname of the backend server to pass traffic to"
|
||||
echo " Note: Do not specify a port"
|
||||
echo " --listenip x.x.x.x"
|
||||
echo " IP to bind to when listening"
|
||||
echo " --desc x.x.x.x"
|
||||
echo " Description of VHosts"
|
||||
echo " -h | --help"
|
||||
echo " Show this usage"
|
||||
echo " Root directory of this vhost"
|
||||
echo " --backend http://127.0.0.1:80"
|
||||
echo " URI of the backend server"
|
||||
echo " Note: port must be specified"
|
||||
echo " --listenip x.x.x.x"
|
||||
echo " IP to bind to when listening"
|
||||
echo " --desc x.x.x.x"
|
||||
echo " Description of VHosts"
|
||||
echo " --denotredirect"
|
||||
echo " Do not redirect HTTP to HTTPS"
|
||||
echo " --servicename"
|
||||
echo " The Nginx server service name to use to reload"
|
||||
echo " -d | --debug"
|
||||
echo " Enable debug logging"
|
||||
echo " -h | --help"
|
||||
echo " Show this usage"
|
||||
|
||||
exit 0
|
||||
}
|
||||
|
|
@ -32,30 +38,32 @@ function get_cert
|
|||
if [ "$DEBUG" = "1" ]; then
|
||||
_debug_arg="--debug"
|
||||
fi
|
||||
/root/.acme.sh/acme.sh --issue --domain $_domain --webroot /srv/http-content-combined/ --cert-file /etc/nginx/ssl/${_domain}.crt --key-file /etc/nginx/ssl/${_domain}.key --fullchain-file /etc/nginx/ssl/${_domain}-fullchain.crt $_debug_arg
|
||||
/root/.acme.sh/acme.sh --issue --domain "$_domain" --webroot /srv/http-content-combined/ --cert-file /etc/ssl/"${_domain}".crt --key-file /etc/ssl/"${_domain}".key --fullchain-file /etc/ssl/"${_domain}"-fullchain.crt $_debug_arg
|
||||
return $?
|
||||
}
|
||||
|
||||
function reload_nginx
|
||||
{
|
||||
echo -n "Reloading Nginx..."
|
||||
if systemctl reload nginx; then
|
||||
echo -n "Reloading ${_servicename}..."
|
||||
if systemctl reload "${_servicename}" > /dev/null 2>&1; then
|
||||
echo "Success"
|
||||
else
|
||||
echo "Failed"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Wait for nginx to reload
|
||||
sleep 0.5
|
||||
return 0
|
||||
}
|
||||
|
||||
function clean_up
|
||||
{
|
||||
debug "Removing Nginx configuration and logs..."
|
||||
rm $_vhost_conf_file
|
||||
rm /var/log/nginx/$_domain.*
|
||||
rm "$_vhost_conf_file" 2> /dev/null
|
||||
rm /var/log/nginx/"$_domain".* > /dev/null 2>&1
|
||||
reload_nginx
|
||||
err $1
|
||||
err "$1"
|
||||
}
|
||||
|
||||
function verify_vhost
|
||||
|
|
@ -64,7 +72,7 @@ function verify_vhost
|
|||
local verify_path=/srv/http-content-combined/.well-known/
|
||||
local verify_file_name=verify.$_domain.html
|
||||
local verify_full_path=$verify_path$verify_file_name
|
||||
local http_resp
|
||||
local http_code
|
||||
|
||||
if test -n "$_listenip"; then
|
||||
target=$_listenip
|
||||
|
|
@ -72,12 +80,13 @@ function verify_vhost
|
|||
|
||||
mkdir -p $verify_path
|
||||
touch $verify_full_path
|
||||
http_resp=$(curl -I -H "Host: $_domain" http://$target/.well-known/$verify_file_name 2> /dev/null | grep 'HTTP/1.1 200 OK')
|
||||
rm $verify_full_path
|
||||
if test -z "$http_resp"; then
|
||||
return 1
|
||||
else
|
||||
http_code=$(curl -I -H "Host: $_domain" http://"$target"/.well-known/"$verify_file_name" 2> /dev/null | grep 'HTTP/1.1' | cut -d " " -f 2)
|
||||
|
||||
if [[ $http_code = '200' ]]; then
|
||||
return 0
|
||||
else
|
||||
debug "Expected HTTP response code '200' but got '$http_code' instead!"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -87,17 +96,22 @@ _bb_myname=$(basename "$0")
|
|||
_bb_mypath=$(realpath $BASH_SOURCE)
|
||||
|
||||
# Init script
|
||||
if test -f $_bootstrap; then
|
||||
source $_bootstrap 2> /dev/null
|
||||
if test -f "$_bootstrap"; then
|
||||
source "$_bootstrap" 2> /dev/null
|
||||
else
|
||||
