#!/bin/bash
# shellcheck disable=SC2034,SC2086
#
# Name: easy-ssl
# Version: 2.8.3
# Description: Seedbox SSL Manager
#
# (c) 2020-2025, Rapidseedbox, alexey@rapidseedbox.com
# boban@rapidseedbox.com
# !!! DEBUG !!!
#set -x
set -o pipefail
export LANG=en_US
export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# -- Check if all required commands available
_rc=0
for _cmd in \
"apachectl" \
"awk" \
"basename" \
"curl" \
"diff" \
"grep" \
"ip" \
"lsb_release" \
"md5sum" \
"ping" \
"sed" \
"service" \
"systemctl" \
"wget" \
; do
if ! command -v "${_cmd}" > /dev/null 2>&1 ; then
>&2 echo "${_cmd}: command not found!"
(( _rc ++ ))
fi
done
# --
if ! id "user" > /dev/null 2>&1 ; then
>&2 echo "'user' account not found!"
(( _rc ++ ))
fi
# --
if [ "${_rc}" != "0" ] ; then
>&2 echo "Can not continue..."
exit 1
fi
# --
SC_NAME="$( basename "${0}" )"
SC_VER="$( grep -m 1 -E '^#\s*Version:\s+' "${0}" | awk '{print $NF}' )"
SC_PID="$$"
SCRIPT_ARGS=$@
# -- Primary client subdomain
SUBDOMAIN="a.seedbox.vip"
# -- Certificates remote storage URL
SSL_STORAGE_SERVER="rsb-supp.rapidseedbox.com"
SSL_STORAGE_URL="https://${SSL_STORAGE_SERVER}/box-cert/${SUBDOMAIN}"
# -- Certificate files
CERT_FILES="cert.pem chain.pem fullchain.pem privkey.pem"
# -- Certificates storage on the box
SSL_ROOT_DIR="/etc/ssl"
SSL_DIR="${SSL_ROOT_DIR}/${SUBDOMAIN}"
# -- Log directory
LOG_DIR="/var/log/rsbssl"
[ -d "${LOG_DIR}" ] || mkdir -p "${LOG_DIR}"
# -- Config / stats directory
[ ! -d "/var/local/rsbssl" ] \
&& mkdir -p "/var/local/rsbssl" > /dev/null 2>&1
# -- Access log for `rsb-p3a-client`
APACHE_RSB_COLLECTOR_LOG="/run/rsb-p3a-access.log"
LSB_VENDOR="$( lsb_release -si 2>&1 | awk '{print $1}' )"
LSB_RELEASE="$( lsb_release -sr )"
case "${LSB_VENDOR}" in
"CentOS"|"CentOSStream"|"Debian")
LSB_RELEASE="$( echo "${LSB_RELEASE}" | awk -F'.' '{print $1}' )"
;;
esac
LSB_VER="${LSB_VENDOR}${LSB_RELEASE}"
# ------------------------------------------------------------------------
#
# -- `a2enmod` functions
#
# ------------------------------------------------------------------------
a2enmod_centos () {
local _mod="${1}"
local _mods_available
local _rc=1
if [ -e "/etc/apache2/modules/mod_${_mod}.so" ] ; then
cat <<-EOF > "/etc/apache2/conf.modules.d/50-${_mod}.conf"
LoadModule ${_mod} modules/mod_${_mod}.so
EOF
_rc=$?
else
_rc=1
fi
return ${_rc}
}
a2ensite_centos () {
local _site="${1}"
local _site_available
local _rc=1
_site_conf="${_site}"
if [ ! -e "/etc/apache2/sites-available/${_site}" ] ; then
if [ -e "/etc/apache2/sites-available/${_site}.conf" ] ; then
_site_conf="${_site}.conf"
fi
fi
if [ -e "/etc/apache2/sites-available/${_site_conf}" ] ; then
ln -sf "/etc/apache2/sites-available/${_site_conf}" \
"/etc/apache2/sites-enabled/${_site_conf}"
fi
_rc=$?
return ${_rc}
}
# ------------------------------------------------------------------------
#
# -- Color output functions
#
# https://github.com/xr09/rainbow.sh
#
# ------------------------------------------------------------------------
__RAINBOWPALETTE="1"
__colortext () {
if [ "${COLORS}" = "yes" ] ; then
echo -n "\e[${__RAINBOWPALETTE};${2}m${1}\e[0m"
else
echo -n "${1}"
fi
}
echogreen () {
echo -ne "$(__colortext "${1}" "32")"
}
echored () {
echo -ne "$(__colortext "${1}" "31")"
}
echoblue () {
echo -ne "$(__colortext "${1}" "34")"
}
echopurple () {
echo -ne "$(__colortext "${1}" "35")"
}
echoyellow () {
echo -ne "$(__colortext "${1}" "33")"
}
echocyan () {
echo -ne "$(__colortext "${1}" "36")"
}
echodarkgray () {
echo -ne "$(__colortext "${1}" "30")"
}
echolightgray () {
echo -ne "$(__colortext "${1}" "37")"
}
# ------------------------------------------------------------------------
#
# -- Apache2 config directory & settings
#
# ------------------------------------------------------------------------
case "${LSB_VENDOR}" in
"CentOS"|"CentOSStream")
APACHE2_SVC="httpd"
APACHE2_CFG_DIR="/etc/httpd"
APACHE2_LOG_DIR="/var/log/httpd"
A2ENMOD="a2enmod_centos"
A2ENSITE="a2ensite_centos"
if [ ! -d "${APACHE2_CFG_DIR}/userconf-enabled" ] ; then
echodarkgray "$( mkdir -vp "${APACHE2_CFG_DIR}/userconf-enabled" 2>&1 )\n"
echo "IncludeOptional userconf-enabled/*.conf" > "${APACHE2_CFG_DIR}/conf.d/userconf.conf"
fi
[ ! -e "/var/www/html/index.html" ] \
&& echo -n "" > "/var/www/html/index.html"
if [ ! -e "${SSL_ROOT_DIR}/certs/dhparam.pem" ] ; then
openssl dhparam -out "${SSL_ROOT_DIR}/certs/dhparam.pem" 2048
fi
;;
"Debian"|"Ubuntu")
APACHE2_SVC="apache2"
APACHE2_CFG_DIR="/etc/apache2"
APACHE2_LOG_DIR="/var/log/apache2"
A2ENMOD="a2enmod"
A2ENSITE="a2ensite"
;;
esac
usage () {
cat <<-EOF
Request SSL certificate for RSB seedbox
Usage:
------------
${SC_NAME} [-h] [-b|-n] [-f | -r] [-s delay]
-h - Display this help message
-b or -n - Batch mode - useful for cronjobs
-f - Force configuration reload
-r - Remove SSL configuration
-t - Use development version
-d - Debugging mode (bash -x)
-s NUM - Sleep for up to NUM secods before execution
EOF
}
# ------------------------------------------------------------------------
#
# -- Check /etc/resolv.conf consistency before we start
#
# ------------------------------------------------------------------------
if ! grep -q -E '^nameserver\s+8\.8\.8\.8\s*$' "/etc/resolv.conf" 2> /dev/null ; then
echored "Adding 'nameserver 8.8.8.8' ->> /etc/resolv.conf\n"
echo "nameserver 8.8.8.8" >> "/etc/resolv.conf"
fi
if ! grep -q -E '^nameserver\s+8\.8\.4\.4\s*$' "/etc/resolv.conf" 2> /dev/null ; then
echored "Adding 'nameserver 8.8.4.4' ->> /etc/resolv.conf\n"
echo "nameserver 8.8.4.4" >> "/etc/resolv.conf"
fi
# ------------------------------------------------------------------------
#
# -- Check if script upgrade is available
#
# ------------------------------------------------------------------------
RSB_URL="http://installers.rapidseedbox.com/scripts/whmcs_client_installers"
DEVELOPMENT="no"
for _s in "${@}" ; do
if [ "${_s}" = "-t" ] ; then
RSB_URL="https://installers.seedbox.vip/oci"
DEVELOPMENT="yes"
echored "==================================\n"
echored "==== >>> DEVELOPMENT MODE <<< ====\n"
echored "==================================\n"
fi
done
# --
if wget \
-4 -nc -q --no-check-certificate \
-O "/var/tmp/${SC_NAME}.${SC_PID}" \
--timeout=60 --tries=50 \
"${RSB_URL}/support/rsb-scripts/common/${SC_NAME}" > /dev/null 2>&1
then
_rc=0
_sfx=""
_NEW_VER="$( grep -m 1 -E '^#\s*Version:\s+' "/var/tmp/${SC_NAME}.${SC_PID}" \
| awk '{print $NF}' )"
if command -v "diff" > /dev/null 2>&1 ; then
diff "/var/tmp/${SC_NAME}.${SC_PID}" "/usr/local/bin/${SC_NAME}" > /dev/null 2>&1
_rc=$?
[ "${_rc}" != "0" ] && [ "${_NEW_VER}" = "${SC_VER}" ] \
&& _sfx=" (modified)"
else
[ "${_NEW_VER}" != "${SC_VER}" ] \
&& _rc=1
fi
if [ "${_rc}" != "0" ] ; then
>&2 echo "${SC_NAME} ${SC_VER}: updating to ${_NEW_VER}${_sfx} and restarting..."
mv -f "/var/tmp/${SC_NAME}.${SC_PID}" "/usr/local/bin/${SC_NAME}"
chmod -f 755 "/usr/local/bin/${SC_NAME}"
export KEEP_ANON_DOWNLOADS_CFG="yes"
>&2 exec "${0}" -f ${SCRIPT_ARGS}
exit 0
else
rm -f "/var/tmp/${SC_NAME}.${SC_PID}" > /dev/null 2>&1
fi
fi
[ -e "/var/tmp/${SC_NAME}.${SC_PID}" ] \
&& rm -f "/var/tmp/${SC_NAME}.${SC_PID}" > /dev/null 2>&1
# ------------------------------------------------------------------------
#
# -- Parse command line
#
# ------------------------------------------------------------------------
COLORS="yes"
OPTIND=1
PARSE_ERR=0
BATCH="no"
FORCE="no"
REMOVE="no"
SLEEP="no"
while getopts ":s:ohbdnfrt" params; do
case "${params}" in
h)
usage ; exit 0
;;
b|n)
COLORS="no"
BATCH="yes"
continue
;;
f)
FORCE="yes"
continue
;;
r)
REMOVE="yes"
continue
;;
t)
continue
;;
d)
set -x
continue
;;
s)
if [[ ${OPTARG} = -* ]] ; then
[ -n "${ERR_MSG}" ] && ERR_MSG="${ERR_MSG}; "
ERR_MSG="${ERR_MSG}Option -${params} requires an argument"
PARSE_ERR=1
continue
fi
SLEEP="${OPTARG}"
;;
\?)
