git / moonbite-network / deploy/setup-https.sh · raw

#!/usr/bin/env bash# Add a domain + HTTPS (Let's Encrypt) to the MoonBite Dashboard on the VPS.# Run as root AFTER setup-dashboard.sh. Requires the domain's DNS to already# point at this server's public IP.## Usage:#   DOMAIN=your.domain.tld ./setup-https.sh## Default domain uses sslip.io (a free wildcard DNS that maps# <ip>.sslip.io -> <ip> with no signup). Replace with your own domain# by exporting DOMAIN before running.set -euo pipefailDOMAIN="${DOMAIN:?export DOMAIN=your-domain.example (or <your-ip>.sslip.io) before running}"# Also cover the www host when the domain is an apex (has exactly one dot).WWW=""if [ "$(echo "$DOMAIN" | tr -cd '.' | wc -c)" = "1" ]; then    WWW="www.$DOMAIN"fiecho "=== 1/4  Install certbot ==="DEBIAN_FRONTEND=noninteractive apt-get install -y -qq certbot python3-certbot-nginx > /dev/nullecho "=== 2/4  Point nginx at the domain ==="cat > /etc/nginx/sites-available/moonbite-dashboard <<NGINXserver {    listen 80;    server_name $DOMAIN${WWW:+ $WWW};    location / {        proxy_pass http://127.0.0.1:8050;        proxy_set_header Host \$host;        proxy_set_header X-Real-IP \$remote_addr;        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto \$scheme;        proxy_read_timeout 300s;    }}NGINXnginx -t && systemctl reload nginxecho "=== 3/4  Issue certificate + enable HTTPS redirect ==="# --register-unsafely-without-email keeps this non-interactive; certbot still# installs a systemd timer that auto-renews the cert before expiry.certbot --nginx -d "$DOMAIN" ${WWW:+-d "$WWW"} \    --non-interactive --agree-tos \    --register-unsafely-without-email \    --redirectecho "=== 4/4  Open firewall for 443 ==="ufw allow 443/tcp 2>/dev/null || truenginx -t && systemctl reload nginxecho ""echo "=== DONE ==="echo "Dashboard live at: https://$DOMAIN"[ -n "$WWW" ] && echo "  (also covers https://$WWW)"