Install and configure H2O HTTP/2 web server with FastCGI and SSL certificates

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Default values
DOMAIN="${1:-example.com}"
H2O_VERSION="v2.2.6"

# Usage function
usage() {
    echo "Usage: $0 [domain_name]"
    echo "Example: $0 mywebsite.com"
    exit 1
}

# Cleanup function for rollback
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop h2o 2>/dev/null || true
    systemctl disable h2o 2>/dev/null || true
    rm -rf /tmp/h2o-* /etc/systemd/system/h2o.service
    systemctl daemon-reload 2>/dev/null || true
}

trap cleanup ERR

# Logging
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Validate input
if [[ $# -gt 1 ]]; then
    usage
fi

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root or with sudo"
    exit 1
fi

log_info "Installing H2O HTTP/2 web server for domain: $DOMAIN"

# [1/10] Detect distribution
echo -e "${BLUE}[1/10] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            APACHE_USER="www-data"
            PHP_FPM_SERVICE="php*-fpm"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            APACHE_USER="apache"
            PHP_FPM_SERVICE="php-fpm"
            # Check if dnf exists, fallback to yum
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum update -y"
            fi
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            APACHE_USER="apache"
            PHP_FPM_SERVICE="php-fpm"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    log_success "Detected $PRETTY_NAME"
else
    log_error "Cannot detect distribution"
    exit 1
fi

# [2/10] Update system packages
echo -e "${BLUE}[2/10] Updating system packages...${NC}"
$PKG_UPDATE

# [3/10] Install build dependencies
echo -e "${BLUE}[3/10] Installing build dependencies...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL build-essential cmake pkg-config libssl-dev zlib1g-dev libyaml-dev wget tar
else
    $PKG_INSTALL groupinstall "Development Tools"
    $PKG_INSTALL cmake pkgconfig openssl-devel zlib-devel libyaml-devel wget tar
fi

# [4/10] Create H2O user and directories
echo -e "${BLUE}[4/10] Creating H2O user and directories...${NC}"
useradd --system --home /var/lib/h2o --shell /bin/false h2o 2>/dev/null || true
mkdir -p /etc/h2o /var/log/h2o /var/lib/h2o /var/www/html
chown h2o:h2o /var/log/h2o /var/lib/h2o
chown $APACHE_USER:$APACHE_USER /var/www/html
chmod 755 /var/log/h2o /var/lib/h2o /var/www/html

# [5/10] Download and compile H2O
echo -e "${BLUE}[5/10] Downloading and compiling H2O...${NC}"
cd /tmp
wget -q "https://github.com/h2o/h2o/archive/${H2O_VERSION}.tar.gz"
tar xzf "${H2O_VERSION}.tar.gz"
cd "h2o-${H2O_VERSION#v}"
cmake -DWITH_BUNDLED_SSL=on -DCMAKE_INSTALL_PREFIX=/usr/local .
make -j$(nproc)
make install

# [6/10] Install PHP-FPM
echo -e "${BLUE}[6/10] Installing PHP-FPM...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL php-fpm php-mysql php-curl php-gd php-mbstring php-xml php-zip
else
    $PKG_INSTALL php-fpm php-mysqlnd php-curl php-gd php-mbstring php-xml php-zip
fi

# Start and enable PHP-FPM
systemctl enable $PHP_FPM_SERVICE
systemctl start $PHP_FPM_SERVICE

# [7/10] Generate SSL certificates
echo -e "${BLUE}[7/10] Generating SSL certificates...${NC}"
mkdir -p /etc/ssl/private
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout "/etc/ssl/private/${DOMAIN}.key" \
    -out "/etc/ssl/certs/${DOMAIN}.crt" \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=${DOMAIN}" 2>/dev/null

chmod 600 "/etc/ssl/private/${DOMAIN}.key"
chmod 644 "/etc/ssl/certs/${DOMAIN}.crt"
chown root:root "/etc/ssl/private/${DOMAIN}.key" "/etc/ssl/certs/${DOMAIN}.crt"

# [8/10] Create H2O configuration
echo -e "${BLUE}[8/10] Creating H2O configuration...${NC}"
cat > /etc/h2o/h2o.conf << EOF
user: h2o
pid-file: /var/run/h2o.pid
error-log: /var/log/h2o/error.log
access-log: /var/log/h2o/access.log

