147 lines
4.5 KiB
Bash
Executable File
147 lines
4.5 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# === Require root if installing on local system ===
|
||
run_locally=""
|
||
|
||
read -rp "Are you running this script on the actual server that will host NGINX? [y/N]: " answer
|
||
if [[ "$answer" =~ ^[Yy]$ ]]; then
|
||
run_locally=true
|
||
if [ "$EUID" -ne 0 ]; then
|
||
echo "❌ This script must be run as root when deploying directly on the target system."
|
||
echo "ℹ️ Try again with: sudo $0"
|
||
exit 1
|
||
fi
|
||
else
|
||
run_locally=false
|
||
echo "ℹ️ Generating config for remote deployment – it will be saved to the current directory."
|
||
fi
|
||
|
||
# === Prompt or take args ===
|
||
SERVER_NAME="${1:-}"
|
||
SSL_CERT_PATH="${2:-}"
|
||
SSL_KEY_PATH="${3:-}"
|
||
NODE_PORT="${4:-12391}"
|
||
|
||
# Prompt if not passed
|
||
if [ -z "$SERVER_NAME" ]; then
|
||
read -rp "Enter server_name (e.g. ext-node.qortal.link): " SERVER_NAME
|
||
fi
|
||
if [ -z "$SSL_CERT_PATH" ]; then
|
||
read -rp "Enter full path to SSL certificate: " SSL_CERT_PATH
|
||
fi
|
||
if [ -z "$SSL_KEY_PATH" ]; then
|
||
read -rp "Enter full path to SSL certificate key: " SSL_KEY_PATH
|
||
fi
|
||
if [ -z "$NODE_PORT" ]; then
|
||
read -rp "Enter Qortal node port [default: 12391]: " NODE_PORT
|
||
NODE_PORT="${NODE_PORT:-12391}"
|
||
fi
|
||
|
||
# === Output destination ===
|
||
if [[ "$run_locally" == true ]]; then
|
||
NGINX_CONF_DIR="/etc/nginx/sites-available"
|
||
NGINX_ENABLED_DIR="/etc/nginx/sites-enabled"
|
||
CONF_PATH="${NGINX_CONF_DIR}/${SERVER_NAME}"
|
||
else
|
||
SCRIPT_DIR="$(pwd)"
|
||
CONF_PATH="${SCRIPT_DIR}/${SERVER_NAME}.nginx.conf"
|
||
fi
|
||
|
||
# === Template ===
|
||
cat > "$CONF_PATH" <<EOF
|
||
server {
|
||
listen 80 default_server;
|
||
server_name _;
|
||
|
||
return 301 https://\$host\$request_uri;
|
||
}
|
||
|
||
map \$scheme \$ws_scheme {
|
||
default "ws";
|
||
https "wss";
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl;
|
||
server_name ${SERVER_NAME};
|
||
|
||
ssl_certificate ${SSL_CERT_PATH};
|
||
ssl_certificate_key ${SSL_KEY_PATH};
|
||
ssl_prefer_server_ciphers on;
|
||
|
||
client_max_body_size 500M;
|
||
|
||
location ~* ^/(lists|admin/(restart|stop|forcesync|apikey/generate|enginestats|orphan|mintingaccounts)|arbitrary/resources/cache/rebuild)\$ {
|
||
if (\$request_method ~* ^(POST|DELETE)\$) {
|
||
access_log /var/log/nginx/forbidden-methods.log;
|
||
return 403;
|
||
}
|
||
}
|
||
|
||
location ~* ^/(admin/repository/|admin/logs|arbitrary/hosted|crosschain/tradebot|bootstrap/create)\$ {
|
||
deny all;
|
||
error_log /var/log/nginx/forbidden.log debug;
|
||
}
|
||
|
||
location / {
|
||
proxy_hide_header Access-Control-Allow-Origin;
|
||
|
||
proxy_pass http://localhost:${NODE_PORT};
|
||
proxy_set_header Host \$host;
|
||
proxy_set_header X-Real-IP \$remote_addr;
|
||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
send_timeout 3600s;
|
||
keepalive_timeout 3600s;
|
||
}
|
||
|
||
location /websockets/ {
|
||
proxy_pass http://localhost:${NODE_PORT}/websockets/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade \$http_upgrade;
|
||
proxy_set_header Connection "Upgrade";
|
||
proxy_set_header Host \$host;
|
||
proxy_ssl_session_reuse off;
|
||
proxy_read_timeout 86400;
|
||
proxy_set_header X-Real-IP \$remote_addr;
|
||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||
}
|
||
|
||
location /websockets/crosschain/ {
|
||
proxy_pass \$ws_scheme://localhost:${NODE_PORT}/websockets/crosschain/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade \$http_upgrade;
|
||
proxy_set_header Connection "Upgrade";
|
||
proxy_set_header Host \$host;
|
||
proxy_ssl_session_reuse off;
|
||
proxy_read_timeout 86400;
|
||
proxy_set_header X-Real-IP \$remote_addr;
|
||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||
}
|
||
}
|
||
EOF
|
||
|
||
echo "✅ NGINX config generated at: $CONF_PATH"
|
||
|
||
# === Symlink + reload only if running locally
|
||
if [[ "$run_locally" == true ]]; then
|
||
if [ ! -e "${NGINX_ENABLED_DIR}/${SERVER_NAME}" ]; then
|
||
ln -s "$CONF_PATH" "${NGINX_ENABLED_DIR}/${SERVER_NAME}"
|
||
echo "🔗 Symlinked into sites-enabled."
|
||
fi
|
||
|
||
read -rp "Reload NGINX now? [y/N] " RELOAD
|
||
if [[ "$RELOAD" =~ ^[Yy]$ ]]; then
|
||
nginx -t && systemctl reload nginx && echo "✅ NGINX reloaded."
|
||
else
|
||
echo "ℹ️ Skipped reload. You can run: sudo systemctl reload nginx"
|
||
fi
|
||
else
|
||
echo "📝 You can now copy the generated config to your server’s /etc/nginx/sites-available/ directory."
|
||
fi
|
||
|