echo "Invalid option: $( echored "-${OPTARG}\n" )"
PARSE_ERR=1
;;
esac
done
if [ "${PARSE_ERR}" != "0" ] ; then
usage ; exit 1
fi
shift "$(( OPTIND - 1 ))"
# -- Sleeping if requested ....
if [ "${SLEEP}" != "no" ] ; then
_sleep="$(( RANDOM % SLEEP ))"
echodarkgray "Sleeping for ${_sleep} seconds...\n"
sleep "${_sleep}"
fi
# ------------------------------------------------------------------------
#
# -- Check network configuration
#
# Info:
# https://unix.stackexchange.com/questions/22615/how-can-i-get-my-external-ip-address-in-a-shell-script
#
# ------------------------------------------------------------------------
_ip_msg=""
_cnt=0
for _url in \
"https://ifconfig.co" \
"https://ifconfig.me" \
"https://canhazip.com" \
"http://whatismyip.akamai.com" \
"https://ipecho.net/plain" \
; do
for _try in $( seq 1 5 ) ; do
(( _cnt ++ ))
[ "${BATCH}" = "no" ] \
&& echodarkgray "Checking network configuration... ${_cnt}"
IP="$( curl -4 -s "${_url}" 2>&1 )"
_rc=$?
if [ "${_rc}" != "0" ] || [ -z "${IP}" ] ; then
sleep 3
[ "${BATCH}" = "no" ] \
&& echodarkgray "\r"
fi
_s="$( ip -o route get "${IP}" 2>&1 )"
_rc=$?
if [ "${_rc}" != "0" ] ; then
[ -n "${_ip_msg}" ] && _ip_msg="${_ip_msg}\n"
_ip_msg="${_ip_msg}${IP}:\t${_s}"
sleep 3
[ "${BATCH}" = "no" ] \
&& echodarkgray "\r"
else
_rc=0
[ "${BATCH}" = "no" ] \
&& echodarkgray "\rChecking network configuration... "
break 2
fi
done
done
[ "${BATCH}" != "no" ] \
&& echodarkgray "Checking network configuration... ${_cnt} attempt(s)"
if [ "${_rc}" != "0" ] ; then
echodarkgray ": $( echored "FAILED: Return code: [${_rc}]" )\n"
if [ -n "${_ip_msg}" ] ; then
echodarkgray "Message: $( echored "${_ip_msg}" )\n"
fi
exit 1
fi
if [ -z "${IP}" ] ; then
echodarkgray ": $( echored "FAILED: Can't determine IP address!" )\n"
exit 1
fi
echodarkgray ": $( echogreen "OK" )\n"
echodarkgray "IP address: $( echogreen "${IP}" )\n"
IP_WITH_DASH="$( tr '.' '-' <<< "${IP}" )"
SERVER_NAME="${IP_WITH_DASH}.${SUBDOMAIN}"
echodarkgray "Server name: $( echogreen "${SERVER_NAME}" )\n"
# ------------------------------------------------------------------------
#
# -- Apache & `plex` functions
#
# ------------------------------------------------------------------------
#
# ---- Get PLEX setting
getPref () {
local key="$1"
sed -n -E "s/^.*${key}=\"([^\"]*)\".*$/\1/p" "${prefFile}"
}
# ---- Set PLEX setting
setPref () {
local key="$1"
local value="$2"
local count
count="$( grep -c "${key}" "${prefFile}" )"
count=$(( count + 0 ))
if [[ $count -gt 0 ]]; then
sed -i -E "s/${key}=\"([^\"]*)\"/${key}=\"$value\"/" "${prefFile}"
else
sed -i -E "s/\/>/ ${key}=\"$value\"\/>/" "${prefFile}"
fi
}
# ---- Delete PLEX setting
delPref () {
local key="$1"
sed -i -E "s/${key}=\"([^\"]*)\"//" "${prefFile}"
}
_remove_apache2_site () {
local _sfx="${1}"
local _descr="${2}"
[ -z "${_sfx}" ] && return 1
[ -z "${_descr}" ] && _descr="${_sfx^^}"
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-${_sfx}.conf" ] \
|| [ -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-${_sfx}.conf" ] \
|| [ -L "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-${_sfx}.conf" ] \
|| [ -L "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-${_sfx}.conf" ]
then
echodarkgray "Removing Apache ${_descr} site"
if rm -f \
"${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-${_sfx}.conf" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-${_sfx}.conf"
then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
APACHE_RESTART="yes"
fi
}
[ "${BATCH}" = "no" ] \
&& echoyellow "${SC_NAME} ${SC_VER} (${LSB_VENDOR} ${LSB_RELEASE}): Starting\n"
# ------------------------------------------------------------------------
#
# -- Check configuration version
#
# ------------------------------------------------------------------------
if [ ! -e "/var/local/rsbssl/version.id" ] ; then
FORCE="yes"
[ "${BATCH}" = "no" ] \
&& echoyellow "${SC_NAME} ${SC_VER} (${LSB_VENDOR} ${LSB_RELEASE}): Will update configuration\n"
else
_ver="$( cat "/var/local/rsbssl/version.id" )"
if [ "${_ver}" != "${SC_VER}" ] ; then
FORCE="yes"
[ "${BATCH}" = "no" ] \
&& echoyellow "${SC_NAME} ${SC_VER} (${LSB_VENDOR} ${LSB_RELEASE}): Will update configuration: v${_ver} -> v${SC_VER}\n"
fi
fi
# ------------------------------------------------------------------------
#
# -- Check ${SSL_STORAGE_SERVER} availability
#
# ------------------------------------------------------------------------
if [ "${REMOVE}" = "no" ] ; then
[ "${BATCH}" = "no" ] \
&& echodarkgray "Checking '${SSL_STORAGE_SERVER}' availability"
if ! ping -c 4 "${SSL_STORAGE_SERVER}" > /dev/null 2>&1 ; then
echodarkgray ": $( echored "${SSL_STORAGE_SERVER}: host is not reachable!" )\n"
exit 1
fi
[ "${BATCH}" = "no" ] \
&& echodarkgray ": $( echogreen "OK" )\n"
fi
# ------------------------------------------------------------------------
#
# -- Check Apache2 status
#
# ------------------------------------------------------------------------
[ "${BATCH}" = "no" ] \
&& echodarkgray "Checking Apache2 status"
if [ ! -e "${APACHE2_CFG_DIR}/sites-available" ] ; then
echored ": Service '${APACHE2_SVC}' is not installed!\n"
exit 1
fi
[ "${BATCH}" = "no" ] \
&& echodarkgray ": $( echogreen "OK" )\n"
# ------------------------------------------------------------------------
#
# -- Initial cleanup
#
# ------------------------------------------------------------------------
case "${LSB_VENDOR}" in
"Debian"|"Ubuntu")
# -- Workaround for missing `mod_security2` on Debian/Ubuntu
if [ ! -e "${APACHE2_CFG_DIR}/mods-available/security2.conf" ] \
|| [ ! -e "${APACHE2_CFG_DIR}/mods-available/security2.load" ]
then
for _f in \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dav.conf" \
"${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-dav.conf" \
; do
if [ -e "${_f}" ] ; then
echodarkgray "$( rm -vf "${_f}" 2>&1 )\n"
fi
done
fi
;;
*)
[ -e "/etc/httpd/conf.modules.d/50-dav.conf" ] \
&& echodarkgray "$( rm -vf "/etc/httpd/conf.modules.d/50-dav.conf" 2>&1 )\n"
[ -e "/etc/httpd/conf.modules.d/50-dav_fs.conf" ] \
&& echodarkgray "$( rm -vf "/etc/httpd/conf.modules.d/50-dav_fs.conf" 2>&1 )\n"
;;
esac
# ------------------------------------------------------------------------
#
# -- Just remove configuration and exit
#
# ------------------------------------------------------------------------
if [ "${REMOVE}" = "yes" ] ; then
# -- Remove `cron` settings
[ -e "/var/local/rsbssl/cron.sh.inc" ] \
&& rm -vf "/var/local/rsbssl/cron.sh.inc" > /dev/null 2>&1
# -- Remove `cron` job
ls -A /etc/cron.d/easy-ssl > /dev/null 2>&1 \
&& rm -vf "/etc/cron.d/easy-ssl" > /dev/null 2>&1
# -- Remove `apache2` sites
ls -A "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}"*.conf > /dev/null 2>&1 \
&& echodarkgray "$( rm -vf "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}"*.conf 2>&1 )\n"
ls -A "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}"*.conf > /dev/null 2>&1 \
&& echodarkgray "$( rm -vf "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}"*.conf 2>&1 )\n"
# -- Remove ${SUBDOMAIN} certificates
if [ -n "${SUBDOMAIN}" ] && [ -d "/etc/ssl/${SUBDOMAIN}" ] ; then
echodarkgray "$( rm -rvf "/etc/ssl/${SUBDOMAIN}" 2>&1 )\n"
fi
# -- Set up ThinLinc
if [ -e "/opt/thinlinc/bin/tl-config" ] ; then
TL_CONFIG="yes"
/opt/thinlinc/bin/tl-config /webaccess/cert=/opt/thinlinc/etc/tlwebaccess/server.crt
/opt/thinlinc/bin/tl-config /webaccess/certkey=/opt/thinlinc/etc/tlwebaccess/server.key
echodarkgray "ThinLinc Web Access service"
if systemctl is-enabled "tlwebaccess" > /dev/null 2>&1 ; then
if service "tlwebaccess" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
echodarkgray "ThinLinc VsmAgent service"
/opt/thinlinc/bin/tl-config /vsmagent/agent_hostname="${IP}"
if systemctl is-enabled "vsmagent" > /dev/null 2>&1 ; then
if service "vsmagent" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
fi
#
if systemctl is-active "${APACHE2_SVC}" > /dev/null 2>&1 ; then
echodarkgray "Reloading '${APACHE2_SVC}' service"
if service "${APACHE2_SVC}" reload > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
exit 2
fi
else
echored "'${APACHE2_SVC}' service is not active\n"
fi
if [ "${BATCH}" = "no" ] ; then
SERVER_NAME="${IP}"
cat <<-EOF
Sincere condolences :(
-----------------------
You can now access your server using this URL:
$( echocyan "https://${SERVER_NAME}" )
EOF
if id "plex" > /dev/null 2>&1 ; then
cat <<-EOF
To access Plex Media Server you can use this URL:
$( echocyan "http://${SERVER_NAME}:32400/web" )
EOF
fi
if id "emby" > /dev/null 2>&1 ; then
cat <<-EOF
To access Emby Media Server you can use this URL:
$( echocyan "http://${SERVER_NAME}:8096" )
EOF
fi
if id "jellyfin" > /dev/null 2>&1 ; then
cat <<-EOF
To access Jellyfin Media Server you can use this URL:
$( echocyan "http://${SERVER_NAME}:3096" )
EOF
fi
if [ "${TL_CONFIG}" = "yes" ] ; then
cat <<-EOF
To access ThinLinc Remote Desktop you can use this URL:
$( echocyan "https://${SERVER_NAME}:300" )
EOF
fi
DL_CONFIG="no"
if [ -e "/var/local/rsbssl/anondownloads.cfg" ] ; then
DL_CONFIG="yes"
DL_PATH="$( cat "/var/local/rsbssl/anondownloads.cfg" )"
fi
if [ "${DL_CONFIG}" = "yes" ] ; then
cat <<-EOF
To access user Downloads folder anonymously you can use this URL:
$( echocyan "https://${SERVER_NAME}/${DL_PATH}" )
EOF
fi
fi
#
exit 0
fi
# ------------------------------------------------------------------------
#
# -- Check cerificates MD5 sums
#
# ------------------------------------------------------------------------
_certs_md5_sums_ok="no"
if [ -n "${SUBDOMAIN}" ] && ls -A "/etc/ssl/${SUBDOMAIN}"/*.pem > /dev/null 2>&1 ; then
echodarkgray "Checking cerificates MD5 sums ..."
