Skip to content

Commit 9fda055

Browse files
anak10thnanak10thn
committed
Add tools
1 parent 39ababf commit 9fda055

11 files changed

+1207
-478
lines changed

‎README.md

-478
Large diffs are not rendered by default.

‎docs/nginx2json.ts

+476
Large diffs are not rendered by default.

‎docs/ssl-generator.md

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# ssl-generator - Let's Encrypt SSL Certificate Generator
2+
3+
The `ssl-generator.ts` tool automates the process of obtaining SSL certificates from Let's Encrypt using the ACME protocol.
4+
5+
#### Features
6+
- Automated certificate generation
7+
- HTTP-01 challenge support
8+
- Staging environment for testing
9+
- Multiple domain support
10+
- Automatic renewal support
11+
- CSR generation
12+
- Key management
13+
14+
#### Installation
15+
```bash
16+
chmod +x tools/ssl-generator.ts tools/challenge-server.ts
17+
```
18+
19+
#### Usage
20+
```bash
21+
deno run --allow-read --allow-write --allow-net tools/ssl-generator.ts [options]
22+
23+
Options:
24+
-d, --domain <domain> Domain name to generate certificate for
25+
-e, --email <email> Email address for Let's Encrypt account
26+
-o, --output <dir> Output directory for certificates
27+
-s, --staging Use Let's Encrypt staging environment
28+
-h, --help Show help message
29+
```
30+
31+
#### Examples
32+
33+
1. **Generate Certificate for Single Domain**
34+
```bash
35+
deno run --allow-read --allow-write --allow-net tools/ssl-generator.ts \
36+
--domain example.com \
37+
--email [email protected] \
38+
--output /etc/nginx/ssl
39+
```
40+
41+
2. **Test with Staging Environment**
42+
```bash
43+
deno run --allow-read --allow-write --allow-net tools/ssl-generator.ts \
44+
--domain example.com \
45+
--email [email protected] \
46+
--staging
47+
```
48+
49+
3. **Generate Certificates for Multiple Domains**
50+
```bash
51+
./examples/generate-ssl.sh
52+
```
53+
54+
#### Challenge Server
55+
56+
The tool includes a challenge server for HTTP-01 validation:
57+
58+
```bash
59+
sudo deno run --allow-net --allow-read tools/challenge-server.ts
60+
```
61+
62+
#### Integration with Nginx
63+
64+
1. **Configure SSL in Nginx**
65+
```nginx
66+
ssl_certificate /etc/nginx/ssl/example.com.crt;
67+
ssl_certificate_key /etc/nginx/ssl/example.com.key;
68+
ssl_protocols TLSv1.2 TLSv1.3;
69+
```
70+
71+
2. **Auto-renewal Setup**
72+
```bash
73+
# Add to crontab
74+
0 0 1 * * /path/to/generate-ssl.sh >> /var/log/ssl-renewal.log 2>&1
75+
```
76+
77+
#### Error Handling
78+
79+
1. **Rate Limits**
80+
- Staging environment: Unlimited
81+
- Production: 50 certificates per domain per week
82+
83+
2. **Common Issues**
84+
- DNS not configured correctly
85+
- Port 80 not accessible
86+
- Invalid domain ownership
87+
- Network connectivity issues
88+
89+
3. **Troubleshooting**
90+
```bash
91+
# Test with staging first
92+
deno run --allow-read --allow-write --allow-net tools/ssl-generator.ts \
93+
--domain example.com \
94+
--email [email protected] \
95+
--staging
96+
97+
# Check challenge server
98+
curl http://example.com/.well-known/acme-challenge/test
99+
100+
# Verify DNS
101+
dig +short example.com
102+
```

