2 # Copyright (C) 2016 Ian Kelling
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
16 [[ $EUID == 0 ]] ||
exec sudo
-E "$BASH_SOURCE" "$@"
19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
21 shopt -s nullglob
# used in apache config file expansion
25 Usage: ${0##*/} [OPTIONS] [EXTRA_SETTINGS_FILE] apache2|nginx DOMAIN
26 apache/nginx config & let's encrypt
28 If using tls then it expects certbot to be installed and in PATH. Also,
29 certbot cronjob should be taken care of outside this script. In the
30 debian package, it installs a systemd timer, which I (Ian Kelling) use
31 and modify to email me on failure. You can see how I do this in my git
32 repo distro-setup, and log-quiet.
35 EXTRA_SETTINGS_FILE can be - for stdin
36 -e EMAIL Contact address for let's encrypt. Default is
37 root@\$(hostname -A|awk '{print $1}')
38 which is root@$(hostname -A|awk '{print $1}') on this host.
39 -f [ADDR:]PORT Enable proxy to [ADDR:]PORT. ADDR default is 127.0.0.1
41 -p PORT Main port to listen on, default 443. 80 implies -i.
43 -s Allow symlinks from the doucmentroot
44 -h|--help Print help and exit
46 Note: Uses GNU getopt options parsing style
51 ##### begin command line parsing ########
57 temp
=$
(getopt
-l help e
:if:p
:r
:sh
"$@") || usage
1
61 -e) email
="$2"; shift 2 ;;
62 -f) proxy
="$2"; shift 2 ;;
63 -i) ssl
=false
; shift ;;
64 -p) port
="$2"; shift 2 ;;
65 -r) root
="$2"; shift 2 ;;
66 -s) symlinkarg
=+; shift ;;
69 *) echo "$0: Internal error!" ; exit 1 ;;
74 if (( ${#@} == 3 )); then
75 read -r extra_settings t h
<<<"${@}"
82 *) echo "$0: error: expected apache2 or nginx arg"; usage
1 ;;
86 echo "$0: error: expected domain and type arg"
90 if [[ ! $root ]]; then
95 [[ $proxy == *:* ]] || proxy
=127.0.0.1:$proxy
98 if [[ ! $email ]]; then
99 email
=root@$
(hostname
-A|
awk '{print $1}')
103 ##### end command line parsing ########
105 se
=/etc
/$t/sites-enabled
106 cert_dir
=/etc
/letsencrypt
/live
/$h
109 vhost_file
=$se/$h.conf
110 redir_file
=$se/$h-redir.conf
112 if [[ $port == 80 ]]; then
114 # remove any thats hanging around
120 f
=$cert_dir/fullchain.pem
121 threedays
=259200 # in seconds
122 if [[ ! -e $f ]] ||
! openssl x509
-checkend $threedays -noout -in $f >/dev
/null
; then
123 # cerbot needs an existing virtualhost.
125 # when generating an example config, add all relevant security options:
126 # --hsts --staple-ocsp --uir --must-staple
127 certbot certonly
-n --email $email --no-self-upgrade \
128 --agree-tos --${t%2} -d $h
134 if [[ $t == apache2
]]; then
135 rm -f $se/000-default.conf
136 # note, we exepct ServerRoot of /etc/apache2
137 # apache requires exactly 1 listen directive per port (when no ip is also given),
138 # so we have to parse the config to do it programatically.
142 conf_files
=(apache2.conf
)
145 for (( i
=0; i
< ${#conf_files[@]}; i
++ )); do
147 # note: globs are expanded here.
148 conf_files
+=( $
(sed -rn "s,^\s*Include(Optional)?\s+(\S+).*,\2,p" "$f") )
149 case $
(readlink
-f "$f") in
150 $vhost_file|
$redir_file) continue ;;
152 for p
in $
(sed -rn "s,^\s*listen\s+(\S+).*,\1,Ip" "$f"); do
154 80) listen_80
=true
;;&
155 $port) listen_port
=true
;;
161 cat >$vhost_file <<EOF
162 <VirtualHost *:$port>
167 Options -Indexes ${symlinkarg}FollowSymlinks
171 if [[ $extra_settings ]]; then
172 cat -- $extra_settings >>$vhost_file
176 if [[ -e /etc
/apache
2/mods-available
/http2.load
]]; then
177 # https://httpd.apache.org/docs/2.4/mod/mod_http2.html
179 cat >>$vhost_file <<EOF
180 Protocols h2 http/1.1
184 if [[ $proxy ]]; then
185 a2enmod
-q proxy proxy_http
186 # fyi: trailing slash is important
187 # reference: https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html
188 # retry=0: https://stackoverflow.com/questions/683052/why-am-i-getting-an-apache-proxy-503-error
189 cat >>$vhost_file <<EOF
190 ProxyPass "/" "http://$proxy/" retry=0
191 ProxyPassReverse "/" "http://$proxy/"
199 common_ssl_conf
=/etc
/apache
2/common-ssl.conf
200 cat >>$vhost_file <<EOF
201 SSLCertificateFile $cert_dir/fullchain.pem
202 SSLCertificateKeyFile $cert_dir/privkey.pem
203 Include $common_ssl_conf
204 # From cerbot generated config example, taken 4/2017,
205 # should be rechecked once a year or so.