wget -4 -nc -q --no-check-certificate --timeout=40 --tries=10 -O - \
"${SSL_STORAGE_URL}/checksum.md5" > "/tmp/easy-ssl-cert-checksum.md5"
_rc="$?"
if [ "${_rc}" != "0" ] || [ ! -s "/tmp/easy-ssl-cert-checksum.md5" ] ; then
echored ": Error fetching ${SSL_STORAGE_URL}/checksum.md5 -> RC: [${_rc}]\n"
else
pushd "/etc/ssl/${SUBDOMAIN}" > /dev/null 2>&1
_ret="$( md5sum -c "/tmp/easy-ssl-cert-checksum.md5" 2>&1 )"
_rc="$?"
if [ "${_rc}" != "0" ] || [ -z "${_ret}" ] ; then
echored ": FAILED -> RC: [${_rc}]\n"
[ -n "${_ret}" ] \
&& echored "${_ret}\n"
else
_certs_md5_sums_ok="yes"
echogreen ": OK\n"
[ -n "${_ret}" ] \
&& echodarkgray "${_ret}\n"
fi
popd > /dev/null 2>&1
fi
fi
# ------------------------------------------------------------------------
#
# -- Fetch SSL cerificates (if needed - MD5 sums mismatch, etc...)
#
# ------------------------------------------------------------------------
if [ "${_certs_md5_sums_ok}" != "yes" ] ; then
__wget_err=0
_rc=0
for _f in ${CERT_FILES} ; do
wget -4 -nc -q --no-check-certificate --timeout=40 --tries=10 -O - \
"${SSL_STORAGE_URL}/${_f}" > "/tmp/${_f}"
_rc="$?"
if [ ${_rc} -ne 0 -o ! -s "/tmp/${_f}" ] ; then
__wget_err=1
break
fi
done
if [ ${__wget_err} -ne 0 ] ; then
echored "Error fetching ${SSL_STORAGE_URL}/${_f} -> RC: [${_rc}]\n"
exit 1
fi
fi
# ------------------------------------------------------------------------
#
# -- Clean up some stuff
#
# ------------------------------------------------------------------------
if [ "${FORCE}" = "yes" ] ; then
# -- Remove `apache2` sites
ls -A "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}"*.conf > /dev/null 2>&1 \
&& echodarkgray "$( rm -vf "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}"*.conf 2>&1 )\n"
ls -A "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}"*.conf > /dev/null 2>&1 \
&& echodarkgray "$( rm -vf "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}"*.conf 2>&1 )\n"
# -- Remove ${SUBDOMAIN} certificates - only if MD5 sums check has failed
if [ -n "${SUBDOMAIN}" ] && [ -d "/etc/ssl/${SUBDOMAIN}" ] ; then
if [ "${_certs_md5_sums_ok}" != "yes" ] ; then
echodarkgray "$( rm -rvf "/etc/ssl/${SUBDOMAIN}" 2>&1 )\n"
fi
fi
fi
# ------------------------------------------------------------------------
#
# -- (Re)create ${SSL_DIR} if needed
#
# ------------------------------------------------------------------------
[ ! -d "${SSL_DIR}" ] \
&& echodarkgray "$( mkdir -vp "${SSL_DIR}" )\n"
# ------------------------------------------------------------------------
#
# -- Start checking/updating Apache2 configuration
#
# ------------------------------------------------------------------------
APACHE_RESTART="no"
# ------------------------------------------------------------------------
#
# -- Check if certificates should be installed or updated
#
# ------------------------------------------------------------------------
if [ "${_certs_md5_sums_ok}" != "yes" ] ; then
for _f in ${CERT_FILES} ; do
[ "${BATCH}" = "no" ] \
&& echodarkgray "Processing ${_f} ...\n"
if [ ! -e "${SSL_DIR}/${_f}" ] ; then
mv -f "/tmp/${_f}" "${SSL_DIR}/${_f}" > /dev/null 2>&1
APACHE_RESTART="yes"
else
if ! diff -q "/tmp/${_f}" "${SSL_DIR}/${_f}" > /dev/null 2>&1 ; then
mv -f "/tmp/${_f}" "${SSL_DIR}/${_f}" > /dev/null 2>&1
APACHE_RESTART="yes"
else
rm -f "/tmp/${_f}" > /dev/null 2>&1
fi
fi
chmod 600 "${SSL_DIR}/${_f}" > /dev/null 2>&1
done
fi
# ------------------------------------------------------------------------
#
# -- Configure Apache
#
# ------------------------------------------------------------------------
case "${LSB_VENDOR}" in
"CentOS"|"CentOSStream")
_cert_file="${SSL_ROOT_DIR}/${SUBDOMAIN}/cert.dh.pem"
;;
"Debian"|"Ubuntu")
_cert_file="${SSL_ROOT_DIR}/${SUBDOMAIN}/fullchain.pem"
if [ ! -e "${APACHE2_CFG_DIR}/conf-available/port-80.conf" ] ; then
sed -i -e 's|^\s*\(Listen 80\)\s*$|#\1|' "/etc/apache2/ports.conf" > /dev/null 2>&1
cat <<-EOF > "${APACHE2_CFG_DIR}/conf-available/port-80.conf"
Listen 80
EOF
a2enconf "port-80.conf" > /dev/null 2>&1
APACHE_RESTART="yes"
elif [ ! -e "${APACHE2_CFG_DIR}/conf-enabled/port-80.conf" ] ; then
a2enconf "port-80.conf" > /dev/null 2>&1
APACHE_RESTART="yes"
fi
;;
esac
# ------------------------------------------------------------------------
#
# -- Update certificates for some user services
#
# ------------------------------------------------------------------------
#
# -- AriaNG
if [ -d "/home/user/.config/ariang" ] ; then
if [ "${APACHE_RESTART}" = "yes" ] ; then
echodarkgray "$( cp -vpf "${SSL_DIR}/fullchain.pem" "/home/user/.config/ariang/" )\n"
echodarkgray "$( cp -vpf "${SSL_DIR}/privkey.pem" "/home/user/.config/ariang/" )\n"
echodarkgray "$( chown -v user:user "/home/user/.config/ariang"/*.pem )\n"
if systemctl is-active "ariang@user" > /dev/null 2>&1 ; then
echodarkgray "AriaNG service"
if service "ariang@user" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
fi
fi
# ------------------------------------------------------------------------
#
# -- Common Apache config parts
#
# ------------------------------------------------------------------------
_site_config_header () {
cat <<-__EOH__
# ------------------------------------------------------------
# Version: ${SC_VER}
#
# !!! PLEASE DON'T CHANGE THIS FILE !!!
#
# -- Your RSB team :)
#
# ------------------------------------------------------------
__EOH__
}
_site_config_ssl_common () {
local _site="${1}"
local _doc_root=${2:-/var/www/html}
[ -n "${_site}" ] && _site="${_site}-"
cat <<-__EOS__
ServerName ${_site}${SERVER_NAME}
ServerAdmin webmaster@localhost
DocumentRoot ${_doc_root}
ErrorLog ${APACHE2_LOG_DIR}/error.log
#CustomLog ${APACHE2_LOG_DIR}/access.log combined
CustomLog /dev/null combined
SSLEngine on
SSLCertificateFile ${_cert_file}
SSLCertificateKeyFile ${SSL_ROOT_DIR}/${SUBDOMAIN}/privkey.pem
SSLCertificateChainFile ${SSL_ROOT_DIR}/${SUBDOMAIN}/chain.pem
__EOS__
}
# ------------------------------------------------------------------------
#
# -- Configure main Apache site
#
# ------------------------------------------------------------------------
MAIN_CONFIG="no"
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf" ] \
|| [ ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}.conf" ]
then
MAIN_CONFIG="yes"
elif ! grep -q -E "\s*ServerName\s*${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf"
then
MAIN_CONFIG="yes"
elif [ -e "${SSL_ROOT_DIR}/${SUBDOMAIN}/cert.dh.pem" ]
then
_tm_1="$( stat -c "%Y" "${SSL_ROOT_DIR}/${SUBDOMAIN}/cert.dh.pem" )"
_tm_2="$( stat -c "%Y" "$( readlink -f "${SSL_ROOT_DIR}/${SUBDOMAIN}/cert.pem" )" )"
_tm_diff="$(( _tm_2 - _tm_1 ))"
if [ ${_tm_diff} -gt 120 ] ; then
MAIN_CONFIG="yes"
fi
fi
if [ "${MAIN_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring main Apache site: ${SUBDOMAIN} ...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf"
$( _site_config_header )
SSLProtocol TLSv1.2
EOF
case "${LSB_VER}" in
"CentOS7"|"CentOSStream8")
cat "${SSL_ROOT_DIR}/${SUBDOMAIN}/cert.pem" "${SSL_ROOT_DIR}/certs/dhparam.pem" \
> "${SSL_ROOT_DIR}/${SUBDOMAIN}/cert.dh.pem"
;;
*)
cat <<-EOF >> "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf"
SSLOpenSSLConfCmd Curves secp521r1:secp384r1:prime256v1
EOF
;;
esac
cat <<-EOF >> "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf"
SSLHonorCipherOrder on
SSLCipherSuite "!ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:!ECDHE-ECDSA-AES128-SHA:!ECDHE-ECDSA-AES256-SHA:!ECDHE-ECDSA-AES128-SHA256:!ECDHE-ECDSA-AES256-SHA384:!ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:!ECDHE-RSA-AES128-SHA:!ECDHE-RSA-AES256-SHA:!ECDHE-RSA-AES128-SHA256:!ECDHE-RSA-AES256-SHA384:!DHE-RSA-AES128-GCM-SHA256:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-AES128-SHA:!DHE-RSA-AES256-SHA:!DHE-RSA-AES128-SHA256:!DHE-RSA-AES256-SHA256"
