Configure H2O HTTP/2 server load balancing with health checks and SSL termination

#!/usr/bin/env bash

set -euo pipefail

# H2O Load Balancer Installation Script
# Configures H2O with SSL termination, load balancing, and health checks

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Variables
DOMAIN=${1:-"example.com"}
BACKEND_IPS=${2:-"192.168.1.10:8080,192.168.1.11:8080,192.168.1.12:8080"}

usage() {
    echo "Usage: $0 [domain] [backend_ips]"
    echo "  domain: Domain name for SSL certificate (default: example.com)"
    echo "  backend_ips: Comma-separated backend servers (default: 192.168.1.10:8080,192.168.1.11:8080,192.168.1.12:8080)"
    echo "Example: $0 mydomain.com 10.0.1.10:8080,10.0.1.11:8080"
    exit 1
}

log() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1"
    exit 1
}

cleanup() {
    warn "Installation failed. Rolling back changes..."
    systemctl stop h2o 2>/dev/null || true
    rm -f /etc/h2o/h2o.conf.backup 2>/dev/null || true
    if [ -f /etc/h2o/h2o.conf.orig ]; then
        mv /etc/h2o/h2o.conf.orig /etc/h2o/h2o.conf 2>/dev/null || true
    fi
}

trap cleanup ERR

check_prerequisites() {
    echo "[1/8] Checking prerequisites..."
    
    if [ "$EUID" -ne 0 ]; then
        error "This script must be run as root"
    fi
    
    if ! command -v wget &> /dev/null; then
        error "wget is required but not installed"
    fi
    
    log "Prerequisites check passed"
}

detect_distro() {
    echo "[2/8] Detecting distribution..."
    
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                FIREWALL_CMD="ufw"
                ;;
            almalinux|rocky|centos|rhel|ol)
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf makecache"
                FIREWALL_CMD="firewall-cmd"
                ;;
            fedora)
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf makecache"
                FIREWALL_CMD="firewall-cmd"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum makecache"
                FIREWALL_CMD="firewall-cmd"
                ;;
            *)
                error "Unsupported distribution: $ID"
                ;;
        esac
    else
        error "Cannot detect distribution - /etc/os-release not found"
    fi
    
    log "Detected distribution: $ID using $PKG_MGR"
}

install_h2o() {
    echo "[3/8] Installing H2O web server..."
    
    case "$PKG_MGR" in
        apt)
            wget -qO- https://h2o.examp1e.net/configure | sh
            $PKG_UPDATE
            $PKG_INSTALL h2o
            ;;
        dnf|yum)
            $PKG_INSTALL epel-release
            if [ "$PKG_MGR" = "dnf" ]; then
                dnf config-manager --add-repo https://h2o.examp1e.net/configure
            else
                yum-config-manager --add-repo https://h2o.examp1e.net/configure
            fi
            $PKG_INSTALL h2o
            ;;
    esac
    
    log "H2O installed successfully"
}

setup_ssl_directory() {
    echo "[4/8] Setting up SSL certificate directory..."
    
    mkdir -p /etc/h2o/ssl
    chmod 750 /etc/h2o/ssl
    
    if getent group h2o >/dev/null 2>&1; then
        chown root:h2o /etc/h2o/ssl
    else
        chown root:root /etc/h2o/ssl
    fi
    
    mkdir -p /var/lib/h2o
    chmod 755 /var/lib/h2o
    if getent passwd h2o >/dev/null 2>&1; then
        chown h2o:h2o /var/lib/h2o
    fi
    
    log "SSL directory created"
}

generate_ssl_certificate() {
    echo "[5/8] Generating self-signed SSL certificate..."
    
