freedakgmail
116 lines
3.5 KiB
Bash
116 lines
3.5 KiB
Bash
#!/bin/bash
|
|
# SSL证书申请脚本 - stock.allbyai.cn
|
|
# 使用 acme.sh + DNS 验证方式申请免费SSL证书
|
|
# 适用于 DNSPod 有 Web 防护导致 HTTP 验证失败的情况
|
|
# 在服务器上执行此脚本
|
|
|
|
set -e
|
|
|
|
DOMAIN="stock.allbyai.cn"
|
|
SSL_DIR="/etc/nginx/ssl"
|
|
ACME_HOME="/home/ubuntu/.acme.sh"
|
|
|
|
echo "=========================================="
|
|
echo "为 ${DOMAIN} 完成SSL证书安装"
|
|
echo "=========================================="
|
|
|
|
# 检查 acme.sh 是否已安装
|
|
if [ ! -f "${ACME_HOME}/acme.sh" ]; then
|
|
echo "错误: acme.sh 未安装，请先运行初始化"
|
|
exit 1
|
|
fi
|
|
|
|
# 检查 DNS TXT 记录
|
|
echo "[1/4] 检查 DNS TXT 记录..."
|
|
TXT_RECORD=$(dig +short TXT _acme-challenge.stock.allbyai.cn 2>/dev/null || echo "")
|
|
if [ -z "$TXT_RECORD" ]; then
|
|
echo ""
|
|
echo "错误: DNS TXT 记录未找到！"
|
|
echo ""
|
|
echo "请在 DNSPod 添加以下 TXT 记录:"
|
|
echo " 主机记录: _acme-challenge.stock"
|
|
echo " 记录值: cM9lSA4-uKk-yjrvA38HYtmA1h7E3DzgIXVJq8IsSNo"
|
|
echo ""
|
|
echo "添加后等待 1-2 分钟，然后重新运行此脚本"
|
|
exit 1
|
|
fi
|
|
echo "DNS TXT 记录已找到: $TXT_RECORD"
|
|
|
|
# 创建 SSL 目录
|
|
echo "[2/4] 创建 SSL 目录..."
|
|
mkdir -p ${SSL_DIR}
|
|
|
|
# 完成证书申请
|
|
echo "[3/4] 完成证书申请..."
|
|
${ACME_HOME}/acme.sh --renew -d ${DOMAIN} --yes-I-know-dns-manual-mode-enough-go-ahead-please
|
|
|
|
# 安装证书
|
|
echo "[4/4] 安装证书到 Nginx..."
|
|
${ACME_HOME}/acme.sh --install-cert -d ${DOMAIN} \
|
|
--key-file ${SSL_DIR}/${DOMAIN}.key \
|
|
--fullchain-file ${SSL_DIR}/${DOMAIN}.crt \
|
|
--reloadcmd "systemctl reload nginx"
|
|
|
|
# 更新 Nginx 配置
|
|
echo "[5/5] 更新 Nginx 配置..."
|
|
cat > /etc/nginx/sites-available/${DOMAIN} << 'NGINX_CONF'
|
|
# Nginx配置 - stock.allbyai.cn (HTTPS)
|
|
server {
|
|
listen 80;
|
|
server_name stock.allbyai.cn;
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name stock.allbyai.cn;
|
|
|
|
ssl_certificate /etc/nginx/ssl/stock.allbyai.cn.crt;
|
|
ssl_certificate_key /etc/nginx/ssl/stock.allbyai.cn.key;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
access_log /var/log/nginx/stock.allbyai.cn.access.log;
|
|
error_log /var/log/nginx/stock.allbyai.cn.error.log;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:3333;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_cache_bypass $http_upgrade;
|
|
proxy_read_timeout 300s;
|
|
proxy_connect_timeout 75s;
|
|
}
|
|
|
|
location /static/ {
|
|
alias /opt/stock-app/static/;
|
|
expires 7d;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
}
|
|
NGINX_CONF
|
|
|
|
# 重载 Nginx
|
|
nginx -t && systemctl reload nginx
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "SSL证书安装完成！"
|
|
echo ""
|
|
echo "访问地址: https://${DOMAIN}"
|
|
echo ""
|
|
echo "证书信息:"
|
|
echo " - 证书路径: ${SSL_DIR}/${DOMAIN}.crt"
|
|
echo " - 密钥路径: ${SSL_DIR}/${DOMAIN}.key"
|
|
echo " - 有效期: 90天"
|
|
echo " - 自动续期: 已配置 (acme.sh cron)"
|
|
echo ""
|
|
echo "手动续期命令: ${ACME_HOME}/acme.sh --renew -d ${DOMAIN} --force"
|
|
echo "=========================================="
|