SSLPassPhraseDialog builtin
SSLCompression off
SSLSessionTickets off
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
ServerName ${SERVER_NAME}
# This VirtualHost redirects everything to HTTPS on port 443.
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/\.well-known/
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
$( _site_config_ssl_common )
SSLOptions +StdEnvVars
SSLOptions +StdEnvVars
UserDir /home/*
UserDir disabled root
HeaderName HEADER.html
ReadmeName README.html
AllowOverride FileInfo AuthConfig Limit Indexes
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
# php_flag engine off
Require all granted
Require all denied
EOF
case "${LSB_VENDOR}" in
"Debian"|"Ubuntu")
cat <<-EOF >> "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf"
# -- WebDAV configuration
Alias /dav /home/user/Downloads/
Alias /davfs /home/user/Downloads/
Alias /webdav /home/user/Downloads/
Alias /webdavs /home/user/Downloads/
Alias /webdavfs /home/user/Downloads/
SecRuleRemoveById 911100
SecRuleRemoveById 920340
SecRuleRemoveById 920440
SecRuleRemoveById 920450
SecRuleRemoveById 920480
DAV On
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require user user
EOF
;;
esac
cat <<-EOF >> "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf"
IncludeOptional userconf-enabled/*.conf
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}.conf" > /dev/null 2>&1
case "${LSB_VENDOR}" in
"Debian"|"Ubuntu")
${A2ENMOD} "dav" > /dev/null 2>&1
${A2ENMOD} "dav_fs" > /dev/null 2>&1
;;
*)
[ -e "/etc/httpd/conf.modules.d/50-dav.conf" ] \
&& echodarkgray "$( rm -vf "/etc/httpd/conf.modules.d/50-dav.conf" 2>&1 )\n"
[ -e "/etc/httpd/conf.modules.d/50-dav_fs.conf" ] \
&& echodarkgray "$( rm -vf "/etc/httpd/conf.modules.d/50-dav_fs.conf" 2>&1 )\n"
;;
esac
fi
# ------------------------------------------------------------------------
#
# -- Configure `dav` URL on Debian/Ubuntu
#
# ------------------------------------------------------------------------
if [ -e "${APACHE2_CFG_DIR}/mods-available/security2.conf" ] \
&& [ -e "${APACHE2_CFG_DIR}/mods-available/security2.load" ]
then
case "${LSB_VENDOR}" in
"Debian"|"Ubuntu")
DAV_CONFIG="no"
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dav.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-dav.conf" ]
then
DAV_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*dav-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dav.conf"
then
DAV_CONFIG="yes"
fi
fi
if [ "${DAV_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache WebDAV site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dav.conf"
$( _site_config_header )
$( _site_config_ssl_common "dav" "/home/user/Downloads" )
SecRuleEngine Off
DAV On
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require user user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-dav.conf" > /dev/null 2>&1
${A2ENMOD} "security2" > /dev/null 2>&1
${A2ENMOD} "dav" > /dev/null 2>&1
${A2ENMOD} "dav_fs" > /dev/null 2>&1
fi
;;
*)
[ -e "/etc/httpd/conf.modules.d/50-dav.conf" ] \
&& echodarkgray "$( rm -vf "/etc/httpd/conf.modules.d/50-dav.conf" 2>&1 )\n"
[ -e "/etc/httpd/conf.modules.d/50-dav_fs.conf" ] \
&& echodarkgray "$( rm -vf "/etc/httpd/conf.modules.d/50-dav_fs.conf" 2>&1 )\n"
;;
esac
fi
# ------------------------------------------------------------------------
#
# -- Configure `plex` URL
#
# ------------------------------------------------------------------------
PLEX_CONFIG="no"
if id "plex" > /dev/null 2>&1 ; then
home="$( getent passwd plex | awk -F: '{print $6}' )"
pmsApplicationSupportDir="${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR:-${home}/Library/Application Support}"
prefFile="${pmsApplicationSupportDir}/Plex Media Server/Preferences.xml"
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-plex.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-plex.conf" ]
then
PLEX_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*plex-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-plex.conf"
then
PLEX_CONFIG="yes"
fi
fi
if [ -e "${prefFile}" ] ; then
_s="$( getPref "butlerTaskDeepMediaAnalysis" 2> /dev/null )"
if [ -n "${_s}" ] ; then
echodarkgray "PLEX: Removing erroneous butlerTaskDeepMediaAnalysis\n"
delPref "butlerTaskDeepMediaAnalysis"
PLEX_CONFIG="yes"
fi
_s="$( getPref "ButlerTaskDeepMediaAnalysis" 2> /dev/null )"
if [ "${_s}" != "0" ] ; then
echodarkgray "PLEX: ButlerTaskDeepMediaAnalysis --> 0\n"
setPref "ButlerTaskDeepMediaAnalysis" "0"
PLEX_CONFIG="yes"
fi
fi
if [ "${PLEX_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache PLEX site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-plex.conf"
$( _site_config_header )
$( _site_config_ssl_common "plex" )
SSLOptions +StdEnvVars
Order deny,allow
Allow from all
ProxyRequests off
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:32400/
ProxyPassReverse / http://127.0.0.1:32400/
ProxyPass /:/ ws://127.0.0.1:32400/:/
ProxyPassReverse /:/ ws://127.0.0.1:32400/:/
ProxyPass /:/ wss://127.0.0.1:32400/:/
ProxyPassReverse /:/ wss://127.0.0.1:32400/:/
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-plex.conf" > /dev/null 2>&1
#
if [ -e "${prefFile}" ] ; then
echodarkgray "Configuring Plex Media Server instance...\n"
setPref "FriendlyName" "plex-${IP_WITH_DASH}"
systemctl is-active plexmediaserver > /dev/null 2>&1 \
&& systemctl restart plexmediaserver
fi
fi
else
_remove_apache2_site "plex" "PLEX"
fi
# ------------------------------------------------------------------------
#
# -- Configure `emby` URL
#
# ------------------------------------------------------------------------
EMBY_CONFIG="no"
if id "emby" > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-emby.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-emby.conf" ]
then
EMBY_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*emby-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-emby.conf"
then
EMBY_CONFIG="yes"
fi
fi
if [ "${EMBY_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache EMBY site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-emby.conf"
$( _site_config_header )
$( _site_config_ssl_common "emby" )
SSLOptions +StdEnvVars
Order deny,allow
Allow from all
ProxyRequests off
ProxyPreserveHost On
ProxyPass / http://127.0.0.1:8096/
ProxyPassReverse / http://127.0.0.1:8096/
ProxyPass /:/ ws://127.0.0.1:8096/:/
ProxyPassReverse /:/ ws://127.0.0.1:8096/:/
ProxyPass /:/ wss://127.0.0.1:8096/:/
ProxyPassReverse /:/ wss://127.0.0.1:8096/:/
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-emby.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "emby" "EMBY"
fi
# ------------------------------------------------------------------------
#
# -- Configure `jellyfin` URL
#
# ------------------------------------------------------------------------
JELLYFIN_CONFIG="no"
if id "jellyfin" > /dev/null 2>&1 ; then
#
if [ "${FORCE}" = "yes" \
-o ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jellyfin.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-jellyfin.conf" ]
then
JELLYFIN_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*jellyfin-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jellyfin.conf"
then
JELLYFIN_CONFIG="yes"
fi
fi
if [ "${JELLYFIN_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Jellyfin site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jellyfin.conf"
$( _site_config_header )
$( _site_config_ssl_common "jellyfin" )
SSLOptions +StdEnvVars
Order deny,allow
Allow from all
ProxyRequests off
ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
ProxyPass "/socket" "ws://127.0.0.1:8096/socket"
ProxyPassReverse "/socket" "ws://127.0.0.1:8096/socket"
ProxyPass "/" "http://127.0.0.1:8096/"
ProxyPassReverse "/" "http://127.0.0.1:8096/"
EOF
${A2ENMOD} "proxy_wstunnel" > /dev/null 2>&1
${A2ENMOD} "remoteip" > /dev/null 2>&1
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-jellyfin.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "jellyfin" "JELLYFIN"
fi
# ------------------------------------------------------------------------
#
# -- Configure `downloads` URL
#
# ------------------------------------------------------------------------
DL_CONFIG="no"
if command -v uuidgen > /dev/null 2>&1 ; then
if [ "${FORCE}" = "yes" ] \
|| [ ! -e "/var/local/rsbssl/anondownloads.cfg" ]
then
if [ ! -e "/var/local/rsbssl/anondownloads.cfg" ] ; then
uuidgen > "/var/local/rsbssl/anondownloads.cfg"
DL_CONFIG="yes"
elif [ "${KEEP_ANON_DOWNLOADS_CFG}" != "yes" ] ; then
uuidgen > "/var/local/rsbssl/anondownloads.cfg"
DL_CONFIG="yes"
fi
fi
DL_PATH="$( cat "/var/local/rsbssl/anondownloads.cfg" )"
#
if [ "${DL_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache anonymous Downloads URI...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/userconf-enabled/downloads.conf"
$( _site_config_header )
Alias /${DL_PATH} "/home/user/Downloads/"
AllowOverride None
Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
Allow from all
Satisfy any
EOF
fi
fi
# ------------------------------------------------------------------------
#
# -- Configure `ruTorrent` URL
#
# ------------------------------------------------------------------------
RUTORRENT_CONFIG="no"
if [ -d "/var/www/rutorrent" ] ; then
if ! apachectl -M 2> /dev/null | grep -q -E 'proxy_scgi_module' ; then
${A2ENMOD} "proxy_scgi" > /dev/null 2>&1
APACHE_RESTART="yes"
fi
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-rt.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-rt.conf" ]
then
RUTORRENT_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*rt-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-rt.conf"
then
RUTORRENT_CONFIG="yes"
elif grep -q -E '127\.0\.0\.1:8080|/var/www/rutorrent/\.htpasswd' \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-rt.conf"
then
RUTORRENT_CONFIG="yes"
fi
fi
if [ ! -e "/etc/apache2/userconf-enabled/rutorrent-user.conf" ] ; then
RUTORRENT_CONFIG="yes"
elif grep -q -E '127\.0\.0\.1:8080|/var/www/rutorrent/\.htpasswd' \
"/etc/apache2/userconf-enabled/rutorrent-user.conf"
then
RUTORRENT_CONFIG="yes"
fi
if [ "${RUTORRENT_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache ruTorrent site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-rt.conf"
$( _site_config_header )
$( _site_config_ssl_common "rt" "/var/www/rutorrent" )
SSLOptions +StdEnvVars
RewriteEngine on
RewriteRule ^/rutorrent$ / [R=permanent]
RewriteRule ^/rutorrent/(.*)$ /\$1 [R=permanent]
RewriteRule ^/rutorrent-user$ / [R=permanent]
RewriteRule ^/rutorrent-user/(.*)$ /\$1 [R=permanent]
RewriteRule ^/rutorrent4$ / [R=permanent]
RewriteRule ^/rutorrent4/(.*)$ /\$1 [R=permanent]
Options +Indexes
AllowOverride None
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require valid-user
IncludeOptional userconf-enabled/rtorrentscgi-*.conf
EOF
cat <<-EOF > "/etc/apache2/userconf-enabled/rutorrent-user.conf"
RewriteEngine on
