Macbook
71 lines
2.3 KiB
Bash
Executable File
71 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# exdev.co.kr — HTTP(80) 유지 + HTTPS(443) Let's Encrypt 인증서 발급
|
|
#
|
|
# 사전: docker compose up -d frontend (80 포트 동작, /.well-known/acme-challenge/ 노출)
|
|
# 사용: ./scripts/setup-exdev-https.sh [--email you@example.com] [--domain exdev.co.kr]
|
|
# ./scripts/setup-exdev-https.sh --self-signed # 로컬/테스트용 자체 서명
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
DOMAIN="${DOMAIN:-exdev.co.kr}"
|
|
EMAIL="${CERTBOT_EMAIL:-}"
|
|
SELF_SIGNED=false
|
|
SSL_DIR="${SSL_CERT_DIR:-$ROOT/docker/nginx/ssl}"
|
|
WEBROOT="${CERTBOT_WEBROOT_DIR:-$ROOT/docker/nginx/certbot-webroot}"
|
|
LE_DIR="$ROOT/docker/nginx/letsencrypt"
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--email) EMAIL="$2"; shift 2 ;;
|
|
--domain) DOMAIN="$2"; shift 2 ;;
|
|
--self-signed) SELF_SIGNED=true; shift ;;
|
|
-h|--help)
|
|
echo "Usage: $0 [--email E] [--domain D] [--self-signed]"
|
|
exit 0
|
|
;;
|
|
*) echo "Unknown option: $1" >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
mkdir -p "$SSL_DIR" "$WEBROOT" "$LE_DIR"
|
|
chmod 755 "$SSL_DIR" "$WEBROOT"
|
|
|
|
link_certs() {
|
|
ln -sf "../letsencrypt/live/$DOMAIN/fullchain.pem" "$SSL_DIR/fullchain.pem"
|
|
ln -sf "../letsencrypt/live/$DOMAIN/privkey.pem" "$SSL_DIR/privkey.pem"
|
|
}
|
|
|
|
if [[ "$SELF_SIGNED" == true ]]; then
|
|
echo "[setup-https] self-signed certificate for $DOMAIN"
|
|
openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
|
|
-keyout "$SSL_DIR/privkey.pem" \
|
|
-out "$SSL_DIR/fullchain.pem" \
|
|
-subj "/CN=$DOMAIN"
|
|
else
|
|
if [[ -z "$EMAIL" ]]; then
|
|
echo "[setup-https] ERROR: --email required for Let's Encrypt (or use --self-signed)" >&2
|
|
exit 1
|
|
fi
|
|
echo "[setup-https] certbot webroot — domain=$DOMAIN email=$EMAIL"
|
|
docker run --rm \
|
|
-v "$WEBROOT:/var/www/certbot" \
|
|
-v "$LE_DIR:/etc/letsencrypt" \
|
|
certbot/certbot certonly --webroot -w /var/www/certbot \
|
|
-d "$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --keep-until-expiring
|
|
link_certs
|
|
fi
|
|
|
|
echo "[setup-https] restarting frontend (443 enable)..."
|
|
docker compose up -d --force-recreate frontend
|
|
|
|
echo ""
|
|
echo "Done."
|
|
echo " HTTP: http://${DOMAIN}/"
|
|
echo " HTTPS: https://${DOMAIN}/"
|
|
echo ""
|
|
echo "Renew (cron monthly):"
|
|
echo " docker run --rm -v \"$WEBROOT:/var/www/certbot\" -v \"$LE_DIR:/etc/letsencrypt\" \\"
|
|
echo " certbot/certbot renew && docker compose exec frontend nginx -s reload"
|