feat: add ssl cert update script and gitattributes

2026-08-24 10:20:35 +08:00
commit 55c56da5f1
3 changed files with 97 additions and 0 deletions
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+#
+# update-ssl.sh — Automatically update SSL certificates on the server.
+#
+# Assumes:
+#   - The nginx cert zips (e.g. ayi-games.online_nginx.zip) are downloaded to
+#     ~/Downloads on this machine (mac).
+#   - This machine can ssh/scp to the server without a password prompt.
+#
+# Flow (for each *_nginx.zip found in ~/Downloads):
+#   1. Upload it to the server.
+#   2. Unzip into ~/certs, overwriting existing cert files (flat, ignoring
+#      any subfolders inside the zip).
+#   3. Remove the uploaded zip from the server.
+#   4. Delete the source zip from ~/Downloads.
+#   5. Reload nginx once, after all zips are installed.
+
+set -euo pipefail
+
+SERVER="lighthouse@ayi-games.online"
+CERTS_DIR="~/certs"
+DOWNLOAD_DIR="${HOME}/Downloads"
+
+usage() {
+    cat <<EOF
+Usage: $0
+
+Finds every *_nginx.zip in ${DOWNLOAD_DIR}, uploads each to the server,
+installs it into ${CERTS_DIR}, reloads nginx, and deletes the source zips
+from ${DOWNLOAD_DIR}.
+EOF
+}
+
+# --- Find all zips --------------------------------------------------------
+ZIPS=()
+while IFS= read -r z; do
+    ZIPS+=("${z}")
+done < <(find "${DOWNLOAD_DIR}" -maxdepth 1 -name '*_nginx.zip' -type f -print 2>/dev/null | sort)
+
+if [[ ${#ZIPS[@]} -eq 0 ]]; then
+    echo "ERROR: no *_nginx.zip found in ${DOWNLOAD_DIR}" >&2
+    exit 1
+fi
+
+echo "Found ${#ZIPS[@]} zip(s) to process:"
+for z in "${ZIPS[@]}"; do
+    echo "  - ${z}"
+done
+
+# --- Upload & install each zip --------------------------------------------
+for ZIP_PATH in "${ZIPS[@]}"; do
+    ZIP_NAME="$(basename "${ZIP_PATH}")"
+    echo
+    echo ">>> Processing ${ZIP_NAME}"
+
+    # Upload
+    echo "Uploading to ${SERVER}..."
+    scp "${ZIP_PATH}" "${SERVER}:${ZIP_NAME}"
+
+    # Install on server (flat extract, overwrite), then remove from server
+    echo "Installing into ${CERTS_DIR}..."
+    ssh "${SERVER}" "set -e
+mkdir -p ${CERTS_DIR}
+unzip -oj ${ZIP_NAME} -d ${CERTS_DIR}
+rm -f ${ZIP_NAME}
+"
+
+    # Only delete the local source once the upload+install succeeded
+    rm -f "${ZIP_PATH}"
+    echo "Deleted local source: ${ZIP_PATH}"
+done
+
+# --- Reload nginx once ----------------------------------------------------
+echo
+echo "Reloading nginx..."
+ssh "${SERVER}" "sudo nginx -s reload && echo 'nginx reloaded OK'"
+
+echo
+echo "Done. All SSL certs updated and nginx reloaded."