Configure NGINX SSL termination with Certbot for Let's Encrypt certificates

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Configuration
DOMAIN=""
EMAIL=""
WEBROOT="/var/www/html"

# Usage function
usage() {
    echo "Usage: $0 -d domain.com -e email@domain.com"
    echo "  -d: Domain name (required)"
    echo "  -e: Email for Let's Encrypt (required)"
    echo "  -h: Show this help"
    exit 1
}

# Parse command line arguments
while getopts "d:e:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        e) EMAIL="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

# Validate required arguments
if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
    echo -e "${RED}Error: Domain and email are required${NC}"
    usage
fi

# Validate email format
if [[ ! "$EMAIL" =~ ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]; then
    echo -e "${RED}Error: Invalid email format${NC}"
    exit 1
fi

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}Error: This script must be run as root or with sudo${NC}"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            FIREWALL_CMD="ufw"
            NGINX_SITES_DIR="/etc/nginx/sites-available"
            NGINX_ENABLED_DIR="/etc/nginx/sites-enabled"
            USE_SITES_ENABLED=true
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            FIREWALL_CMD="firewall-cmd"
            NGINX_SITES_DIR="/etc/nginx/conf.d"
            USE_SITES_ENABLED=false
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            FIREWALL_CMD="firewall-cmd"
            NGINX_SITES_DIR="/etc/nginx/conf.d"
            USE_SITES_ENABLED=false
            ;;
        *) 
            echo -e "${RED}Error: Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Error: Cannot detect distribution${NC}"
    exit 1
fi

# Cleanup function for rollback
cleanup() {
    echo -e "${YELLOW}Cleaning up...${NC}"
    systemctl stop nginx 2>/dev/null || true
    if [[ "$USE_SITES_ENABLED" == true ]]; then
        rm -f "$NGINX_ENABLED_DIR/$DOMAIN" 2>/dev/null || true
    fi
    rm -f "$NGINX_SITES_DIR/$DOMAIN.conf" 2>/dev/null || true
}

# Set trap for cleanup on error
trap cleanup ERR

echo -e "${GREEN}=== NGINX SSL Setup with Let's Encrypt ===${NC}"
echo "Domain: $DOMAIN"
echo "Distribution: $PRETTY_NAME"

# Step 1: Update system packages
echo -e "${GREEN}[1/9] Updating system packages...${NC}"
$PKG_UPDATE

# Step 2: Install NGINX
echo -e "${GREEN}[2/9] Installing NGINX...${NC}"
$PKG_INSTALL nginx

# Step 3: Install Certbot
echo -e "${GREEN}[3/9] Installing Certbot...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL certbot python3-certbot-nginx
else
    $PKG_INSTALL certbot python3-certbot-nginx
fi

# Step 4: Enable and start NGINX
echo -e "${GREEN}[4/9] Enabling and starting NGINX...${NC}"
systemctl enable nginx
systemctl start nginx

# Step 5: Configure firewall
echo -e "${GREEN}[5/9] Configuring firewall...${NC}"
if [[ "$FIREWALL_CMD" == "ufw" ]]; then
    ufw --force enable
    ufw allow 'Nginx Full'
    ufw reload
else
    systemctl enable firewalld
    systemctl start firewalld
    firewall-cmd --permanent --add-service=http
    firewall-cmd --permanent --add-service=https
    firewall-cmd --reload
fi

# Step 6: Create webroot directory
echo -e "${GREEN}[6/9] Creating webroot directory...${NC}"
mkdir -p "$WEBROOT"
chown -R nginx:nginx "$WEBROOT" 2>/dev/null || chown -R www-data:www-data "$WEBROOT" 2>/dev/null || true
chmod 755 "$WEBROOT"

# Step 7: Create basic NGINX configuration
echo -e "${GREEN}[7/9] Creating NGINX configuration...${NC}"
if [[ "$USE_SITES_ENABLED" == true ]]; then
    CONFIG_FILE="$NGINX_SITES_DIR/$DOMAIN"
else
    CONFIG_FILE="$NGINX_SITES_DIR/$DOMAIN.conf"
fi

cat > "$CONFIG_FILE" << EOF
server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;
    
    root $WEBROOT;
    index index.html index.htm;
    
    location / {
        try_files \$uri \$uri/ =404;
    }
    
    # Let's Encrypt challenge location
    location /.well-known/acme-challenge/ {
        root $WEBROOT;
    }
}
EOF

# Enable site if using sites-enabled structure
if [[ "$USE_SITES_ENABLED" == true ]]; then
    ln -sf "$CONFIG_FILE" "$NGINX_ENABLED_DIR/$DOMAIN"
fi

# Test NGINX configuration
nginx -t
systemctl reload nginx

# Create a simple index page
echo "<h1>Welcome to $DOMAIN</h1>" > "$WEBROOT/index.html"
chown nginx:nginx "$WEBROOT/index.html" 2>/dev/null || chown www-data:www-data "$WEBROOT/index.html" 2>/dev/null || true
chmod 644 "$WEBROOT/index.html"

# Step 8: Obtain SSL certificate
echo -e "${GREEN}[8/9] Obtaining SSL certificate...${NC}"
certbot --nginx -d "$DOMAIN" -d "www.$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive

# Step 9: Enhanced SSL configuration with security headers
echo -e "${GREEN}[9/9] Applying enhanced SSL configuration...${NC}"
cat > "$CONFIG_FILE" << EOF
server {
    listen 443 ssl http2;
    server_name $DOMAIN www.$DOMAIN;
    
    ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;" always;
    
    root $WEBROOT;
    index index.html index.htm;
    
    location / {
        try_files \$uri \$uri/ =404;
    }
}

server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;
    return 301 https://\$server_name\$request_uri;
}
EOF

# Test and reload NGINX
nginx -t
systemctl reload nginx

# Verification
echo -e "${GREEN}=== Verification ===${NC}"
echo "✓ NGINX status:"
systemctl status nginx --no-pager -l

echo "✓ SSL certificate status:"
certbot certificates

echo "✓ Testing HTTPS connection:"
if curl -s -I "https://$DOMAIN" | head -1 | grep -q "200\|301\|302"; then
    echo -e "${GREEN}✓ HTTPS is working${NC}"
else
    echo -e "${YELLOW}⚠ HTTPS test inconclusive${NC}"
fi

echo -e "${GREEN}=== Setup Complete ===${NC}"
echo "Your NGINX server with SSL is now configured!"
echo "Domain: https://$DOMAIN"
echo "Certificate auto-renewal is enabled via systemd timer"

# Remove error trap
trap - ERR