setup-proxy-only.sh

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'

function check_root() {
	if [ ! "$(whoami)" = "root" ]
	then
		echo "Root privilege required to run this script. Rerun as root."
		exit 1
	fi
}
check_root

if [ -z "$1" ] || [ -z "$2" ]
then
	echo "Usage:   setup-proxy-only <hostname> <proxy destination>"
	echo "Example: setup-proxy-only nodejs.example.com https://127.0.0.1:12345"
	exit
fi


function set_available_php_version_from_runtime {
	# 1. Get first line of version text ("PHP 8.2.7 (cli) (built: Jun  9 2023 19:37:27) (NTS)")
	# 2. Get the full version number ("8.2.7")
	# 3. Strip everything after the second dot
	PHP_VERSION=$(php --version | head -n 1 | cut -d ' ' -f 2 | cut -d '.' -f 1,2)
	#PHP_VERSION="8.2"
}
set_available_php_version_from_runtime


# certbot
echo "Fetching letsencrypt.org certificate for $1"
certbot certonly --rsa-key-size 4096 --nginx -d "$1"


# nginx config
cat > "/etc/nginx/sites-available/$1.conf" <<END
server{
	server_name $2;
	server_tokens off; # We've set this in /etc/nginx/nginx.conf already
	listen 80;
	listen [::]:80;

	# Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
	return 301 https://\$host\$request_uri;
}

server {
	server_name $2;
	server_tokens off; # We've set this in /etc/nginx/nginx.conf already
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	include snippets/headers_defaults;

	location / {
		proxy_set_header X-Real-IP \$remote_addr;
		proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
		proxy_set_header Host \$http_host;
		proxy_set_header X-NginX-Proxy true;

		proxy_pass $2;
		proxy_redirect off;

		proxy_http_version 1.1;
		proxy_set_header Upgrade \$http_upgrade;
		proxy_set_header Connection "upgrade";
    }

	# TLS config
	# Certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
	ssl_certificate         /etc/letsencrypt/live/$2/fullchain.pem;
	ssl_certificate_key     /etc/letsencrypt/live/$2/privkey.pem;
	ssl_trusted_certificate /etc/letsencrypt/live/$2/chain.pem;

	include snippets/tls_defaults;

	access_log /var/log/nginx/$2-access.log;
	error_log  /var/log/nginx/$2-error.log;
}
END

ln -s "/etc/nginx/sites-available/$1.conf" "/etc/nginx/sites-enabled/$1.conf"


service nginx reload
service php${PHP_VERSION}-fpm reload


echo "Virtual host created. Proxying $1 to $2."