75 lines
2.5 KiB
Bash
75 lines
2.5 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Uppdatera nginx-config för LandveX Finance
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
NGINX_CONF="/etc/nginx/sites-enabled/landvex-ssl.conf"
|
||
|
|
BACKUP="${NGINX_CONF}.bak-$(date +%s)"
|
||
|
|
|
||
|
|
# Backup
|
||
|
|
cp "$NGINX_CONF" "$BACKUP"
|
||
|
|
echo "Backup: $BACKUP"
|
||
|
|
|
||
|
|
# Ta bort basic auth-blocket och ersätt med JWT-version
|
||
|
|
python3 << 'PYEOF'
|
||
|
|
import re
|
||
|
|
|
||
|
|
with open("/etc/nginx/sites-enabled/landvex-ssl.conf", "r") as f:
|
||
|
|
content = f.read()
|
||
|
|
|
||
|
|
# Hitta och ersätt finance-blocket
|
||
|
|
old_block = ''' # ── Finance — lösenordsskyddad ──────────────────────────────────────
|
||
|
|
location = /ouroboros/finance/whoami {
|
||
|
|
auth_basic "LandveX Finance";
|
||
|
|
auth_basic_user_file /etc/nginx/auth/finance.htpasswd;
|
||
|
|
add_header Content-Type "application/json" always;
|
||
|
|
add_header Cache-Control "no-store" always;
|
||
|
|
return 200 '{"user":"$remote_user"}';
|
||
|
|
}
|
||
|
|
|
||
|
|
location /ouroboros/finance/ {
|
||
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
||
|
|
add_header Pragma "no-cache" always;
|
||
|
|
alias /opt/amos/public/ouroboros/finance/;
|
||
|
|
index index.html;
|
||
|
|
auth_basic "LandveX Finance";
|
||
|
|
auth_basic_user_file /etc/nginx/auth/finance.htpasswd;
|
||
|
|
try_files $uri $uri/ /ouroboros/finance/index.html;
|
||
|
|
}'''
|
||
|
|
|
||
|
|
new_block = ''' # ── Finance — JWT-baserad auth (ingen basic auth) ───────────────────
|
||
|
|
location = /ouroboros/finance/whoami {
|
||
|
|
add_header Content-Type "application/json" always;
|
||
|
|
add_header Cache-Control "no-store" always;
|
||
|
|
return 200 '{"status":"jwt-auth-required","message":"Send JWT in Authorization header"}';
|
||
|
|
}
|
||
|
|
|
||
|
|
location /ouroboros/finance/ {
|
||
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
||
|
|
add_header Pragma "no-cache" always;
|
||
|
|
alias /opt/amos/public/ouroboros/finance/;
|
||
|
|
index index.html;
|
||
|
|
try_files $uri $uri/ /ouroboros/finance/index.html;
|
||
|
|
}'''
|
||
|
|
|
||
|
|
content = content.replace(old_block, new_block)
|
||
|
|
|
||
|
|
# Ta bort hårdkodat intern token
|
||
|
|
content = content.replace('proxy_set_header Authorization "Bearer wavult-amos-internal-2026";', '')
|
||
|
|
|
||
|
|
with open("/etc/nginx/sites-enabled/landvex-ssl.conf", "w") as f:
|
||
|
|
f.write(content)
|
||
|
|
|
||
|
|
print("Nginx config uppdaterad")
|
||
|
|
PYEOF
|
||
|
|
|
||
|
|
# Testa nginx config
|
||
|
|
nginx -t && echo "NGINX_OK" || {
|
||
|
|
echo "NGINX_FAIL — återställer backup"
|
||
|
|
cp "$BACKUP" "$NGINX_CONF"
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ladda om nginx
|
||
|
|
systemctl reload nginx && echo "RELOAD_OK" || echo "RELOAD_FAIL"
|