Configure NGINX SSL certificate automation with Certbot and renewal monitoring

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Global variables
DOMAIN=""
EMAIL=""
WEB_ROOT=""
NGINX_CONF_DIR=""
SITES_AVAILABLE=""
SITES_ENABLED=""

# Usage function
usage() {
    echo "Usage: $0 -d DOMAIN -e EMAIL"
    echo "  -d DOMAIN    Domain name (e.g., example.com)"
    echo "  -e EMAIL     Email for Let's Encrypt notifications"
    echo "  -h           Show this help message"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function for rollback
cleanup() {
    if [[ $? -ne 0 ]]; then
        log_error "Script failed. Cleaning up..."
        if [[ -n "$DOMAIN" && -f "$SITES_AVAILABLE/$DOMAIN" ]]; then
            rm -f "$SITES_AVAILABLE/$DOMAIN"
            [[ -L "$SITES_ENABLED/$DOMAIN" ]] && rm -f "$SITES_ENABLED/$DOMAIN"
        fi
        [[ -d "$WEB_ROOT" ]] && rm -rf "$WEB_ROOT"
        systemctl reload nginx 2>/dev/null || true
    fi
}

trap cleanup ERR

# Parse command line arguments
while getopts "d:e:h" opt; do
    case $opt in
        d) DOMAIN="$OPTARG" ;;
        e) EMAIL="$OPTARG" ;;
        h) usage ;;
        *) usage ;;
    esac
done

# Validate required arguments
if [[ -z "$DOMAIN" || -z "$EMAIL" ]]; then
    log_error "Domain and email are required"
    usage
fi

# Validate email format
if [[ ! "$EMAIL" =~ ^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$ ]]; then
    log_error "Invalid email format"
    exit 1
fi

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

# Auto-detect distro and set package manager
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            WEB_USER="www-data"
            SITES_AVAILABLE="/etc/nginx/sites-available"
            SITES_ENABLED="/etc/nginx/sites-enabled"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            WEB_USER="nginx"
            SITES_AVAILABLE="/etc/nginx/conf.d"
            SITES_ENABLED="/etc/nginx/conf.d"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            WEB_USER="nginx"
            SITES_AVAILABLE="/etc/nginx/conf.d"
            SITES_ENABLED="/etc/nginx/conf.d"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect Linux distribution"
    exit 1
fi

WEB_ROOT="/var/www/$DOMAIN"
NGINX_CONF_DIR="/etc/nginx"

log_info "[1/9] Updating package repositories..."
$PKG_UPDATE

log_info "[2/9] Installing NGINX and Certbot..."
$PKG_INSTALL nginx certbot python3-certbot-nginx

log_info "[3/9] Creating web root directory..."
mkdir -p "$WEB_ROOT"
chown -R "$WEB_USER:$WEB_USER" "$WEB_ROOT"
chmod -R 755 "$WEB_ROOT"
echo "Welcome to $DOMAIN" > "$WEB_ROOT/index.html"
chown "$WEB_USER:$WEB_USER" "$WEB_ROOT/index.html"
chmod 644 "$WEB_ROOT/index.html"

log_info "[4/9] Creating NGINX virtual host configuration..."
if [[ "$PKG_MGR" == "apt" ]]; then
    # Debian/Ubuntu style
    cat > "$SITES_AVAILABLE/$DOMAIN" << EOF
server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;
    root $WEB_ROOT;
    index index.html index.htm;

    location / {
        try_files \$uri \$uri/ =404;
    }

    location /.well-known/acme-challenge/ {
        root $WEB_ROOT;
        allow all;
    }
}
EOF
    ln -sf "$SITES_AVAILABLE/$DOMAIN" "$SITES_ENABLED/$DOMAIN"
else
    # RHEL/CentOS style
    cat > "$SITES_AVAILABLE/$DOMAIN.conf" << EOF
server {
    listen 80;
    server_name $DOMAIN www.$DOMAIN;
    root $WEB_ROOT;
    index index.html index.htm;

    location / {
        try_files \$uri \$uri/ =404;
    }

    location /.well-known/acme-challenge/ {
        root $WEB_ROOT;
        allow all;
    }
}
EOF
fi

log_info "[5/9] Testing NGINX configuration and starting service..."
nginx -t
systemctl enable nginx
systemctl start nginx
systemctl reload nginx

# Configure firewall if present
if command -v ufw >/dev/null 2>&1; then
    ufw allow 'Nginx Full' 2>/dev/null || true
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=http --add-service=https 2>/dev/null || true
    firewall-cmd --reload 2>/dev/null || true
fi

log_info "[6/9] Requesting SSL certificate with Certbot..."
certbot --nginx -d "$DOMAIN" -d "www.$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --no-eff-email

log_info "[7/9] Creating certificate renewal script..."
cat > /usr/local/bin/certbot-renewal.sh << 'EOF'
#!/bin/bash
# Certbot renewal script with logging and error handling
LOG_FILE="/var/log/certbot-renewal.log"
DATE=$(date '+%Y-%m-%d %H:%M:%S')

echo "[$DATE] Starting certificate renewal check" >> "$LOG_FILE"

# Attempt renewal
if /usr/bin/certbot renew --quiet --nginx >> "$LOG_FILE" 2>&1; then
    echo "[$DATE] Certificate renewal check completed successfully" >> "$LOG_FILE"
    
    # Test nginx configuration
    if /usr/sbin/nginx -t >> "$LOG_FILE" 2>&1; then
        # Reload nginx if config is valid
        /bin/systemctl reload nginx >> "$LOG_FILE" 2>&1
        echo "[$DATE] NGINX reloaded successfully" >> "$LOG_FILE"
    else
        echo "[$DATE] ERROR: NGINX configuration test failed" >> "$LOG_FILE"
        exit 1
    fi
else
    echo "[$DATE] ERROR: Certificate renewal failed" >> "$LOG_FILE"
    exit 1
fi

echo "[$DATE] Renewal process completed" >> "$LOG_FILE"
EOF

chmod 755 /usr/local/bin/certbot-renewal.sh
chown root:root /usr/local/bin/certbot-renewal.sh

log_info "[8/9] Creating systemd service and timer for automatic renewal..."
cat > /etc/systemd/system/certbot-renewal.service << EOF
[Unit]
Description=Certbot SSL Certificate Renewal
After=network.target

[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/certbot-renewal.sh
StandardOutput=journal
StandardError=journal
EOF

cat > /etc/systemd/system/certbot-renewal.timer << EOF
[Unit]
Description=Run Certbot renewal twice daily
Requires=certbot-renewal.service

[Timer]
OnCalendar=*-*-* 00,12:00:00
Persistent=true
RandomizedDelaySec=3600

[Install]
WantedBy=timers.target
EOF

systemctl daemon-reload
systemctl enable certbot-renewal.timer
systemctl start certbot-renewal.timer

log_info "[9/9] Verifying installation..."
nginx -t
systemctl reload nginx

# Verify SSL certificate
if certbot certificates | grep -q "$DOMAIN"; then
    log_info "SSL certificate successfully installed for $DOMAIN"
else
    log_error "SSL certificate verification failed"
    exit 1
fi

# Verify systemd timer
if systemctl is-active --quiet certbot-renewal.timer; then
    log_info "Automatic renewal timer is active"
else
    log_error "Automatic renewal timer failed to start"
    exit 1
fi

log_info "SSL certificate automation setup completed successfully!"
log_info "Certificate will be automatically renewed twice daily"
log_info "Check renewal logs at: /var/log/certbot-renewal.log"
log_info "Your site is now available at: https://$DOMAIN"