206 Header always set Strict-Transport-Security "max-age=31536000"
208 Header always set Content-Security-Policy upgrade-insecure-requests
211 echo "$0: creating $redir_file"
212 cat >$redir_file <<EOF
215 ServerAdmin webmaster@localhost
216 DocumentRoot /var/www/html
218 ErrorLog \${APACHE_LOG_DIR}/error.log
219 CustomLog \${APACHE_LOG_DIR}/access.log vhost_time_combined
222 RewriteCond %{SERVER_NAME} =$h
223 RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
226 if ! $listen_80; then
227 cat >>$redir_file <<'EOF'
232 # this is a copy of a file certbot, see below.
233 echo "$0: creating $common_ssl_conf"
234 cat >$common_ssl_conf <<'EOF'
235 # This file contains important security parameters. If you modify this file
236 # manually, Certbot will be unable to automatically provide future security
237 # updates. Instead, Certbot will print and log an error message with a path to
238 # the up-to-date file that you will need to refer to when manually updating
243 # Intermediate configuration, tweak to your needs
244 SSLProtocol all -SSLv2 -SSLv3
245 SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
246 SSLHonorCipherOrder on
249 SSLOptions +StrictRequire
251 # Add vhost name to log entries:
252 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
253 LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
255 #CustomLog /var/log/apache2/access.log vhost_combined
257 #ErrorLog /var/log/apache2/error.log
259 # Always ensure Cookies have "Secure" set (JAH 2012/1)
260 #Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"
263 upstream
=https
://raw.githubusercontent.com
/certbot
/certbot
/master
/certbot-apache
/certbot_apache
/options-ssl-apache.conf
264 if ! diff -u <(wget
-q -O - $upstream) $common_ssl_conf; then
271 upstream ssl settings differ from the snapshot we have taken!!!
272 We diffed with this command:
273 diff -c <(wget -q -O - $upstream) $common_ssl_conf
274 Update this script to take care this warning!!!!!
280 cat >>$vhost_file <<'EOF'
281 ErrorLog ${APACHE_LOG_DIR}/error.log
282 CustomLog ${APACHE_LOG_DIR}/access.log vhost_time_combined
286 if ! $listen_port; then
287 # reference: https://httpd.apache.org/docs/2.4/mod/mpm_common.html#listen
288 cat >>$vhost_file <<EOF
289 listen ${port}${https_arg}
294 a2enmod
-q ssl rewrite
# rewrite needed for httpredir
295 service apache2 restart
297 # I rarely look at how much traffic I get, so let's keep that info
298 # around for longer than the default of 2 weeks.
299 sed -ri --follow-symlinks 's/^(\s*rotate\s).*/\1 365/' /etc
/logrotate.d
/apache2
300 fi ###### end if apache
302 if [[ $t == nginx
]]; then
303 common_ssl_conf
=/etc
/nginx
/common-ssl.conf
307 [[ -e dh2048.pem
]] || openssl dhparam
-out dh2048.pem
2048
311 if nginx
-V |
& grep -- '--with-http_v2_module\b' &>/dev
/null
; then
312 # fun fact: nginx can be configured to do http2 without ssl.
317 cat >$common_ssl_conf <<'EOF'
318 # let's encrypt gives us a bad nginx config, so use this:
319 # https://mozilla.github.io/server-side-tls/ssl-config-generator/
320 # using modern config. last checked 2017/4/22
321 ssl_session_timeout 1d;
322 ssl_session_cache shared:SSL:50m;
323 ssl_session_tickets off;
325 # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
326 ssl_dhparam /etc/nginx/dh2048.pem;
328 # modern configuration. tweak to your needs.
329 ssl_protocols TLSv1.2;
330 ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
331 ssl_prefer_server_ciphers on;
333 # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
334 add_header Strict-Transport-Security max-age=15768000;
337 # fetch OCSP records from URL in ssl_certificate and cache them
339 ssl_stapling_verify on;
341 ## verify chain of trust of OCSP response using Root CA and Intermediate certs
342 # ian: commented out, unnecessary for le certs or my nginx ver.
343 #ssl_trusted_certificate $cert_dir/fullchain.pem;;
345 # ian: commented out, our local dns is expected to work fine.
346 #resolver <IP DNS resolver>;
348 cat >$vhost_file <<EOF
350 server_name $h www.$h;
352 listen $port $ssl_arg;
353 listen [::]:$port $ssl_arg;
359 cat >>$vhost_file <<EOF
360 ssl_certificate $cert_dir/fullchain.pem;
361 ssl_certificate_key $cert_dir/privkey.pem;
362 include $common_ssl_conf;
365 cat >$redir_file <<EOF
367 server_name $h www.$h;
368 listen 80 $http2_arg;
369 listen [::]:80 $http2_arg;
370 return 301 https://$server_name$request_uri;
375 if [[ $extra_settings ]]; then
376 cat $extra_settings >>$vhost_file
379 if [[ $proxy ]]; then
380 cat >>$vhost_file <<EOF
382 proxy_set_header Host \$host;
383 proxy_set_header X-Real-IP \$remote_addr;
384 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
385 proxy_set_header X-Forwarded-Ssl on;
386 proxy_set_header X-Forwarded-Port $port;
387 proxy_pass http://$proxy;
392 cat >>$vhost_file <<EOF
397 service nginx restart
399 fi ####### end if nginx
401 cat >/etc
/apache
2/conf-enabled
/local-custom.conf
<<'EOF'
402 # vhost_combined with %D (request time in microseconds)
403 # this file is just a convenient place to drop it.
404 LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" vhost_time_combined
405 SSLStaplingCache shmcb:/var/run/apache2/stapling_cache(128000)