nginx_add_server

#!/bin/sh
# 09/07/17 - Created by Andrew Puckett

if [ $# -lt 1 ]; then
	echo "NAME"
	echo "	$(basename $0) options"
	echo
	echo "DESCRIPTION"
	echo "	$(basename $0) is used to add a vhost to nginx."
	echo
	echo "OPTIONS"
	echo "	-c"
	echo "	    Use certificates."
	echo "	-d"
	echo "	    Domain. Required."
	echo "	-i"
	echo "	    Install directory. Optional. If -c is used the key and pem files should be here. The conf file will be copied here as well."
	echo "	-m"
	echo "	    Manual challenge. Can be used when DNS is pointed to the server yet."
	echo "	-n"
	echo "	    Name of host (abbreviation). Optional."
	echo "	-o"
	echo "	    Origin certificate instead of apex, used with CDNs when origin is on the same domain."
	echo "	-p"
	echo "	    Manual challenge with dns. Can be used when don't have access to current server."
	echo "	-r"
	echo "	    Redirect to this domain."
	echo "	-s"
	echo "	    Server name. Optional. Used with CDNs when origin is on a separate domain."
	echo "	-w"
	echo "	    Get certificate for www subdomain."
	echo
	echo "AUTHOR"
	echo "	Andrew Puckett"
	echo
	exit 1
fi

[ $(id -u) != "0" ] && echo "ERROR: You must be the superuser to run this script" >&2 && exit 1

CERT=0
ORIGIN=
REDIRECT=
WWW=
INSTALL_DIR=.
CHALLENGE=--nginx
CERT_DIR=/etc/ssl/certs
KEY_DIR=/etc/ssl/private
ETC_DIR=/etc/nginx/sites-available
LOG_DIR=/var/log/nginx
ENABLED_DIR=/etc/nginx/sites-enabled/
VHOST_DIR=/var/www

while getopts cd:i:mn:opr:s:w opt
do
	case "$opt" in
		c) CERT=1;;
		d) DOMAIN=$OPTARG;;
		i) INSTALL_DIR=$OPTARG;;
		m) CHALLENGE=--manual;;
		n) SHORT_NAME=$OPTARG;;
		o) ORIGIN=origin.;;
		p) CHALLENGE="--manual --preferred-challenges dns";;
		r) REDIRECT=$OPTARG;;
		s) SERVER_NAME=$OPTARG;;
		w) WWW=-d;;
	esac
done

[ -z "$REDIRECT" ] && REDIRECT=$DOMAIN
[ -z "$DOMAIN" ] && echo "ERROR: Domain is required." >&2 && exit 1
[ -z "$SHORT_NAME" ] && SHORT_NAME=$DOMAIN
[ -z "$SERVER_NAME" ] && SERVER_NAME=$DOMAIN
[ "$WWW" = "-d" ] && WWW="-d www.$DOMAIN"

if [ "$ORIGIN" = "origin." ] || [ "$SERVER_NAME" != "$DOMAIN" ]; then
  SERVER_NAME="$SERVER_NAME $ORIGIN$DOMAIN"
fi

if [ $CERT -eq 1 ]; then
	cp --backup=numbered $INSTALL_DIR/$SHORT_NAME.pem $CERT_DIR/$SHORT_NAME.pem
	cp --backup=numbered $INSTALL_DIR/$SHORT_NAME.key $KEY_DIR/$SHORT_NAME.key
	chmod 600 $KEY_DIR/$SHORT_NAME.key
else
	cp --backup=numbered $CERT_DIR/ssl-cert-snakeoil.pem $CERT_DIR/$SHORT_NAME.pem
	cp --backup=numbered $KEY_DIR/ssl-cert-snakeoil.key $KEY_DIR/$SHORT_NAME.key
	certbot $CHALLENGE -d $ORIGIN$DOMAIN $WWW certonly && ln -sf /etc/letsencrypt/live/$ORIGIN$DOMAIN/fullchain.pem $CERT_DIR/$SHORT_NAME.pem && ln -sf /etc/letsencrypt/live/$ORIGIN$DOMAIN/privkey.pem $KEY_DIR/$SHORT_NAME.key
	if [ "$CHALLENGE" = "--manual" ] || [ "$CHALLENGE" = "--manual --preferred-challenges dns" ]; then
		sed -i "s/authenticator = manual/authenticator = nginx/" /etc/letsencrypt/renewal/$ORIGIN$DOMAIN.conf
		sed -i "s/manual_public_ip_logging_ok = True/installer = nginx/" /etc/letsencrypt/renewal/$ORIGIN$DOMAIN.conf
		sed -i "/^pref_challs/d" /etc/letsencrypt/renewal/$ORIGIN$DOMAIN.conf
	fi
fi

