diff --git a/bootstrap.sh b/bootstrap.sh index 62cf12a..7f5b2c6 100644 --- a/bootstrap.sh +++ b/bootstrap.sh @@ -127,7 +127,7 @@ function run_cmd { fi ## Check if command exists on system - if ! command -v $1; then + if ! cmd_exists $1; then err "$1: command not found" fi @@ -154,3 +154,11 @@ function run_cmd { } + +function cmd_exists +{ + if ! command -v $1 > /dev/null 2>&1; then + return 1 + fi + return 0 +} \ No newline at end of file diff --git a/createVhosts.sh b/createVhosts.sh index 42685cc..74735cc 100755 --- a/createVhosts.sh +++ b/createVhosts.sh @@ -7,20 +7,26 @@ function usage { - echo "Usage: ${0}" - echo " --domain domain.tld" - echo " Domain to use when creating vhost" + echo "Usage: ${0}" + echo " --domain domain.tld" + echo " Domain to use when creating vhost" echo " --root /var/www/html" - echo " Root directory of this vhost" - echo " --backend http://127.0.0.1" - echo " Hostname of the backend server to pass traffic to" - echo " Note: Do not specify a port" - echo " --listenip x.x.x.x" - echo " IP to bind to when listening" - echo " --desc x.x.x.x" - echo " Description of VHosts" - echo " -h | --help" - echo " Show this usage" + echo " Root directory of this vhost" + echo " --backend http://127.0.0.1:80" + echo " URI of the backend server" + echo " Note: port must be specified" + echo " --listenip x.x.x.x" + echo " IP to bind to when listening" + echo " --desc x.x.x.x" + echo " Description of VHosts" + echo " --denotredirect" + echo " Do not redirect HTTP to HTTPS" + echo " --servicename" + echo " The Nginx server service name to use to reload" + echo " -d | --debug" + echo " Enable debug logging" + echo " -h | --help" + echo " Show this usage" exit 0 } @@ -32,30 +38,32 @@ function get_cert if [ "$DEBUG" = "1" ]; then _debug_arg="--debug" fi - /root/.acme.sh/acme.sh --issue --domain $_domain --webroot /srv/http-content-combined/ --cert-file /etc/nginx/ssl/${_domain}.crt --key-file /etc/nginx/ssl/${_domain}.key --fullchain-file /etc/nginx/ssl/${_domain}-fullchain.crt $_debug_arg + /root/.acme.sh/acme.sh --issue --domain "$_domain" --webroot /srv/http-content-combined/ --cert-file /etc/ssl/"${_domain}".crt --key-file /etc/ssl/"${_domain}".key --fullchain-file /etc/ssl/"${_domain}"-fullchain.crt $_debug_arg return $? } function reload_nginx { - echo -n "Reloading Nginx..." - if systemctl reload nginx; then + echo -n "Reloading ${_servicename}..." + if systemctl reload "${_servicename}" > /dev/null 2>&1; then echo "Success" else echo "Failed" + return 1 fi # Wait for nginx to reload sleep 0.5 + return 0 } function clean_up { debug "Removing Nginx configuration and logs..." - rm $_vhost_conf_file - rm /var/log/nginx/$_domain.* + rm "$_vhost_conf_file" 2> /dev/null + rm /var/log/nginx/"$_domain".* > /dev/null 2>&1 reload_nginx - err $1 + err "$1" } function verify_vhost @@ -64,7 +72,7 @@ function verify_vhost local verify_path=/srv/http-content-combined/.well-known/ local verify_file_name=verify.