97 lines
3.5 KiB
Bash
97 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
||
# HTTPS внутри Docker: монтирование сертификата в контейнер (Apache + mod_ssl)
|
||
#
|
||
# Использование:
|
||
# ./enable-docker-ssl.sh cloud.example.com \
|
||
# /path/to/fullchain.pem /path/to/privkey.pem
|
||
#
|
||
# Или положите файлы в docker/certs/ и запустите:
|
||
# ./enable-docker-ssl.sh cloud.example.com
|
||
#
|
||
# Nextcloud будет доступен: https://cloud.example.com:8443 (порт NEXTCLOUD_HTTPS_PORT)
|
||
|
||
set -euo pipefail
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
cd "${SCRIPT_DIR}"
|
||
|
||
# shellcheck source=../lib/common.sh
|
||
source "${SCRIPT_DIR}/../lib/common.sh"
|
||
drop_root_if_sudo "${SCRIPT_DIR}/enable-docker-ssl.sh" "$@"
|
||
|
||
[[ -f .env ]] || { echo "[ERROR] Сначала: ./install.sh"; exit 1; }
|
||
check_docker_access || exit 1
|
||
|
||
# shellcheck disable=SC1091
|
||
source .env
|
||
|
||
DOMAIN="${1:-}"
|
||
SRC_CERT="${2:-}"
|
||
SRC_KEY="${3:-}"
|
||
|
||
CERT_DIR="${SCRIPT_DIR}/certs"
|
||
CERT_FILE="${CERT_DIR}/fullchain.pem"
|
||
KEY_FILE="${CERT_DIR}/privkey.pem"
|
||
|
||
mkdir -p "${CERT_DIR}"
|
||
|
||
if [[ -z "${DOMAIN}" ]]; then
|
||
read -r -p "Домен (trusted domain): " DOMAIN
|
||
fi
|
||
|
||
# Копируем или используем certs/
|
||
if [[ -n "${SRC_CERT}" && -n "${SRC_KEY}" ]]; then
|
||
cp "${SRC_CERT}" "${CERT_FILE}"
|
||
cp "${SRC_KEY}" "${KEY_FILE}"
|
||
elif [[ ! -f "${CERT_FILE}" || ! -f "${KEY_FILE}" ]]; then
|
||
echo "[ERROR] Укажите сертификаты или положите в ${CERT_DIR}/"
|
||
echo " ./enable-docker-ssl.sh domain /path/fullchain.pem /path/privkey.pem"
|
||
exit 1
|
||
fi
|
||
|
||
chmod 600 "${KEY_FILE}" 2>/dev/null || true
|
||
|
||
# Порт HTTPS (по умолчанию 8443)
|
||
HTTPS_PORT="${NEXTCLOUD_HTTPS_PORT:-8443}"
|
||
if ! grep -q '^NEXTCLOUD_HTTPS_PORT=' .env 2>/dev/null; then
|
||
echo "NEXTCLOUD_HTTPS_PORT=${HTTPS_PORT}" >> .env
|
||
fi
|
||
|
||
touch .ssl-enabled
|
||
|
||
echo "[INFO] Сборка образа с mod_ssl..."
|
||
run_compose build app
|
||
|
||
echo "[INFO] Перезапуск с HTTPS (порт ${HTTPS_PORT})..."
|
||
run_compose up -d
|
||
ensure_app_code_ready
|
||
|
||
HTTPS_URL="https://${DOMAIN}:${HTTPS_PORT}"
|
||
|
||
echo "[INFO] Настройка Nextcloud..."
|
||
if run_compose exec -T -u www-data app php occ status &>/dev/null; then
|
||
run_compose exec -T -u www-data app php occ config:system:set overwrite.cli.url --value="${HTTPS_URL}"
|
||
run_compose exec -T -u www-data app php occ config:system:set overwriteprotocol --value="https"
|
||
# Порт в overwritehost обязателен для публичных ссылок /s/… при нестандартном HTTPS-порте
|
||
# run_compose exec -T -u www-data app php occ config:system:set overwritehost --value="${DOMAIN}:${HTTPS_PORT}"
|
||
else
|
||
echo "[WARN] Nextcloud ещё не установлен; после install.sh выполните:"
|
||
echo " ./enable-docker-ssl.sh ${DOMAIN}"
|
||
fi
|
||
|
||
current_domains="$(grep '^NEXTCLOUD_TRUSTED_DOMAINS=' .env | cut -d= -f2- | sed 's/^"//; s/"$//' || true)"
|
||
if ! printf '%s\n' "${current_domains}" | tr ' ' '\n' | grep -Fxq "${DOMAIN}"; then
|
||
current_domains="${current_domains} ${DOMAIN}"
|
||
current_domains="$(echo "${current_domains}" | xargs)"
|
||
sed -i "s|^NEXTCLOUD_TRUSTED_DOMAINS=.*|NEXTCLOUD_TRUSTED_DOMAINS=\"${current_domains}\"|" .env
|
||
fi
|
||
|
||
echo ""
|
||
echo "[INFO] === HTTPS внутри Docker включён ==="
|
||
echo " URL: ${HTTPS_URL}"
|
||
echo " HTTP: http://127.0.0.1:${NEXTCLOUD_PORT:-8080} (по-прежнему работает)"
|
||
echo " Certs: ${CERT_DIR}/ → /etc/ssl/nextcloud/ в контейнере"
|
||
echo ""
|
||
echo "Отключить: ./disable-docker-ssl.sh"
|
||
echo "Проверка: curl -kI ${HTTPS_URL}/status.php"
|