예제 소스

idc_expand_mariago_ssl.sh

#!/usr/bin/env bash
# IDC(ethtrade)에서 실행: mariago.kr 을 Let's Encrypt 인증서·nginx에 추가
#
#   scp scripts/idc_expand_mariago_ssl.sh ethtrade:~/
#   ssh ethtrade
#   chmod +x ~/idc_expand_mariago_ssl.sh
#   sudo ./idc_expand_mariago_ssl.sh
#
# 사전 조건:
#   - mariago.kr A 레코드 → IDC IP (********)
#   - (선택) www.mariago.kr 도 같은 IP면 함께 추가

set -euo pipefail

CONF=/etc/nginx/sites-enabled/baduk.mariago.kr.conf
BACKUP="/etc/nginx/sites-enabled/baduk.mariago.kr.conf.bak.$(date +%Y%m%d%H%M%S)"

if [[ "$(id -u)" -ne 0 ]]; then
  echo "sudo 로 실행해 주세요." >&2
  exit 1
fi

if [[ ! -f "$CONF" ]]; then
  echo "nginx 설정 없음: $CONF" >&2
  exit 1
fi

DOMAINS=(baduk.mariago.kr go.mariago.kr mariago.kr)
if dig +short www.mariago.kr A | grep -q .; then
  DOMAINS+=(www.mariago.kr)
  echo "www.mariago.kr DNS 확인 → 인증서에 포함"
else
  echo "www.mariago.kr DNS 없음 → mariago.kr 만 추가 (나중에 www CNAME 추가 후 재실행 가능)"
fi

SERVER_NAMES="${DOMAINS[*]}"

cp -a "$CONF" "$BACKUP"
echo "백업: $BACKUP"

# server_name 두 곳(443/80) 갱신
python3 - <<'PY' "$CONF" "$SERVER_NAMES"
import re, sys
path, names = sys.argv[1], sys.argv[2].split()
text = open(path, encoding="utf-8").read()
new_names = " ".join(names)
text = re.sub(
    r"server_name\s+baduk\.mariago\.kr\s+go\.mariago\.kr\s*;",
    f"server_name {new_names};",
    text,
)
open(path, "w", encoding="utf-8").write(text)
PY

# HTTP → HTTPS 리다이렉트 (mariago.kr)
if ! grep -q 'if ($host = mariago.kr)' "$CONF"; then
  sed -i '/if ($host = go.mariago.kr)/a\
\
    if ($host = mariago.kr) {\
        return 301 https://$host$request_uri;\
    } # managed by Certbot' "$CONF"
fi

nginx -t
systemctl reload nginx

CERT_ARGS=()
for d in "${DOMAINS[@]}"; do
  CERT_ARGS+=(-d "$d")
done

echo "인증서 확장: ${DOMAINS[*]}"
certbot certonly --nginx "${CERT_ARGS[@]}" --expand --non-interactive --agree-tos --register-unsafely-without-email || \
  certbot certonly --webroot -w /var/www/html "${CERT_ARGS[@]}" --expand --non-interactive --agree-tos --register-unsafely-without-email

nginx -t
systemctl reload nginx

echo ""
echo "== 확인 =="
certbot certificates | sed -n '/Certificate Name: go.mariago.kr/,/^$/p'
echo ""
openssl s_client -connect mariago.kr:443 -servername mariago.kr </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -ext subjectAltName

echo ""
echo "완료. 브라우저에서 https://mariago.kr 열어 경고 없는지 확인하세요."