$_domain.html local verify_full_path=$verify_path$verify_file_name - local http_resp + local http_code if test -n "$_listenip"; then target=$_listenip @@ -72,12 +80,13 @@ function verify_vhost mkdir -p $verify_path touch $verify_full_path - http_resp=$(curl -I -H "Host: $_domain" http://$target/.well-known/$verify_file_name 2> /dev/null | grep 'HTTP/1.1 200 OK') - rm $verify_full_path - if test -z "$http_resp"; then - return 1 - else + http_code=$(curl -I -H "Host: $_domain" http://"$target"/.well-known/"$verify_file_name" 2> /dev/null | grep 'HTTP/1.1' | cut -d " " -f 2) + + if [[ $http_code = '200' ]]; then return 0 + else + debug "Expected HTTP response code '200' but got '$http_code' instead!" + return 1 fi } @@ -87,17 +96,22 @@ _bb_myname=$(basename "$0") _bb_mypath=$(realpath $BASH_SOURCE) # Init script -if test -f $_bootstrap; then - source $_bootstrap 2> /dev/null +if test -f "$_bootstrap"; then + source "$_bootstrap" 2> /dev/null else echo "Unable to parse BOOTSTRAP: $_bootstrap" exit 1 fi +# check if we have the binaries we need to run +if ! cmd_exists curl; then + err "Missing dependency: curl. Please run 'dnf install -y curl'" +fi + # gain priviledges become "$@" -OPTS=$(getopt -o h -l domain:,root:,backend:,listenip:,desc:,donotredirect -n 'createVhosts' -- "$@") +OPTS=$(getopt -o h,d -l domain:,root:,backend:,listenip:,desc:,donotredirect,servicename:,confpath:,debug -n 'createVhosts' -- "$@") if [ "$?" -gt '0' ]; then echo 'Failed to set command line arguments' exit 1; @@ -110,6 +124,8 @@ _donotredirect=false _root="" _backend="" _listenip="" +_debug=false +_servicename=nginx while true; do case "$1" in --domain ) @@ -129,6 +145,15 @@ while true; do shift ;; --donotredirect ) _donotredirect=true + shift ;; + --servicename ) + _servicename=$2 + shift ;; + --confpath ) + _confpath=$2 + shift ;; + -d | --debug ) + _debug=true shift ;; -h | --help ) usage; shift ;; -- ) shift; break ;; @@ -136,17 +161,26 @@ while true; do esac done +## +## Begin processing command line arguments +########################################### + +# Enable debugging +if [[ $_debug = true ]]; then + DEBUG=1 +fi + if [[ $_domain = false ]]; then err "You must set domain" fi if test -n "$_root"; then - echo -n "Checking if $_root exists?" - if ! test -d $_root; then - echo " Creating..." - mkdir -p $_root + echo -n "Checking if $_root exists? " + if ! test -d "$_root"; then + echo "Creating..." + mkdir -p "$_root" else - echo " Yes!" + echo "Yes!" fi _rootpath="root $_root;" fi @@ -156,86 +190,104 @@ _locationblock_http="" _locationblock_https="" if test -n "$_backend"; then echo "Verifying backend(s)..." - _https_backend=$(echo $_backend | sed 's/http/https/') - if validate_host $_https_backend:443; then - -#<<<<< $_vhost_conf_file +cat << EOF > "$_vhost_conf_file" #### Description ## Type: HTTP ## VHost: $_domain @@ -259,21 +311,23 @@ $_locationblock_http EOF echo "Setting permissions on conf file..." -setfacl -m user:sysadmin:rw $_vhost_conf_file +setfacl -m user:sysadmin:rw "$_vhost_conf_file" -reload_nginx +if ! reload_nginx; then + clean_up "Failed to reload Nginx" +fi echo "Verifying vhost..." if ! verify_vhost; then clean_up "Failed to verify vhost" fi -echo "Retrieving Let's Encrypt Certificate..." +echo "Retrieving SSL Certificate..." if ! get_cert; then clean_up "Failed to retrieve certificate!" fi -cat << EOF >> $_vhost_conf_file +cat << EOF >> "$_vhost_conf_file" server { listen ${_listenip}443 http2 ssl; @@ -283,8 +337,8 @@ server { error_log /var/log/nginx/${_domain}.error.log; access_log /var/log/nginx/${_domain}.access.log main; - ssl_certificate ssl/${_domain}-fullchain.crt; - ssl_certificate_key ssl/${_domain}.key; + ssl_certificate /etc/ssl/${_domain}-fullchain.crt; + ssl_certificate_key /etc/ssl/${_domain}.key; location / { ${_locationblock_https}