forked from littlebizzy/slickstack
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ss-install-nginx-ssl.txt
255 lines (201 loc) · 12 KB
/
ss-install-nginx-ssl.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
#!/bin/bash
####################################################################################################
#### author: SlickStack ############################################################################
#### link: https://slickstack.io ###################################################################
#### mirror: https://mirrors.slickstack.io/bash/ss-install-nginx-ssl.txt ###########################
#### path: /var/www/ss-install-nginx-ssl ###########################################################
#### destination: n/a (not a boilerplate) ##########################################################
#### purpose: Reinstalls desired SSL cert (OpenSSL vs Lets Encrypt) to Nginx (idempotent) ##########
#### module version: Nginx 1.18.x ##################################################################
#### sourced by: ss-install-nginx ##################################################################
#### bash aliases: ss install nginx ssl, ss install ssl ############################################
####################################################################################################
## SS-CONFIG MUST BE PROPERLY CONFIGURED AND ON CURRENT BUILD BEFORE RUNNING SS-INSTALL ##
## ENSURE YOUR SS-CONFIG BUILD REMAINS CURRENT BY RUNNING SS-UPDATE OCCASIONALLY ##
## source ss-config ##
source /var/www/ss-config
## source ss-functions ##
source /var/www/ss-functions
## BELOW THIS RELIES ON SS-CONFIG AND SS-FUNCTIONS
####################################################################################################
#### SS-Install-Nginx-SSL: Message (Begin Script) ##################################################
####################################################################################################
## this is a simple message that announces to the shell the purpose of this bash script ##
## it will only be noticed by sudo users who manually call ss core bash scripts ##
## echo message ##
echo -e "${PURPLE}Running ss-install-nginx-ssl: Reinstalls desired SSL cert (OpenSSL vs Lets Encrypt) to Nginx (idempotent)... ${NOCOLOR}"
sleep "$SLEEP_MESSAGE_BEGIN"
####################################################################################################
#### SS-Install-Nginx-SSL: Install Lets Encrypt (Per SS-Config) ####################################
####################################################################################################
## here we update the Nginx config files to activate either OpenSSL or Lets Encrypt SSL ##
## this depends on your ss-config settings (both certs should exist regardless) ##
## install letsencrypt.conf (if preferred) ##
if [[ "$SSL_TYPE" == "letsencrypt" ]] || [[ "$SSL_TYPE" == "certbot" ]]; then
## retrieve boilerplate ##
wget -O "$TMP_LETSENCRYPT_CONF" "$MIRROR_LETSENCRYPT_CONF"
## protocols ##
if [[ -z "$SSL_PROTOCOLS" ]]; then
sed -i "s/@SSL_PROTOCOLS/TLSv1.2 TLSv1.3/g" "$TMP_LETSENCRYPT_CONF"
else
sed -i "s/@SSL_PROTOCOLS/${SSL_PROTOCOLS}/g" "$TMP_LETSENCRYPT_CONF"
fi
## ciphers ##
if [[ -z "$SSL_CIPHERS" ]]; then
sed -i "s/@SSL_CIPHERS/ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384/g" "$TMP_LETSENCRYPT_CONF"
else
sed -i "s/@SSL_CIPHERS/${SSL_CIPHERS}/g" "$TMP_LETSENCRYPT_CONF"
fi
## session timeout ##
if [[ -z "$SSL_SESSION_TIMEOUT" ]]; then
sed -i "s/@SSL_SESSION_TIMEOUT/1d/g" "$TMP_LETSENCRYPT_CONF"
else
sed -i "s/@SSL_SESSION_TIMEOUT/${SSL_SESSION_TIMEOUT}/g" "$TMP_LETSENCRYPT_CONF"
fi
## session cache ##
if [[ -z "$SSL_SESSION_CACHE" ]]; then
sed -i "s/@SSL_SESSION_CACHE/shared:SSL:64m/g" "$TMP_LETSENCRYPT_CONF"
