oier/ulicraft-server-v1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nginx): render-nginx.sh + www->apex redirect vhost

Browse Source 
Add tooling/render-nginx.sh: pulls BASE_DOMAIN/CADDY_HTTP_PORT from .env,
defaults APP_DIR to the repo checkout, renders a vhost template (default the
caddy-front one) to stdout, or --install writes + symlinks + nginx -t + reloads.
Document it in the README, replacing the manual envsubst one-liner.

Also add the www.${BASE_DOMAIN} canonical 301->apex block and put www in the
LE_SUBDOMAINS default so its cert is issued.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Oier Bravo
2026-06-09 01:09:46 +02:00
parent f3c38da56c
commit 3185fea4c1
5 changed files with 89 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.env.example
View File

@@ -37,7 +37,7 @@ DISTRIBUTION_WEB_ROOT=/home/oier/projects/mc-mods/ulicraft-group/ulicraft-distri
# Only needed to issue real TLS certs. DNS-01 needs no inbound ports.
LE_EMAIL=you@example.com
# space-separated subdomains; apex ${BASE_DOMAIN} is always included
LE_SUBDOMAINS=auth pack distribution
LE_SUBDOMAINS=auth pack distribution www
# OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/
# OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it.
OVH_END_POINT=ovh-eu

24
README.md
View File

@@ -105,20 +105,18 @@ caddy by Host header. Caddy stays the single router (apex landing, `auth.`
-f docker-compose.static.yml -f docker-compose.distribution.yml up -d
```
4. **Render + install the nginx vhost** from `nginx/ulicraft-caddy.conf.tmpl`.
Substitute `CADDY_HTTP_PORT` (proxy target), `BASE_DOMAIN`, `APP_DIR` (repo
path on the host, for the cert files):
4. **Render + install the nginx vhost** with `tooling/render-nginx.sh`. It pulls
`BASE_DOMAIN` + `CADDY_HTTP_PORT` from `.env`, defaults `APP_DIR` to the repo
checkout (where `certs/` live), and renders `nginx/ulicraft-caddy.conf.tmpl`:
```sh
CADDY_HTTP_PORT=8880 BASE_DOMAIN=ulicraft.net APP_DIR=/home/ubuntu/mc/ulicraft-server-v1 \
envsubst '$CADDY_HTTP_PORT $BASE_DOMAIN $APP_DIR' \
< nginx/ulicraft-caddy.conf.tmpl | sudo tee /etc/nginx/sites-available/ulicraft.conf
sudo ln -sf /etc/nginx/sites-available/ulicraft.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
tooling/render-nginx.sh # preview to stdout (dry run)
tooling/render-nginx.sh --install # write, symlink, nginx -t, reload
```
Overrides via env: `APP_DIR=/path` (if the repo isn't at the cert location),
`SITE_NAME=foo.conf`, `TEMPLATE=nginx/ulicraft.conf.tmpl` (the static variant —
nginx serves the files itself + proxies only drasl; pick one, not both).
Re-run step 4 whenever you add a subdomain (e.g. a new vhost) so its server
block is rendered. `nginx/ulicraft.conf.tmpl` is the older alternative (nginx
serves the static files itself + proxies only drasl) — pick one, not both.
Re-run step 4 whenever you add a subdomain so its server block is rendered.
`distribution.${BASE_DOMAIN}` serves a static site whose web root lives in
another repo: set `DISTRIBUTION_WEB_ROOT` (absolute host path) in `.env`; it's
@@ -146,8 +144,10 @@ dnsmasq/dnsmasq.conf.tmpl # optional DNS config (rendered)
docker/avahi/ # mDNS responder image
pack/ # packwiz modpack source
landing/ # Astro site → www/
tooling/ # build-stack, render-config, dns-records,
tooling/ # build-stack, render-config, render-nginx,
# dns-records, issue-letsencrypt,
# mirror-mods, mirror-airgap, fetch-launcher
nginx/*.conf.tmpl # host-nginx TLS vhost templates
mirror/ # vendored jars + launcher + asset mirror (gitignored)
plan/ # full design docs (00–12)
```

14
nginx/ulicraft-caddy.conf.tmpl
View File

@@ -32,7 +32,7 @@ upstream ulicraft_caddy {
server {
listen 80;
listen [::]:80;
server_name ${BASE_DOMAIN} auth.${BASE_DOMAIN} pack.${BASE_DOMAIN} distribution.${BASE_DOMAIN};
server_name ${BASE_DOMAIN} www.${BASE_DOMAIN} auth.${BASE_DOMAIN} pack.${BASE_DOMAIN} distribution.${BASE_DOMAIN};
return 301 https://$host$request_uri;
}
@@ -58,6 +58,18 @@ server {
}
}
# www -> apex canonical redirect (needs its own cert; covered by LE_SUBDOMAINS).
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name www.${BASE_DOMAIN};
ssl_certificate ${APP_DIR}/certs/www.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/www.${BASE_DOMAIN}/key.pem;
return 301 https://${BASE_DOMAIN}$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;

