virtualmin-nginx-hook

#!/bin/bash

#######################################################################
# Nginx Config Generator is a virtualmin hook to set Nginx config
# when creating/editing/deleting a virtualserver.

# Copyright (C) 2017 Marc Sanchez Fauste
# Copyright (C) 2017 Adrian Gibanel
# Copyright (C) 2017 BTACTIC, SCCL

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#######################################################################

#set -x
#set -v

NGINX_CONF_TEMPLATE_DIR="/usr/local/etc/nginx-templates"
NGINX_CONF_TEMPLATE="default"
NGINX_SSL_CONF_TEMPLATE_FILE="plantilla-nginx-ssl.conf"
NGINX_NON_SSL_CONF_TEMPLATE_FILE="plantilla-nginx.conf"

# Nginx logrotate
NGINX_LOGS_FOLDER="/var/log/virtualmin/nginx"
NGINX_LOGROTATE_CONFIG_FOLDER="/etc/logrotate.d"

NGINX_LOGROTATE_TEMPLATE_DIR="/usr/local/etc/nginx-logrotate-templates"
NGINX_LOGROTATE_TEMPLATE="default"
NGINX_LOGROTATE_TEMPLATE_FILE_NAME="logrotate-nginx.conf"

# Check if nginx logrotate template is specified on virtualserver description
LOGROTATE_TEMPLATE=$(echo "$VIRTUALSERVER_OWNER" \
        | grep -Po "(?<=\[nginx-logrotate-template )(\w|-)+(?=\])")
if [ ! -z "${LOGROTATE_TEMPLATE}" ]; then
    if [ -d ${NGINX_LOGROTATE_TEMPLATE_DIR}/${LOGROTATE_TEMPLATE} ]; then
        NGINX_LOGROTATE_TEMPLATE=${LOGROTATE_TEMPLATE}
    fi
fi
NGINX_LOGROTATE_TEMPLATE_FILE="${NGINX_LOGROTATE_TEMPLATE_DIR}\
/${NGINX_LOGROTATE_TEMPLATE}\
/${NGINX_LOGROTATE_TEMPLATE_FILE_NAME}"

NGINX_LOGROTATE_CONFIG_FILE_NON_SSL="${NGINX_LOGROTATE_CONFIG_FOLDER}\
/${VIRTUALSERVER_DOM}.nginx.conf"
NGINX_LOGROTATE_CONFIG_FILE_SSL="${NGINX_LOGROTATE_CONFIG_FOLDER}\
/${VIRTUALSERVER_DOM}.ssl.nginx.conf"

### NGINX CONF DEFAULT VARIABLES - BEGIN

REPL_SSL_PROTOCOLS="TLSv1 TLSv1.1 TLSv1.2"
REPL_SSL_CIPHERS="!SSLv2:!MD5:HIGH"

### NGINX CONF DEFAULT VARIABLES - END

NGINX_SITES_AVAILABLE_DIRECTORY="/etc/nginx/sites-available"
NGINX_SITES_ENABLED_DIRECTORY="/etc/nginx/sites-enabled"

# Check if nginx template is specified on virtualserver description
TEMPLATE=$(echo "$VIRTUALSERVER_OWNER" | grep -Po "(?<=\[nginx-template )(\w|-)+(?=\])")
if [ ! -z "${TEMPLATE}" ]; then
    if [ -d ${NGINX_CONF_TEMPLATE_DIR}/${TEMPLATE} ]; then
        NGINX_CONF_TEMPLATE=${TEMPLATE}
    fi
fi

NGINX_SSL_CONF_TEMPLATE="${NGINX_CONF_TEMPLATE_DIR}/${NGINX_CONF_TEMPLATE}/${NGINX_SSL_CONF_TEMPLATE_FILE}"
NGINX_NON_SSL_CONF_TEMPLATE="${NGINX_CONF_TEMPLATE_DIR}/${NGINX_CONF_TEMPLATE}/${NGINX_NON_SSL_CONF_TEMPLATE_FILE}"

# Check if virtual server is an alias
if [ ! -z "${VIRTUALSERVER_PARENT}" ] && [ ${VIRTUALSERVER_ALIAS_MODE} -eq 1 ]; then
    IS_ALIAS="YES"
else
    IS_ALIAS="NO"
fi

### NGINX CONF THIS MACHINE VARIABLES - BEGIN

REPL_PUBLIC_NON_SSL_PORT="80"
REPL_PUBLIC_SSL_PORT="443"

if [ "$IS_ALIAS" = "YES" ]; then
    REPL_PUBLIC_NON_SSL_IP="${PARENT_VIRTUALSERVER_IP}"
    REPL_APACHE_NON_SSL_IP="${PARENT_VIRTUALSERVER_IP}"
    REPL_APACHE_NON_SSL_PORT="${PARENT_VIRTUALSERVER_WEB_PORT}"

