59 lines
1.6 KiB
Bash
Executable File
59 lines
1.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# Issue SSL certificates via certbot webroot through the nginx container.
|
|
#
|
|
# This script ONLY issues certs. It does not touch the real nginx confs.
|
|
# Nginx must be running (even with minimal config) to serve ACME challenges.
|
|
#
|
|
# Provisioning order:
|
|
# 1. Start nginx with no app confs (just security-headers.inc)
|
|
# 2. Run this script to issue certs
|
|
# 3. Start all app containers (so upstreams are resolvable)
|
|
# 4. Copy app confs into conf.d and reload nginx
|
|
#
|
|
# For adding a cert to a running server, apps are already up — just run
|
|
# this script, add the conf, and reload nginx.
|
|
#
|
|
# Usage: ./issue-cert.sh <domain> [domain...]
|
|
# Example: ./issue-cert.sh nextcloud.timothykim.net git.timothykim.net
|
|
set -euo pipefail
|
|
|
|
CONF_DIR="/opt/argento/docker/nginx/conf.d"
|
|
WEBROOT="/opt/argento/docker/nginx/certbot/www"
|
|
|
|
if [ $# -eq 0 ]; then
|
|
echo "Usage: $0 <domain> [domain...]"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$WEBROOT"
|
|
|
|
for domain in "$@"; do
|
|
echo "=== Issuing cert for $domain ==="
|
|
|
|
# Write temporary HTTP-only config
|
|
cat > "$CONF_DIR/$domain.tmp.conf" <<NGINXCONF
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name $domain;
|
|
location /.well-known/acme-challenge/ { root /var/www/certbot; }
|
|
location / { return 444; }
|
|
}
|
|
NGINXCONF
|
|
|
|
trap 'rm -f "$CONF_DIR/$domain.tmp.conf"' EXIT
|
|
docker exec nginx nginx -t
|
|
docker exec nginx nginx -s reload
|
|
|
|
certbot certonly --webroot -w "$WEBROOT" \
|
|
--non-interactive --agree-tos -m timothykim@fastmail.fm \
|
|
--cert-name "$domain" -d "$domain"
|
|
|
|
rm -f "$CONF_DIR/$domain.tmp.conf"
|
|
trap - EXIT
|
|
|
|
echo "Certificate issued for $domain"
|
|
done
|
|
|
|
echo "=== Done ==="
|