Implement NGINX Plus active health checks for enterprise environments

#!/usr/bin/env bash
set -euo pipefail

# NGINX Plus Active Health Checks Installation Script
# Supports Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, RHEL

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Variables
DOMAIN=${1:-"example.com"}
API_DOMAIN=${2:-"api.example.com"}
BACKEND_IPS=${3:-"192.168.1.10,192.168.1.11,192.168.1.12"}

usage() {
    echo "Usage: $0 [domain] [api_domain] [backend_ips]"
    echo "Example: $0 mysite.com api.mysite.com 10.0.1.10,10.0.1.11,10.0.1.12"
    exit 1
}

error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
}

warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

cleanup() {
    if [[ ${BACKUP_DIR:-} ]]; then
        warning "Failure detected. Backup files available in $BACKUP_DIR"
    fi
}

trap cleanup ERR

# Validate arguments
if [[ $# -gt 3 ]]; then
    usage
fi

# Check root privileges
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
    exit 1
fi

echo "[1/8] Detecting operating system..."

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            NGINX_CONFIG_DIR="/etc/nginx"
            SITES_DIR="/etc/nginx/sites-available"
            SITES_ENABLED="/etc/nginx/sites-enabled"
            USE_SITES=true
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf check-update || true"
            NGINX_CONFIG_DIR="/etc/nginx"
            SITES_DIR="/etc/nginx/conf.d"
            USE_SITES=false
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf check-update || true"
            NGINX_CONFIG_DIR="/etc/nginx"
            SITES_DIR="/etc/nginx/conf.d"
            USE_SITES=false
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum check-update || true"
            NGINX_CONFIG_DIR="/etc/nginx"
            SITES_DIR="/etc/nginx/conf.d"
            USE_SITES=false
            ;;
        *)
            error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    error "Cannot detect operating system"
    exit 1
fi

success "Detected $PRETTY_NAME"

echo "[2/8] Installing dependencies..."
$PKG_UPDATE
$PKG_INSTALL wget curl gnupg2

echo "[3/8] Setting up NGINX Plus repository..."

# Create backup directory
BACKUP_DIR="/tmp/nginx-plus-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR"

# Backup existing nginx config if present
if [[ -d "$NGINX_CONFIG_DIR" ]]; then
    cp -r "$NGINX_CONFIG_DIR" "$BACKUP_DIR/"
fi

# Download NGINX signing key
wget -qO /tmp/nginx_signing.key https://nginx.org/keys/nginx_signing.key

if [[ "$PKG_MGR" == "apt" ]]; then
    apt-key add /tmp/nginx_signing.key
    echo "deb https://plus-pkgs.nginx.com/$ID $(lsb_release -cs) nginx-plus" > /etc/apt/sources.list.d/nginx-plus.list
    $PKG_UPDATE
else
    rpm --import /tmp/nginx_signing.key
    cat > /etc/yum.repos.d/nginx-plus.repo << EOF
[nginx-plus]
name=nginx-plus repo
baseurl=https://plus-pkgs.nginx.com/centos/\$releasever/\$basearch/
gpgcheck=1
enabled=1
EOF
fi

echo "[4/8] Installing NGINX Plus..."
$PKG_INSTALL nginx-plus

echo "[5/8] Configuring upstream servers..."

# Create upstream configuration
cat > "${NGINX_CONFIG_DIR}/conf.d/upstream.conf" << EOF
upstream backend {
    zone backend 64k;
EOF

IFS=',' read -ra IPS <<< "$BACKEND_IPS"
for ip in "${IPS[@]}"; do
    echo "    server ${ip}:80 max_fails=3 fail_timeout=30s;" >> "${NGINX_CONFIG_DIR}/conf.d/upstream.conf"
done

cat >> "${NGINX_CONFIG_DIR}/conf.d/upstream.conf" << EOF
}

upstream api_servers {
    zone api_backend 128k;
EOF

for ip in "${IPS[@]}"; do
    echo "    server ${ip}:8080 slow_start=30s;" >> "${NGINX_CONFIG_DIR}/conf.d/upstream.conf"
done

cat >> "${NGINX_CONFIG_DIR}/conf.d/upstream.conf" << EOF
}

match server_ok {
    status 200;
    header Content-Type ~ "application/json";
    body ~ '"status":"ok"';
}

match api_healthy {
    status 200-299;
    header X-Health-Status = "healthy";
    body !~ "error|maintenance";
}
EOF

echo "[6/8] Configuring virtual hosts..."

