From afe6ad474d2f8486429c53f5f9102250e862a667 Mon Sep 17 00:00:00 2001
From: Hizkia Felix Winata <felix@hizkifw.me>
Date: Sun, 30 Jan 2022 04:34:48 +0800
Subject: [PATCH] feat(nginx): directly proxy spwn

---
 scripts/nginx/README.md       | 21 ++++++++++++++
 scripts/nginx/remote_setup.sh | 54 +++++++++++++++++++++++++++++------
 2 files changed, 66 insertions(+), 9 deletions(-)

diff --git a/scripts/nginx/README.md b/scripts/nginx/README.md
index 2e563eb..873dd69 100644
--- a/scripts/nginx/README.md
+++ b/scripts/nginx/README.md
@@ -83,3 +83,24 @@ Run the script:
 Once the script is done, your server should be accessible from
 `https://relay1.stream.example.org` and proxying all requests to
 `https://restream.dev`.
+
+Example 2: setting up a relay for SPWN:
+
+```
+./remote_setup.sh \
+    --domain relay1.stream.example.org \
+    --upstream-server 'https://vod.spwn.jp:443' \
+    --upstream-base '/spwn-archives/xxxxx/xxxx' \
+    --acme-email acme@example.org \
+    --target-server root@relay1.stream.example.org \
+    --pass-header User-Agent '[user agent string]' \
+    --pass-header Cookie '[redacted]' \
+    --pass-header Referrer 'https://spwn.jp/'
+```
+
+**Notes**
+
+- `--upstream-server`: Include the `https://` in front and the `:443` port
+  number, and _do not_ include a trailing `/`.
+- `--upstream-base`: The rest of the URL before the `index.m3u8` file. Start
+  with a `/` but do not add a `/` at the end.
diff --git a/scripts/nginx/remote_setup.sh b/scripts/nginx/remote_setup.sh
index 416eb9f..aac7291 100755
--- a/scripts/nginx/remote_setup.sh
+++ b/scripts/nginx/remote_setup.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 positional_args=()
+original_args="${@@Q}"
 
 while [[ $# -gt 0 ]]; do
   case $1 in
@@ -14,6 +15,11 @@ while [[ $# -gt 0 ]]; do
       shift # past argument
       shift # past value
       ;;
+    --upstream-base)
+      upstream_base="$2"
+      shift # past argument
+      shift # past value
+      ;;
     --target-server)
       target_server="$2"
       shift # past argument
@@ -28,6 +34,13 @@ while [[ $# -gt 0 ]]; do
       is_in_target=1
       shift # past argument
       ;;
+    --pass-header)
+      pass_headers="$pass_headers
+proxy_set_header $2 '$3';"
+      shift # past argument
+      shift # past value
+      shift # past value
+      ;;
     -*|--*)
       echo "Unknown option $1"
       exit 1
@@ -49,7 +62,7 @@ if [ -z "$is_in_target" ]; then
     || [ -z "$upstream_server" ] \
     || [ -z "$acme_email" ] \
     || [ -z "$target_server" ]; then
-    echo "Usage: $0 --domain <domain> --upstream-server <https://domain:port> --acme-email <your.email@domain.co> --target-server <user@host>"
+    echo "Usage: $0 --domain <domain> --upstream-server <https://domain:port> --upstream-base </some/path/> --acme-email <your.email@domain.co> --target-server <user@host> [--pass-header Header Value]"
     exit 1
   fi
 
@@ -59,7 +72,7 @@ if [ -z "$is_in_target" ]; then
   scp $0 $target_server:$target_filename
 
   echo "Executing setup script on target server..."
-  ssh $target_server "$target_filename --domain $domain --upstream-server $upstream_server --upstream-proto $upstream_proto --acme-email $acme_email --is-in-target"
+  ssh $target_server "$target_filename --is-in-target $original_args"
 
   # exit
   exit 0
@@ -73,15 +86,36 @@ if [ "$(id -u)" != "0" ]; then
 fi
 
 echo "Installing dependencies..."
+cat <<EOF > /etc/apt/sources.list.d/nginx.list
+deb https://nginx.org/packages/ubuntu/ focal nginx
+deb-src https://nginx.org/packages/ubuntu/ focal nginx
+EOF
+
+while fuser /var/lib/dpkg/lock >/dev/null 2>&1 ; do
+  echo "Waiting for dpkg lock to be free..."
+  sleep 0.5
+done 
+
+
+apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ABF5BD827BD9BF62 && \
 apt-get update && \
 apt-get upgrade -y && \
 apt-get install -y nginx socat
 
+# Fix firewall
+if command -v ufw >/dev/null 2>&1; then
+  echo "Adding firewall rules..."
+  ufw allow http
+  ufw allow https
+fi
+
 echo "Downloading acme.sh..."
 wget -O - https://get.acme.sh | sh -s email=$acme_email
 
 echo "Issuing certificate..."
-~/.acme.sh/acme.sh --issue -d $domain -w /var/www/html
+systemctl stop nginx
+~/.acme.sh/acme.sh --issue -d $domain --server letsencrypt --standalone
+systemctl start nginx
 ~/.acme.sh/acme.sh --install-cert -d $domain \
   --cert-file /etc/nginx/ssl.crt \
   --key-file /etc/nginx/ssl.key \
@@ -172,15 +206,17 @@ http {
 
     add_header X-Edge-Cache-Status \$upstream_cache_status;
 
-    location ~ \.(m3u8|mpd)\$ {
-      proxy_cache_valid 200 302 1s;
-      proxy_ssl_server_name on;
-      proxy_pass $upstream_server;
-    }
-
     location / {
+      $pass_headers
       proxy_ssl_server_name on;
+      rewrite ^(.*)$ $upstream_base\$1 break;
       proxy_pass $upstream_server;
+
+      location ~ \.(m3u8|mpd)$ {
+        rewrite ^(.*)$ $upstream_base\$1 break;
+        proxy_cache_valid any 1s;
+        proxy_pass $upstream_server;
+      }
     }
   }
 }