77 lines
2.0 KiB
Bash
77 lines
2.0 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
INFRA_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||
|
|
cd "$INFRA_DIR"
|
||
|
|
|
||
|
|
GREEN='\033[0;32m'
|
||
|
|
YELLOW='\033[1;33m'
|
||
|
|
RED='\033[0;31m'
|
||
|
|
NC='\033[0m'
|
||
|
|
|
||
|
|
if [ ! -f .env ]; then
|
||
|
|
echo -e "${RED}Missing .env — copy deploy.prod.env.example to .env${NC}"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
set -a
|
||
|
|
# shellcheck disable=SC1091
|
||
|
|
source .env
|
||
|
|
set +a
|
||
|
|
|
||
|
|
: "${DOMAIN:?Set DOMAIN in .env}"
|
||
|
|
: "${LETSENCRYPT_EMAIL:?Set LETSENCRYPT_EMAIL in .env}"
|
||
|
|
|
||
|
|
COMPOSE=(docker compose -f docker-compose.prod.yml --env-file .env)
|
||
|
|
|
||
|
|
mkdir -p nginx/generated logs/nginx database/backups
|
||
|
|
|
||
|
|
CERT_PATH="certbot_conf/live/${DOMAIN}/fullchain.pem"
|
||
|
|
if docker volume inspect dyolink_certbot_conf >/dev/null 2>&1; then
|
||
|
|
if docker run --rm -v dyolink_certbot_conf:/etc/letsencrypt:ro alpine \
|
||
|
|
test -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"; then
|
||
|
|
echo -e "${GREEN}Certificate already exists for ${DOMAIN}${NC}"
|
||
|
|
./scripts/render-nginx-ssl.sh
|
||
|
|
"${COMPOSE[@]}" up -d --force-recreate nginx
|
||
|
|
"${COMPOSE[@]}" up -d
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo -e "${YELLOW}Phase 1: bootstrap nginx (HTTP) for ACME challenge...${NC}"
|
||
|
|
cp nginx/nginx.bootstrap.conf nginx/generated/default.conf
|
||
|
|
"${COMPOSE[@]}" up -d nginx
|
||
|
|
|
||
|
|
echo -e "${YELLOW}Phase 2: request Let's Encrypt certificate...${NC}"
|
||
|
|
CERTBOT_ARGS=(
|
||
|
|
certonly
|
||
|
|
--webroot
|
||
|
|
-w /var/www/certbot
|
||
|
|
--email "$LETSENCRYPT_EMAIL"
|
||
|
|
--agree-tos
|
||
|
|
--no-eff-email
|
||
|
|
-d "$DOMAIN"
|
||
|
|
)
|
||
|
|
|
||
|
|
if [ -n "${CERTBOT_EXTRA_DOMAINS:-}" ]; then
|
||
|
|
for extra in $CERTBOT_EXTRA_DOMAINS; do
|
||
|
|
CERTBOT_ARGS+=(-d "$extra")
|
||
|
|
done
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ "${LETSENCRYPT_STAGING:-0}" = "1" ]; then
|
||
|
|
CERTBOT_ARGS+=(--staging)
|
||
|
|
echo -e "${YELLOW}Using Let's Encrypt staging (test) certificates${NC}"
|
||
|
|
fi
|
||
|
|
|
||
|
|
"${COMPOSE[@]}" run --rm --entrypoint certbot certbot "${CERTBOT_ARGS[@]}"
|
||
|
|
|
||
|
|
echo -e "${YELLOW}Phase 3: enable HTTPS nginx config...${NC}"
|
||
|
|
./scripts/render-nginx-ssl.sh
|
||
|
|
"${COMPOSE[@]}" up -d --force-recreate nginx
|
||
|
|
"${COMPOSE[@]}" up -d
|
||
|
|
|
||
|
|
echo -e "${GREEN}SSL ready for https://${DOMAIN}${NC}"
|
||
|
|
echo -e "${GREEN}Certbot renewal container is running (checks every 12h).${NC}"
|