Configure NGINX virtual hosts with SSL certificates for multiple domains

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Global variables
NGINX_SITES_PATH=""
NGINX_USER=""
STEP_COUNT=0
TOTAL_STEPS=12

# Usage message
usage() {
    echo "Usage: $0 <primary_domain> [subdomain1] [subdomain2] ..."
    echo "Example: $0 example.com api.example.com blog.example.com"
    echo "Note: Domains must be pointing to this server's IP for SSL to work"
    exit 1
}

# Print colored output
print_status() {
    local color=$1
    local message=$2
    echo -e "${color}${message}${NC}"
}

# Progress counter
progress() {
    STEP_COUNT=$((STEP_COUNT + 1))
    print_status $YELLOW "[${STEP_COUNT}/${TOTAL_STEPS}] $1"
}

# Error cleanup
cleanup() {
    if [ $? -ne 0 ]; then
        print_status $RED "Installation failed. Cleaning up..."
        systemctl stop nginx 2>/dev/null || true
        rm -f /etc/nginx/sites-available/nginx-vhosts-* 2>/dev/null || true
        rm -f /etc/nginx/conf.d/nginx-vhosts-* 2>/dev/null || true
        rm -rf /var/www/nginx-vhost-* 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check prerequisites
check_prereqs() {
    if [[ $EUID -ne 0 ]]; then
        print_status $RED "This script must be run as root or with sudo"
        exit 1
    fi
    
    if [ $# -lt 1 ]; then
        usage
    fi
}

# Detect distribution and set package manager
detect_distro() {
    progress "Detecting distribution and configuring package manager"
    
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update && apt upgrade -y"
                NGINX_SITES_PATH="/etc/nginx/sites-available"
                NGINX_USER="www-data"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf update -y"
                NGINX_SITES_PATH="/etc/nginx/conf.d"
                NGINX_USER="nginx"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum update -y"
                NGINX_SITES_PATH="/etc/nginx/conf.d"
                NGINX_USER="nginx"
                ;;
            *) 
                print_status $RED "Unsupported distribution: $ID"
                exit 1 
                ;;
        esac
        print_status $GREEN "Detected: $PRETTY_NAME using $PKG_MGR"
    else
        print_status $RED "Cannot detect distribution - /etc/os-release not found"
        exit 1
    fi
}

# Update system packages
update_system() {
    progress "Updating system packages"
    $PKG_UPDATE
}

# Install required packages
install_packages() {
    progress "Installing NGINX and Certbot"
    
    if [ "$PKG_MGR" = "dnf" ]; then
        $PKG_INSTALL epel-release
    fi
    
    $PKG_INSTALL nginx certbot python3-certbot-nginx
}

# Configure firewall
configure_firewall() {
    progress "Configuring firewall"
    
    if command -v ufw >/dev/null 2>&1; then
        ufw allow 'Nginx Full' 2>/dev/null || true
    elif command -v firewall-cmd >/dev/null 2>&1; then
        firewall-cmd --permanent --add-service=http 2>/dev/null || true
        firewall-cmd --permanent --add-service=https 2>/dev/null || true
        firewall-cmd --reload 2>/dev/null || true
    fi
}

# Start and enable NGINX
start_nginx() {
    progress "Starting and enabling NGINX"
    systemctl enable nginx
    systemctl start nginx
    systemctl is-active nginx >/dev/null || {
        print_status $RED "Failed to start NGINX"
        exit 1
    }
}

# Create directory structure
create_directories() {
    progress "Creating directory structure for domains"
    
    for domain in "$@"; do
        mkdir -p "/var/www/${domain}/html"
        print_status $GREEN "Created directory for $domain"
    done
    
    chown -R $NGINX_USER:$NGINX_USER /var/www/
    chmod -R 755 /var/www/
}

# Create test content
create_test_content() {
    progress "Creating test content for each domain"
    
    for domain in "$@"; do
        cat > "/var/www/${domain}/html/index.html" << EOF
<!DOCTYPE html>
<html>
<head>
    <title>Welcome to ${domain}</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <style>
        body { font-family: Arial, sans-serif; margin: 40px; }
        h1 { color: #333; }
        .status { background: #e8f5e8; padding: 20px; border-radius: 5px; }
    </style>
</head>
<body>
    <div class="status">
        <h1>${domain} is working!</h1>
        <p>NGINX virtual host is properly configured.</p>
        <p>Server time: $(date)</p>
    </div>
</body>
</html>
EOF
        chown $NGINX_USER:$NGINX_USER "/var/www/${domain}/html/index.html"
        chmod 644 "/var/www/${domain}/html/index.html"
    done
}