else
sed -i "s/@SSL_SESSION_CACHE/${SSL_SESSION_CACHE}/g" "$TMP_LETSENCRYPT_CONF"
fi
## buffer size ##
if [[ -z "$SSL_BUFFER_SIZE" ]]; then
sed -i "s/@SSL_BUFFER_SIZE/16k/g" "$TMP_LETSENCRYPT_CONF"
else
sed -i "s/@SSL_BUFFER_SIZE/${SSL_BUFFER_SIZE}/g" "$TMP_LETSENCRYPT_CONF"
fi
## move file ##
cp "$TMP_LETSENCRYPT_CONF" "$PATH_LETSENCRYPT_CONF"
rm /etc/nginx/conf.d/openssl.conf*
rm /etc/nginx/conf.d/thirdparty.conf*
echo -e "${PURPLE}Exiting ss-install-nginx-ssl: Lets Encrypt installation to the Nginx server appears to have been successful... ${NOCOLOR}"
fi
## here we modify the live Nginx configuration files to activate Lets Encrypt certificates ##
## this snippet will only be executed if Lets Encrypt certs appear to be successful ##
####################################################################################################
#### SS-Install-Nginx-SSL: Install OpenSSL (Per SS-Config) #########################################
####################################################################################################
## install letsencrypt.conf (if preferred) ##
if [[ "$SSL_TYPE" == "openssl" ]] || [[ -z "$SSL_TYPE" ]]; then
## retrieve Lets Encrypt and OpenSSL sub-config file ##
wget -O "$TMP_OPENSSL_CONF" "$MIRROR_OPENSSL_CONF"
## protocols ##
if [[ -z "$SSL_PROTOCOLS" ]]; then
sed -i "s/@SSL_PROTOCOLS/TLSv1.2 TLSv1.3/g" "$TMP_OPENSSL_CONF"
else
sed -i "s/@SSL_PROTOCOLS/${SSL_PROTOCOLS}/g" "$TMP_OPENSSL_CONF"
fi
## ciphers ##
if [[ -z "$SSL_CIPHERS" ]]; then
sed -i "s/@SSL_CIPHERS/ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384/g" "$TMP_OPENSSL_CONF"
else
sed -i "s/@SSL_CIPHERS/${SSL_CIPHERS}/g" "$TMP_OPENSSL_CONF"
fi
## session timeout ##
if [[ -z "$SSL_SESSION_TIMEOUT" ]]; then
sed -i "s/@SSL_SESSION_TIMEOUT/1d/g" "$TMP_OPENSSL_CONF"
else
sed -i "s/@SSL_SESSION_TIMEOUT/${SSL_SESSION_TIMEOUT}/g" "$TMP_OPENSSL_CONF"
fi
## session cache ##
if [[ -z "$SSL_SESSION_CACHE" ]]; then
sed -i "s/@SSL_SESSION_CACHE/shared:SSL:64m/g" "$TMP_OPENSSL_CONF"
else
sed -i "s/@SSL_SESSION_CACHE/${SSL_SESSION_CACHE}/g" "$TMP_OPENSSL_CONF"
fi
## buffer size ##
if [[ -z "$SSL_BUFFER_SIZE" ]]; then
sed -i "s/@SSL_BUFFER_SIZE/16k/g" "$TMP_OPENSSL_CONF"
else
sed -i "s/@SSL_BUFFER_SIZE/${SSL_BUFFER_SIZE}/g" "$TMP_OPENSSL_CONF"
fi
## here we modify the live Nginx configuration files to activate Lets Encrypt certificates ##
## this snippet will only be executed if Lets Encrypt certs appear to be successful ##
## copy SSL sub-config file to /etc/nginx/conf.d/ and delete conflicting files ##
cp "$TMP_OPENSSL_CONF" /etc/nginx/conf.d/openssl.conf
rm /etc/nginx/conf.d/letsencrypt.conf*
rm /etc/nginx/conf.d/thirdparty.conf*
echo -e "${PURPLE}Exiting ss-install-nginx-ssl: OpenSSL installation to the Nginx server appears to have been successful... ${NOCOLOR}"
fi
####################################################################################################
#### SS-Install-Nginx-SSL: Install Third Party SSL (Per SS-Config) #################################
####################################################################################################
## install thirdparty.conf ##
if [[ "$SSL_TYPE" == "thirdparty" ]]; then
## retrieve boilerplate ##
wget -O "$TMP_THIRDPARTY_CONF" "$MIRROR_THIRDPARTY_CONF"
## protocols ##
if [[ -z "$SSL_PROTOCOLS" ]]; then
sed -i "s/@SSL_PROTOCOLS/TLSv1.2 TLSv1.3/g" "$TMP_THIRDPARTY_CONF"
else
sed -i "s/@SSL_PROTOCOLS/${SSL_PROTOCOLS}/g" "$TMP_THIRDPARTY_CONF"
fi
## ciphers ##
if [[ -z "$SSL_CIPHERS" ]]; then
sed -i "s/@SSL_CIPHERS/ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384/g" "$TMP_THIRDPARTY_CONF"
else
sed -i "s/@SSL_CIPHERS/${SSL_CIPHERS}/g" "$TMP_THIRDPARTY_CONF"
fi
## session timeout ##
if [[ -z "$SSL_SESSION_TIMEOUT" ]]; then