echo "Unable to parse BOOTSTRAP: $_bootstrap"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# check if we have the binaries we need to run
|
||||
if ! cmd_exists curl; then
|
||||
err "Missing dependency: curl. Please run 'dnf install -y curl'"
|
||||
fi
|
||||
|
||||
# gain priviledges
|
||||
become "$@"
|
||||
|
||||
OPTS=$(getopt -o h -l domain:,root:,backend:,listenip:,desc:,donotredirect -n 'createVhosts' -- "$@")
|
||||
OPTS=$(getopt -o h,d -l domain:,root:,backend:,listenip:,desc:,donotredirect,servicename:,confpath:,debug -n 'createVhosts' -- "$@")
|
||||
if [ "$?" -gt '0' ]; then
|
||||
echo 'Failed to set command line arguments'
|
||||
exit 1;
|
||||
|
|
@ -110,6 +124,8 @@ _donotredirect=false
|
|||
_root=""
|
||||
_backend=""
|
||||
_listenip=""
|
||||
_debug=false
|
||||
_servicename=nginx
|
||||
while true; do
|
||||
case "$1" in
|
||||
--domain )
|
||||
|
|
@ -129,6 +145,15 @@ while true; do
|
|||
shift ;;
|
||||
--donotredirect )
|
||||
_donotredirect=true
|
||||
shift ;;
|
||||
--servicename )
|
||||
_servicename=$2
|
||||
shift ;;
|
||||
--confpath )
|
||||
_confpath=$2
|
||||
shift ;;
|
||||
-d | --debug )
|
||||
_debug=true
|
||||
shift ;;
|
||||
-h | --help ) usage; shift ;;
|
||||
-- ) shift; break ;;
|
||||
|
|
@ -136,17 +161,26 @@ while true; do
|
|||
esac
|
||||
done
|
||||
|
||||
##
|
||||
## Begin processing command line arguments
|
||||
###########################################
|
||||
|
||||
# Enable debugging
|
||||
if [[ $_debug = true ]]; then
|
||||
DEBUG=1
|
||||
fi
|
||||
|
||||
if [[ $_domain = false ]]; then
|
||||
err "You must set domain"
|
||||
fi
|
||||
|
||||
if test -n "$_root"; then
|
||||
echo -n "Checking if $_root exists?"
|
||||
if ! test -d $_root; then
|
||||
echo " Creating..."
|
||||
mkdir -p $_root
|
||||
echo -n "Checking if $_root exists? "
|
||||
if ! test -d "$_root"; then
|
||||
echo "Creating..."
|
||||
mkdir -p "$_root"
|
||||
else
|
||||
echo " Yes!"
|
||||
echo "Yes!"
|
||||
fi
|
||||
_rootpath="root $_root;"
|
||||
fi
|
||||
|
|
@ -156,86 +190,104 @@ _locationblock_http=""
|
|||
_locationblock_https=""
|
||||
if test -n "$_backend"; then
|
||||
echo "Verifying backend(s)..."
|
||||
_https_backend=$(echo $_backend | sed 's/http/https/')
|
||||
if validate_host $_https_backend:443; then
|
||||
|
||||
#<<<<<<HEREDOC
|
||||
_locationblock_https=$(cat <<- EOF
|
||||
proxy_pass $_https_backend:443;
|
||||
include proxy_params;
|
||||
EOF
|
||||
)
|
||||
#<<<<<<HEREDOC
|
||||
|
||||
else
|
||||
if ! validate_host "$_backend"; then
|
||||
_check_host=failed
|
||||
fi
|
||||
|
||||
# Include backend for HTTP traffic if donotredirect is enabled
|
||||
#
|
||||
if [ "$_donotredirect" = "true" ]; then
|
||||
_http_backend=$(echo $_backend | sed 's/https/http/')
|
||||
if validate_host $_http_backend:80; then
|
||||
|
||||
#<<<<<<HEREDOC
|
||||
##Begin HEREDOC
|
||||
_locationblock_http=$(cat <<- EOF
|
||||
proxy_pass $_http_backend:80;
|
||||
proxy_pass $_backend;
|
||||
include proxy_params;
|
||||
EOF
|
||||
)
|
||||
#<<<<<<HEREDOC
|
||||
|
||||
else
|
||||
_check_host=failed
|
||||
fi
|
||||
##End HEREDOC
|
||||
fi
|
||||
|
||||
if [ "$_check_host" = "failed" ]; then
|
||||
if [ "$_check_host" = "success" ]; then
|
||||
# Include backend for HTTP traffic if donotredirect is enabled
|
||||
#
|
||||
if [ "$_donotredirect" = "true" ]; then
|
||||
##Begin HEREDOC
|
||||
_locationblock_http=$(cat <<- EOF
|
||||
proxy_pass $_backend;
|
||||
include proxy_params;
|
||||
EOF
|
||||
)
|
||||
##End HEREDOC
|
||||
fi
|
||||
|
||||
##Begin HEREDOC
|
||||
_locationblock_https=$(cat <<- EOF
|
||||
proxy_pass $_backend;
|
||||
include proxy_params;
|
||||
EOF
|
||||
)
|
||||
##End HEREDOC
|
||||
else
|
||||
err "Invalid hostname: $_backend. Not resolvable!"
