Skip to content

Commit adc740b

Browse files
xhikaxhika
committed
added files
1 parent ae13836 commit adc740b

10 files changed

+314
-0
lines changed

‎.env

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/env bash
2+
3+
# user
4+
USER=admin
5+
6+
# nginx
7+
NGINX_HOST=example.domain.com
8+
9+
# certbot mail
10+
CERTBOT_MAIL=example.mail.com
11+
12+
# mysql
13+
MYSQL_HOST=mysql
14+
MYSQL_DATABASE=test
15+
MYSQL_ROOT_USER=root
16+
MYSQL_ROOT_PASSWORD=root
17+
MYSQL_USER=user
18+
MYSQL_PASSWORD=password

‎README.md

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Create-A-Vhost!
2+
Simple script that will deploy a virtual host on ubuntu
3+
4+
5+
## Instructions
6+
Start of with adding a new A record for the host at your host provider.
7+
In your server (ubuntu)
8+
9+
```bash
10+
use git clone https://github.com/xhika/deployVH.git
11+
```
12+
13+
### Terminal
14+
```bash
15+
cd into folder
16+
17+
chmod +w+r+x install.sh
18+
chmod +w+r+x config.sh
19+
20+
!! Before running the script make sure to
21+
edit the NGINX_HOST value to your desired host name !!
22+
23+
sudo ./install.sh
24+
```
25+
26+
### Multiple Virtual Hosts
27+
If multiple host wants to be created, don't forget to change the NGINX_HOST variable's value in .env file for a new Virtual Host to be created and then run
28+
``` bash sudo ./config```
29+
30+
31+
## AWS (EC2)
32+
For this script to work on AWS EC2 instance follow these steps:
33+
```
34+
1. Enter EC2 dashboard -> Instances
35+
2. Click on your newly created instance and a window will open below.
36+
3. Click Security tab, then inder Security group click on link
37+
4. Edit inbound rules and add rules for http & https
38+
select source to be 0.0.0.0/0
39+
as the first ssh is on default.
40+
5. Save rules!
41+
```
42+
43+
## Troubleshooting
44+
- If any troubles occur, make sure ports 80,443 are available.
45+
- If certbot fails, make sure envsubst have replaced variables correctly check in /etc/nginx/sites-enabled/{your_host_name}
46+
47+

‎config.sh

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/bin/bash
2+
set -a
3+
source .env
4+
5+
# Export variables from .env
6+
export NGINX_HOST=${NGINX_HOST}
7+
export CERTBOT_MAIL=${CERTBOT_MAIL}
8+
9+
export MYSQL_HOST=${MYSQL_HOST}
10+
export MYSQL_DATABASE=${MYSQL_DATABASE}
11+
export MYSQL_ROOT_USER=${MYSQL_ROOT_USER}
12+
export MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
13+
export MYSQL_USER=${MYSQL_USER}
14+
export MYSQL_PASSWORD=${MYSQL_PASSWORD}
15+
16+
sudo unlink /etc/nginx/sites-enabled/default
17+
18+
sudo mkdir -p /var/lib/letsencrypt/.well-known
19+
sudo chgrp www-data /var/lib/letsencrypt
20+
sudo chmod g+s /var/lib/letsencrypt
21+
sudo cp letsencrypt.conf /etc/nginx/snippets/letsencrypt.conf
22+
23+
24+
25+
# Create directory for host
26+
sudo mkdir -p /var/www/${NGINX_HOST}/public
27+
28+
# Replace variables
29+
envsubst "$(printf '${%s} ' $(env | sed 's/=.*//'))" < ./nginx.conf.template > /etc/nginx/sites-available/nginx.conf
30+
31+
# Copy to virtual host
32+
sudo cp /etc/nginx/sites-available/nginx.conf /etc/nginx/sites-available/${NGINX_HOST}
33+
34+
# Symlink
35+
sudo ln -s /etc/nginx/sites-available/${NGINX_HOST} /etc/nginx/sites-enabled/
36+
37+
# Reload nginx
38+
sudo nginx -t
39+
sudo service nginx reload
40+
41+
# Generating Certificate
42+
sudo certbot certonly --webroot --non-interactive --agree-tos --email [email protected] \
43+
-w /var/www/${NGINX_HOST}/public -d ${NGINX_HOST} -d www.${NGINX_HOST}
44+
45+
# Replace variables for ssl Virtual Host
46+
envsubst "$(printf '${%s} ' $(env | sed 's/=.*//'))" < ./nginx-ssl.conf.template > /etc/nginx/sites-available/nginx-ssl.conf
47+
# Copy to Virtual Host
48+
sudo cp /etc/nginx/sites-available/nginx-ssl.conf /etc/nginx/sites-available/${NGINX_HOST}
49+
50+
# Reload nginx
51+
sudo nginx -t
52+
sudo service nginx reload
53+
54+
sudo certbot renew --dry-run
55+
56+
# .well-known directory
57+
sudo mkdir /var/www/${NGINX_HOST}/public/.well-known
58+
sudo chown www-data:www-data -R /var/www/${NGINX_HOST}/public/.well-known
59+
sudo chmod 755 -R /var/www/${NGINX_HOST}/public/.well-known
60+
61+
# Copy index to domain path
62+
sudo cp ./index.php /var/www/${NGINX_HOST}/public
63+
64+
65+
66+
67+
68+

‎index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
3+
echo "Hello world!";

‎install.sh

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/bash
2+
3+
# Keep up to date!
4+
sudo apt update && apt -y upgrade
5+
sudo apt-get update
6+
sudo apt-get install -y software-properties-common
7+
8+
# Install php
9+
sudo apt install -y php php-cli php-fpm php-json php-pdo php-mysql php-zip php-gd php-mbstring php-curl php-xml php-pear php-bcmath
10+
11+