sed -i "s/@SSL_SESSION_TIMEOUT/1d/g" "$TMP_THIRDPARTY_CONF"
else
sed -i "s/@SSL_SESSION_TIMEOUT/${SSL_SESSION_TIMEOUT}/g" "$TMP_THIRDPARTY_CONF"
fi
## session cache ##
if [[ -z "$SSL_SESSION_CACHE" ]]; then
sed -i "s/@SSL_SESSION_CACHE/shared:SSL:64m/g" "$TMP_THIRDPARTY_CONF"
else
sed -i "s/@SSL_SESSION_CACHE/${SSL_SESSION_CACHE}/g" "$TMP_THIRDPARTY_CONF"
fi
## buffer size ##
if [[ -z "$SSL_BUFFER_SIZE" ]]; then
sed -i "s/@SSL_BUFFER_SIZE/16k/g" "$TMP_THIRDPARTY_CONF"
else
sed -i "s/@SSL_BUFFER_SIZE/${SSL_BUFFER_SIZE}/g" "$TMP_THIRDPARTY_CONF"
fi
## move file ##
cp "$TMP_THIRDPARTY_CONF" "$PATH_THIRDPARTY_CONF"
rm /etc/nginx/conf.d/letsencrypt.conf*
rm /etc/nginx/conf.d/openssl.conf*
echo -e "${PURPLE}Exiting ss-install-nginx-ssl: Third party SSL installation to the Nginx server appears to have been successful... ${NOCOLOR}"
fi
####################################################################################################
#### SS-Install-Nginx-SSL: XXXXXX ###########################################
####################################################################################################
## here we modify the live Nginx configuration files to activate Lets Encrypt certificates ##
## this snippet will only be executed if Lets Encrypt certs appear to be successful ##
## copy SSL sub-config file to /etc/nginx/conf.d/ and delete conflicting files ##
# if [[ "$SSL_TYPE" == "certbot" ]] && [[ -f "/var/www/certs/fullchain.pem" ]] && [[ -f "/var/www/certs/keys/privkey.pem" ]]; then
# cp /tmp/letsencrypt.conf /etc/nginx/conf.d/letsencrypt.conf
# rm /etc/nginx/conf.d/openssl.conf*
# echo -e "${PURPLE}Lets Encrypt installation appears to have been successful. ${NOCOLOR}"
# elif [[ "$SSL_TYPE" == "certbot" ]] && [[ ! -f "/etc/letsencrypt/live/slickstack/fullchain.pem" || ! -f "/etc/letsencrypt/live/slickstack/privkey.pem" ]]; then
# cp /tmp/openssl.conf /etc/nginx/conf.d/openssl.conf
# rm /etc/nginx/conf.d/letsencrypt.conf*
# sed -i "s#SSL_TYPE="certbot"#SSL_TYPE="openssl"#g" /var/www/ss-config
# echo -e "${PURPLE}Lets Encrypt installation was not successful, reverting to OpenSSL instead. ${NOCOLOR}"
#else
# cp /tmp/openssl.conf /etc/nginx/conf.d/openssl.conf
# rm /etc/nginx/conf.d/letsencrypt.conf*
# echo -e "${YELLOW}OpenSSL installation appears to have been successful. ${NOCOLOR}"
# fi
####################################################################################################
#### SS-Install-Nginx-SSL: Reset Permissions (Nginx SSL) ###########################################
####################################################################################################
## run ss-perms-nginx-ssl ##
source "$PATH_SS_PERMS_NGINX_SSL"
####################################################################################################
#### SS-Install-Nginx-SSL: Touch Timestamp File (End Script) #######################################
####################################################################################################
## this is a dummy timestamp file that will remember the last time this script was run ##
## it can be useful for developer reference and is sometimes used by SlickStack ##
## script timestamp ##
touch "$TIMESTAMP_SS_INSTALL_NGINX_SSL"
####################################################################################################
#### SlickStack: External References Used To Improve This Script (Thanks, Interwebz) ###############
####################################################################################################
## Ref: https://github.com/littlebizzy/slickstack/blob/master/ss-install-nginx-config.txt
## Ref: https://github.com/littlebizzy/slickstack/blob/master/ss-encrypt-openssl.txt
## Ref: https://github.com/littlebizzy/slickstack/blob/master/ss-encrypt-certbot.txt
## SS_EOF