4
tooling/issue-letsencrypt.sh
View File

@@ -17,7 +17,7 @@
# OVH_CK OVH consumer key (obtained on first run — see below)
# OVH_END_POINT OVH API endpoint (e.g. ovh-eu)
# optional:
# LE_SUBDOMAINS space-separated (default: "auth pack distribution")
# LE_SUBDOMAINS space-separated (default: "auth pack distribution www")
# LE_STAGING=1 use the LE staging CA (untrusted, for dry runs)
#
# First-time OVH consumer key: set OVH_AK/OVH_AS/OVH_END_POINT, leave OVH_CK
@@ -53,7 +53,7 @@ ACME="${ACME_SH:-$HOME/.acme.sh/acme.sh}"
then re-run (or set ACME_SH=/path/to/acme.sh)."
CERT_DIR="${CERT_DIR:-certs}"
read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution}"
read -r -a SUBDOMAINS <<< "${LE_SUBDOMAINS:-auth pack distribution www}"
if [ "${LE_STAGING:-0}" = "1" ]; then
SERVER="letsencrypt_test"; warn "STAGING mode — certs will NOT be trusted by browsers"

61
tooling/render-nginx.sh Executable file
View File

@@ -0,0 +1,61 @@
#!/usr/bin/env bash
# render-nginx.sh — render an nginx vhost template with the .env values.
#
# Substitutes $BASE_DOMAIN, $APP_DIR, $CADDY_HTTP_PORT into a template and
# prints the result to stdout, or installs it with --install (writes to
# sites-available, symlinks sites-enabled, tests, reloads nginx).
#
# Usage:
# tooling/render-nginx.sh # render caddy-front template -> stdout
# tooling/render-nginx.sh --install # render + install + reload nginx
# TEMPLATE=nginx/ulicraft.conf.tmpl tooling/render-nginx.sh # the static variant
#
# .env vars used:
# BASE_DOMAIN required
# CADDY_HTTP_PORT caddy-front template only (localhost port nginx proxies to)
# optional:
# APP_DIR host path to this repo (cert files live under APP_DIR/certs)
# — defaults to the repo root (this checkout)
# TEMPLATE template to render (default nginx/ulicraft-caddy.conf.tmpl)
# SITE_NAME installed filename (default ulicraft.conf)
set -euo pipefail
cd "$(dirname "$0")/.." # repo root
log() { printf '\n\033[1;32m==>\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33m!!\033[0m %s\n' "$*" >&2; }
die() { printf '\033[1;31mxx\033[0m %s\n' "$*" >&2; exit 1; }
[ -f .env ] || die ".env not found (copy .env.example and fill it)"
# shellcheck disable=SC1091
set -a; . ./.env; set +a
: "${BASE_DOMAIN:?BASE_DOMAIN unset in .env}"
TEMPLATE="${TEMPLATE:-nginx/ulicraft-caddy.conf.tmpl}"
[ -f "$TEMPLATE" ] || die "template not found: $TEMPLATE"
APP_DIR="${APP_DIR:-$PWD}"
SITE_NAME="${SITE_NAME:-ulicraft.conf}"
# CADDY_HTTP_PORT only matters for the caddy-front template; default 80 so the
# static template (which never references it) still renders cleanly.
export BASE_DOMAIN APP_DIR
export CADDY_HTTP_PORT="${CADDY_HTTP_PORT:-80}"
rendered="$(envsubst '$BASE_DOMAIN $APP_DIR $CADDY_HTTP_PORT' < "$TEMPLATE")"
if [ "${1:-}" != "--install" ]; then
printf '%s\n' "$rendered"
warn "dry run — pipe to a file or pass --install to deploy"
exit 0
fi
command -v nginx >/dev/null 2>&1 || die "nginx not found on PATH"
avail="/etc/nginx/sites-available/$SITE_NAME"
enabled="/etc/nginx/sites-enabled/$SITE_NAME"
log "installing $TEMPLATE -> $avail (APP_DIR=$APP_DIR, CADDY_HTTP_PORT=$CADDY_HTTP_PORT)"
printf '%s\n' "$rendered" | sudo tee "$avail" >/dev/null
sudo ln -sf "$avail" "$enabled"
sudo nginx -t
sudo systemctl reload nginx
log "done — nginx reloaded"