initial commit

scripts/issue-cert.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Issue SSL certificates via certbot webroot through the nginx container.
+#
+# This script ONLY issues certs. It does not touch the real nginx confs.
+# Nginx must be running (even with minimal config) to serve ACME challenges.
+#
+# Provisioning order:
+#   1. Start nginx with no app confs (just security-headers.inc)
+#   2. Run this script to issue certs
+#   3. Start all app containers (so upstreams are resolvable)
+#   4. Copy app confs into conf.d and reload nginx
+#
+# For adding a cert to a running server, apps are already up — just run
+# this script, add the conf, and reload nginx.
+#
+# Usage: ./issue-cert.sh <domain> [domain...]
+# Example: ./issue-cert.sh nextcloud.timothykim.net git.timothykim.net
+set -euo pipefail
+
+CONF_DIR="/opt/argento/docker/nginx/conf.d"
+WEBROOT="/opt/argento/docker/nginx/certbot/www"
+
+if [ $# -eq 0 ]; then
+    echo "Usage: $0 <domain> [domain...]"
+    exit 1
+fi
+
+mkdir -p "$WEBROOT"
+
+for domain in "$@"; do
+    echo "=== Issuing cert for $domain ==="
+
+    # Write temporary HTTP-only config
+    cat > "$CONF_DIR/$domain.tmp.conf" <<NGINXCONF
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    location /.well-known/acme-challenge/ { root /var/www/certbot; }
+    location / { return 444; }
+}
+NGINXCONF
+
+    trap 'rm -f "$CONF_DIR/$domain.tmp.conf"' EXIT
+    docker exec nginx nginx -t
+    docker exec nginx nginx -s reload
+
+    certbot certonly --webroot -w "$WEBROOT" \
+        --non-interactive --agree-tos -m timothykim@fastmail.fm \
+        --cert-name "$domain" -d "$domain"
+
+    rm -f "$CONF_DIR/$domain.tmp.conf"
+    trap - EXIT
+
+    echo "Certificate issued for $domain"
+done
+
+echo "=== Done ==="