cat > $INSTALL_DIR/$SHORT_NAME.conf <<- EOM
	map \$uri \$loggable {
	    / 0;
	    default 1;
	}

	map \$http_accept \$extension {
	    application/json json;
	    default html;
	}

	server {
	    listen 80; #default_server
	    server_name $ORIGIN$DOMAIN www.$DOMAIN;
	    access_log $LOG_DIR/${SHORT_NAME}_redirect.log combined if=\$loggable;
	    return 301 https://$REDIRECT\$request_uri;
	}

	server {
	    listen 443 ssl;
	    ssl_certificate $CERT_DIR/$SHORT_NAME.pem;
	    ssl_certificate_key $KEY_DIR/$SHORT_NAME.key;
	    access_log $LOG_DIR/${SHORT_NAME}_redirect.log combined;
EOM

if [ "$REDIRECT" = "$DOMAIN" ]; then
	mkdir -p $VHOST_DIR/$SHORT_NAME/current
	cat >> $INSTALL_DIR/$SHORT_NAME.conf <<- EOM
	    server_name www.$DOMAIN;
	    return 301 https://$REDIRECT\$request_uri;
	}

	server {
	    listen 443 ssl http2; #default_server
	    server_name $SERVER_NAME;
	    ssl_certificate $CERT_DIR/$SHORT_NAME.pem;
	    ssl_certificate_key $KEY_DIR/$SHORT_NAME.key;
	    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
	    expires +30d;
	    client_max_body_size 20m;

	    root $VHOST_DIR/$SHORT_NAME/current;

	    #log_format custom '\$time_local \$request_time \$remote_addr "\$request" \$request_length \$status \$bytes_sent "\$http_referer" "\$http_user_agent"';
	    error_log $LOG_DIR/${SHORT_NAME}_error.log warn;
	    access_log $LOG_DIR/${SHORT_NAME}_access.log custom;

	    location = / { try_files /pub/index.html /ext/index.html @frontcontroller; }
	    location / { try_files /pub/\$uri /pub/\$uri.html /ext/\$uri @frontcontroller; }
	    location /ext {}
	    location /pub {}
	    location @frontcontroller {
	        expires off;
	        try_files /lib/_8n/frontcontroller.php =404;
	        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
	        include fastcgi.conf;
	    }

	    error_page 400 /400;
	    error_page 401 /401;
	    error_page 403 /403;
	    error_page 404 /404;
	    error_page 413 /413;
	    error_page 500 /500;
	    error_page 502 /502;
	    error_page 504 /504;

	    location = /400 { try_files /pub/400.\$extension /ext/400.\$extension; }
	    location = /401 { try_files /pub/401.\$extension /ext/401.\$extension; }
	    location = /403 { try_files /pub/403.\$extension /ext/403.\$extension; }
	    location = /404 { try_files /pub/404.\$extension /ext/404.\$extension; }
	    location = /413 { try_files /pub/413.\$extension /ext/413.\$extension; }
	    location = /500 { try_files /pub/500.\$extension /ext/500.\$extension; }
	    location = /502 { try_files /pub/502.\$extension /ext/502.\$extension; }
	    location = /504 { try_files /pub/504.\$extension /ext/504.\$extension; }
	}
	EOM
else
	cat >> $INSTALL_DIR/$SHORT_NAME.conf <<- EOM
	    server_name  $DOMAIN www.$DOMAIN;
	    return 301 https://$REDIRECT\$request_uri;
	}
	EOM
fi

cp --backup=numbered $INSTALL_DIR/$SHORT_NAME.conf $ETC_DIR/$SHORT_NAME.conf

ln -sf $ETC_DIR/$SHORT_NAME.conf $ENABLED_DIR
nginx -t && echo You may now run sudo service nginx reload