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
        -keyout /etc/h2o/ssl/server.key \
        -out /etc/h2o/ssl/server.crt \
        -subj "/C=US/ST=State/L=City/O=Organization/CN=$DOMAIN" 2>/dev/null
    
    chmod 600 /etc/h2o/ssl/server.key
    chmod 644 /etc/h2o/ssl/server.crt
    
    if getent group h2o >/dev/null 2>&1; then
        chown root:h2o /etc/h2o/ssl/server.*
    fi
    
    log "SSL certificate generated for $DOMAIN"
}

configure_h2o() {
    echo "[6/8] Configuring H2O load balancer..."
    
    if [ -f /etc/h2o/h2o.conf ]; then
        cp /etc/h2o/h2o.conf /etc/h2o/h2o.conf.orig
    fi
    
    # Convert comma-separated backend IPs to YAML format
    backend_servers=""
    IFS=',' read -ra BACKENDS <<< "$BACKEND_IPS"
    for backend in "${BACKENDS[@]}"; do
        backend_servers="$backend_servers    - server: $backend"$'\n'"      weight: 1"$'\n'
    done
    
    cat > /etc/h2o/h2o.conf << EOF
user: h2o
pid-file: /var/run/h2o.pid
error-log: /var/log/h2o/error.log
access-log: /var/log/h2o/access.log

# SSL/TLS Configuration
ssl-session-resumption:
  mode: ticket
  ticket-store: file
  ticket-file: /var/lib/h2o/session-ticket

# Backend servers configuration
proxy.preserve-host: ON
proxy.timeout.io: 30000
proxy.timeout.keepalive: 5000

# Load balancer upstream definitions
upstreams:
  backend-cluster:
$backend_servers

# Health check configuration
health-check:
  interval: 5
  timeout: 3
  healthy-threshold: 2
  unhealthy-threshold: 3
  path: /health
  expected-status: 200

hosts:
  # HTTP redirect to HTTPS
  "*:80":
    listen:
      port: 80
    paths:
      "/":
        redirect:
          status: 301
          url: "https://$DOMAIN/"
  
  # HTTPS with load balancing
  "$DOMAIN:443":
    listen:
      port: 443
      ssl:
        certificate-file: /etc/h2o/ssl/server.crt
        key-file: /etc/h2o/ssl/server.key
        cipher-suite: "ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!SHA1:!AESCCM"
        minimum-version: TLSv1.2
    header.add: "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"
    header.add: "X-Frame-Options: SAMEORIGIN"
    header.add: "X-Content-Type-Options: nosniff"
    header.add: "X-XSS-Protection: 1; mode=block"
    paths:
      "/":
        proxy.reverse.url: "http://backend-cluster"
        proxy.preserve-host: ON
        proxy.proxy-protocol: OFF
EOF
    
    chmod 644 /etc/h2o/h2o.conf
    chown root:root /etc/h2o/h2o.conf
    
    log "H2O configuration created"
}

configure_firewall() {
    echo "[7/8] Configuring firewall..."
    
    case "$FIREWALL_CMD" in
        ufw)
            if systemctl is-active --quiet ufw; then
                ufw allow 80/tcp
                ufw allow 443/tcp
                log "UFW rules added for ports 80 and 443"
            fi
            ;;
        firewall-cmd)
            if systemctl is-active --quiet firewalld; then
                firewall-cmd --permanent --add-service=http
                firewall-cmd --permanent --add-service=https
                firewall-cmd --reload
                log "Firewalld rules added for HTTP and HTTPS"
            fi
            ;;
    esac
    
    # Configure SELinux if present
    if command -v setsebool &> /dev/null; then
        setsebool -P httpd_can_network_connect 1 2>/dev/null || true
        log "SELinux configured for network connections"
    fi
}

start_and_verify() {
    echo "[8/8] Starting H2O and verifying installation..."
    
    systemctl enable h2o
    systemctl start h2o
    
    sleep 2
    
    if ! systemctl is-active --quiet h2o; then
        error "H2O failed to start. Check logs: journalctl -u h2o"
    fi
    
    if ss -tlnp | grep -q ":80\|:443"; then
        log "H2O is listening on ports 80 and 443"
    else
        error "H2O is not listening on expected ports"
    fi
    
    log "H2O load balancer installed and started successfully!"
    warn "Replace the self-signed certificate with a proper SSL certificate in production"
    warn "Update backend server IPs in /etc/h2o/h2o.conf as needed"
    log "Configuration file: /etc/h2o/h2o.conf"
    log "View logs: journalctl -u h2o -f"
}

# Main execution
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    if [[ $# -gt 2 ]]; then
        usage
    fi
    
    check_prerequisites
    detect_distro
    install_h2o
    setup_ssl_directory
    generate_ssl_certificate
    configure_h2o
    configure_firewall
    start_and_verify
fi