Setup Caddy automatic SSL certificates with Let's Encrypt and DNS challenges

#!/usr/bin/env bash
set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
DOMAIN="${1:-}"
DNS_PROVIDER="${2:-cloudflare}"
API_TOKEN="${3:-}"

# Usage function
usage() {
    echo "Usage: $0 <domain> [dns_provider] [api_token]"
    echo "Example: $0 example.com cloudflare cf_token_here"
    echo "Supported DNS providers: cloudflare, route53, digitalocean, namecheap"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    if [ $? -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        systemctl stop caddy 2>/dev/null || true
        systemctl disable caddy 2>/dev/null || true
        rm -f /etc/caddy/Caddyfile /etc/caddy/caddy.env 2>/dev/null || true
    fi
}

trap cleanup EXIT

# Validate arguments
if [ -z "$DOMAIN" ]; then
    usage
fi

# Check if running as root or with sudo
if [ $EUID -ne 0 ]; then
    log_error "This script must be run as root or with sudo"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            REPO_SETUP="debian"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            REPO_SETUP="rhel"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            REPO_SETUP="rhel"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution"
    exit 1
fi

log_info "Detected distribution: $ID"

# Step 1: Update system packages
echo "[1/10] Updating system packages..."
$PKG_UPDATE

# Step 2: Install required packages
echo "[2/10] Installing required packages..."
$PKG_INSTALL curl wget gnupg

# Install distribution-specific packages
if [ "$REPO_SETUP" = "debian" ]; then
    $PKG_INSTALL lsb-release
else
    if ! command -v dnf >/dev/null 2>&1 && [ "$PKG_MGR" = "dnf" ]; then
        $PKG_INSTALL 'dnf-command(copr)'
    fi
fi

# Step 3: Add Caddy repository
echo "[3/10] Adding Caddy repository..."
if [ "$REPO_SETUP" = "debian" ]; then
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
    apt update
else
    if [ "$PKG_MGR" = "dnf" ]; then
        dnf copr enable @caddy/caddy -y
    else
        yum install -y yum-plugin-copr
        yum copr enable @caddy/caddy -y
    fi
fi

# Step 4: Install Caddy
echo "[4/10] Installing Caddy..."
$PKG_INSTALL caddy

# Step 5: Create caddy user if it doesn't exist
echo "[5/10] Configuring Caddy user..."
if ! id -u caddy >/dev/null 2>&1; then
    useradd --system --home /var/lib/caddy --create-home --shell /usr/sbin/nologin caddy
fi

# Step 6: Create directory structure
echo "[6/10] Creating directory structure..."
mkdir -p /etc/caddy /var/www/html /var/log/caddy /var/lib/caddy
chown -R caddy:caddy /etc/caddy /var/www/html /var/log/caddy /var/lib/caddy
chmod 755 /etc/caddy /var/www/html /var/log/caddy /var/lib/caddy

# Step 7: Create environment file
echo "[7/10] Creating environment configuration..."
cat > /etc/caddy/caddy.env << EOF
# DNS Provider Configuration
# Replace with your actual API credentials
EOF

case "$DNS_PROVIDER" in
    cloudflare)
        echo "CLOUDFLARE_API_TOKEN=${API_TOKEN:-your_cloudflare_api_token_here}" >> /etc/caddy/caddy.env
        ;;
    route53)
        cat >> /etc/caddy/caddy.env << EOF
ROUTE53_ACCESS_KEY_ID=${API_TOKEN:-your_access_key_id}
ROUTE53_SECRET_ACCESS_KEY=${API_TOKEN:-your_secret_access_key}
ROUTE53_REGION=us-east-1
EOF
        ;;
    digitalocean)
        echo "DIGITALOCEAN_TOKEN=${API_TOKEN:-your_do_token}" >> /etc/caddy/caddy.env
        ;;
    namecheap)
        cat >> /etc/caddy/caddy.env << EOF
NAMECHEAP_API_USER=${API_TOKEN:-your_username}
NAMECHEAP_API_KEY=${API_TOKEN:-your_api_key}
EOF
        ;;
esac

chown caddy:caddy /etc/caddy/caddy.env
chmod 600 /etc/caddy/caddy.env

# Step 8: Create Caddyfile
echo "[8/10] Creating Caddy configuration..."
cat > /etc/caddy/Caddyfile << EOF
{
    email admin@${DOMAIN}
    acme_ca https://acme-v02.api.letsencrypt.org/directory
}

${DOMAIN} {
    tls {
        dns ${DNS_PROVIDER} {env.$(echo $DNS_PROVIDER | tr '[:lower:]' '[:upper:]')_API_TOKEN}
    }
    
    root * /var/www/html
    file_server
    
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
    
    log {
        output file /var/log/caddy/access.log
        format json
    }
}

*.${DOMAIN} {
    tls {
        dns ${DNS_PROVIDER} {env.$(echo $DNS_PROVIDER | tr '[:lower:]' '[:upper:]')_API_TOKEN}
    }
    
    handle {
        respond "Subdomain not configured" 404
    }
}
EOF

chown caddy:caddy /etc/caddy/Caddyfile
chmod 644 /etc/caddy/Caddyfile

# Step 9: Configure systemd service
echo "[9/10] Configuring systemd service..."
mkdir -p /etc/systemd/system/caddy.service.d
cat > /etc/systemd/system/caddy.service.d/override.conf << EOF
[Service]
EnvironmentFile=/etc/caddy/caddy.env
EOF

# Create sample index page
cat > /var/www/html/index.html << EOF
<!DOCTYPE html>
<html>
<head>
    <title>Caddy with Let's Encrypt</title>
</head>
<body>
    <h1>Success!</h1>
    <p>Caddy is running with automatic SSL certificates for ${DOMAIN}</p>
</body>
</html>
EOF

chown caddy:caddy /var/www/html/index.html
chmod 644 /var/www/html/index.html

# Configure firewall if available
if command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=http --add-service=https 2>/dev/null || true
    firewall-cmd --reload 2>/dev/null || true
elif command -v ufw >/dev/null 2>&1; then
    ufw allow 80/tcp 2>/dev/null || true
    ufw allow 443/tcp 2>/dev/null || true
fi

# Configure SELinux if enabled
if command -v setsebool >/dev/null 2>&1 && [ "$(getenforce 2>/dev/null)" = "Enforcing" ]; then
    setsebool -P httpd_can_network_connect 1 2>/dev/null || true
fi

systemctl daemon-reload
systemctl enable caddy
systemctl start caddy

# Step 10: Verification
echo "[10/10] Verifying installation..."
sleep 3

if systemctl is-active --quiet caddy; then
    log_info "Caddy service is running"
else
    log_error "Caddy service failed to start"
    systemctl status caddy --no-pager
    exit 1
fi

# Test configuration
if caddy validate --config /etc/caddy/Caddyfile; then
    log_info "Caddy configuration is valid"
else
    log_error "Caddy configuration validation failed"
    exit 1
fi

log_info "Installation completed successfully!"
log_warn "IMPORTANT: Update the API credentials in /etc/caddy/caddy.env"
log_warn "Then restart Caddy: systemctl restart caddy"
echo ""
echo "Configuration files:"
echo "  - Caddyfile: /etc/caddy/Caddyfile"
echo "  - Environment: /etc/caddy/caddy.env (update your API credentials here)"
echo "  - Web root: /var/www/html"
echo "  - Logs: /var/log/caddy/"
echo ""
echo "Commands:"
echo "  - Check status: systemctl status caddy"
echo "  - View logs: journalctl -u caddy -f"
echo "  - Restart service: systemctl restart caddy"