From 3185fea4c1d4e8e5f7f35631eff91d08e33f4446 Mon Sep 17 00:00:00 2001 From: Oier Bravo Urtasun Date: Tue, 9 Jun 2026 01:09:46 +0200 Subject: [PATCH] feat(nginx): render-nginx.sh + www->apex redirect vhost Add tooling/render-nginx.sh: pulls BASE_DOMAIN/CADDY_HTTP_PORT from .env, defaults APP_DIR to the repo checkout, renders a vhost template (default the caddy-front one) to stdout, or --install writes + symlinks + nginx -t + reloads. Document it in the README, replacing the manual envsubst one-liner. Also add the www.${BASE_DOMAIN} canonical 301->apex block and put www in the LE_SUBDOMAINS default so its cert is issued. Co-Authored-By: Claude Opus 4.8 (1M context) --- .env.example | 2 +- README.md | 24 ++++++------- nginx/ulicraft-caddy.conf.tmpl | 14 +++++++- tooling/issue-letsencrypt.sh | 4 +-- tooling/render-nginx.sh | 61 ++++++++++++++++++++++++++++++++++ 5 files changed, 89 insertions(+), 16 deletions(-) create mode 100755 tooling/render-nginx.sh diff --git a/.env.example b/.env.example index 9d9469a..2e9ff10 100644 --- a/.env.example +++ b/.env.example @@ -37,7 +37,7 @@ DISTRIBUTION_WEB_ROOT=/home/oier/projects/mc-mods/ulicraft-group/ulicraft-distri # Only needed to issue real TLS certs. DNS-01 needs no inbound ports. LE_EMAIL=you@example.com # space-separated subdomains; apex ${BASE_DOMAIN} is always included -LE_SUBDOMAINS=auth pack distribution +LE_SUBDOMAINS=auth pack distribution www # OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/ # OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it. OVH_END_POINT=ovh-eu diff --git a/README.md b/README.md index be0b10a..c171a9e 100644 --- a/README.md +++ b/README.md @@ -105,20 +105,18 @@ caddy by Host header. Caddy stays the single router (apex landing, `auth.` -f docker-compose.static.yml -f docker-compose.distribution.yml up -d ``` -4. **Render + install the nginx vhost** from `nginx/ulicraft-caddy.conf.tmpl`. - Substitute `CADDY_HTTP_PORT` (proxy target), `BASE_DOMAIN`, `APP_DIR` (repo - path on the host, for the cert files): +4. **Render + install the nginx vhost** with `tooling/render-nginx.sh`. It pulls + `BASE_DOMAIN` + `CADDY_HTTP_PORT` from `.env`, defaults `APP_DIR` to the repo + checkout (where `certs/` live), and renders `nginx/ulicraft-caddy.conf.tmpl`: ```sh - CADDY_HTTP_PORT=8880 BASE_DOMAIN=ulicraft.net APP_DIR=/home/ubuntu/mc/ulicraft-server-v1 \ - envsubst '$CADDY_HTTP_PORT $BASE_DOMAIN $APP_DIR' \ - < nginx/ulicraft-caddy.conf.tmpl | sudo tee /etc/nginx/sites-available/ulicraft.conf - sudo ln -sf /etc/nginx/sites-available/ulicraft.conf /etc/nginx/sites-enabled/ - sudo nginx -t && sudo systemctl reload nginx + tooling/render-nginx.sh # preview to stdout (dry run) + tooling/render-nginx.sh --install # write, symlink, nginx -t, reload ``` + Overrides via env: `APP_DIR=/path` (if the repo isn't at the cert location), + `SITE_NAME=foo.conf`, `TEMPLATE=nginx/ulicraft.conf.tmpl` (the static variant — + nginx serves the files itself + proxies only drasl; pick one, not both). -Re-run step 4 whenever you add a subdomain (e.g. a new vhost) so its server -block is rendered. `nginx/ulicraft.conf.tmpl` is the older alternative (nginx -serves the static files itself + proxies only drasl) — pick one, not both. +Re-run step 4 whenever you add a subdomain so its server block is rendered. `distribution.${BASE_DOMAIN}` serves a static site whose web root lives in another repo: set `DISTRIBUTION_WEB_ROOT` (absolute host path) in `.env`; it's @@ -146,8 +144,10 @@ dnsmasq/dnsmasq.conf.tmpl # optional DNS config (rendered) docker/avahi/ # mDNS responder image pack/ # packwiz modpack source landing/ # Astro site → www/ -tooling/ # build-stack, render-config, dns-records, +tooling/ # build-stack, render-config, render-nginx, + # dns-records, issue-letsencrypt, # mirror-mods, mirror-airgap, fetch-launcher +nginx/*.conf.tmpl # host-nginx TLS vhost templates mirror/ # vendored jars + launcher + asset mirror (gitignored) plan/ # full design docs (00–12) ``` diff --git a/nginx/ulicraft-caddy.conf.tmpl b/nginx/ulicraft-caddy.conf.tmpl index 5e3681e..763af04 100644 --- a/nginx/ulicraft-caddy.conf.tmpl +++ b/nginx/ulicraft-caddy.conf.tmpl @@ -32,7 +32,7 @@ upstream ulicraft_caddy { server { listen 80; listen [::]:80; - server_name ${BASE_DOMAIN} auth.