Set up HAProxy SSL termination with Let's Encrypt certificates

#!/usr/bin/env bash
set -euo pipefail

# ---------------------------------------------------------------------------
# HAProxy + Let's Encrypt SSL termination installer
# ---------------------------------------------------------------------------

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

log_info()  { echo -e "${GREEN}$*${NC}"; }
log_warn()  { echo -e "${YELLOW}$*${NC}"; }
log_error() { echo -e "${RED}$*${NC}"; }

usage() {
    echo "Usage: $0 -d <domain> [-e <email>] [-b <backend_host:port>] [--dns-challenge]"
    echo
    echo "  -d   Primary domain (required), e.g. example.com"
    echo "  -e   Admin email for Let's Encrypt (default: admin@<domain>)"
    echo "  -b   Backend server address:port (default: 127.0.0.1:8080)"
    echo "  --dns-challenge   Use DNS challenge instead of standalone HTTP challenge"
    exit 1
}

DOMAIN=""
EMAIL=""
BACKEND="127.0.0.1:8080"
USE_DNS_CHALLENGE=false

while [ $# -gt 0 ]; do
    case "$1" in
        -d) DOMAIN="$2"; shift 2 ;;
        -e) EMAIL="$2"; shift 2 ;;
        -b) BACKEND="$2"; shift 2 ;;
        --dns-challenge) USE_DNS_CHALLENGE=true; shift ;;
        *) usage ;;
    esac
done

[ -z "$DOMAIN" ] && usage
[ -z "$EMAIL" ] && EMAIL="admin@${DOMAIN}"

# ---------------------------------------------------------------------------
# Prerequisite checks
# ---------------------------------------------------------------------------
if [ "$(id -u)" -ne 0 ]; then
    log_error "This script must be run as root (use sudo)."
    exit 1
fi

CERT_ISSUED=false
ROLLBACK_NEEDED=false

cleanup_on_error() {
    log_error "Error occurred. Rolling back changes..."
    if [ "$ROLLBACK_NEEDED" = true ] && [ -f "$HAPROXY_CFG.bak" ]; then
        mv -f "$HAPROXY_CFG.bak" "$HAPROXY_CFG"
        log_warn "Restored previous HAProxy config."
    fi
    systemctl restart haproxy 2>/dev/null || true
    exit 1
}
trap cleanup_on_error ERR

# ---------------------------------------------------------------------------
# [1/9] Detect distro
# ---------------------------------------------------------------------------
echo "[1/9] Detecting distribution..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"; PKG_INSTALL="apt install -y"
            HAPROXY_CFG="/etc/haproxy/haproxy.cfg"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"; PKG_INSTALL="dnf install -y"
            HAPROXY_CFG="/etc/haproxy/haproxy.cfg"
            FIREWALL_CMD="firewalld"
            ;;
        amzn)
            PKG_MGR="yum"; PKG_INSTALL="yum install -y"
            HAPROXY_CFG="/etc/haproxy/haproxy.cfg"
            FIREWALL_CMD="firewalld"
            ;;
        *) log_error "Unsupported distro: $ID"; exit 1 ;;
    esac
else
    log_error "/etc/os-release not found. Cannot detect distro."
    exit 1
fi
log_info "Detected: $ID (package manager: $PKG_MGR)"

# ---------------------------------------------------------------------------
# [2/9] Install HAProxy and Certbot
# ---------------------------------------------------------------------------
echo "[2/9] Installing HAProxy and Certbot..."
if [ "$PKG_MGR" = "apt" ]; then
    apt update -y
fi
$PKG_INSTALL haproxy certbot

# ---------------------------------------------------------------------------
# [3/9] Configure firewall for HTTP/HTTPS
# ---------------------------------------------------------------------------
echo "[3/9] Configuring firewall..."
if command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then
    ufw allow 80/tcp
    ufw allow 443/tcp
    log_info "UFW rules added for ports 80/443."
elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    firewall-cmd --permanent --add-service=http
    firewall-cmd --permanent --add-service=https
    firewall-cmd --reload
    log_info "firewalld rules added for HTTP/HTTPS."
else
    log_warn "No active supported firewall detected; skipping firewall configuration."
fi

# ---------------------------------------------------------------------------
# [4/9] Stop HAProxy if using standalone challenge
# ---------------------------------------------------------------------------
echo "[4/9] Preparing for certificate issuance..."
HAPROXY_WAS_RUNNING=false
if systemctl is-active --quiet haproxy; then
    HAPROXY_WAS_RUNNING=true
fi

if [ "$USE_DNS_CHALLENGE" = false ]; then
    if [ "$HAPROXY_WAS_RUNNING" = true ]; then
        log_warn "Stopping HAProxy temporarily to free port 80..."
        systemctl stop haproxy
    fi
fi