RewriteRule ^/rutorrent$ /rutorrent/ [R=permanent]
RewriteRule ^/rutorrent-user$ /rutorrent/ [R=permanent]
RewriteRule ^/rutorrent-user/(.*)$ /rutorrent/\$1 [R=permanent]
RewriteRule ^/rutorrent4$ /rutorrent/ [R=permanent]
RewriteRule ^/rutorrent4/(.*)$ /rutorrent/\$1 [R=permanent]
Alias /rutorrent /var/www/rutorrent
Options +Indexes
AllowOverride None
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require valid-user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-rt.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "rt" "ruTorrent"
fi
# ------------------------------------------------------------------------
#
# -- Configure `Deluge` URL
#
# ------------------------------------------------------------------------
DELUGE_CONFIG="no"
if [ -d "/home/user/.config/deluge" ] ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dg.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-dg.conf" ]
then
DELUGE_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*dg-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dg.conf"
then
DELUGE_CONFIG="yes"
fi
fi
if [ "${DELUGE_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Deluge site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dg.conf"
$( _site_config_header )
$( _site_config_ssl_common "dg" )
ProxyPass http://127.0.0.1:8112/
ProxyPassReverse http://127.0.0.1:8112/
ProxyPassReverseCookieDomain 127.0.0.1 %{HTTP:Host}
ProxyPassReverseCookiePath / /
RequestHeader append X-Deluge-Base "/"
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-dg.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "dg" "Deluge"
fi
# ------------------------------------------------------------------------
#
# -- Configure `qBittorrent` URL
#
# ------------------------------------------------------------------------
QBITTORRENT_CONFIG="no"
if [ -d "/home/user/.config/qBittorrent" ] ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-qb.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-qb.conf" ]
then
QBITTORRENT_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*qb-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-qb.conf"
then
QBITTORRENT_CONFIG="yes"
fi
fi
if [ "${QBITTORRENT_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache qBittorrent site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-qb.conf"
$( _site_config_header )
$( _site_config_ssl_common "qb" )
ProxyRequests off
ProxyPreserveHost Off
RequestHeader unset Accept-Encoding
RequestHeader unset Referer
RequestHeader unset Origin
RequestHeader set Referer ""
RequestHeader set Origin ""
ProxyPass http://127.0.0.1:18080/
ProxyPassReverse http://127.0.0.1:18080/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "qBittorrent"
AuthDigestProvider file
AuthUserFile "/etc/apache2/qbittorrent.users.password"
Require user user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-qb.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "qb" "qBittorrent"
fi
# ------------------------------------------------------------------------
#
# -- Configure `Syncthing` URL
#
# ------------------------------------------------------------------------
SYNCTHING_CONFIG="no"
if [ -e "/home/user/.config/syncthing/config.xml" ] ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-syncthing.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-syncthing.conf" ]
then
SYNCTHING_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*syncthing-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-syncthing.conf"
then
SYNCTHING_CONFIG="yes"
fi
fi
if [ "${SYNCTHING_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Syncthing site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-syncthing.conf"
$( _site_config_header )
$( _site_config_ssl_common "syncthing" )
ProxyRequests off
ProxyPreserveHost Off
ProxyPass http://127.0.0.1:8384/
ProxyPassReverse http://127.0.0.1:8384/
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
Order Allow,Deny
Allow from All
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-syncthing.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "syncthing" "Syncthing"
fi
# ------------------------------------------------------------------------
#
# -- Configure `Transmission` URL
#
# ------------------------------------------------------------------------
TRANSMISSION_CONFIG="no"
if [ -d "/home/user/.config/transmission-daemon" ] ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tr.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-tr.conf" ]
then
TRANSMISSION_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*tr-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tr.conf"
then
TRANSMISSION_CONFIG="yes"
fi
fi
if [ "${TRANSMISSION_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Transmission site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tr.conf"
$( _site_config_header )
$( _site_config_ssl_common "tr" )
ProxyRequests on
ProxyPreserveHost Off
RewriteEngine on
RewriteRule ^[/]?$ /transmission/web/ [R=permanent]
ProxyPass /transmission http://127.0.0.1:9091/transmission
ProxyPassReverse /transmission http://127.0.0.1:9091/transmission
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "Transmission"
AuthDigestProvider file
AuthUserFile "/etc/apache2/transmission.users.password"
Require user user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-tr.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "tr" "Transmission"
fi
# ------------------------------------------------------------------------
#
# Configure `Lidarr` URL
#
# ------------------------------------------------------------------------
LIDARR_CONFIG="no"
if [ -e "/etc/systemd/system/lidarr@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-lidarr.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-lidarr.conf" ]
then
LIDARR_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*lidarr-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-lidarr.conf"
then
LIDARR_CONFIG="yes"
fi
fi
if [ "${LIDARR_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Lidarr site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-lidarr.conf"
$( _site_config_header )
$( _site_config_ssl_common "lidarr" )
ProxyRequests on
ProxyPreserveHost Off
ProxyPass http://127.0.0.1:8686/
ProxyPassReverse http://127.0.0.1:8686/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
Require all granted
Satisfy any
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-lidarr.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "lidarr" "Lidarr"
fi
# ------------------------------------------------------------------------
#
# Configure `Radarr` URL
#
# ------------------------------------------------------------------------
RADARR_CONFIG="no"
if [ -e "/etc/systemd/system/radarr@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-radarr.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-radarr.conf" ]
then
RADARR_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*radarr-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-radarr.conf"
then
RADARR_CONFIG="yes"
fi
fi
if [ "${RADARR_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Radarr site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-radarr.conf"
$( _site_config_header )
$( _site_config_ssl_common "radarr" )
ProxyRequests on
ProxyPreserveHost Off
ProxyPass http://127.0.0.1:7879/
ProxyPassReverse http://127.0.0.1:7879/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
Require all granted
Satisfy any
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-radarr.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "radarr" "Radarr"
fi
# ------------------------------------------------------------------------
#
# Configure `Sonarr` URL
#
# ------------------------------------------------------------------------
SONARR_CONFIG="no"
if [ -e "/etc/systemd/system/sonarr@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-sonarr.conf" ]
then
SONARR_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*sonarr-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr.conf"
then
SONARR_CONFIG="yes"
fi
fi
if [ "${SONARR_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Sonarr site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr.conf"
$( _site_config_header )
$( _site_config_ssl_common "sonarr" )
ProxyRequests on
ProxyPreserveHost Off
ProxyPass http://127.0.0.1:8989/
ProxyPassReverse http://127.0.0.1:8989/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
Require all granted
Satisfy any
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-sonarr.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "sonarr" "Sonarr"
fi
# ------------------------------------------------------------------------
#
# Configure `Sonarr (Latest)` URL
#
# ------------------------------------------------------------------------
SONARR_2_CONFIG="no"
if [ -e "/etc/systemd/system/sonarr-latest@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr2.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-sonarr2.conf" ]
then
SONARR_2_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*sonarr2-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr2.conf"
then
SONARR_2_CONFIG="yes"
fi
fi
if [ "${SONARR_2_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Sonarr (Latest) site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr2.conf"
$( _site_config_header )
$( _site_config_ssl_common "sonarr2" )
ProxyRequests on
ProxyPreserveHost Off
ProxyPass http://127.0.0.1:9989/
ProxyPassReverse http://127.0.0.1:9989/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-sonarr2.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "sonarr2" "Sonarr2"
fi
# ------------------------------------------------------------------------
#
# Configure `Jackett` URL
#
# ------------------------------------------------------------------------
JACKETT_CONFIG="no"
if [ -e "/etc/systemd/system/jackett@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jackett.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-jackett.conf" ]
then
JACKETT_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*jackett-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jackett.conf"
then
JACKETT_CONFIG="yes"
fi
fi
if [ "${JACKETT_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Jackett site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jackett.conf"
$( _site_config_header )
$( _site_config_ssl_common "jackett" )
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
ProxyPass http://127.0.0.1:9117/
ProxyPassReverse http://127.0.0.1:9117/
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-jackett.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "jackett" "Jackett"
fi
# ------------------------------------------------------------------------
#
# Configure `Tautulli` URL
#
# ------------------------------------------------------------------------
TAUTULLI_CONFIG="no"
