88 lines
2.7 KiB
Bash
88 lines
2.7 KiB
Bash
#!/bin/bash
|
|
# ==============================================================================
|
|
# OnEver Drive — SSL / HTTPS Configuration for Debian 12 / 13 LXC
|
|
# Supports Let's Encrypt (Certbot) or Local High-Entropy Self-Signed Cert
|
|
# ==============================================================================
|
|
|
|
set -e
|
|
|
|
DOMAIN="$1"
|
|
SSL_DIR="/etc/ssl/onever-drive"
|
|
|
|
if [ -z "$DOMAIN" ]; then
|
|
echo "Uso:"
|
|
echo " $0 <midominio.com> # Para Certbot / Let's Encrypt"
|
|
echo " $0 self-signed # Para certificado autofirmado LAN / Intranet"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$DOMAIN" != "self-signed" ]; then
|
|
echo "[*] Instalando Certbot para Let's Encrypt..."
|
|
apt-get update && apt-get install -y certbot python3-certbot-nginx
|
|
certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos -m "admin@$DOMAIN"
|
|
echo "[+] Certificado Let's Encrypt configurado para $DOMAIN"
|
|
else
|
|
echo "[*] Generando certificado SSL autofirmado de 4096 bits para Intranet..."
|
|
mkdir -p "$SSL_DIR"
|
|
openssl req -x509 -nodes -days 3650 -newkey rsa:4096 \
|
|
-keyout "$SSL_DIR/server.key" \
|
|
-out "$SSL_DIR/server.crt" \
|
|
-subj "/C=ES/ST=State/L=City/O=OnEver/CN=onever-drive.local"
|
|
|
|
cat <<'EOF' > /etc/nginx/sites-available/onever-drive
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name _;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2 default_server;
|
|
listen [::]:443 ssl http2 default_server;
|
|
server_name _;
|
|
|
|
ssl_certificate /etc/ssl/onever-drive/server.crt;
|
|
ssl_certificate_key /etc/ssl/onever-drive/server.key;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
|
|
root /var/www/onever-drive-web;
|
|
index index.html;
|
|
|
|
client_max_body_size 0;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
location /api/ {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
}
|
|
|
|
location /ws/ {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "Upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_read_timeout 86400s;
|
|
proxy_send_timeout 86400s;
|
|
}
|
|
}
|
|
EOF
|
|
nginx -t
|
|
systemctl restart nginx
|
|
echo "[+] SSL autofirmado activado en puerto 443 (HTTPS)"
|
|
fi
|