# Install node
12+
sudo apt install -y nodejs
13+
14+
# Intall vim
15+
sudo apt install -y vim
16+
17+
# Open ports & remove apache2
18+
sudo ufw allow http && sudo ufw allow https && sudo ufw reload
19+
sudo apt remove -y --purge --auto-remove apache2
20+
sudo rm -rf /var/www/html
21+
22+
23+
# Install nginx
24+
sudo apt install -y nginx
25+
sudo apt install -y python3-certbot-nginx python3-pyparsing
26+
sudo rm -rf /var/www/html
27+
28+
# Install gettext for envsubst
29+
sudo apt-get install -y gettext-base
30+
31+
# Install mysql
32+
sudo apt install -y mysql-server mysql-client
33+
34+
# Install certbot
35+
sudo apt install -y certbot python3-certbot-nginx
36+
37+
# Install snap for certbot
38+
sudo snap install -y core; sudo snap refresh core
39+
sudo snap install -y --classic certbot
40+
sudo ln -s /snap/bin/certbot /usr/bin/certbot
41+
42+
43+
44+
# Check / Start & Reload nginx
45+
sudo nginx -t
46+
sudo service nginx start
47+
sudo service nginx reload
48+
49+
##LATEST
50+
# SSL
51+
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
52+
53+
sudo cp ./ssl-params.conf /etc/nginx/snippets/ssl-params.conf
54+
55+
# fail2ban
56+
sudo apt install -y fail2ban
57+
sudo cp ./jail.local /etc/fail2ban/jail.local
58+
sudo service fail2ban restart && sudo fail2ban-client status
59+
60+
# Permissions
61+
sudo usermod -a -G www-data ${USER}
62+
#
63+
# ACL
64+
sudo apt -y install acl
65+
#
66+
## sudo su
67+
sudo chown -R www-data:www-data /var/www && setfacl -Rd -m g:www-data:rwx /var/www && setfacl -R -m g:www-data:rwx /var/www && chmod -R g+s /var/www
68+
69+
70+
# Nginx configuration
71+
cp ./nginx.conf.template /nginx.conf.template
72+
cp ./nginx.conf.template /etc/nginx/sites-available/nginx.conf
73+
cp ./nginx-ssl.conf.template /etc/nginx/sites-available/nginx-ssl.conf
74+
75+
# Run second script
76+
sudo ./config.sh
77+
78+
79+

‎jail.local

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[sshd]
2+
enabled = true
3+
port = 3113
4+
[nginx-http-auth]
5+
enabled = true

‎letsencrypt.conf

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
location ^~ /.well-known/acme-challenge/ {
2+
allow all;
3+
root /var/lib/letsencrypt/;
4+
default_type "text/plain";
5+
try_files $uri =404;
6+
}

‎nginx-ssl.conf.template

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
server {
2+
listen 80;
3+
listen [::]:80;
4+
5+
server_name ${NGINX_HOST} www.${NGINX_HOST};
6+
7+
return 301 https://${NGINX_HOST}$request_uri;
8+
}
9+
10+
server {
11+
listen 443 ssl http2;
12+
listen [::]:443 ssl http2;
13+
14+
server_name www.${NGINX_HOST};
15+
16+
ssl_certificate /etc/letsencrypt/live/${NGINX_HOST}/fullchain.pem;
17+
ssl_certificate_key /etc/letsencrypt/live/${NGINX_HOST}/privkey.pem;
18+
include snippets/ssl-params.conf;
19+
20+
return 301 https://${NGINX_HOST}$request_uri;
21+
}
22+
23+
server {
24+
listen 443 ssl http2;
25+
listen [::]:443 ssl http2;
26+
27+
server_name ${NGINX_HOST};
28+
29+
ssl_certificate /etc/letsencrypt/live/${NGINX_HOST}/fullchain.pem;
30+
ssl_certificate_key /etc/letsencrypt/live/${NGINX_HOST}/privkey.pem;
31+
32+
include snippets/ssl-params.conf;
33+
34+
root /var/www/${NGINX_HOST}/public;
35+
index index.php index.html index.htm;
36+
37+
location / {
38+
try_files $uri $uri/ /index.php?q=$uri&$args;
39+
}
40+
41+
location ~ \.php$ {
42+
include snippets/fastcgi-php.conf;
43+
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
44+
}
45+
46+
location ~ /\.ht {
47+
deny all;
48+
}
49+
}

‎nginx.conf.template

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
server {
2+
listen 80;
3+
listen [::]:80;
4+
5+
server_name ${NGINX_HOST} www.${NGINX_HOST};
6+
7+
root /var/www/${NGINX_HOST}/public;
8+
index index.php index.html index.htm;
9+
10+
location / {
11+
try_files $uri $uri/ /index.php?q=\$uri\&$args;
12+
}
13+
14+
location ~ \.php$ {
15+
include snippets/fastcgi-php.conf;
16+
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
17+
}
18+
19+
location ~ /\.ht {
20+
deny all;
21+
}
22+
}

‎ssl-params.conf

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# https://cipherli.st/ & https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
2+
3+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
4+
ssl_prefer_server_ciphers on;
5+
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
6+
ssl_ecdh_curve secp384r1;
7+
ssl_session_cache shared:SSL:10m;
8+
ssl_session_tickets off;
9+
ssl_stapling on;
10+
ssl_stapling_verify on;
11+
resolver 8.8.8.8 8.8.4.4 valid=300s;
12+
resolver_timeout 5s;
13+
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
14+
add_header X-Frame-Options DENY;
15+
add_header X-Content-Type-Options nosniff;
16+
17+
ssl_dhparam /etc/ssl/certs/dhparam.pem;

0 commit comments

Comments
 (0)