‎examples/generate-config.sh

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/bash
2+
3+
# Static website example
4+
echo "Generating static website configuration..."
5+
curl -X POST -H "Content-Type: application/json" -d '{
6+
"template": "static",
7+
"templateParams": {
8+
"domain": "example.com",
9+
"rootPath": "/var/www/example",
10+
"sslEnabled": true
11+
}
12+
}' http://localhost:3000
13+
14+
echo -e "\n\nGenerating WordPress configuration..."
15+
curl -X POST -H "Content-Type: application/json" -d '{
16+
"template": "wordpress",
17+
"templateParams": {
18+
"domain": "blog.com",
19+
"rootPath": "/var/www/wordpress",
20+
"phpVersion": "8.2",
21+
"sslEnabled": true
22+
}
23+
}' http://localhost:3000
24+
25+
echo -e "\n\nGenerating microservices configuration..."
26+
curl -X POST -H "Content-Type: application/json" -d '{
27+
"template": "microservices",
28+
"templateParams": {
29+
"domain": "api.myapp.com",
30+
"services": [
31+
{
32+
"name": "auth",
33+
"port": 3001,
34+
"path": "/auth",
35+
"methods": ["POST", "GET"],
36+
"corsEnabled": true
37+
},
38+
{
39+
"name": "users",
40+
"port": 3002,
41+
"path": "/users",
42+
"methods": ["GET", "POST", "PUT", "DELETE"],
43+
"corsEnabled": true
44+
},
45+
{
46+
"name": "websocket",
47+
"port": 3003,
48+
"path": "/ws"
49+
}
50+
],
51+
"sslEnabled": true
52+
}
53+
}' http://localhost:3000

‎examples/generate-ssl.sh

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/bin/bash
2+
3+
# Example script to generate SSL certificates for multiple domains
4+
5+
# Start the challenge server (requires root for port 80)
6+
sudo luwak ../tools/challenge-server.ts &
7+
CHALLENGE_PID=$!
8+
9+
# Function to clean up challenge server
10+
cleanup() {
11+
echo "Stopping challenge server..."
12+
sudo kill $CHALLENGE_PID
13+
exit
14+
}
15+
16+
# Set up trap for cleanup
17+
trap cleanup EXIT INT TERM
18+
19+
# Generate certificates for domains
20+
DOMAINS=(
21+
"example.com"
22+
"api.example.com"
23+
"blog.example.com"
24+
)
25+
26+
EMAIL="[email protected]"
27+
OUTPUT_DIR="/etc/nginx/ssl"
28+
29+
for domain in "${DOMAINS[@]}"; do
30+
echo "Generating certificate for $domain..."
31+
32+
# Use staging environment first to test
33+
deno run --allow-read --allow-write --allow-net ../tools/ssl-generator.ts \
34+
--domain "$domain" \
35+
--email "$EMAIL" \
36+
--output "$OUTPUT_DIR" \
37+
--staging
38+
39+
# If successful, generate real certificate
40+
if [ $? -eq 0 ]; then
41+
echo "Staging successful, generating production certificate..."
42+
deno run --allow-read --allow-write --allow-net ../tools/ssl-generator.ts \
43+
--domain "$domain" \
44+
--email "$EMAIL" \
45+
--output "$OUTPUT_DIR"
46+
fi
47+
done
48+
49+
# Clean up will happen automatically due to trap

‎examples/example.com.conf renamed to ‎examples/nginx-config/example.com.conf

File renamed without changes.

