← Retour
#!/bin/bash
# ===========================================
# Générateur de configuration Nginx
# Usage: ./generate.sh <project> <service> <env> <port> [output_file] [domain] [private]
#
# Supporte n'importe quel domaine :
# - *.33800.nowhere84.com (Bordeaux)
# - *.86000.nowhere84.com (Poitiers)
# - *.nowhere84.com (racine)
# - domaines externes
#
# private: true (default) = réseau local uniquement (192.168.1.0/24)
# false = accessible publiquement
# ===========================================
set -e
# Configuration par défaut
DOCKER_HOST_PROD="192.168.1.12" # prod-portainer
DOCKER_HOST_DEV="192.168.1.51" # dev-portainer
# Certificats SSL par domaine
declare -A SSL_CERTS=(
["33800.nowhere84.com"]="/etc/letsencrypt/live/33800.nowhere84.com"
["86000.nowhere84.com"]="/etc/letsencrypt/live/86000.nowhere84.com"
["nowhere84.com"]="/etc/letsencrypt/live/nowhere84.com"
)
DEFAULT_SSL_PATH="/etc/letsencrypt/live/33800.nowhere84.com"
# Couleurs
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'
# Fonction pour trouver le certificat SSL approprié
find_ssl_cert() {
local domain="$1"
# Chercher le certificat le plus spécifique
for base_domain in "${!SSL_CERTS[@]}"; do
if [[ "$domain" == *"$base_domain" ]]; then
echo "${SSL_CERTS[$base_domain]}"
return
fi
done
# Fallback sur le certificat par défaut
echo "$DEFAULT_SSL_PATH"
}
if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ] || [ -z "$4" ]; then
echo "Usage: $0 <project> <service> <env> <port> [output_file] [domain] [private]"
echo ""
echo "Arguments:"
echo " project Nom du projet (ex: hellocar)"
echo " service Nom du service (ex: api, public, admin)"
echo " env Environnement (prod ou dev)"
echo " port Port du container Docker"
echo " output_file Fichier de sortie (optionnel, - pour auto)"
echo " domain Domaine personnalisé (optionnel, - pour auto)"
echo " private true (default) = réseau local, false = public"
echo ""
echo "Exemples:"
echo " $0 hellocar api prod 4510"
echo " $0 hellocar api prod 4510 /tmp/conf.conf api.33800.nowhere84.com true"
echo " $0 monapp web prod 3000 - app.nowhere84.com false # public"
exit 1
fi
PROJECT="$1"
SERVICE="$2"
ENV="$3"
PORT="$4"
CUSTOM_DOMAIN="$6"
# Private par défaut = true (réseau local uniquement)
PRIVATE="${7:-true}"
# Sélection du host Docker selon l'environnement
if [ "$ENV" = "prod" ]; then
DOCKER_HOST="$DOCKER_HOST_PROD"
elif [ "$ENV" = "dev" ]; then
DOCKER_HOST="$DOCKER_HOST_DEV"
else
echo -e "${RED}[ERROR]${NC} Environnement invalide: $ENV (utilisez 'prod' ou 'dev')"
exit 1
fi
# Domaine : personnalisé ou auto-généré
if [ -n "$CUSTOM_DOMAIN" ] && [ "$CUSTOM_DOMAIN" != "-" ]; then
DOMAIN="$CUSTOM_DOMAIN"
else
DOMAIN="${PROJECT}-${SERVICE}-${ENV}.33800.nowhere84.com"
fi
OUTPUT_FILE="${5:-/tmp/${DOMAIN}.conf}"
[ "$OUTPUT_FILE" = "-" ] && OUTPUT_FILE="/tmp/${DOMAIN}.conf"
# Trouver le certificat SSL approprié
SSL_PATH=$(find_ssl_cert "$DOMAIN")
SSL_CERT_PATH="$SSL_PATH/fullchain.pem"
SSL_KEY_PATH="$SSL_PATH/privkey.pem"
echo -e "${GREEN}[INFO]${NC} Génération config pour: $DOMAIN"
echo -e "${GREEN}[INFO]${NC} Proxy vers: http://$DOCKER_HOST:$PORT"
if [ "$PRIVATE" = "true" ]; then
echo -e "${GREEN}[INFO]${NC} Mode: PRIVÉ (réseau local uniquement)"
else
echo -e "${GREEN}[INFO]${NC} Mode: PUBLIC (accessible depuis internet)"
fi
# Génération restriction IP si private
IP_RESTRICTION=""
if [ "$PRIVATE" = "true" ]; then
IP_RESTRICTION="
# Restrict to local network only (private: true)
allow 192.168.1.0/24;
allow 127.0.0.1;
deny all;"
fi
cat > "$OUTPUT_FILE" << EOF
# ===========================================
# $PROJECT - $SERVICE - Configuration Nginx $ENV
# Auto-generated by gouroubleu deploy system
# Date: $(date '+%Y-%m-%d %H:%M:%S')
# ===========================================
# Redirect HTTP to HTTPS
server {
listen 80;
server_name $DOMAIN;
return 301 https://\$server_name\$request_uri;
}
# HTTPS Server
server {
listen 443 ssl http2;
server_name $DOMAIN;
# SSL Configuration
ssl_certificate $SSL_CERT_PATH;
ssl_certificate_key $SSL_KEY_PATH;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
$IP_RESTRICTION
# Security Headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
# Cache static assets (for frontend apps)
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
proxy_pass http://$DOCKER_HOST:$PORT;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_cache_valid 200 30d;
add_header Cache-Control "public, immutable, max-age=2592000";
}
# Main location
location / {
proxy_pass http://$DOCKER_HOST:$PORT;
proxy_http_version 1.1;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_cache_bypass \$http_upgrade;
proxy_read_timeout 86400s;
proxy_send_timeout 86400s;
client_max_body_size 100M;
}
}
EOF
echo -e "${GREEN}[INFO]${NC} Configuration générée: $OUTPUT_FILE"
echo ""
echo "Pour déployer:"
echo " ./deploy-nginx.sh $OUTPUT_FILE"