install_nginx.sh

install_nginx.sh

#!/bin/bash

# ==============================================================================
# Script: setup_lb.sh
# Description: Installs Nginx and configures it as a Load Balancer with optional SSL
# OS: Arch Linux
# ==============================================================================

set -e

# --- 1. Root Check ---
if [ "$EUID" -ne 0 ]; then
  echo "❌ Error: This script must be run as root (use sudo)."
  exit 1
fi

echo "------------------------------------------------------------------"
echo "🚀 Nginx Load Balancer Setup"
echo "------------------------------------------------------------------"

# --- 2. Check/Install Nginx ---
if ! command -v nginx &> /dev/null; then
    echo "📦 Nginx not found. Installing..."
    pacman -Syu --noconfirm nginx
    systemctl enable --now nginx
else
    echo "✔ Nginx is already installed."
fi

# Ensure standard directory structure exists (Debian-style on Arch)
mkdir -p /etc/nginx/sites-available
mkdir -p /etc/nginx/sites-enabled

# Ensure nginx.conf includes these directories (if not already added)
if ! grep -q "sites-enabled" /etc/nginx/nginx.conf; then
    echo "⚠  Adding 'include /etc/nginx/sites-enabled/*.conf;' to nginx.conf..."
    # Insert inside the http block
    sed -i '/http {/a \    include /etc/nginx/sites-enabled/*.conf;' /etc/nginx/nginx.conf
fi

# --- 3. Inputs ---
echo ""
read -p "Enter the Domain Name for this Load Balancer (e.g., lb.example.com): " LB_DOMAIN

echo ""
echo "Enter the Target IPs or Domains (the servers behind this LB)."
echo "Separate multiple targets with spaces (e.g., 10.0.0.1 10.0.0.2 app.internal):"
read -p "Targets: " -a TARGETS

if [ ${#TARGETS[@]} -eq 0 ]; then
    echo "❌ Error: No targets provided. Exiting."
    exit 1
fi

echo ""
while [[ "$SSL_OPTION" != "y" && "$SSL_OPTION" != "n" ]]; do
    read -p "Do you want to enable SSL (HTTPS) via Certbot? [y/n]: " SSL_OPTION
done

# --- 4. Generate Configuration ---
echo ""
echo "⚙  Generating Nginx Configuration..."

CONFIG_FILE="/etc/nginx/sites-available/${LB_DOMAIN}.conf"
SYMLINK_FILE="/etc/nginx/sites-enabled/${LB_DOMAIN}.conf"
UPSTREAM_NAME="backend_cluster_${LB_DOMAIN//./_}" # Replace dots with underscores

# Start Config Content
cat <<EOF > "$CONFIG_FILE"
upstream ${UPSTREAM_NAME} {
    # Load Balancing Method (Default is Round Robin)
    # ip_hash; # Uncomment to enable sticky sessions based on IP
    keepalive 100;
    
EOF

# Add Targets
for target in "${TARGETS[@]}"; do
    echo "    server $target;" >> "$CONFIG_FILE"
done

# End Upstream & Start Server Block
cat <<EOF >> "$CONFIG_FILE"
}

server {
    listen 80;
    server_name ${LB_DOMAIN};

    location / {
        proxy_pass http://${UPSTREAM_NAME};

        # Performance Optimization
        proxy_http_version 1.1;
        proxy_set_header Connection "";


        # Proxy Headers
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;

        # Timeouts (Optional, good for long connections)
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}
EOF

echo "✔ Configuration written to $CONFIG_FILE"

# --- 5. Enable and Test ---
echo "🔗 Enabling site..."
ln -sf "$CONFIG_FILE" "$SYMLINK_FILE"

echo "🧪 Testing configuration..."
if nginx -t; then
    echo "✔ Syntax OK. Reloading Nginx..."
    systemctl reload nginx
else
    echo "❌ Nginx configuration failed. Please check $CONFIG_FILE"
    exit 1
fi

# --- 6. SSL Setup (Optional) ---
if [ "$SSL_OPTION" == "y" ]; then
    echo ""
    echo "🔒 Setting up SSL with Certbot..."

    # Check/Install Certbot
    if ! command -v certbot &> /dev/null; then
        echo "📦 Installing certbot and certbot-nginx..."
        pacman -S --noconfirm certbot certbot-nginx
    fi

    # Run Certbot
    # --nginx: Use Nginx plugin
    # --non-interactive: Run without user input (assumes standard setup)
    # --agree-tos: Agree to terms
    # -m: You might want to ask for email, but usually interactive mode handles this better.
    # We will use standard interactive mode for the first run to ensure email/TOS are handled correctly.
    
    certbot --nginx -d "$LB_DOMAIN"
    
    echo "✔ SSL Setup complete (or attempted)."
fi

echo "------------------------------------------------------------------"
echo "✅ Load Balancer Setup Complete!"
echo "   Domain:  http://$LB_DOMAIN (or https:// if SSL enabled)"
echo "   Targets: ${TARGETS[*]}"
echo "------------------------------------------------------------------"