# Global settings
max-connections: 1024
num-threads: 4
http2-idle-timeout: 10
http2-graceful-shutdown-timeout: 30

hosts:
  "${DOMAIN}:80":
    listen:
      port: 80
    paths:
      "/":
        file.dir: /var/www/html
        file.index: ['index.html', 'index.php']
        fastcgi.connect:
          port: 9000
          type: tcp
        fastcgi.spawn: "php-fpm"
  
  "${DOMAIN}:443":
    listen:
      port: 443
      ssl:
        certificate-file: /etc/ssl/certs/${DOMAIN}.crt
        key-file: /etc/ssl/private/${DOMAIN}.key
        cipher-suite: "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
        cipher-preference: server
    paths:
      "/":
        file.dir: /var/www/html
        file.index: ['index.html', 'index.php']
        fastcgi.connect:
          port: 9000
          type: tcp
        fastcgi.spawn: "php-fpm"
        header.add: "Strict-Transport-Security: max-age=31536000; includeSubDomains"
        header.add: "X-Frame-Options: DENY"
        header.add: "X-Content-Type-Options: nosniff"
EOF

chmod 644 /etc/h2o/h2o.conf
chown root:root /etc/h2o/h2o.conf

# Create test files
cat > /var/www/html/index.html << EOF
<!DOCTYPE html>
<html><head><title>H2O Server</title></head>
<body><h1>H2O HTTP/2 Server Running!</h1><p>Domain: ${DOMAIN}</p></body></html>
EOF

cat > /var/www/html/info.php << EOF
<?php phpinfo(); ?>
EOF

chown $APACHE_USER:$APACHE_USER /var/www/html/index.html /var/www/html/info.php
chmod 644 /var/www/html/index.html /var/www/html/info.php

# [9/10] Create systemd service
echo -e "${BLUE}[9/10] Creating systemd service...${NC}"
cat > /etc/systemd/system/h2o.service << EOF
[Unit]
Description=H2O HTTP/2 Web Server
Documentation=https://h2o.examp1e.net/
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/local/bin/h2o -c /etc/h2o/h2o.conf
ExecReload=/bin/kill -HUP \$MAINPID
KillMode=mixed
StandardOutput=journal
StandardError=journal
SyslogIdentifier=h2o

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable h2o
systemctl start h2o

# Configure firewall
if command -v ufw &> /dev/null && ufw status | grep -q "Status: active"; then
    ufw allow 80/tcp
    ufw allow 443/tcp
    log_success "UFW firewall rules added"
elif command -v firewall-cmd &> /dev/null; then
    firewall-cmd --permanent --add-port=80/tcp
    firewall-cmd --permanent --add-port=443/tcp
    firewall-cmd --reload
    log_success "Firewalld rules added"
fi

# [10/10] Verify installation
echo -e "${BLUE}[10/10] Verifying installation...${NC}"

# Check if H2O is running
if systemctl is-active --quiet h2o; then
    log_success "H2O service is running"
else
    log_error "H2O service failed to start"
    systemctl status h2o
    exit 1
fi

# Check if PHP-FPM is running
if systemctl is-active --quiet $PHP_FPM_SERVICE; then
    log_success "PHP-FPM service is running"
else
    log_warning "PHP-FPM service not running properly"
fi

# Check if ports are listening
if ss -tlnp | grep -q ":80 "; then
    log_success "HTTP port 80 is listening"
else
    log_warning "HTTP port 80 is not listening"
fi

if ss -tlnp | grep -q ":443 "; then
    log_success "HTTPS port 443 is listening"
else
    log_warning "HTTPS port 443 is not listening"
fi

echo ""
log_success "H2O installation completed successfully!"
echo ""
echo "Configuration details:"
echo "  - Domain: $DOMAIN"
echo "  - HTTP: http://$DOMAIN"
echo "  - HTTPS: https://$DOMAIN"
echo "  - Document root: /var/www/html"
echo "  - Config file: /etc/h2o/h2o.conf"
echo "  - Log files: /var/log/h2o/"
echo "  - SSL certificate: /etc/ssl/certs/${DOMAIN}.crt"
echo ""
echo "Test URLs:"
echo "  - Static content: http://$DOMAIN/"
echo "  - PHP info: http://$DOMAIN/info.php"
echo ""
log_warning "Self-signed SSL certificate is for testing only. Use Let's Encrypt for production."