# Main site configuration
if [[ "$USE_SITES" == true ]]; then
    MAIN_CONFIG="${SITES_DIR}/${DOMAIN}"
else
    MAIN_CONFIG="${SITES_DIR}/${DOMAIN}.conf"
fi

cat > "$MAIN_CONFIG" << EOF
server {
    listen 80;
    server_name $DOMAIN;
    
    location / {
        proxy_pass http://backend;
        health_check interval=5s fails=3 passes=2 uri=/health match=server_ok;
        
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        
        proxy_connect_timeout 3s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }
}
EOF

# API site configuration
if [[ "$USE_SITES" == true ]]; then
    API_CONFIG="${SITES_DIR}/${API_DOMAIN}"
else
    API_CONFIG="${SITES_DIR}/${API_DOMAIN}.conf"
fi

cat > "$API_CONFIG" << EOF
server {
    listen 80;
    server_name $API_DOMAIN;
    
    location /api/ {
        proxy_pass http://api_servers;
        health_check interval=10s fails=2 passes=3 uri=/api/health match=api_healthy;
        health_check_timeout 5s;
        
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        
        proxy_connect_timeout 3s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
    }
}
EOF

# Dashboard configuration
cat > "${NGINX_CONFIG_DIR}/conf.d/dashboard.conf" << EOF
server {
    listen 8080;
    server_name localhost;
    
    # Restrict access to dashboard
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;
    
    location /api {
        api write=on;
        access_log off;
    }
    
    location = /dashboard.html {
        root /usr/share/nginx/html;
    }
    
    location /swagger-ui {
        root /usr/share/nginx/html;
    }
}
EOF

# Enable sites if using sites-available
if [[ "$USE_SITES" == true ]]; then
    ln -sf "${SITES_DIR}/${DOMAIN}" "${SITES_ENABLED}/"
    ln -sf "${SITES_DIR}/${API_DOMAIN}" "${SITES_ENABLED}/"
    # Remove default site
    rm -f "${SITES_ENABLED}/default"
fi

echo "[7/8] Setting permissions and enabling service..."

# Set proper permissions
chown -R root:root "$NGINX_CONFIG_DIR"
find "$NGINX_CONFIG_DIR" -type d -exec chmod 755 {} \;
find "$NGINX_CONFIG_DIR" -type f -exec chmod 644 {} \;

# Test configuration
nginx -t

# Configure firewall
if command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=http
    firewall-cmd --permanent --add-port=8080/tcp
    firewall-cmd --reload
elif command -v ufw >/dev/null 2>&1; then
    ufw allow 80/tcp
    ufw allow 8080/tcp
fi

# Enable and start NGINX Plus
systemctl enable nginx
systemctl restart nginx

echo "[8/8] Verifying installation..."

# Wait for service to start
sleep 2

if systemctl is-active --quiet nginx; then
    success "NGINX Plus is running"
else
    error "NGINX Plus failed to start"
    exit 1
fi

# Test configuration endpoints
if curl -s http://localhost:8080/api/nginx >/dev/null; then
    success "NGINX Plus API is accessible"
else
    warning "NGINX Plus API may not be accessible"
fi

success "NGINX Plus with active health checks installed successfully!"
echo
echo "Configuration details:"
echo "- Main site: http://$DOMAIN"
echo "- API site: http://$API_DOMAIN"
echo "- Dashboard: http://localhost:8080/dashboard.html"
echo "- API endpoint: http://localhost:8080/api"
echo
echo "Backend servers configured:"
for ip in "${IPS[@]}"; do
    echo "  - ${ip}:80 (web)"
    echo "  - ${ip}:8080 (api)"
done
echo
echo "Health check endpoints expected:"
echo "  - GET /health (returns JSON with status:ok)"
echo "  - GET /api/health (returns X-Health-Status: healthy header)"