${BASE_DOMAIN} pack.${BASE_DOMAIN} distribution.${BASE_DOMAIN}; + server_name ${BASE_DOMAIN} www.${BASE_DOMAIN} auth.${BASE_DOMAIN} pack.${BASE_DOMAIN} distribution.${BASE_DOMAIN}; return 301 https://$host$request_uri; } @@ -58,6 +58,18 @@ server { } } +# www -> apex canonical redirect (needs its own cert; covered by LE_SUBDOMAINS). +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name www.${BASE_DOMAIN}; + + ssl_certificate ${APP_DIR}/certs/www.${BASE_DOMAIN}/cert.pem; + ssl_certificate_key ${APP_DIR}/certs/www.${BASE_DOMAIN}/key.pem; + + return 301 https://${BASE_DOMAIN}$request_uri; +} + server { listen 443 ssl http2; listen [::]:443 ssl http2; diff --git a/tooling/issue-letsencrypt.sh b/tooling/issue-letsencrypt.sh index 95d745d..c2e2900 100755 --- a/tooling/issue-letsencrypt.sh +++ b/tooling/issue-letsencrypt.sh @@ -17,7 +17,7 @@ # OVH_CK OVH consumer key (obtained on first run — see below) # OVH_END_POINT OVH API endpoint (e.g. ovh-eu) # optional: -# LE_SUBDOMAINS space-separated (default: "auth pack distribution") +# LE_SUBDOMAINS space-separated (default: "auth pack distribution www") # LE_STAGING=1 use the LE staging CA (untrusted, for dry runs) # # First-time OVH consumer key: set OVH_AK/OVH_AS/OVH_END_POINT, leave OVH_CK @@ -53,7 +53,7 @@ ACME="${ACME_SH:-$HOME/.acme.sh/acme.sh}" then re-run (or set ACME_SH=/path/to/acme.sh)." CERT_DIR="${CERT_DIR:-certs}" -read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution}" +read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution www}" if [ "${LE_STAGING:-0}" = "1" ]; then SERVER="letsencrypt_test"; warn "STAGING mode — certs will NOT be trusted by browsers" diff --git a/tooling/render-nginx.sh b/tooling/render-nginx.sh new file mode 100755 index 0000000..cec2913 --- /dev/null +++ b/tooling/render-nginx.sh @@ -0,0 +1,61 @@ +#!/usr/bin/env bash +# render-nginx.sh — render an nginx vhost template with the .env values. +# +# Substitutes $BASE_DOMAIN, $APP_DIR, $CADDY_HTTP_PORT into a template and +# prints the result to stdout, or installs it with --install (writes to +# sites-available, symlinks sites-enabled, tests, reloads nginx). +# +# Usage: +# tooling/render-nginx.sh # render caddy-front template -> stdout +# tooling/render-nginx.sh --install # render + install + reload nginx +# TEMPLATE=nginx/ulicraft.conf.tmpl tooling/render-nginx.sh # the static variant +# +# .env vars used: +# BASE_DOMAIN required +# CADDY_HTTP_PORT caddy-front template only (localhost port nginx proxies to) +# optional: +# APP_DIR host path to this repo (cert files live under APP_DIR/certs) +# — defaults to the repo root (this checkout) +# TEMPLATE template to render (default nginx/ulicraft-caddy.conf.tmpl) +# SITE_NAME installed filename (default ulicraft.conf) +set -euo pipefail + +cd "$(dirname "$0")/.." # repo root + +log() { printf '\n\033[1;32m==>\033[0m %s\n' "$*"; } +warn() { printf '\033[1;33m!!\033[0m %s\n' "$*" >&2; } +die() { printf '\033[1;31mxx\033[0m %s\n' "$*" >&2; exit 1; } + +[ -f .env ] || die ".env not found (copy .env.example and fill it)" +# shellcheck disable=SC1091 +set -a; . ./.env; set +a +: "${BASE_DOMAIN:?BASE_DOMAIN unset in .env}" + +TEMPLATE="${TEMPLATE:-nginx/ulicraft-caddy.conf.tmpl}" +[ -f "$TEMPLATE" ] || die "template not found: $TEMPLATE" +APP_DIR="${APP_DIR:-$PWD}" +SITE_NAME="${SITE_NAME:-ulicraft.conf}" + +# CADDY_HTTP_PORT only matters for the caddy-front template; default 80 so the +# static template (which never references it) still renders cleanly. +export BASE_DOMAIN APP_DIR +export CADDY_HTTP_PORT="${CADDY_HTTP_PORT:-80}" + +rendered="$(envsubst '$BASE_DOMAIN $APP_DIR $CADDY_HTTP_PORT' < "$TEMPLATE")" + +if [ "${1:-}" != "--install" ]; then + printf '%s\n' "$rendered" + warn "dry run — pipe to a file or pass --install to deploy" + exit 0 +fi + +command -v nginx >/dev/null 2>&1 || die "nginx not found on PATH" +avail="/etc/nginx/sites-available/$SITE_NAME" +enabled="/etc/nginx/sites-enabled/$SITE_NAME" + +log "installing $TEMPLATE -> $avail (APP_DIR=$APP_DIR, CADDY_HTTP_PORT=$CADDY_HTTP_PORT)" +printf '%s\n' "$rendered" | sudo tee "$avail" >/dev/null +sudo ln -sf "$avail" "$enabled" +sudo nginx -t +sudo systemctl reload nginx +log "done — nginx reloaded"