if [ -e "/etc/systemd/system/tautulli.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tautulli.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-tautulli.conf" ]
then
TAUTULLI_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*tautulli-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tautulli.conf"
then
TAUTULLI_CONFIG="yes"
fi
fi
if [ "${TAUTULLI_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Tautulli site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tautulli.conf"
$( _site_config_header )
$( _site_config_ssl_common "tautulli" )
ProxyRequests on
ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
ProxyPass http://127.0.0.1:8181/
ProxyPassReverse http://127.0.0.1:8181/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-tautulli.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "tautulli" "Tautulli"
fi
# ------------------------------------------------------------------------
#
# Configure `Couchpotato` URL
#
# ------------------------------------------------------------------------
COUCHPOTATO_CONFIG="no"
if [ -e "/etc/systemd/system/couchpotato@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-couchpotato.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-couchpotato.conf" ]
then
COUCHPOTATO_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*couchpotato-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-couchpotato.conf"
then
COUCHPOTATO_CONFIG="yes"
fi
fi
if [ "${COUCHPOTATO_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Couchpotato site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-couchpotato.conf"
$( _site_config_header )
$( _site_config_ssl_common "couchpotato" )
ProxyRequests on
ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
ProxyPass http://127.0.0.1:5050/
ProxyPassReverse http://127.0.0.1:5050/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-couchpotato.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "couchpotato" "Couchpotato"
fi
# ------------------------------------------------------------------------
#
# Configure `Sickrage` URL
#
# ------------------------------------------------------------------------
SICKRAGE_CONFIG="no"
if [ -e "/etc/systemd/system/sickrage@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sickrage.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-sickrage.conf" ]
then
SICKRAGE_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*sickrage-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sickrage.conf"
then
SICKRAGE_CONFIG="yes"
fi
fi
if [ "${SICKRAGE_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Sickrage site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sickrage.conf"
$( _site_config_header )
$( _site_config_ssl_common "sickrage" )
ProxyRequests on
ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
ProxyPass http://127.0.0.1:8082/sickrage
ProxyPassReverse http://127.0.0.1:8082/sickrage
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
EOF
${A2ENMOD} "proxy_wstunnel" > /dev/null 2>&1
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-sickrage.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "sickrage" "Sickrage"
fi
# ------------------------------------------------------------------------
#
# Configure `overseerr` URL
#
# ------------------------------------------------------------------------
OVERSEERR_CONFIG="no"
if [ -e "/root/snap/overseerr/common/settings.json" ] ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-overseerr.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-overseerr.conf" ]
then
OVERSEERR_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*overseerr-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-overseerr.conf"
then
OVERSEERR_CONFIG="yes"
fi
if ! grep -q -E "\s*ServerName\s*overseerrx-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-overseerr.conf"
then
OVERSEERR_CONFIG="yes"
fi
fi
if [ -e "/etc/apache2/sites-enabled/custom.conf" ] ; then
if grep -q -E "\s*ServerName\s*overseerrx-" \
"/etc/apache2/sites-enabled/custom.conf"
then
mv -f "/etc/apache2/sites-enabled/custom.conf" \
"/etc/apache2/sites-enabled/custom.conf.$( date -u '+%Y%m%d%H%M%S' )" > /dev/null 2>&1
OVERSEERR_CONFIG="yes"
fi
fi
if [ "${OVERSEERR_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Overseerr site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-overseerr.conf"
$( _site_config_header )
$( _site_config_ssl_common "overseerr" )
ProxyRequests on
ProxyPreserveHost On
ProxyPass http://127.0.0.1:5055/
ProxyPassReverse http://127.0.0.1:5055/
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthDigestProvider file
AuthUserFile "/etc/apache2/users.password"
Require user user
$( _site_config_ssl_common "overseerrx" )
ProxyRequests on
ProxyPreserveHost On
ProxyPass http://127.0.0.1:5055/
ProxyPassReverse http://127.0.0.1:5055/
Order Allow,Deny
Allow from All
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-overseerr.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "overseerr" "Overseerr"
fi
# ------------------------------------------------------------------------
#
# Configure `WizTorrent` URL
#
# ------------------------------------------------------------------------
WT_CONFIG="no"
if [ -e "/etc/systemd/system/rsb-wiztorrent@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-wt.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-wt.conf" ]
then
WT_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*wt-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-wt.conf"
then
WT_CONFIG="yes"
fi
fi
if [ "${WT_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache WizTorrent site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-wt.conf"
$( _site_config_header )
$( _site_config_ssl_common "wt" )
RewriteEngine on
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule ^/?(.*) "ws://127.0.0.1:3005/\$1" [P,L]
Order Allow,Deny
Allow from All
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require user user
ProxyPass http://127.0.0.1:3005/
EOF
${A2ENMOD} "proxy_wstunnel" > /dev/null 2>&1
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-wt.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "wt" "WizTorrent"
fi
# ------------------------------------------------------------------------
#
# Configure `Cloud Torrent` URL
#
# ------------------------------------------------------------------------
CT_CONFIG="no"
if [ -e "/etc/systemd/system/cloud-torrent@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cloudtorrent.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-cloudtorrent.conf" ]
then
CT_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*cloudtorrent-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cloudtorrent.conf"
then
CT_CONFIG="yes"
fi
fi
if [ "${CT_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Cloud Torrent site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cloudtorrent.conf"
$( _site_config_header )
$( _site_config_ssl_common "cloudtorrent" )
ProxyRequests on
RewriteEngine on
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*) ws://127.0.0.1:53530/\$1 [P,L]
AllowOverride None
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require user user
ProxyPreserveHost On
ProxyPass http://127.0.0.1:53530/
ProxyPassReverse http://127.0.0.1:53530/
EOF
${A2ENMOD} "proxy_wstunnel" > /dev/null 2>&1
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-cloudtorrent.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "cloudtorrent" "Cloud Torrent"
fi
# ------------------------------------------------------------------------
#
# Configure `Simple Torrent` URL
#
# ------------------------------------------------------------------------
ST_CONFIG="no"
if [ -e "/etc/systemd/system/simple-torrent@.service" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-simpletorrent.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-simpletorrent.conf" ]
then
ST_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*simpletorrent-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-simpletorrent.conf"
then
ST_CONFIG="yes"
fi
fi
if [ "${ST_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Simple Torrent site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-simpletorrent.conf"
$( _site_config_header )
$( _site_config_ssl_common "simpletorrent" )
ProxyRequests on
RewriteEngine on
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*) ws://127.0.0.1:53540/\$1 [P,L]
AllowOverride None
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require user user
ProxyPreserveHost On
ProxyPass http://127.0.0.1:53540/
ProxyPassReverse http://127.0.0.1:53540/
EOF
${A2ENMOD} "proxy_wstunnel" > /dev/null 2>&1
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-simpletorrent.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "simpletorrent" "Simple Torrent"
fi
# ------------------------------------------------------------------------
#
# Configure `Cuberite` URL
#
# ------------------------------------------------------------------------
CUBERITE_CONFIG="no"
if [ -e "/etc/systemd/system/cuberite@.service" ] > /dev/null 2>&1 \
&& [ -d "/home/user/.config/Cuberite" ]
then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cuberite.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-cuberite.conf" ]
then
CUBERITE_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*cuberite-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cuberite.conf"
then
CUBERITE_CONFIG="yes"
fi
fi
if [ "${CUBERITE_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache Cuberite site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cuberite.conf"
$( _site_config_header )
$( _site_config_ssl_common "cuberite" )
ProxyRequests off
ProxyPreserveHost On
ProxyPass http://127.0.0.1:8083/
ProxyPassReverse http://127.0.0.1:8083/
EOF
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-cuberite.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "cuberite" "Cuberite"
fi
# ------------------------------------------------------------------------
#
# Configure `RSB Dashboard` URL
#
# ------------------------------------------------------------------------
DASH_CONFIG="no"
if [ -d "/var/www/dashboard" ] > /dev/null 2>&1 ; then
#
if [ ! -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dashboard.conf" \
-o ! -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-dashboard.conf" ]
then
DASH_CONFIG="yes"
else
if ! grep -q -E "\s*ServerName\s*dashboard-${SERVER_NAME}" \
"${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dashboard.conf"
then
DASH_CONFIG="yes"
fi
fi
if [ "${DASH_CONFIG}" = "yes" ] ; then
echodarkgray "Configuring Apache RSB Dashboard site...\n"
APACHE_RESTART="yes"
cat <<-EOF > "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dashboard.conf"
$( _site_config_header )
$( _site_config_ssl_common "dashboard" "/var/www/dashboard" )
ProxyRequests on
ProxyPreserveHost Off
RewriteEngine on
