add nginx and cert subcommands to service.sh

tools/service.sh

@@ -5,16 +5,20 @@ usage() {
     echo "Usage: ./tools/service.sh <command> <name>"
     echo ""
     echo "Commands:"
-    echo "  dns <name>    Create A record for <name>.hantim.net"
-    echo "  files <name>  Create compose.yml and deploy workflow"
-    echo "  all <name>    Run dns + files"
+    echo "  dns <name>          Create A record for <name>.hantim.net"
+    echo "  files <name>        Create compose.yml and deploy workflow"
+    echo "  nginx <name> <port> Create nginx conf for <name>.hantim.net"
+    echo "  cert <name>         Issue SSL certificate for <name>.hantim.net"
+    echo "  all <name> <port>   Run dns + files + nginx + cert"
     echo ""
     echo "Examples:"
     echo "  ./tools/service.sh files garage"
-    echo "  ./tools/service.sh dns garage      # garage.hantim.net -> server IP"
-    echo "  ./tools/service.sh all garage"
+    echo "  ./tools/service.sh dns garage        # garage.hantim.net -> server IP"
+    echo "  ./tools/service.sh nginx garage 3903 # create nginx conf"
+    echo "  ./tools/service.sh cert garage       # issue SSL cert"
+    echo "  ./tools/service.sh all garage 3903"
     echo ""
-    echo "Requires: bws, jq, dig (for dns)"
+    echo "Requires: bws, jq, dig (for dns/cert)"
     exit 1
 }
 
@@ -80,6 +84,25 @@ require_dig() {
     fi
 }
 
+resolve_server_ip() {
+    require_dig
+    SERVER_IP=$(dig +short hantim.net | head -1)
+    if [ -z "$SERVER_IP" ]; then
+        echo "Error: Could not resolve hantim.net to get server IP."
+        exit 1
+    fi
+}
+
+setup_deploy_key() {
+    require_bws
+    echo "==> Fetching deploy key..."
+    DEPLOY_KEY=$(bws_get "hantim-deploy-ssh-private-key")
+    DEPLOY_KEY_FILE=$(mktemp)
+    echo "$DEPLOY_KEY" > "$DEPLOY_KEY_FILE"
+    chmod 600 "$DEPLOY_KEY_FILE"
+    trap "rm -f $DEPLOY_KEY_FILE" EXIT
+}
+
 validate_name() {
     local name="$1"
     if [ -z "$name" ]; then
@@ -228,11 +251,73 @@ OUTER
     echo "  configure.sh will generate the .env file on the server automatically."
 }
 
+cmd_nginx() {
+    local name="$1"
+    local port="$2"
+    local fqdn="$name.hantim.net"
+
+    if [ -e "$REPO_ROOT/docker/nginx/conf.d/$fqdn.conf" ]; then
+        echo "  docker/nginx/conf.d/$fqdn.conf already exists, skipping."
+        return
+    fi
+
+    echo "==> Creating docker/nginx/conf.d/$fqdn.conf..."
+    cat > "$REPO_ROOT/docker/nginx/conf.d/$fqdn.conf" <<NGINX
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $fqdn;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$fqdn\$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name $fqdn;
+
+    ssl_certificate     /etc/letsencrypt/live/$fqdn/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$fqdn/privkey.pem;
+
+    include /etc/nginx/conf.d/security-headers.inc;
+
+    location / {
+        proxy_pass http://$name:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    }
+}
+NGINX
+}
+
+cmd_cert() {
+    local name="$1"
+    local fqdn="$name.hantim.net"
+
+    resolve_server_ip
+    setup_deploy_key
+
+    echo "==> Issuing SSL certificate for $fqdn via deploy user..."
+    ssh -o StrictHostKeyChecking=accept-new -i "$DEPLOY_KEY_FILE" deploy@"$SERVER_IP" "cert-$fqdn"
+    echo "  Certificate issued."
+}
+
 cmd_all() {
     local name="$1"
+    local port="$2"
 
     cmd_dns "$name"
     cmd_files "$name"
+    cmd_nginx "$name" "$port"
+    cmd_cert "$name"
 }
 
 # --- Dispatch ---
@@ -246,9 +331,27 @@ case "$COMMAND" in
         validate_name "${2:-}"
         cmd_files "${2:-}"
         ;;
+    nginx)
+        validate_name "${2:-}"
+        if [ -z "${3:-}" ]; then
+            echo "Error: port is required for nginx command."
+            echo "  Usage: ./tools/service.sh nginx <name> <port>"
+            exit 1
+        fi
+        cmd_nginx "${2:-}" "${3:-}"
+        ;;
+    cert)
+        validate_name "${2:-}"
+        cmd_cert "${2:-}"
+        ;;
     all)
         validate_name "${2:-}"
-        cmd_all "${2:-}"
+        if [ -z "${3:-}" ]; then
+            echo "Error: port is required for all command."
+            echo "  Usage: ./tools/service.sh all <name> <port>"
+            exit 1
+        fi
+        cmd_all "${2:-}" "${3:-}"
         ;;
     *)
         echo "Unknown command: $COMMAND"