nginx Scripts and Tools

#!/usr/bin/env bash
#
# Pre-compress static web files for nginx gzip_static
# Reads document root directories from nginx configuration
# Creates .gz companion files for compressible file types
#
# Usage: sudo nginx-precompress
# Schedule: cron.daily or after deploying updated static content
#

set -euo pipefail

NGINX_USER='www-data'
NGINX_GROUP='www-data'
GZIP_CMD='/bin/gzip'

# File types to compress (matches nginx gzip_types in conf.d/gzip.conf)
FILETYPES='html htm css js xml json svg atom rss txt woff woff2'

# Log to syslog
log() {
    logger -t nginx-precompress --priority "user.${1}" "${2}"
}

if [[ ${EUID} -ne 0 ]]; then
    echo "This script must be run as root"
    exit 1
fi

log 'notice' "Starting static pre-compression for nginx"

# Extract document root directories from current nginx configuration
webdirs=$(nginx -qT 2>/dev/null | \
    grep -oP '^\s*(root|alias)\s+\K(/[^\s;]+)' | \
    sort -u)

if [[ -z "$webdirs" ]]; then
    log 'warning' "No document root directories found in nginx configuration"
    exit 0
fi

total_files=0
total_new=0
total_updated=0

for dir in $webdirs; do

    [[ -d "$dir" ]] || continue

    log 'info' "Processing directory: $dir"

    for filetype in $FILETYPES; do

        while IFS= read -r -d '' file; do

            total_files=$((total_files + 1))
            gz_file="${file}.gz"

            # Skip if already compressed and up to date
            if [[ -f "$gz_file" && "$gz_file" -nt "$file" ]]; then
                continue
            fi

            if [[ -f "$gz_file" ]]; then
                # Update outdated compressed file
                total_updated=$((total_updated + 1))
            else
                # Create new compressed file
                total_new=$((total_new + 1))
            fi

            # Compress keeping the original
            $GZIP_CMD --best --keep --force "$file"

            # Preserve ownership and permissions from original
            chown --reference="$file" "$gz_file"
            chmod --reference="$file" "$gz_file"
            touch --reference="$file" "$gz_file"

        done < <(find "$dir" -type f -name "*.${filetype}" -print0)

    done

done

log 'notice' "Pre-compression complete: ${total_files} files checked, ${total_new} new, ${total_updated} updated"

sudo chmod 0755 /usr/local/bin/nginx-precompress

# In a location block serving static files
location ~* \.(html|css|js|svg|xml|json)$ {
    gzip_static on;
    expires 1y;
    add_header Cache-Control 'public' always;
}

sudo tee /etc/cron.daily/nginx-precompress << 'EOF'
#!/usr/bin/env bash
/usr/local/bin/nginx-precompress
EOF

sudo chmod 0755 /etc/cron.daily/nginx-precompress

sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d yourdomain.net -d www.yourdomain.net

sudo systemctl status certbot.timer

sudo certbot renew --dry-run

ls /etc/letsencrypt/renewal-hooks/deploy/

sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh << 'EOF'
#!/usr/bin/env bash
systemctl reload nginx
EOF

sudo chmod 0755 /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

#!/usr/bin/env bash
#
# nginx virtual server health check
# Tests TLS connectivity and certificate validity for all configured servers
#
# Usage: nginx-healthcheck [--verbose]
#

set -uo pipefail

VERBOSE=false
[[ "${1:-}" == "--verbose" ]] && VERBOSE=true

PASS=0
FAIL=0
WARN=0

log_result() {
    local status="$1"
    local server="$2"
    local message="$3"

    case "$status" in
        PASS) echo "✓ ${server}: ${message}"; PASS=$((PASS + 1)) ;;
        FAIL) echo "✗ ${server}: ${message}" >&2; FAIL=$((FAIL + 1)) ;;
        WARN) echo "! ${server}: ${message}"; WARN=$((WARN + 1)) ;;
    esac
}

# Extract virtual server names from nginx configuration
servers=$(nginx -qT 2>/dev/null | \
    grep -oP '^\s*server_name\s+\K[^\s;]+' | \
    grep -v '^\*' | \
    grep '\.' | \
    sort -u)

if [[ -z "$servers" ]]; then
    echo "No virtual servers found in nginx configuration" >&2
    exit 1
fi

for server in $servers; do

    # Skip internal hostnames and localhost
    [[ "$server" =~ ^(localhost|127\.|10\.|192\.168\.) ]] && continue

    # Test HTTPS connection and certificate
    cert_info=$(openssl s_client \
        -connect "${server}:443" \
        -servername "$server" \
        -verify_return_error \
        2>/dev/null < /dev/null)

    if [[ $? -ne 0 ]]; then
        log_result FAIL "$server" "TLS connection failed"
        continue
    fi

    # Check certificate expiry
    expiry=$(echo "$cert_info" | \
        openssl x509 -noout -enddate 2>/dev/null | \
        cut -d= -f2)

    if [[ -n "$expiry" ]]; then
        expiry_epoch=$(date -d "$expiry" +%s 2>/dev/null)
        now_epoch=$(date +%s)
        days_remaining=$(( (expiry_epoch - now_epoch) / 86400 ))

        if [[ $days_remaining -lt 0 ]]; then
            log_result FAIL "$server" "Certificate EXPIRED"
        elif [[ $days_remaining -lt 14 ]]; then
            log_result WARN "$server" "Certificate expires in ${days_remaining} days"
        else
            $VERBOSE && log_result PASS "$server" "Certificate valid for ${days_remaining} days"
        fi
    fi

    # Test HTTP response code
    http_code=$(curl -s -o /dev/null -w "%{http_code}" \
        --max-time 5 \
        "https://${server}/" 2>/dev/null)

    case "$http_code" in
        200|301|302|304)
            $VERBOSE && log_result PASS "$server" "HTTP ${http_code}"
            ;;
        000)
            log_result FAIL "$server" "Connection refused or timeout"
            ;;
        *)
            log_result WARN "$server" "Unexpected HTTP ${http_code}"
            ;;
    esac

done

echo ""
echo "Results: ${PASS} passed, ${WARN} warnings, ${FAIL} failed"

[[ $FAIL -gt 0 ]] && exit 1
exit 0

sudo chmod 0755 /usr/local/bin/nginx-healthcheck

# Quick check (only show warnings and failures)
sudo nginx-healthcheck

# Verbose (show all results including passing checks)
sudo nginx-healthcheck --verbose

cat > ~/.anacron/cron.weekly/nginx-healthcheck << 'EOF'
#!/usr/bin/env bash
/usr/local/bin/nginx-healthcheck 2>&1 | \
    mail -s "nginx health check on $(hostname -s)" root
EOF

chmod 0755 ~/.anacron/cron.weekly/nginx-healthcheck

# Top 10 client IP addresses by request count
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Top 10 requested URLs
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# HTTP error responses in the last hour
awk -v d="$(date --date='1 hour ago' '+%d/%b/%Y:%H')" \
    '$4 ~ d && $9 >= 400 {print $9, $7}' \
    /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Requests per minute (useful for detecting attacks)
awk '{print $4}' /var/log/nginx/access.log | \
    cut -d: -f1-3 | sort | uniq -c

# Check for rate limit hits (429 responses)
grep ' 429 ' /var/log/nginx/access.log | \
    awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# 1. Validate configuration syntax
sudo nginx -t

# 2. Reload nginx
sudo systemctl reload nginx

# 3. Run health check
sudo nginx-healthcheck --verbose

# 4. Check error log for any new issues
sudo journalctl -u nginx --since "5 minutes ago"