    REPL_PUBLIC_SSL_IP="${PARENT_VIRTUALSERVER_IP}"
    REPL_APACHE_SSL_IP="${PARENT_VIRTUALSERVER_IP}"
    REPL_APACHE_SSL_PORT="${PARENT_VIRTUALSERVER_WEB_SSLPORT}"
else
    REPL_PUBLIC_NON_SSL_IP="${VIRTUALSERVER_IP}"
    REPL_APACHE_NON_SSL_IP="${VIRTUALSERVER_IP}"
    REPL_APACHE_NON_SSL_PORT="${VIRTUALSERVER_WEB_PORT}"

    REPL_PUBLIC_SSL_IP="${VIRTUALSERVER_IP}"
    REPL_APACHE_SSL_IP="${VIRTUALSERVER_IP}"
    REPL_APACHE_SSL_PORT="${VIRTUALSERVER_WEB_SSLPORT}"
fi

### NGINX CONF THIS MACHINE VARIABLES - END

# Check if SSL is enabled
if [ "$IS_ALIAS" = "YES" ]; then
    if [ $PARENT_VIRTUALSERVER_SSL -eq 1 ]; then
        IS_SSL="YES"
    else
        IS_SSL="NO"
    fi
else
    if [ $VIRTUALSERVER_SSL -eq 1 ]; then
        IS_SSL="YES"
    else
        IS_SSL="NO"
    fi
fi

# Configure nginx logs
NGINX_ACCESS_LOG_FILE_NON_SSL="${NGINX_LOGS_FOLDER}/${VIRTUALSERVER_DOM}_access_log"
NGINX_ERROR_LOG_FILE_NON_SSL="${NGINX_LOGS_FOLDER}/${VIRTUALSERVER_DOM}_error_log"

#
# Create the nginx conf entry upon creating or modifying a domain
#
if [ "$VIRTUALSERVER_ACTION" = "CREATE_DOMAIN" ] || [ "$VIRTUALSERVER_ACTION" = "MODIFY_DOMAIN" ]; then

    ndomain_alias_string="${VIRTUALSERVER_DOM} www.${VIRTUALSERVER_DOM}"

    # Virtual server is an alias? Then use PARENT variables
    if [ "$IS_ALIAS" = "YES" ]; then
        ndomain_web_root_path=${PARENT_VIRTUALSERVER_PUBLIC_HTML_PATH};
    else
        # Otherwise it is a parent server or a sub-server
        ndomain_web_root_path=${VIRTUALSERVER_PUBLIC_HTML_PATH};
    fi

    sed -e 's/''@SERVER_NAME@''/'"${ndomain_alias_string}"'/g' \
          -e 's/''@PUBLIC_NON_SSL_IP@''/'"${REPL_PUBLIC_NON_SSL_IP}"'/g' \
          -e 's/''@PUBLIC_NON_SSL_PORT@''/'"${REPL_PUBLIC_NON_SSL_PORT}"'/g' \
          -e 's~''@WEB_ROOT_PATH@''~'"${ndomain_web_root_path}"'~g' \
          -e 's/''@APACHE_NON_SSL_IP@''/'"${REPL_APACHE_NON_SSL_IP}"'/g' \
          -e 's/''@APACHE_NON_SSL_PORT@''/'"${REPL_APACHE_NON_SSL_PORT}"'/g' \
          -e 's~''@ACCESS_LOG_FILE@''~'"${NGINX_ACCESS_LOG_FILE_NON_SSL}"'~g' \
          -e 's~''@ERROR_LOG_FILE@''~'"${NGINX_ERROR_LOG_FILE_NON_SSL}"'~g' \
    \
          "${NGINX_NON_SSL_CONF_TEMPLATE}" \
    > "${NGINX_SITES_AVAILABLE_DIRECTORY}/${VIRTUALSERVER_DOM}.conf"

    sed -e 's~''@ACCESS_LOG_FILE@''~'"${NGINX_ACCESS_LOG_FILE_NON_SSL}"'~g' \
          -e 's~''@ERROR_LOG_FILE@''~'"${NGINX_ERROR_LOG_FILE_NON_SSL}"'~g' \
    \
          "${NGINX_LOGROTATE_TEMPLATE_FILE}" \
    > "${NGINX_LOGROTATE_CONFIG_FILE_NON_SSL}"

