Setup nginx reverse proxy with SSL certificates and security hardening

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
DOMAIN="${1:-}"
BACKEND_IP="${2:-127.0.0.1:3000}"
NGINX_USER="nginx"
NGINX_CONFIG_DIR="/etc/nginx"
NGINX_SITES_DIR=""
NGINX_MAIN_CONFIG="/etc/nginx/nginx.conf"

# Usage message
usage() {
    echo "Usage: $0 <domain> [backend_ip:port]"
    echo "Example: $0 example.com 127.0.0.1:8080"
    exit 1
}

# Logging functions
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function
cleanup() {
    if [ $? -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        systemctl stop nginx 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check prerequisites
check_prerequisites() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi

    if [[ -z "$DOMAIN" ]]; then
        log_error "Domain name is required"
        usage
    fi

    if ! command -v systemctl &> /dev/null; then
        log_error "systemctl is required but not installed"
        exit 1
    fi
}

# Detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update && apt upgrade -y"
                PKG_INSTALL="apt install -y"
                FIREWALL_CMD="ufw"
                NGINX_USER="www-data"
                NGINX_SITES_DIR="/etc/nginx/sites-available"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                FIREWALL_CMD="firewalld"
                # Install EPEL for certbot
                dnf install -y epel-release 2>/dev/null || true
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                FIREWALL_CMD="firewalld"
                amazon-linux-extras install epel -y 2>/dev/null || true
                ;;
            *)
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution - /etc/os-release not found"
        exit 1
    fi
    
    # Set sites directory for RHEL-based systems
    if [[ -z "$NGINX_SITES_DIR" ]]; then
        NGINX_SITES_DIR="/etc/nginx/conf.d"
    fi
}

# Update system packages
update_system() {
    echo "[1/8] Updating system packages..."
    eval "$PKG_UPDATE"
    log_success "System packages updated"
}

# Install required packages
install_packages() {
    echo "[2/8] Installing nginx and required packages..."
    local packages="nginx certbot python3-certbot-nginx curl"
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        packages="$packages ufw"
    else
        packages="$packages firewalld"
    fi
    
    eval "$PKG_INSTALL $packages"
    log_success "Packages installed successfully"
}

# Configure firewall
configure_firewall() {
    echo "[3/8] Configuring firewall..."
    
    if [[ "$FIREWALL_CMD" == "ufw" ]]; then
        ufw --force enable
        ufw allow 22/tcp
        ufw allow 80/tcp
        ufw allow 443/tcp
        ufw --force reload
    else
        systemctl enable --now firewalld
        firewall-cmd --permanent --add-service=http
        firewall-cmd --permanent --add-service=https
        firewall-cmd --permanent --add-service=ssh
        firewall-cmd --reload
    fi
    
    log_success "Firewall configured"
}

# Start and enable nginx
start_nginx() {
    echo "[4/8] Starting and enabling nginx..."
    systemctl enable nginx
    systemctl start nginx
    log_success "Nginx started and enabled"
}

# Create main nginx configuration
create_main_config() {
    echo "[5/8] Creating nginx main configuration..."
    
    cat > "$NGINX_MAIN_CONFIG" << 'EOF'
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 4096;
    server_tokens off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;

    # SSL Configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_stapling on;
    ssl_stapling_verify on;

    # Gzip Settings
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types
        application/atom+xml
        application/javascript
        application/json
        application/rss+xml
        application/vnd.ms-fontobject
        application/x-font-ttf
        application/x-web-app-manifest+json
        application/xhtml+xml
        application/xml
        font/opentype
        image/svg+xml
        image/x-icon
        text/css
        text/plain
        text/x-component;

    include /etc/nginx/conf.d/*.conf;
EOF

    # Add sites-enabled include for Debian-based systems
    if [[ "$PKG_MGR" == "apt" ]]; then
        echo "    include /etc/nginx/sites-enabled/*;" >> "$NGINX_MAIN_CONFIG"
        mkdir -p /etc/nginx/sites-enabled
    fi

    echo "}" >> "$NGINX_MAIN_CONFIG"
    
