This script install and setup a basic reverse proxy with nginx and add Let's encrypt automation to get SSL certificate

vps-setup-nginx-ssl.sh

#!/bin/bash

# Parsing of --saas-domain and --port
PORT=3000  # Default port

while [[ "$#" -gt 0 ]]; do
  case $1 in
    --saas-domain)
      SAAS_DOMAIN="$2"
      shift 2
      ;;
    --port)
      PORT="$2"
      shift 2
      ;;
    *)
      echo "❌ Unknown option: $1"
      exit 1
      ;;
  esac
done

if [ -z "$SAAS_DOMAIN" ]; then
  echo "❌ You need to pass a domain name with --saas-domain"
  exit 1
fi

# Nginx installation if not present
if ! command -v nginx &>/dev/null; then
  apt update && apt install -y nginx
fi

# Certbot installation
if ! command -v certbot &>/dev/null; then
  apt install -y certbot python3-certbot-nginx
fi

# Get SSL certificate with Certbot
certbot --nginx -d "$SAAS_DOMAIN" --non-interactive --agree-tos -m admin@$SAAS_DOMAIN --redirect

echo "🔐 SSL certificate installed and HTTPS redirect active for $SAAS_DOMAIN."

# Setup of auto-renew of SSL certificate
if ! crontab -l | grep -q 'certbot renew'; then
  (crontab -l 2>/dev/null; echo "0 3 * * * certbot renew --quiet") | crontab -
  echo "⏲️  Cron added for SSL renew every day a 3:00."
else
  echo "✅ Cron already setup."
fi

# Advanced SSL reverse proxy configuration
tee "/etc/nginx/sites-available/$SAAS_DOMAIN" > /dev/null <<EOF
# Redirect all HTTP to HTTPS
server {
    listen 80;
    server_name $SAAS_DOMAIN;
    
    return 301 https://$host$request_uri;
}

# HTTPS server with SSL and strong security settings
server {
    listen 443 ssl http2;
    server_name $SAAS_DOMAIN;
    
    # SSL certificate (via Certbot / Let's Encrypt)
    ssl_certificate     /etc/letsencrypt/live/$SAAS_DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$SAAS_DOMAIN/privkey.pem;
    ssl_error_log /var/log/nginx/ssl_error.log warn;

    # TLS protocols
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_prefer_server_ciphers on;

    # SSL session settings
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    
    
    # Proxy to your app (e.g., running on localhost:3000)
    location / {
        proxy_pass http://localhost:$PORT;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
EOF

# Enable configuration
ln -s "/etc/nginx/sites-available/$SAAS_DOMAIN" "/etc/nginx/sites-enabled/$SAAS_DOMAIN"
rm -f /etc/nginx/sites-enabled/default

# Check nginx configuration
nginx -t && systemctl reload nginx

echo "🔁 NGINX configurated as reverse proxy for $SAAS_DOMAIN on port $PORT."