restream-tools/scripts/nginx/remote_setup.sh

#!/bin/bash

positional_args=()

while [[ $# -gt 0 ]]; do
  case $1 in
    --domain)
      domain="$2"
      shift # past argument
      shift # past value
      ;;
    --upstream-server)
      upstream_server="$2"
      shift # past argument
      shift # past value
      ;;
    --target-server)
      target_server="$2"
      shift # past argument
      shift # past value
      ;;
    --acme-email)
      acme_email="$2"
      shift # past argument
      shift # past value
      ;;
    --is-in-target)
      is_in_target=1
      shift # past argument
      ;;
    -*|--*)
      echo "Unknown option $1"
      exit 1
      ;;
    *)
      positional_args+=("$1") # save positional arg
      shift # past argument
      ;;
  esac
done

set -- "${positional_args[@]}" # restore positional parameters

# check if self is in target server
if [ -z "$is_in_target" ]; then
  # we're still in the user's pc
  # make sure we have all the required arguments
  if [ -z "$domain" ] \
    || [ -z "$upstream_server" ] \
    || [ -z "$acme_email" ] \
    || [ -z "$target_server" ]; then
    echo "Usage: $0 --domain <domain> --upstream-server <https://domain:port> --acme-email <your.email@domain.co> --target-server <user@host>"
    exit 1
  fi

  target_filename=$(mktemp -u)

  echo "Copying self to target server..."
  scp $0 $target_server:$target_filename

  echo "Executing setup script on target server..."
  ssh $target_server "$target_filename --domain $domain --upstream-server $upstream_server --upstream-proto $upstream_proto --acme-email $acme_email --is-in-target"

  # exit
  exit 0
fi

# we're now on the target server
# make sure we're root
if [ "$(id -u)" != "0" ]; then
  echo "This script must be run as root"
  exit 1
fi

echo "Installing dependencies..."
apt-get update && \
apt-get upgrade -y && \
apt-get install -y nginx socat

echo "Downloading acme.sh..."
wget -O - https://get.acme.sh | sh -s email=$acme_email

echo "Issuing certificate..."
~/.acme.sh/acme.sh --issue -d $domain -w /var/www/html
~/.acme.sh/acme.sh --install-cert -d $domain \
  --cert-file /etc/nginx/ssl.crt \
  --key-file /etc/nginx/ssl.key \
  --fullchain-file /etc/nginx/ssl.pem \
  --reloadcmd "systemctl reload nginx"

# create directories
mkdir -p /var/cache/nginx/proxy_cache

# create the nginx config file
echo "Setting up nginx"
cat <<EOF > /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
  worker_connections 1048576;
  multi_accept on;
  use epoll;
}

http {
  # Basic settings
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;
  server_tokens off;
  keepalive_timeout 300s;
  types_hash_max_size 2048;

  include /etc/nginx/mime.types;
  default_type application/octet-stream;

  # SSL settings
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;

  # Logging Settings
  access_log /var/log/nginx/access.log;
  error_log /var/log/nginx/error.log;

  # DNS resolver
  resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
  resolver_timeout 10s;

  # Proxy cache
  proxy_cache_path
    /var/cache/nginx/proxy_cache
    levels=1:2
    keys_zone=restream_cache:10m
    inactive=10m
    max_size=20g;

  server {
    listen 80;
    listen [::]:80;
    server_name $domain;

    return 301 https://\$server_name\$request_uri;
  }

  server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name $domain;

    # SSL settings
    ssl_certificate /etc/nginx/ssl.crt;
    ssl_certificate_key /etc/nginx/ssl.key;

    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_read_timeout 10s;
    proxy_send_timeout 10s;
    proxy_connect_timeout 10s;
    proxy_cache restream_cache;
    proxy_cache_methods GET HEAD;
    proxy_cache_key \$uri;
    proxy_cache_valid 200 302 5m;
    proxy_cache_valid 404 3s;
    proxy_cache_lock on;
    proxy_cache_lock_age 5s;
    proxy_cache_lock_timeout 1h;
    proxy_ignore_headers Cache-Control;
    proxy_ignore_headers Set-Cookie;

    add_header X-Edge-Cache-Status \$upstream_cache_status;

    location ~ \.(m3u8|mpd)\$ {
      proxy_cache_valid 200 302 1s;
      proxy_ssl_server_name on;
      proxy_pass $upstream_server;
    }

    location / {
      proxy_ssl_server_name on;
      proxy_pass $upstream_server;
    }
  }
}
EOF

nginx -t
systemctl reload nginx

# sysctl settings
echo "Configuring sysctl"
cat <<EOF > /etc/sysctl.d/999-perf.conf
fs.file-max=1048576
fs.inotify.max_user_instances=1048576
fs.inotify.max_user_watches=1048576
fs.nr_open=1048576
net.core.default_qdisc=fq
net.core.netdev_max_backlog=1048576
net.core.rmem_max=16777216
net.core.somaxconn=65535
net.core.wmem_max=16777216
net.ipv4.ip_local_port_range=1024 65535
net.ipv4.netfilter.ip_conntrack_max=1048576
net.ipv4.tcp_fin_timeout=5
net.ipv4.tcp_max_orphans=1048576
net.ipv4.tcp_max_syn_backlog=20480
net.ipv4.tcp_max_tw_buckets=400000
net.ipv4.tcp_no_metrics_save=1
net.ipv4.tcp_rmem=4096 87380 16777216
net.ipv4.tcp_slow_start_after_idle=0
net.ipv4.tcp_synack_retries=2
net.ipv4.tcp_syn_retries=2
net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_wmem=4096 65535 16777216
net.nf_conntrack_max=1048576
vm.max_map_count=1048576
vm.min_free_kbytes=65535
vm.overcommit_memory=1
vm.swappiness=0
vm.vfs_cache_pressure=50
EOF
sysctl --system

# limits.conf settings
cat <<EOF > /etc/security/limits.d/999-perf.conf
*               soft    nofile          1048576
*               hard    nofile          1048576
root            soft    nofile          1048576
root            hard    nofile          1048576
*               soft    nproc           1048576
*               hard    nproc           1048576
root            soft    nproc           1048576
root            hard    nproc           1048576
*               soft    memlock         unlimited
*               hard    memlock         unlimited
root            soft    memlock         unlimited
root            hard    memlock         unlimited
*               soft    core            0
*               hard    core            0
root            soft    core            0
root            hard    core            0
EOF

# systemd limits
cat <<EOF > /etc/systemd/system.conf
[Manager]
DefaultLimitNOFILE=1048576
DefaultLimitNPROC=1048576
DefaultLimitMEMLOCK=infinity
EOF

# Done!
reboot