# -- Web console
ProxyPass /user.console/ws ws://127.0.0.1:4200/ws
ProxyPass /user.console http://127.0.0.1:4200/
ProxyPassReverse /user.console http://127.0.0.1:4200/
# -- Cherrymusic URL
RewriteRule ^/cherrymusic$ /cherrymusic/ [R=permanent]
ProxyPass http://localhost:7070/cherrymusic
ProxyPassReverse http://localhost:7070/cherrymusic
# -- Deluge URL
ProxyPass http://127.0.0.1:8112/
ProxyPassReverse http://127.0.0.1:8112/
ProxyPassReverseCookieDomain 127.0.0.1 %{HTTP:Host}
ProxyPassReverseCookiePath / /deluge/
RequestHeader append X-Deluge-Base "/deluge/"
# -- Flood Web URL
RewriteRule ^/flood$ /flood/ [R=permanent]
ProxyRequests off
ProxyPreserveHost Off
ProxyPass http://127.0.0.1:3000/flood/
ProxyPassReverse http://127.0.0.1:3000/flood/
# -- Madsonic URL
RewriteRule ^/madsonic$ /madsonic/ [R=permanent]
ProxyPreserveHost Off
RequestHeader unset Accept-Encoding
ProxyPass http://127.0.0.1:4041/madsonic/
ProxyPassReverse http://127.0.0.1:4041/madsonic/
# -- Ombi URL
RewriteRule ^/ombi$ /ombi/ [R=permanent]
ProxyPreserveHost On
ProxyPass http://127.0.0.1:15000/ombi connectiontimeout=5 timeout=30 keepalive=on
ProxyPassReverse http://127.0.0.1:15000/ombi
# -- qBittorrent Web URL
RewriteRule ^/qbittorrent-user$ /qbittorrent-user/ [R=permanent]
ProxyPreserveHost Off
RequestHeader unset Accept-Encoding
RequestHeader unset Referer
RequestHeader unset Origin
RequestHeader set Referer ""
RequestHeader set Origin ""
ProxyPass http://127.0.0.1:18080/
ProxyPassReverse http://127.0.0.1:18080/
# -- ruTorrent URL compatibility redirects
RewriteRule ^/rutorrent-user$ /rutorrent/ [R=permanent]
RewriteRule ^/rutorrent-user/(.*)$ /rutorrent/\$1 [R=permanent]
# -- SabNZBD URL
RewriteRule ^/sabnzbd$ /sabnzbd/ [R=permanent]
order deny,allow
deny from all
allow from all
ProxyPass http://127.0.0.1:8085/sabnzbd
ProxyPassReverse http://127.0.0.1:8085/sabnzbd
AuthType Digest
AuthName "SABnzbd"
AuthDigestProvider file
AuthUserFile "/etc/apache2/sabnzbd.users.password"
Require user user
# -- Subsonic URL
RewriteRule ^/subsonic$ /subsonic/ [R=permanent]
ProxyPreserveHost Off
RequestHeader unset Accept-Encoding
ProxyPass http://127.0.0.1:4040/subsonic/
ProxyPassReverse http://127.0.0.1:4040/subsonic/
# -- Syncthing URL
RewriteRule ^/syncthing$ /syncthing/ [R=permanent]
ProxyPass http://127.0.0.1:8384/
ProxyPassReverse http://127.0.0.1:8384/
# -- Transmission Web URL
RewriteRule ^/transmission[/]?$ /transmission/web/ [R=permanent]
ProxyPass http://127.0.0.1:9091/transmission
ProxyPassReverse http://127.0.0.1:9091/transmission
# -- WireGuard info page URL
RewriteRule ^/wireguard$ /wireguard/ [R=permanent]
Options -Indexes
# == Main Dashboard URL
Options +Indexes +FollowSymLinks +MultiViews
AllowOverride All AuthConfig
Order allow,deny
Allow from all
AuthType Digest
AuthName "apache2"
AuthUserFile /etc/apache2/users.password
Require user user
EOF
${A2ENMOD} "proxy_wstunnel" > /dev/null 2>&1
${A2ENSITE} "rsbssl_easy_${SUBDOMAIN}-dashboard.conf" > /dev/null 2>&1
fi
else
_remove_apache2_site "dashboard" "RSB Dashboard"
fi
# ------------------------------------------------------------------------
#
# -- Configure access logs for `rsb-p3a-client`
#
# ------------------------------------------------------------------------
P3A_SITES="dg rt qb tr wt plex emby jellyfin lidarr sonarr radarr jackett tautulli cloudtorrent simpletorrent syncthing"
#_default_logging="yes"
case "${LSB_VENDOR}" in
"Debian"|"Ubuntu")
if [ -e "/var/local/.rsb-p3a-client" ] ; then
_configs="rsb.conf rsbssl_easy_${SUBDOMAIN}.conf"
for _c in $( tr ' ' '\n' <<< "${P3A_SITES}" | sed -e '/^$/d' | sort )
do
_configs="${_configs} rsbssl_easy_${SUBDOMAIN}-${_c}.conf"
done
_logging_changed="no"
for _f in ${_configs} ; do
[ ! -e "${APACHE2_CFG_DIR}/sites-available/${_f}" ] && continue
if grep -q -E "^\s*CustomLog /dev/null " \
"${APACHE2_CFG_DIR}/sites-available/${_f}"
then
APACHE_RESTART="yes"
if [ "${_logging_changed}" = "no" ] ; then
# echodarkgray "Setting logging for data collector"
echodarkgray "Setting logging for data collector\n"
_logging_changed="yes"
fi
echodarkgray "--> ${_f}\n"
sed -i -r \
-e "s|^(\s*)CustomLog /dev/null (.*)\$|\1CustomLog ${APACHE_RSB_COLLECTOR_LOG} \2|" \
"${APACHE2_CFG_DIR}/sites-available/${_f}"
fi
done
# if [ "${_logging_changed}" = "yes" ] ; then
# echodarkgray ": $( echogreen "OK" )\n"
# fi
else
# Restore default logging
_logging_changed="no"
while read -r _f ; do
if grep -q -E "^\s*CustomLog ${APACHE_RSB_COLLECTOR_LOG} " "${_f}"
then
APACHE_RESTART="yes"
if [ "${_logging_changed}" = "no" ] ; then
echodarkgray "Restoring default logging\n"
_logging_changed="yes"
fi
echodarkgray "--> $( basename "${_f}" )\n"
sed -i -r \
-e "s|^(\s*)CustomLog ${APACHE_RSB_COLLECTOR_LOG} (.*)\$|\1CustomLog /dev/null \2|" \
"${_f}"
fi
done < <( find "/etc/apache2/sites-available" \
-mindepth 1 \
-maxdepth 1 \
-type f \
-name "*.conf" 2> /dev/null | sort )
# rm -f "${APACHE_RSB_COLLECTOR_LOG}" > /dev/null 2>&1
echodarkgray "$( rm -vf "${APACHE_RSB_COLLECTOR_LOG}" 2>&1 )\n"
# if [ "${_logging_changed}" = "yes" ] ; then
# echodarkgray ": $( echogreen "OK" )\n"
# fi
fi
;;
esac
# ------------------------------------------------------------------------
#
# -- Reload `apache2` service if needed
#
# ------------------------------------------------------------------------
if [ "${APACHE_RESTART}" = "yes" ] ; then
echodarkgray "Checking '${APACHE2_SVC}' configuration"
if ! apachectl -t > /dev/null 2>&1 ; then
echodarkgray "Apache configuration test: $( echored "FAILED" )\n"
echored "Please run 'apachectl -t' to check...\n"
exit 2
fi
echogreen ": OK\n"
if systemctl is-active "${APACHE2_SVC}" > /dev/null 2>&1 ; then
echodarkgray "Reloading '${APACHE2_SVC}' service"
if service "${APACHE2_SVC}" reload > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
elif systemctl is-enabled "${APACHE2_SVC}" > /dev/null 2>&1 ; then
echodarkgray "Restarting '${APACHE2_SVC}' service"
if service "${APACHE2_SVC}" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
else
echored "'${APACHE2_SVC}' service is not active\n"
fi
fi
# ------------------------------------------------------------------------
#
# -- Configure `resilio-sync`
#
# ------------------------------------------------------------------------
RESILIO_CONFIG="no"
[ "${FORCE}" = "yes" ] && RESILIO_CONFIG="yes"
_conf_dir="/home/user/.config/resilio-sync"
if [ -e "${_conf_dir}/config.json" ] ; then
grep -q "ssl_certificate" "${_conf_dir}/config.json" \
|| RESILIO_CONFIG="yes"
grep -q "ssl_private_key" "${_conf_dir}/config.json" \
|| RESILIO_CONFIG="yes"
[ -e "${_conf_dir}/ssl/cert.pem" ] \
|| RESILIO_CONFIG="yes"
[ -e "${_conf_dir}/ssl/privkey.pem" ] \
|| RESILIO_CONFIG="yes"
if [ "${RESILIO_CONFIG}" = "yes" ] ; then
if ! command -v "jq" > /dev/null 2>&1 ; then
echodarkgray "Configuring Resilio Sync service: $( echored "FAILED: 'jq' not found" )\n"
else
echodarkgray "Configuring Resilio Sync service\n"
[ -e "${_conf_dir}/ssl" ] \
|| echodarkgray "$( mkdir -v "${_conf_dir}/ssl" 2>&1 )\n"
echodarkgray "$( cp -v "/etc/ssl/a.seedbox.vip/cert.pem" "${_conf_dir}/ssl/" 2>&1 )\n"
echodarkgray "$( cp -v "/etc/ssl/a.seedbox.vip/privkey.pem" "${_conf_dir}/ssl/" 2>&1 )\n"
jq -r -c --argjson webui \
"{\"ssl_certificate\":\"${_conf_dir}/ssl/cert.pem\"}" \
'.webui += $webui' "${_conf_dir}/config.json" | jq . > "${_conf_dir}/config.json.1"
jq -r -c --argjson webui \
"{\"ssl_private_key\":\"${_conf_dir}/ssl/privkey.pem\"}" \
'.webui += $webui' "${_conf_dir}/config.json.1" | jq . > "${_conf_dir}/config.json.2"
cp -f "${_conf_dir}/config.json.2" "${_conf_dir}/config.json"
rm -f "${_conf_dir}/config.json.1" "${_conf_dir}/config.json.2"
if systemctl is-active "resilio-sync@user" > /dev/null 2>&1 ; then
echodarkgray "Restarting Resilio Sync service"
if systemctl restart "resilio-sync@user" > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
fi
fi
fi
# ------------------------------------------------------------------------
#
# -- Configure `thinlinc`
#
# ------------------------------------------------------------------------
if [ -e "/opt/thinlinc/bin/tl-config" ] ; then
TL_CONFIG="no"
[ "${FORCE}" = "yes" ] \
&& TL_CONFIG="yes"
grep -q "${SERVER_NAME}" "/opt/thinlinc/etc/conf.d/vsmagent.hconf" \
|| TL_CONFIG="yes"
grep -q "${SUBDOMAIN}" "/opt/thinlinc/etc/conf.d/webaccess.hconf" \
|| TL_CONFIG="yes"
if [ "${TL_CONFIG}" = "yes" ] ; then
/opt/thinlinc/bin/tl-config /webaccess/cert=/etc/ssl/${SUBDOMAIN}/fullchain.pem
/opt/thinlinc/bin/tl-config /webaccess/certkey=/etc/ssl/${SUBDOMAIN}/privkey.pem
echodarkgray "ThinLinc Web Access service"
if service "tlwebaccess" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
echodarkgray "ThinLinc VsmAgent service"
/opt/thinlinc/bin/tl-config /vsmagent/agent_hostname="${SERVER_NAME}"
if service "vsmagent" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
TL_CONFIG="yes"
fi
# ------------------------------------------------------------------------
#
# -- Configure `SABnzbd`
#
# ------------------------------------------------------------------------
if command -v crudini > /dev/null 2>&1 && [ -e "/home/user/.sabnzbd/sabnzbd.ini" ] ; then
_s="$( crudini --get "/home/user/.sabnzbd/sabnzbd.ini" "misc" "host_whitelist" 2> /dev/null )"
if [ "${_s}" != "${SERVER_NAME}, sabnzbd-${SERVER_NAME}" ] ; then
echodarkgray "Configuring SABnzbd"
if crudini --set "/home/user/.sabnzbd/sabnzbd.ini" \
"misc" \
"host_whitelist" \
"${SERVER_NAME}, sabnzbd-${SERVER_NAME}" > /dev/null 2>&1
then
echodarkgray ": $( echogreen "OK" )\n"
if systemctl is-active "sabnzbd@user" > /dev/null 2>&1 ; then
echodarkgray "Restarting SABnzbd service"
if service "sabnzbd@user" restart > /dev/null 2>&1 ; then
echodarkgray ": $( echogreen "OK" )\n"
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
else
echodarkgray ": $( echored "FAILED" )\n"
fi
fi
fi
if [ -e /etc/apache2/userconf-enabled/sabnzbd-user.conf ]; then
echodarkgray "Configuring Apache2 config for SABnzbd API endpoint: "
API_BLOCK=$(cat << 'EOF'
authtype none
allow from all
satisfy any
Require all granted
ProxyPass http://127.0.0.1:8085/sabnzbd/api
ProxyPassReverse http://127.0.0.1:8085/sabnzbd/api
EOF
)
if grep -q "" /etc/apache2/userconf-enabled/sabnzbd-user.conf; then
echodarkgray "$( echogreen "The block already exists in /etc/apache2/userconf-enabled/sabnzbd-user.conf.\n" )"
else
echodarkgray "$( echogreen "Adding block to /etc/apache2/userconf-enabled/sabnzbd-user.conf\n" )"
echo -e "\n$API_BLOCK" >> /etc/apache2/userconf-enabled/sabnzbd-user.conf
echodarkgray "$( echogreen "Block added successfully.\n" )"
fi
fi
# ------------------------------------------------------------------------
#
# -- Configure `logrotate`
#
# ------------------------------------------------------------------------
if [ -d "/etc/logrotate.d" ] ; then
cat <<-EOF > "/etc/logrotate.d/ssl-mgr"