    # If SSL in enabled, add the SSL directive too
    if [ "$IS_SSL" = "YES" ]; then

        # Virtual server is an alias? Then use PARENT certs
        if [ "$IS_ALIAS" = "YES" ]; then
            ndomain_ssl_key=${PARENT_VIRTUALSERVER_SSL_KEY};
            ndomain_nginx_chained_ssl_crt=${PARENT_VIRTUALSERVER_SSL_COMBINED};
        else
            # Otherwise it is a parent server or a sub-server
            ndomain_ssl_key=${VIRTUALSERVER_SSL_KEY};
            ndomain_nginx_chained_ssl_crt=${VIRTUALSERVER_SSL_COMBINED};
        fi

        # Configure nginx logs
        NGINX_ACCESS_LOG_FILE_SSL="${NGINX_LOGS_FOLDER}/${VIRTUALSERVER_DOM}.ssl_access_log"
        NGINX_ERROR_LOG_FILE_SSL="${NGINX_LOGS_FOLDER}/${VIRTUALSERVER_DOM}.ssl_error_log"

        sed -e 's/''@SERVER_NAME@''/'"${ndomain_alias_string}"'/g' \
              -e 's/''@PUBLIC_SSL_IP@''/'"${REPL_PUBLIC_SSL_IP}"'/g' \
              -e 's/''@PUBLIC_SSL_PORT@''/'"${REPL_PUBLIC_SSL_PORT}"'/g' \
              -e 's~''@WEB_ROOT_PATH@''~'"${ndomain_web_root_path}"'~g' \
              -e 's/''@SSL_PROTOCOLS@''/'"${REPL_SSL_PROTOCOLS}"'/g' \
              -e 's/''@SSL_CIPHERS@''/'"${REPL_SSL_CIPHERS}"'/g' \
              -e 's~''@SSL_CERTIFICATE@''~'"${ndomain_nginx_chained_ssl_crt}"'~g' \
              -e 's~''@SSL_CERTIFICATE_KEY@''~'"${ndomain_ssl_key}"'~g' \
              -e 's/''@APACHE_SSL_IP@''/'"${REPL_APACHE_SSL_IP}"'/g' \
              -e 's/''@APACHE_SSL_PORT@''/'"${REPL_APACHE_SSL_PORT}"'/g' \
              -e 's~''@ACCESS_LOG_FILE@''~'"${NGINX_ACCESS_LOG_FILE_SSL}"'~g' \
              -e 's~''@ERROR_LOG_FILE@''~'"${NGINX_ERROR_LOG_FILE_SSL}"'~g' \
        \
              "${NGINX_SSL_CONF_TEMPLATE}" \
        > "${NGINX_SITES_AVAILABLE_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf"

        sed -e 's~''@ACCESS_LOG_FILE@''~'"${NGINX_ACCESS_LOG_FILE_SSL}"'~g' \
              -e 's~''@ERROR_LOG_FILE@''~'"${NGINX_ERROR_LOG_FILE_SSL}"'~g' \
        \
              "${NGINX_LOGROTATE_TEMPLATE_FILE}" \
        > "${NGINX_LOGROTATE_CONFIG_FILE_SSL}"

    fi


    # Make sure symlinks are always created in case of non-ssl
    if [ ! -e ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.conf ]; then
        ln -s ${NGINX_SITES_AVAILABLE_DIRECTORY}/${VIRTUALSERVER_DOM}.conf ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.conf
    fi

    # Make sure symlinks are created when enabling ssl or deleted when it is disabled
    if [ "$IS_SSL" = "YES" ]; then
        if [ ! -e ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf ]; then
            ln -s ${NGINX_SITES_AVAILABLE_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf
        fi
    else
        if [ -e ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf ]; then
            rm ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf
        fi
        if [ -e ${NGINX_LOGROTATE_CONFIG_FILE_SSL} ]; then
            rm ${NGINX_LOGROTATE_CONFIG_FILE_SSL}
        fi
    fi

fi

#
# Delete the config file and the symlink if the entry is being deleted
#
if [ "$VIRTUALSERVER_ACTION" = "DELETE_DOMAIN" ]; then

    rm -f ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.conf ${NGINX_SITES_AVAILABLE_DIRECTORY}/${VIRTUALSERVER_DOM}.conf
    if [ -e ${NGINX_LOGROTATE_CONFIG_FILE_NON_SSL} ]; then
        rm ${NGINX_LOGROTATE_CONFIG_FILE_NON_SSL}
    fi

    if [ "$IS_SSL" = "YES" ]; then
        rm -f ${NGINX_SITES_ENABLED_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf ${NGINX_SITES_AVAILABLE_DIRECTORY}/${VIRTUALSERVER_DOM}.ssl.conf
        if [ -e ${NGINX_LOGROTATE_CONFIG_FILE_SSL} ]; then
            rm ${NGINX_LOGROTATE_CONFIG_FILE_SSL}
        fi
    fi

fi

# Reload nginx
# /etc/init.d/nginx reload
service nginx reload && service nginx restart