mirror of
https://github.com/itiligent/Easy-Guacamole-Installer.git
synced 2025-12-13 18:02:32 +00:00
8c9e1f34b3
Installs Guac v1.5.1. All manual scripts scripts now customise with install variables at install. Backup SMTP working. Many tidy ups with flow and menus, clearer readme notes for further customisation and editing
127 lines
3.9 KiB
Bash
127 lines
3.9 KiB
Bash
#!/bin/bash
|
|
#######################################################################################################################
|
|
# Add Let's Encrypt SSL Certificates to Guacamole with Nginx reverse proxy
|
|
# For Ubuntu / Debian / Raspian
|
|
# 4b of 4
|
|
# David Harrop
|
|
# April 2023
|
|
#######################################################################################################################
|
|
|
|
# Prepare text output colours
|
|
GREY='\033[0;37m'
|
|
DGREY='\033[0;90m'
|
|
GREYB='\033[1;37m'
|
|
RED='\033[0;31m'
|
|
LRED='\033[0;91m'
|
|
GREEN='\033[0;32m'
|
|
LGREEN='\033[0;92m'
|
|
YELLOW='\033[0;33m'
|
|
LYELLOW='\033[0;93m'
|
|
BLUE='\033[0;34m'
|
|
LBLUE='\033[0;94m'
|
|
CYAN='\033[0;36m'
|
|
LCYAN='\033[0;96m'
|
|
MAGENTA='\033[0;35m'
|
|
LMAGENTA='\033[0;95m'
|
|
NC='\033[0m' #No Colour
|
|
|
|
echo
|
|
echo
|
|
echo -e "${LGREEN}Installing Let's Encrypt SSL configuration for Nginx...${GREY}"
|
|
echo
|
|
|
|
# Install nginx
|
|
apt-get update -qq &>> ${LOG_LOCATION}
|
|
apt-get install nginx certbot python3-certbot-nginx -qq -y &>> ${LOG_LOCATION}
|
|
|
|
# Backup the current Nginx config
|
|
cp /etc/nginx/sites-enabled/${PROXY_SITE} $DOWNLOAD_DIR/${PROXY_SITE}-nginx.bak
|
|
echo
|
|
echo -e "${GREY}Backing up previous Nginx proxy to $DOWNLOAD_DIR/$PROXY_SITE-nginx.bak"
|
|
if [ $? -ne 0 ]; then
|
|
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
|
|
exit 1
|
|
else
|
|
echo -e "${LGREEN}OK${GREY}"
|
|
echo
|
|
fi
|
|
|
|
# Configure Nginx to accept the new certificates
|
|
echo -e "${GREY}Configuring Nginx proxy for Let's Encrypt SSL and setting up automatic HTTP redirect...${GREY}"
|
|
cat > /etc/nginx/sites-available/$PROXY_SITE <<EOL
|
|
server {
|
|
listen 80 default_server;
|
|
#listen [::]:80 default_server;
|
|
root /var/www/html;
|
|
index index.html index.htm index.nginx-debian.html;
|
|
server_name $PROXY_SITE;
|
|
location / {
|
|
proxy_pass $GUAC_URL;
|
|
proxy_buffering off;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection \$http_connection;
|
|
access_log off;
|
|
}
|
|
}
|
|
EOL
|
|
if [ $? -ne 0 ]; then
|
|
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
|
|
exit 1
|
|
else
|
|
echo -e "${LGREEN}OK${GREY}"
|
|
echo
|
|
fi
|
|
|
|
# Bounce Nginx to reload the new Nginx config so certbot config can start continue
|
|
systemctl restart nginx
|
|
|
|
# Run certbot to create and associate certificates with currenly public IP (must have tcp 80 and 443 open to work)
|
|
certbot --nginx -n -d $LE_DNS_NAME --email $LE_EMAIL --agree-tos --redirect --hsts
|
|
echo -e
|
|
echo -e "${GREY}Let's Encrypt successfully installed, but check for any errors above (DNS & firewall are the usual culprits).${GREY}"
|
|
if [ $? -ne 0 ]; then
|
|
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
|
|
exit 1
|
|
else
|
|
echo -e "${LGREEN}OK${GREY}"
|
|
echo
|
|
fi
|
|
|
|
# Select a random daily time to schedule a daily check for Let's Encrypt certificates due to expire in next 30 days.
|
|
# If are any due to expire within a 30 day window, Certbot will attempt to renew automatically renew.
|
|
echo -e "${GREY}Scheduling automatic certificate renewals for certificates with < 30 days till expiry.)${GREY}"
|
|
#Dump out the current crontab
|
|
crontab -l > cron_1
|
|
# Remove any previosly added certbot renewal entries
|
|
sed -i '/# certbot renew/d' cron_1
|
|
# Randomly choose a daily update schedule and append this to the cron schedule
|
|
HOUR=$(shuf -i 0-23 -n 1)
|
|
MINUTE=$(shuf -i 0-59 -n 1)
|
|
echo "${MINUTE} ${HOUR} * * * /usr/bin/certbot renew --quiet --pre-hook 'service nginx stop' --post-hook 'service nginx start'" >> cron_1
|
|
# Overwrite old cron settings and cleanup
|
|
crontab cron_1
|
|
rm cron_1
|
|
if [ $? -ne 0 ]; then
|
|
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
|
|
exit 1
|
|
else
|
|
echo -e "${LGREEN}OK${GREY}"
|
|
echo
|
|
fi
|
|
|
|
# Reload everything once again
|
|
echo -e "${GREY}Restaring Guacamole & Ngnix..."
|
|
sudo systemctl restart $TOMCAT_VERSION
|
|
sudo systemctl restart guacd
|
|
sudo systemctl restart nginx
|
|
if [ $? -ne 0 ]; then
|
|
echo -e "${RED}Failed. See ${LOG_LOCATION}${GREY}" 1>&2
|
|
exit 1
|
|
else
|
|
echo -e "${LGREEN}OK${GREY}"
|
|
fi
|
|
|
|
# Done
|
|
echo -e ${NC}
|