${LOG_DIR}/*.log
{
rotate 8
weekly
missingok
notifempty
size 1M
compress
delaycompress
}
EOF
fi
# ------------------------------------------------------------------------
#
# -- Configure `cron`
#
# !! NB: BE EXTREMELY CAREFUL !!
#
# ------------------------------------------------------------------------
#_cron_flags=""
## !!! DEBUG !!!
#DEVELOPMENT="no"
## / !!! DEBUG !!!
if [ ! -e "/var/local/rsbssl/cron.sh.inc" ] \
|| [ "${FORCE}" = "yes" ]
then
if [ "${DEVELOPMENT}" = "yes" ] ; then
_cron_mode="DEV"
_cron_flags=" -t"
_cron_hours="*"
_minute_interval="5"
_start_minute="$(( RANDOM % _minute_interval ))"
_minutes="${_start_minute}"
for _m in $( seq $(( _start_minute + _minute_interval )) ${_minute_interval} 59 ) ; do
_minutes="${_minutes},${_m}"
done
_cron_minutes="$( tr ',' '\n' <<< "${_minutes}" \
| sort -n \
| tr '\n' ',' \
| sed -re 's/,$//' )"
else
_cron_mode="PROD"
_cron_flags=""
# _cron_hours="*/3"
# # !!! DEBUG !!!
# _cron_flags=" -t"
# # / !!! DEBUG !!!
# # --
_cron_minutes="$(( RANDOM % 60 ))"
# --
_hour_interval="3"
_start_hour="$(( RANDOM % _hour_interval ))"
_hours="${_start_hour}"
for _h in $( seq $(( _start_hour + _hour_interval )) ${_hour_interval} 23 ) ; do
_hours="${_hours},${_h}"
done
_cron_hours="$( tr ',' '\n' <<< "${_hours}" \
| sort -n \
| tr '\n' ',' \
| sed -re 's/,$//' )"
# --
fi
cat <<-EOF > "/var/local/rsbssl/cron.sh.inc"
# Version: ${SC_VER}
CRON_MODE="${_cron_mode}"
CRON_FLAGS="${_cron_flags}"
CRON_HOURS="${_cron_hours}"
CRON_MINUTES="${_cron_minutes}"
EOF
fi
. "/var/local/rsbssl/cron.sh.inc"
if [ -d "/etc/cron.d" ] ; then
cat <<-EOF > "/var/tmp/${SC_NAME}.cron.${SC_PID}"
# ${SERVER_NAME}
# Version: ${SC_VER}
MAILTO=""
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
#@reboot root /bin/bash /usr/local/bin/easy-ssl -b${_flags} 2>&1 | while IFS= read -r line; do echo "[\$(date -u)]: \${line}"; done | tee -a "${LOG_DIR}/easy-ssl.log"
@reboot root /bin/bash /usr/local/bin/easy-ssl -b${CRON_FLAGS} 2>&1 | while IFS= read -r line; do echo "[\$(date -u)]: \${line}"; done | tee -a "${LOG_DIR}/easy-ssl.log"
${CRON_MINUTES} ${CRON_HOURS} * * * root /bin/bash /usr/local/bin/easy-ssl -b${CRON_FLAGS} 2>&1 | while IFS= read -r line; do echo "[\$(date -u)]: \${line}"; done | tee -a "${LOG_DIR}/easy-ssl.log"
EOF
if command -v diff > /dev/null 2>&1 ; then
if ! diff -q "/var/tmp/${SC_NAME}.cron.${SC_PID}" "/etc/cron.d/easy-ssl" > /dev/null 2>&1
then
echodarkgray "Installing CRON job...\n"
mv -f "/var/tmp/${SC_NAME}.cron.${SC_PID}" "/etc/cron.d/easy-ssl" > /dev/null 2>&1
else
rm -f "/var/tmp/${SC_NAME}.cron.${SC_PID}" > /dev/null 2>&1
fi
else
echodarkgray "Installing CRON job...\n"
mv -f "/var/tmp/${SC_NAME}.cron.${SC_PID}" "/etc/cron.d/easy-ssl" > /dev/null 2>&1
fi
fi
# ------------------------------------------------------------------------
#
# -- Finalizing ...
#
# ------------------------------------------------------------------------
if [ "${APACHE_RESTART}" = "yes" ] || [ "${BATCH}" = "no" ] || [ "${FORCE}" = "yes" ]
then
echo "${SC_VER}" > "/var/local/rsbssl/version.id"
cat <<-EOF
Congratulations!
------------------
You can now access your server using this URL:
$( echocyan "https://${SERVER_NAME}" )
EOF
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dashboard.conf" ] ; then
cat <<-EOF
$( echocyan "https://dashboard-${SERVER_NAME}" ) - RSB Dashboard
EOF
fi
case "${LSB_VENDOR}" in
"Debian"|"Ubuntu")
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dav.conf" ] \
&& [ -e "${APACHE2_CFG_DIR}/sites-enabled/rsbssl_easy_${SUBDOMAIN}-dav.conf" ]
then
cat <<-EOF
$( echocyan "https://dav-${SERVER_NAME}" ) - WebDAV (recommended URL)
EOF
fi
cat <<-EOF
$( echocyan "https://${SERVER_NAME}/dav" ) - WebDAV
EOF
;;
esac
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}.conf" ] ; then
cat <<-EOF
$( echocyan "https://${SERVER_NAME}" )/~user - Web Access
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-wt.conf" ] ; then
cat <<-EOF
$( echocyan "https://wt-${SERVER_NAME}" ) - RSB WizTorrent WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-dg.conf" ] ; then
cat <<-EOF
$( echocyan "https://dg-${SERVER_NAME}" ) - Deluge WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-qb.conf" ] ; then
cat <<-EOF
$( echocyan "https://qb-${SERVER_NAME}" ) - qBittorrent WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-rt.conf" ] ; then
cat <<-EOF
$( echocyan "https://rt-${SERVER_NAME}" ) - ruTorrent WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tr.conf" ] ; then
cat <<-EOF
$( echocyan "https://tr-${SERVER_NAME}" ) - Transmission WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-syncthing.conf" ] ; then
cat <<-EOF
$( echocyan "https://syncthing-${SERVER_NAME}" ) - Syncthing WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cloudtorrent.conf" ] ; then
cat <<-EOF
$( echocyan "https://cloudtorrent-${SERVER_NAME}" ) - Cloud Torrent WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-couchpotato.conf" ] ; then
cat <<-EOF
$( echocyan "https://couchpotato-${SERVER_NAME}" ) - Couchpotato WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-cuberite.conf" ] ; then
cat <<-EOF
$( echocyan "https://cuberite-${SERVER_NAME}" ) - Cuberite WebUI (Minecraft server)
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jackett.conf" ] ; then
cat <<-EOF
$( echocyan "https://jackett-${SERVER_NAME}" ) - Jackett WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-lidarr.conf" ] ; then
cat <<-EOF
$( echocyan "https://lidarr-${SERVER_NAME}" ) - Lidarr WebUI
$( echocyan "https://lidarr-${SERVER_NAME}/api" ) - Lidarr WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-overseerr.conf" ] ; then
cat <<-EOF
$( echocyan "https://overseerr-${SERVER_NAME}" ) - Overseerr WebUI
$( echocyan "https://overseerrx-${SERVER_NAME}" ) - Overseerr WebUI (native auth)
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-radarr.conf" ] ; then
cat <<-EOF
$( echocyan "https://radarr-${SERVER_NAME}" ) - Radarr WebUI
$( echocyan "https://radarr-${SERVER_NAME}/api" ) - Radarr API Endpoint
EOF
fi
if [ -e "/home/user/.config/resilio-sync/config.json" ] \
&& command -v "jq" > /dev/null 2>&1
then
cat <<-EOF
$( echocyan "https://${SERVER_NAME}:8888" ) - Resilio Sync WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sickrage.conf" ] ; then
cat <<-EOF
$( echocyan "https://sickrage-${SERVER_NAME}" ) - Sickrage WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-simpletorrent.conf" ] ; then
cat <<-EOF
$( echocyan "https://simpletorrent-${SERVER_NAME}" ) - Simple Torrent WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr.conf" ] ; then
cat <<-EOF
$( echocyan "https://sonarr-${SERVER_NAME}" ) - Sonarr WebUI
$( echocyan "https://sonarr-${SERVER_NAME}/sonarr/api" ) - Sonarr API Endpoint
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-sonarr2.conf" ] ; then
cat <<-EOF
$( echocyan "https://sonarr2-${SERVER_NAME}" ) - Sonarr (Latest) WebUI
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-plex.conf" ] ; then
cat <<-EOF
$( echocyan "https://plex-${SERVER_NAME}" ) - Plex Media Server
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-emby.conf" ] ; then
cat <<-EOF
$( echocyan "https://emby-${SERVER_NAME}" ) - Emby Media Server
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-jellyfin.conf" ] ; then
cat <<-EOF
$( echocyan "https://jellyfin-${SERVER_NAME}" ) - Jellyfin Media Server
EOF
fi
if [ -e "${APACHE2_CFG_DIR}/sites-available/rsbssl_easy_${SUBDOMAIN}-tautulli.conf" ] ; then
cat <<-EOF
$( echocyan "https://tautulli-${SERVER_NAME}" ) - Tautulli
EOF
fi
if [ "${TL_CONFIG}" = "yes" ] ; then
cat <<-EOF
$( echocyan "https://${SERVER_NAME}:300" ) - ThinLinc Remote Desktop
EOF
fi
if [ "${DL_CONFIG}" = "yes" ] ; then
cat <<-EOF
$( echocyan "https://${SERVER_NAME}/${DL_PATH}" ) - Downloads folder (anonymous mode)
EOF
fi
else
echodarkgray "Everything is up to date. Nothing to do.\n\n"
fi
exit 0