60 lines
1.9 KiB
Bash
60 lines
1.9 KiB
Bash
#!/usr/bin/env bash
|
||
#
|
||
# 启用 HTTPS 配置：只把"已经拿到证书"的域名对应的 server 块
|
||
# 从 ssl.d.available/ 复制到 ssl.d/（nginx 挂载并 include 的目录），
|
||
# 然后校验配置并优雅重载 nginx。
|
||
#
|
||
# 冷启动时 ssl.d/ 为空，nginx 只加载 conf.d/00-http.conf（不引用证书），
|
||
# 因此可以在没有证书的情况下正常启动并提供 80 端口 —— 这是打破
|
||
# "先有证书还是先有 nginx" 死锁的关键。
|
||
#
|
||
set -euo pipefail
|
||
|
||
# cron / 非登录 shell 下 PATH 极简，显式补齐
|
||
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin${PATH:+:$PATH}"
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
AVAILABLE="$SCRIPT_DIR/ssl.d.available"
|
||
ENABLED="$SCRIPT_DIR/ssl.d"
|
||
DOMAINS="${DOMAINS:-fastgpt.stonelan.cn gitea.stonelan.cn image.stonelan.cn registry.stonelan.cn www.stonelan.cn}"
|
||
|
||
mkdir -p "$ENABLED"
|
||
cd "$SCRIPT_DIR"
|
||
|
||
copied=()
|
||
for d in $DOMAINS; do
|
||
conf="$AVAILABLE/$d.conf"
|
||
if [ ! -f "$conf" ]; then
|
||
echo "跳过 $d：缺少 $conf"
|
||
continue
|
||
fi
|
||
|
||
# nginx 容器以只读方式挂载了 certbot-certs 卷，用它判断证书是否就绪
|
||
if ! docker compose exec -T nginx-proxy test -f "/etc/letsencrypt/live/$d/fullchain.pem" 2>/dev/null; then
|
||
echo "跳过 $d：证书不存在（/etc/letsencrypt/live/$d/fullchain.pem）"
|
||
continue
|
||
fi
|
||
|
||
if ! cmp -s "$conf" "$ENABLED/$d.conf" 2>/dev/null; then
|
||
cp "$conf" "$ENABLED/$d.conf"
|
||
copied+=("$ENABLED/$d.conf")
|
||
echo "已启用 $d"
|
||
fi
|
||
done
|
||
|
||
if [ "${#copied[@]}" -eq 0 ]; then
|
||
echo "没有需要变更的 HTTPS 配置"
|
||
exit 0
|
||
fi
|
||
|
||
if out=$(docker compose exec -T nginx-proxy nginx -t 2>&1); then
|
||
echo "$out" | sed 's/^/ /'
|
||
docker kill -s HUP nginx-proxy
|
||
echo "nginx 已重载，HTTPS 配置生效"
|
||
else
|
||
echo "$out" | sed 's/^/ /'
|
||
echo "nginx 配置校验失败，回滚本次变更" >&2
|
||
rm -f "${copied[@]}"
|
||
exit 1
|
||
fi
|