‎examples/nginx-config/microservices.conf

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
upstream auth_service {
2+
server localhost:3001 weight=3;
3+
server localhost:3002 weight=3;
4+
}
5+
6+
upstream api_service {
7+
server localhost:4001;
8+
server localhost:4002;
9+
}
10+
11+
upstream websocket_service {
12+
server localhost:5001;
13+
}
14+
15+
server {
16+
listen 443 ssl http2;
17+
server_name api.example.com;
18+
19+
ssl_certificate /etc/ssl/api.example.com.crt;
20+
ssl_certificate_key /etc/ssl/api.example.com.key;
21+
ssl_protocols TLSv1.2 TLSv1.3;
22+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
23+
ssl_prefer_server_ciphers on;
24+
ssl_session_timeout 1d;
25+
ssl_session_tickets off;
26+
ssl_stapling on;
27+
ssl_stapling_verify on;
28+
29+
# Security headers
30+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
31+
add_header X-Frame-Options "DENY";
32+
add_header X-Content-Type-Options "nosniff";
33+
add_header X-XSS-Protection "1; mode=block";
34+
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'";
35+
36+
# Global rate limiting
37+
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
38+
39+
# Auth service
40+
location /auth {
41+
proxy_pass http://auth_service;
42+
proxy_set_header Host $host;
43+
proxy_set_header X-Real-IP $remote_addr;
44+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
45+
proxy_set_header X-Forwarded-Proto $scheme;
46+
47+
# Rate limiting
48+
limit_req zone=api_limit burst=20 nodelay;
49+
50+
# CORS
51+
add_header 'Access-Control-Allow-Origin' 'https://example.com';
52+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
53+
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
54+
add_header 'Access-Control-Allow-Credentials' 'true';
55+
}
56+
57+
# API service with caching
58+
location /api {
59+
proxy_pass http://api_service;
60+
proxy_set_header Host $host;
61+
proxy_set_header X-Real-IP $remote_addr;
62+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
63+
proxy_set_header X-Forwarded-Proto $scheme;
64+
65+
# Caching
66+
proxy_cache api_cache;
67+
proxy_cache_valid 200 60m;
68+
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
69+
proxy_cache_key $host$request_uri;
70+
71+
# CORS
72+
add_header 'Access-Control-Allow-Origin' 'https://example.com';
73+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
74+
add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type';
75+
add_header 'Access-Control-Allow-Credentials' 'true';
76+
}
77+
78+
# WebSocket service
79+
location /ws {
80+
proxy_pass http://websocket_service;
81+
proxy_http_version 1.1;
82+
proxy_set_header Upgrade $http_upgrade;
83+
proxy_set_header Connection "upgrade";
84+
proxy_set_header Host $host;
85+
proxy_set_header X-Real-IP $remote_addr;
86+
proxy_read_timeout 3600s;
87+
proxy_send_timeout 3600s;
88+
}
89+
}

‎examples/nginx-config/static-site.conf

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
server {
2+
listen 80;
3+
server_name example.com www.example.com;
4+
return 301 https://$server_name$request_uri;
5+
}
6+
7+
server {
8+
listen 443 ssl;
9+
server_name example.com www.example.com;
10+
11+
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
12+
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
13+
ssl_protocols TLSv1.2 TLSv1.3;
14+
ssl_prefer_server_ciphers on;
15+
16+
root /var/www/example.com;
17+
index index.html;
18+
19+
# Security headers
20+
add_header X-Frame-Options "SAMEORIGIN";
21+
add_header X-Content-Type-Options "nosniff";
22+
add_header X-XSS-Protection "1; mode=block";
23+
24+
# Enable gzip compression
25+
gzip on;
26+
gzip_types text/plain text/css application/json application/javascript;
27+
28+
location / {
29+
try_files $uri $uri/ =404;
30+
expires 30d;
31+
add_header Cache-Control "public, no-transform";
32+
}
33+
34+
location /assets {
35+
expires max;
36+
add_header Cache-Control "public, no-transform";
37+
access_log off;
38+
}
39+
}

‎examples/nginx-config/wordpress.conf

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
server {
2+
listen 443 ssl;
3+
server_name blog.example.com;
4+
5+
root /var/www/wordpress;
6+
index index.php;
7+
8+
client_max_body_size 64M;
9+
10+
ssl_certificate /etc/ssl/blog.example.com.crt;
11+
ssl_certificate_key /etc/ssl/blog.example.com.key;
12+
13+
# Security headers
14+
add_header X-Frame-Options "SAMEORIGIN";
15+
add_header X-Content-Type-Options "nosniff";
16+
add_header X-XSS-Protection "1; mode=block";
17+
18+
# Gzip compression
19+
gzip on;
20+
gzip_types text/plain text/css application/json application/javascript text/xml application/xml+rss text/javascript;
21+
22+
location / {
23+
try_files $uri $uri/ /index.php?$args;
24+
}
25+
26+
location ~ \.php$ {
27+
fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
28+
fastcgi_index index.php;
29+
include fastcgi_params;
30+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
31+
fastcgi_param PATH_INFO $fastcgi_path_info;
32+
}
33+
34+
location /wp-content {
35+
expires 30d;
36+
add_header Cache-Control "public, no-transform";
37+
}
38+
39+
location = /favicon.ico {
40+
access_log off;
41+
log_not_found off;
42+
}
43+
44+
location = /robots.txt {
45+
access_log off;
46+
log_not_found off;
47+
}
48+
}

0 commit comments

Comments
 (0)