sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw status

sudo apt update
sudo apt install -y nginx
systemctl status nginx --no-pager
nginx -v

ls /etc/nginx/
ls -l /etc/nginx/sites-available/ /etc/nginx/sites-enabled/
grep -n 'include' /etc/nginx/nginx.conf

sudo mkdir -p /var/www/TU_DOMINIO /var/www/letsencrypt
sudo chown -R TU_USUARIO:TU_USUARIO /var/www/TU_DOMINIO
ls -ld /var/www/TU_DOMINIO /var/www/letsencrypt

tee /var/www/TU_DOMINIO/index.html > /dev/null <<'EOF'
<!doctype html>
<html lang="es">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Mi servidor</title>
</head>
<body style="font-family:sans-serif;max-width:40rem;margin:4rem auto;padding:0 1rem">
  <h1>Funciona</h1>
  <p>Esta página la sirve Nginx desde mi propio servidor Ubuntu.</p>
</body>
</html>
EOF

sudo tee /etc/nginx/sites-available/TU_DOMINIO > /dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name TU_DOMINIO www.TU_DOMINIO;

    # Comprobaciones de Let's Encrypt
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    root /var/www/TU_DOMINIO;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/TU_DOMINIO.access.log;
    error_log  /var/log/nginx/TU_DOMINIO.error.log;
}
EOF

sudo ln -s /etc/nginx/sites-available/TU_DOMINIO /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
ls -l /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

sudo apt install -y certbot
certbot --version
systemctl list-timers | grep certbot

sudo certbot certonly --webroot -w /var/www/letsencrypt -d TU_DOMINIO -d www.TU_DOMINIO --dry-run

sudo certbot certonly --webroot -w /var/www/letsencrypt -d TU_DOMINIO -d www.TU_DOMINIO --cert-name TU_DOMINIO

sudo ls -l /etc/letsencrypt/live/TU_DOMINIO/

sudo tee /etc/nginx/snippets/tls.conf > /dev/null <<'EOF'
# Ebenezer: ajustes TLS comunes para todos los sitios
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:TLS:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
EOF
cat /etc/nginx/snippets/tls.conf

sudo tee /etc/nginx/sites-available/TU_DOMINIO > /dev/null <<'EOF'
# 1) HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name TU_DOMINIO www.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://TU_DOMINIO$request_uri;
    }
}

# 2) HTTPS con www: redirige a la versión sin www
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;

    return 301 https://TU_DOMINIO$request_uri;
}

# 3) HTTPS: el sitio de verdad
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;

    # Cabeceras de seguridad
    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    root /var/www/TU_DOMINIO;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    access_log /var/log/nginx/TU_DOMINIO.access.log;
    error_log  /var/log/nginx/TU_DOMINIO.error.log;
}
EOF

sudo nginx -t
sudo systemctl reload nginx

sudo tee /etc/nginx/sites-available/00-por-defecto > /dev/null <<'EOF'
# Peticiones a nombres que no son míos (o a la IP a secas): sin respuesta
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 444;
}

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name _;
    ssl_reject_handshake on;
}
EOF
sudo ln -s /etc/nginx/sites-available/00-por-defecto /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

sudo tee /etc/nginx/conf.d/compresion.conf > /dev/null <<'EOF'
# Ebenezer: compresión gzip para los archivos de texto
gzip_vary on;
gzip_proxied any;
gzip_comp_level 5;
gzip_min_length 1024;
gzip_types text/css text/plain text/xml application/javascript application/json application/xml image/svg+xml;
EOF
sudo nginx -t && sudo systemctl reload nginx

sudo tee /etc/letsencrypt/renewal-hooks/deploy/recargar-nginx.sh > /dev/null <<'EOF'
#!/bin/sh
# Ebenezer: que Nginx use el certificado recién renovado
systemctl reload nginx
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/recargar-nginx.sh
ls -l /etc/letsencrypt/renewal-hooks/deploy/

sudo cat /etc/letsencrypt/renewal/TU_DOMINIO.conf

sudo certbot renew --dry-run

sudo tail -n 5 /var/log/nginx/TU_DOMINIO.access.log
sudo tail -n 5 /var/log/nginx/TU_DOMINIO.error.log