# Create virtual host configurations
create_vhost_configs() {
    progress "Creating virtual host configurations"
    
    for domain in "$@"; do
        if [ "$NGINX_SITES_PATH" = "/etc/nginx/sites-available" ]; then
            config_file="/etc/nginx/sites-available/${domain}"
            ln_target="/etc/nginx/sites-enabled/${domain}"
        else
            config_file="/etc/nginx/conf.d/${domain}.conf"
        fi
        
        cat > "$config_file" << EOF
server {
    listen 80;
    listen [::]:80;
    
    server_name ${domain};
    
    root /var/www/${domain}/html;
    index index.html index.htm index.nginx-debian.html;
    
    location / {
        try_files \$uri \$uri/ =404;
    }
    
    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    
    # Disable server tokens
    server_tokens off;
    
    # Logging
    access_log /var/log/nginx/${domain}.access.log;
    error_log /var/log/nginx/${domain}.error.log;
    
    # Security: deny access to hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}
EOF
        
        chmod 644 "$config_file"
        
        # Enable site on Debian-based systems
        if [ "$NGINX_SITES_PATH" = "/etc/nginx/sites-available" ]; then
            ln -sf "$config_file" "$ln_target"
        fi
        
        print_status $GREEN "Created configuration for $domain"
    done
}

# Test NGINX configuration
test_nginx_config() {
    progress "Testing NGINX configuration"
    nginx -t || {
        print_status $RED "NGINX configuration test failed"
        exit 1
    }
    systemctl reload nginx
}

# Install SSL certificates
install_ssl() {
    progress "Installing SSL certificates with Let's Encrypt"
    
    print_status $YELLOW "Note: Domains must be pointing to this server for SSL to work"
    
    for domain in "$@"; do
        print_status $YELLOW "Attempting SSL certificate for $domain..."
        
        if certbot --nginx -d "$domain" --non-interactive --agree-tos --email "admin@$domain" --redirect; then
            print_status $GREEN "SSL certificate installed for $domain"
        else
            print_status $YELLOW "SSL certificate installation failed for $domain - continuing with HTTP"
        fi
    done
    
    # Set up auto-renewal
    if ! crontab -l 2>/dev/null | grep -q "certbot renew"; then
        (crontab -l 2>/dev/null; echo "0 12 * * * /usr/bin/certbot renew --quiet") | crontab -
        print_status $GREEN "SSL auto-renewal configured"
    fi
}

# Final verification
verify_installation() {
    progress "Verifying installation"
    
    if ! systemctl is-active nginx >/dev/null; then
        print_status $RED "NGINX is not running"
        exit 1
    fi
    
    for domain in "$@"; do
        if [ -d "/var/www/${domain}" ]; then
            print_status $GREEN "✓ Directory structure for $domain"
        fi
        
        if curl -s -H "Host: $domain" http://localhost/ | grep -q "$domain is working"; then
            print_status $GREEN "✓ Virtual host for $domain is responding"
        else
            print_status $YELLOW "⚠ Virtual host for $domain may not be working properly"
        fi
    done
    
    print_status $GREEN "Installation completed successfully!"
    print_status $YELLOW "Next steps:"
    echo "  1. Point your domains to this server's IP address"
    echo "  2. Test each domain in a web browser"
    echo "  3. Replace test content in /var/www/<domain>/html/"
    echo "  4. SSL certificates will auto-renew via cron"
}

# Main execution
main() {
    check_prereqs "$@"
    detect_distro
    update_system
    install_packages
    configure_firewall
    start_nginx
    create_directories "$@"
    create_test_content "$@"
    create_vhost_configs "$@"
    test_nginx_config
    install_ssl "$@"
    verify_installation "$@"
}

main "$@"