    # Fix user directive for Debian-based systems
    if [[ "$PKG_MGR" == "apt" ]]; then
        sed -i "s/user nginx;/user $NGINX_USER;/" "$NGINX_MAIN_CONFIG"
    fi
    
    chmod 644 "$NGINX_MAIN_CONFIG"
    log_success "Main nginx configuration created"
}

# Create site configuration
create_site_config() {
    echo "[6/8] Creating site configuration for $DOMAIN..."
    
    local config_file
    if [[ "$PKG_MGR" == "apt" ]]; then
        config_file="/etc/nginx/sites-available/$DOMAIN"
    else
        config_file="/etc/nginx/conf.d/$DOMAIN.conf"
    fi
    
    cat > "$config_file" << EOF
server {
    listen 80;
    server_name $DOMAIN;
    
    location / {
        return 301 https://\$server_name\$request_uri;
    }
    
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
}

server {
    listen 443 ssl http2;
    server_name $DOMAIN;
    
    # SSL certificates will be added by certbot
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    
    # Rate limiting
    limit_req zone=general burst=20 nodelay;
    limit_conn conn_limit_per_ip 10;
    
    location / {
        proxy_pass http://$BACKEND_IP;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_set_header X-Forwarded-Host \$host;
        proxy_set_header X-Forwarded-Port \$server_port;
        
        # Timeouts
        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        
        # Buffer settings
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
    }
}
EOF
    
    chmod 644 "$config_file"
    
    # Enable site for Debian-based systems
    if [[ "$PKG_MGR" == "apt" ]]; then
        ln -sf "$config_file" "/etc/nginx/sites-enabled/$DOMAIN"
        rm -f /etc/nginx/sites-enabled/default
    fi
    
    log_success "Site configuration created"
}

# Obtain SSL certificate
obtain_ssl_certificate() {
    echo "[7/8] Obtaining SSL certificate for $DOMAIN..."
    
    # Test nginx configuration
    nginx -t
    systemctl reload nginx
    
    # Create webroot directory
    mkdir -p /var/www/html
    chown "$NGINX_USER:$NGINX_USER" /var/www/html
    
    # Obtain certificate
    certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos --email "admin@$DOMAIN" --redirect
    
    # Set up automatic renewal
    (crontab -l 2>/dev/null; echo "0 12 * * * /usr/bin/certbot renew --quiet") | crontab -
    
    log_success "SSL certificate obtained and auto-renewal configured"
}

# Verify installation
verify_installation() {
    echo "[8/8] Verifying installation..."
    
    # Test nginx configuration
    if nginx -t; then
        log_success "Nginx configuration is valid"
    else
        log_error "Nginx configuration test failed"
        return 1
    fi
    
    # Check if nginx is running
    if systemctl is-active --quiet nginx; then
        log_success "Nginx is running"
    else
        log_error "Nginx is not running"
        return 1
    fi
    
    # Test HTTP redirect
    if curl -sI "http://$DOMAIN" | grep -q "301\|302"; then
        log_success "HTTP to HTTPS redirect is working"
    else
        log_warn "HTTP redirect test failed - this is normal if DNS is not configured yet"
    fi
    
    log_success "Installation completed successfully!"
    echo
    echo "Next steps:"
    echo "1. Point your domain DNS A record to this server's IP address"
    echo "2. Your backend application should be running on $BACKEND_IP"
    echo "3. Test your site at https://$DOMAIN"
}

# Main execution
main() {
    log_info "Starting nginx reverse proxy installation for $DOMAIN"
    
    check_prerequisites
    detect_distro
    update_system
    install_packages
    configure_firewall
    start_nginx
    create_main_config
    create_site_config
    obtain_ssl_certificate
    verify_installation
}

main "$@"