# ---------------------------------------------------------------------------
# [5/9] Obtain certificate
# ---------------------------------------------------------------------------
echo "[5/9] Requesting certificate from Let's Encrypt..."
if [ -d "/etc/letsencrypt/live/${DOMAIN}" ]; then
    log_warn "Certificate for ${DOMAIN} already exists. Skipping issuance."
else
    if [ "$USE_DNS_CHALLENGE" = true ]; then
        log_warn "DNS challenge selected. You will need to add a TXT record manually."
        certbot certonly --manual --preferred-challenges dns \
            -d "${DOMAIN}" -d "*.${DOMAIN}" \
            --agree-tos -m "${EMAIL}"
    else
        certbot certonly --standalone -d "${DOMAIN}" \
            --agree-tos -m "${EMAIL}" --non-interactive
    fi
fi
CERT_ISSUED=true

# Restart HAProxy now that port 80 is free again (it will be reconfigured later)
if [ "$USE_DNS_CHALLENGE" = false ] && [ "$HAPROXY_WAS_RUNNING" = true ]; then
    systemctl start haproxy || true
fi

# ---------------------------------------------------------------------------
# [6/9] Build combined PEM bundle
# ---------------------------------------------------------------------------
echo "[6/9] Building combined PEM bundle for HAProxy..."
mkdir -p /etc/haproxy/certs
chmod 700 /etc/haproxy/certs
chown root:root /etc/haproxy/certs

LE_LIVE="/etc/letsencrypt/live/${DOMAIN}"
PEM_BUNDLE="/etc/haproxy/certs/${DOMAIN}.pem"

if [ ! -f "${LE_LIVE}/fullchain.pem" ] || [ ! -f "${LE_LIVE}/privkey.pem" ]; then
    log_error "Certificate files not found at ${LE_LIVE}."
    exit 1
fi

cat "${LE_LIVE}/fullchain.pem" "${LE_LIVE}/privkey.pem" > "${PEM_BUNDLE}"
chmod 600 "${PEM_BUNDLE}"
chown root:root "${PEM_BUNDLE}"
log_info "PEM bundle created at ${PEM_BUNDLE}."

# ---------------------------------------------------------------------------
# [7/9] Write HAProxy configuration
# ---------------------------------------------------------------------------
echo "[7/9] Writing HAProxy configuration..."
[ -f "$HAPROXY_CFG" ] && cp "$HAPROXY_CFG" "${HAPROXY_CFG}.bak"
ROLLBACK_NEEDED=true

cat > "$HAPROXY_CFG" <<EOF
global
    log /dev/log local0
    log /dev/log local1 notice
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin
    stats timeout 30s
    user haproxy
    group haproxy
    daemon
    maxconn 4096
    ssl-default-bind-ciphers ECDHE+AESGCM:ECDHE+CHACHA20:!aNULL:!MD5:!DSS
    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11

defaults
    log global
    mode http
    option httplog
    option dontlognull
    timeout connect 5s
    timeout client 30s
    timeout server 30s

# Redirect all plain HTTP traffic to HTTPS
frontend http_front
    bind *:80
    http-request redirect scheme https unless { ssl_fc }

# TLS termination point
frontend https_front
    bind *:443 ssl crt ${PEM_BUNDLE}
    http-request set-header X-Forwarded-Proto https
    default_backend app_back

backend app_back
    balance roundrobin
    option httpchk GET /
    http-check expect status 200
    server web1 ${BACKEND} check ssl verify none
EOF

chmod 644 "$HAPROXY_CFG"
chown root:root "$HAPROXY_CFG"

# Validate configuration before restarting service
if ! haproxy -c -f "$HAPROXY_CFG"; then
    log_error "HAProxy configuration test failed."
    exit 1
fi

# ---------------------------------------------------------------------------
# [8/9] Enable service and set up auto-renewal
# ---------------------------------------------------------------------------
echo "[8/9] Enabling HAProxy service and configuring renewal hook..."
systemctl enable haproxy
systemctl restart haproxy
ROLLBACK_NEEDED=false

RENEW_HOOK_DIR="/etc/letsencrypt/renewal-hooks/deploy"
mkdir -p "$RENEW_HOOK_DIR"
cat > "${RENEW_HOOK_DIR}/haproxy-rebuild.sh" <<EOF
#!/usr/bin/env bash
set -euo pipefail
cat /etc/letsencrypt/live/${DOMAIN}/fullchain.pem /etc/letsencrypt/live/${DOMAIN}/privkey.pem > ${PEM_BUNDLE}
chmod 600 ${PEM_BUN