66 lines
2.0 KiB
Bash
66 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
# 为 api.lingshivip.cn 申请 DNS 证书并启用 HTTPS
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
SSL_DIR="/etc/nginx/ssl/api.lingshivip.cn"
|
|
NGINX_CONF="/etc/nginx/conf.d/dukang-lingshivip.conf"
|
|
|
|
mkdir -p "$SSL_DIR" /var/www/certbot/.well-known/acme-challenge
|
|
|
|
echo "==> 1. 发起 DNS 验证（需先在 DNSPod 添加 TXT 记录）"
|
|
~/.acme.sh/acme.sh --issue -d api.lingshivip.cn --dns \
|
|
--yes-I-know-dns-manual-mode-enough-go-ahead-please \
|
|
--server letsencrypt || true
|
|
|
|
echo ""
|
|
echo "请在 DNSPod 添加上述 TXT 记录后，执行："
|
|
echo " $0 --renew"
|
|
echo ""
|
|
|
|
if [[ "${1:-}" != "--renew" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
echo "==> 2. 继续 DNS 验证并签发证书"
|
|
~/.acme.sh/acme.sh --renew -d api.lingshivip.cn --yes-I-know-dns-manual-mode-enough-go-ahead-please
|
|
|
|
echo "==> 3. 安装证书到 nginx 目录"
|
|
install -m 644 ~/.acme.sh/api.lingshivip.cn_ecc/fullchain.cer "$SSL_DIR/fullchain.cer"
|
|
install -m 600 ~/.acme.sh/api.lingshivip.cn_ecc/api.lingshivip.cn.key "$SSL_DIR/api.lingshivip.cn.key"
|
|
|
|
echo "==> 4. 更新 nginx 并重载"
|
|
cp "$SCRIPT_DIR/nginx-lingshivip.conf" "$NGINX_CONF"
|
|
python3 - <<'PY'
|
|
from pathlib import Path
|
|
p = Path("/etc/nginx/conf.d/dukang-lingshivip.conf")
|
|
text = p.read_text()
|
|
old = """ location / {
|
|
proxy_pass http://127.0.0.1:8090;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Connection "";
|
|
}
|
|
}
|
|
|
|
# API 独立域名 HTTPS"""
|
|
new = """ location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
# API 独立域名 HTTPS"""
|
|
if old not in text:
|
|
raise SystemExit("nginx api http redirect patch failed")
|
|
p.write_text(text.replace(old, new, 1))
|
|
PY
|
|
|
|
nginx -t
|
|
systemctl reload nginx
|
|
|
|
echo "==> 5. 健康检查"
|
|
curl -sf -o /dev/null -w "api-https:%{http_code}\n" https://api.lingshivip.cn/api/v1/health
|
|
echo "==> api.lingshivip.cn HTTPS 已启用"
|