https 접속 허용

2026-06-15 13:02:41 +09:00
parent 6481a432fd
commit 8922895ab7
13 changed files with 306 additions and 151 deletions
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# exdev.co.kr — HTTP(80) 유지 + HTTPS(443) Let's Encrypt 인증서 발급
+#
+# 사전: docker compose up -d frontend (80 포트 동작, /.well-known/acme-challenge/ 노출)
+# 사용: ./scripts/setup-exdev-https.sh [--email you@example.com] [--domain exdev.co.kr]
+#       ./scripts/setup-exdev-https.sh --self-signed   # 로컬/테스트용 자체 서명
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+DOMAIN="${DOMAIN:-exdev.co.kr}"
+EMAIL="${CERTBOT_EMAIL:-}"
+SELF_SIGNED=false
+SSL_DIR="${SSL_CERT_DIR:-$ROOT/docker/nginx/ssl}"
+WEBROOT="${CERTBOT_WEBROOT_DIR:-$ROOT/docker/nginx/certbot-webroot}"
+LE_DIR="$ROOT/docker/nginx/letsencrypt"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --email) EMAIL="$2"; shift 2 ;;
+    --domain) DOMAIN="$2"; shift 2 ;;
+    --self-signed) SELF_SIGNED=true; shift ;;
+    -h|--help)
+      echo "Usage: $0 [--email E] [--domain D] [--self-signed]"
+      exit 0
+      ;;
+    *) echo "Unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+mkdir -p "$SSL_DIR" "$WEBROOT" "$LE_DIR"
+chmod 755 "$SSL_DIR" "$WEBROOT"
+
+link_certs() {
+  ln -sf "../letsencrypt/live/$DOMAIN/fullchain.pem" "$SSL_DIR/fullchain.pem"
+  ln -sf "../letsencrypt/live/$DOMAIN/privkey.pem" "$SSL_DIR/privkey.pem"
+}
+
+if [[ "$SELF_SIGNED" == true ]]; then
+  echo "[setup-https] self-signed certificate for $DOMAIN"
+  openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
+    -keyout "$SSL_DIR/privkey.pem" \
+    -out "$SSL_DIR/fullchain.pem" \
+    -subj "/CN=$DOMAIN"
+else
+  if [[ -z "$EMAIL" ]]; then
+    echo "[setup-https] ERROR: --email required for Let's Encrypt (or use --self-signed)" >&2
+    exit 1
+  fi
+  echo "[setup-https] certbot webroot — domain=$DOMAIN email=$EMAIL"
+  docker run --rm \
+    -v "$WEBROOT:/var/www/certbot" \
+    -v "$LE_DIR:/etc/letsencrypt" \
+    certbot/certbot certonly --webroot -w /var/www/certbot \
+    -d "$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --keep-until-expiring
+  link_certs
+fi
+
+echo "[setup-https] restarting frontend (443 enable)..."
+docker compose up -d --force-recreate frontend
+
+echo ""
+echo "Done."
+echo "  HTTP:  http://${DOMAIN}/"
+echo "  HTTPS: https://${DOMAIN}/"
+echo ""
+echo "Renew (cron monthly):"
+echo "  docker run --rm -v \"$WEBROOT:/var/www/certbot\" -v \"$LE_DIR:/etc/letsencrypt\" \\"
+echo "    certbot/certbot renew && docker compose exec frontend nginx -s reload"