|
||||
fi
|
||||
fi
|
||||
|
||||
if test -n "$_listenip"; then
|
||||
if ! validate_ip $_listenip; then
|
||||
if ! validate_ip "$_listenip"; then
|
||||
err "Invalid IP: $_listenip"
|
||||
fi
|
||||
_listenip="$_listenip:"
|
||||
else
|
||||
warn "Listen ip not specified, listening on all interfaces."
|
||||
warn "No listen ip specified, listening on all interfaces."
|
||||
fi
|
||||
|
||||
if test -z "$_root" -a -z "$_backend"; then
|
||||
err "You must specify either --root or --backend!"
|
||||
fi
|
||||
|
||||
echo -n "Checking if /srv/http-content-combined/ exists?"
|
||||
if ! test -d /srv/http-content-combined; then
|
||||
echo " Creating..."
|
||||
mkdir -p /srv/http-content-combined/
|
||||
else
|
||||
echo " Yes!"
|
||||
fi
|
||||
|
||||
echo -n "Checking if we should redirect?"
|
||||
echo -n "Checking if we should redirect? "
|
||||
if [ "$_donotredirect" = "false" ]; then
|
||||
echo " Yes, enabling redirect!"
|
||||
echo "Yes, enabling redirect!"
|
||||
_locationblock_http=" return 302 https://${_domain}\$request_uri;"
|
||||
else
|
||||
echo " No!"
|
||||
echo "No!"
|
||||
fi
|
||||
|
||||
_vhost_conf_file=/etc/nginx/conf.d/${_domain}.conf
|
||||
echo -n "Checking if conf path '$_confpath' exists? "
|
||||
if test -d "$_confpath"; then
|
||||
echo "Yes!"
|
||||
else
|
||||
echo "No!"
|
||||
clean_up
|
||||
fi
|
||||
|
||||
##
|
||||
## End processing command line arguments
|
||||
###########################################
|
||||
|
||||
##
|
||||
## Begin issuing certificate
|
||||
###########################################
|
||||
|
||||
echo -n "Checking if /srv/http-content-combined/ exists? "
|
||||
if ! test -d /srv/http-content-combined; then
|
||||
echo "Creating..."
|
||||
mkdir -p /srv/http-content-combined/
|
||||
else
|
||||
echo "Yes!"
|
||||
fi
|
||||
|
||||
_vhost_conf_file=$_confpath/conf.d/${_domain}.conf
|
||||
|
||||
echo -n "Checking if $_vhost_conf_file exists? "
|
||||
if test -f $_vhost_conf_file; then
|
||||
if test -f "$_vhost_conf_file"; then
|
||||
echo "Removing!"
|
||||
rm $_vhost_conf_file
|
||||
rm "$_vhost_conf_file"
|
||||
else
|
||||
echo "No!"
|
||||
fi
|
||||
|
||||
echo "Creating Nginx configuration..."
|
||||
cat << EOF > $_vhost_conf_file
|
||||
cat << EOF > "$_vhost_conf_file"
|
||||
#### Description
|
||||
## Type: HTTP
|
||||
## VHost: $_domain
|
||||
|
|
@ -259,21 +311,23 @@ $_locationblock_http
|
|||
EOF
|
||||
|
||||
echo "Setting permissions on conf file..."
|
||||
setfacl -m user:sysadmin:rw $_vhost_conf_file
|
||||
setfacl -m user:sysadmin:rw "$_vhost_conf_file"
|
||||
|
||||
reload_nginx
|
||||
if ! reload_nginx; then
|
||||
clean_up "Failed to reload Nginx"
|
||||
fi
|
||||
|
||||
echo "Verifying vhost..."
|
||||
if ! verify_vhost; then
|
||||
clean_up "Failed to verify vhost"
|
||||
fi
|
||||
|
||||
echo "Retrieving Let's Encrypt Certificate..."
|
||||
echo "Retrieving SSL Certificate..."
|
||||
if ! get_cert; then
|
||||
clean_up "Failed to retrieve certificate!"
|
||||
fi
|
||||
|
||||
cat << EOF >> $_vhost_conf_file
|
||||
cat << EOF >> "$_vhost_conf_file"
|
||||
|
||||
server {
|
||||
listen ${_listenip}443 http2 ssl;
|
||||
|
|
@ -283,8 +337,8 @@ server {
|
|||
error_log /var/log/nginx/${_domain}.error.log;
|
||||
access_log /var/log/nginx/${_domain}.access.log main;
|
||||
|
||||
ssl_certificate ssl/${_domain}-fullchain.crt;
|
||||
ssl_certificate_key ssl/${_domain}.key;
|
||||
ssl_certificate /etc/ssl/${_domain}-fullchain.crt;
|
||||
ssl_certificate_key /etc/ssl/${_domain}.key;
|
||||
|
||||
location / {
|
||||
${_locationblock_https}
|
||||
|
|
|
|||
Loading…
Reference in New Issue