115 lines
2.7 KiB
Bash
115 lines
2.7 KiB
Bash
|
#!/bin/sh
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
NGINX_PORT="${NGINX_PORT:-3001}"
|
||
|
|
NGINX_SERVER_NAME="${NGINX_SERVER_NAME:-_}"
|
||
|
|
SSL_CERT_DIR="${SSL_CERT_DIR:-/etc/nginx/certs}"
|
||
|
|
SSL_CERT_FILE_NAME="${SSL_CERT_FILE_NAME:-RSA-cert.pem}"
|
||
|
|
SSL_CHAIN_FILE_NAME="${SSL_CHAIN_FILE_NAME:-RSA-chain.pem}"
|
||
|
|
SSL_KEY_FILE_NAME="${SSL_KEY_FILE_NAME:-RSA-privkey.pem}"
|
||
|
|
UPSTREAM_HOST="${UPSTREAM_HOST:-rental-contract-pdf}"
|
||
|
|
UPSTREAM_PORT="${UPSTREAM_PORT:-3001}"
|
||
|
|
|
||
|
|
GENERATED_DIR="/etc/nginx/generated"
|
||
|
|
GENERATED_CERT_PATH="${GENERATED_DIR}/fullchain.pem"
|
||
|
|
GENERATED_KEY_PATH="${GENERATED_DIR}/privkey.pem"
|
||
|
|
|
||
|
|
mkdir -p "${GENERATED_DIR}"
|
||
|
|
|
||
|
|
build_cert_bundle() {
|
||
|
|
cert_path="${SSL_CERT_DIR}/${SSL_CERT_FILE_NAME}"
|
||
|
|
chain_path="${SSL_CERT_DIR}/${SSL_CHAIN_FILE_NAME}"
|
||
|
|
key_path="${SSL_CERT_DIR}/${SSL_KEY_FILE_NAME}"
|
||
|
|
|
||
|
|
if [ ! -f "${cert_path}" ]; then
|
||
|
|
echo "Missing certificate file: ${cert_path}" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ ! -f "${chain_path}" ]; then
|
||
|
|
echo "Missing chain file: ${chain_path}" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ ! -f "${key_path}" ]; then
|
||
|
|
echo "Missing key file: ${key_path}" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
normalize_pem_file "${cert_path}" > "${GENERATED_CERT_PATH}"
|
||
|
|
normalize_pem_file "${chain_path}" >> "${GENERATED_CERT_PATH}"
|
||
|
|
cp "${key_path}" "${GENERATED_KEY_PATH}"
|
||
|
|
}
|
||
|
|
|
||
|
|
normalize_pem_file() {
|
||
|
|
pem_path="$1"
|
||
|
|
|
||
|
|
awk '
|
||
|
|
{
|
||
|
|
sub(/\r$/, "")
|
||
|
|
print
|
||
|
|
has_content = 1
|
||
|
|
}
|
||
|
|
END {
|
||
|
|
if (has_content) {
|
||
|
|
print ""
|
||
|
|
}
|
||
|
|
}
|
||
|
|
' "${pem_path}"
|
||
|
|
}
|
||
|
|
|
||
|
|
write_nginx_config() {
|
||
|
|
cat > /etc/nginx/conf.d/default.conf <<EOF
|
||
|
|
server {
|
||
|
|
listen ${NGINX_PORT} ssl;
|
||
|
|
server_name ${NGINX_SERVER_NAME};
|
||
|
|
|
||
|
|
ssl_certificate ${GENERATED_CERT_PATH};
|
||
|
|
ssl_certificate_key ${GENERATED_KEY_PATH};
|
||
|
|
ssl_session_cache shared:SSL:10m;
|
||
|
|
ssl_session_timeout 10m;
|
||
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||
|
|
ssl_prefer_server_ciphers on;
|
||
|
|
|
||
|
|
client_max_body_size 20m;
|
||
|
|
|
||
|
|
location / {
|
||
|
|
proxy_pass http://${UPSTREAM_HOST}:${UPSTREAM_PORT};
|
||
|
|
proxy_http_version 1.1;
|
||
|
|
proxy_set_header Host \$host;
|
||
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
||
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||
|
|
proxy_set_header X-Forwarded-Proto https;
|
||
|
|
proxy_set_header Upgrade \$http_upgrade;
|
||
|
|
proxy_set_header Connection "upgrade";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
EOF
|
||
|
|
}
|
||
|
|
|
||
|
|
watch_cert_updates() {
|
||
|
|
while inotifywait -qq -e close_write,create,delete,move "${SSL_CERT_DIR}"; do
|
||
|
|
echo "Certificate files changed, reloading nginx..."
|
||
|
|
build_cert_bundle
|
||
|
|
nginx -s reload
|
||
|
|
done
|
||
|
|
}
|
||
|
|
|
||
|
|
build_cert_bundle
|
||
|
|
write_nginx_config
|
||
|
|
nginx -t
|
||
|
|
|
||
|
|
watch_cert_updates &
|
||
|
|
WATCHER_PID=$!
|
||
|
|
|
||
|
|
cleanup() {
|
||
|
|
kill "${WATCHER_PID}" 2>/dev/null || true
|
||
|
|
}
|
||
|
|
|
||
|
|
trap cleanup INT TERM
|
||
|
|
|
||
|
|
nginx -g 'daemon off;' &
|
||
|
|
NGINX_PID=$!
|
||
|
|
|
||
|
|
wait "${NGINX_PID}"
|