Add nginx reverse proxy and DNS domain configuration to Ubuntu install script

ubuntu-install.sh

@@ -97,7 +97,7 @@ echo "2. Navigate to Azure Active Directory > App registrations"
 echo "3. Create a new registration or use existing one"
 echo "4. Note the Application (client) ID and Directory (tenant) ID"
 echo "5. Create a client secret under Certificates & secrets"
-echo "6. Add redirect URI: http://your-server-ip:5000/auth/callback"
+echo "6. Add redirect URI: http://your-domain-name/auth/callback (will be configured automatically)"
 echo "=================================================================="
 echo ""
 
@@ -106,8 +106,19 @@ read -p "Enter Azure AD Tenant ID (Directory ID): " AZURE_TENANT_ID
 read -p "Enter Azure AD Client ID (Application ID): " AZURE_CLIENT_ID
 read -s -p "Enter Azure AD Client Secret: " AZURE_CLIENT_SECRET
 echo ""
-read -p "Enter server IP/domain (for redirect URI) [localhost]: " SERVER_HOST
+read -p "Enter DNS domain name (e.g., eoypdf.trbc.org) [localhost]: " DNS_DOMAIN
-SERVER_HOST=${SERVER_HOST:-localhost}
+DNS_DOMAIN=${DNS_DOMAIN:-localhost}
+read -p "Enter server IP/domain (for redirect URI) [$DNS_DOMAIN]: " SERVER_HOST
+SERVER_HOST=${SERVER_HOST:-$DNS_DOMAIN}
+
+# Determine if we should use HTTPS
+USE_HTTPS=false
+if [[ "$DNS_DOMAIN" != "localhost" && "$DNS_DOMAIN" != "127.0.0.1" ]]; then
+    read -p "Do you have SSL certificates for $DNS_DOMAIN? (y/n) [n]: " HAS_SSL
+    if [[ "${HAS_SSL,,}" == "y" || "${HAS_SSL,,}" == "yes" ]]; then
+        USE_HTTPS=true
+    fi
+fi
 
 # Create .env file with real values
 cat > .env << EOF
@@ -127,7 +138,7 @@ AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET
 AZURE_AUTHORITY=https://login.microsoftonline.com/$AZURE_TENANT_ID
 
 # Redirect URI (must match what's configured in Azure AD app registration)
-AZURE_REDIRECT_URI=http://$SERVER_HOST:5000/auth/callback
+AZURE_REDIRECT_URI=http${USE_HTTPS:+s}://$SERVER_HOST/auth/callback
 
 # Scopes to request (openid, profile, email are common)
 AZURE_SCOPES=openid profile email
@@ -138,6 +149,71 @@ EOF
 
 log_success "Azure AD configuration saved to .env file"
 
+# Install and configure nginx
+log_info "Installing and configuring nginx..."
+sudo apt install -y nginx
+
+# Create nginx configuration
+NGINX_CONF="/etc/nginx/sites-available/pdf-sort-merge"
+sudo tee "$NGINX_CONF" > /dev/null << EOF
+server {
+    listen 80;
+    server_name $DNS_DOMAIN;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
+
+    # Proxy to Flask app
+    location / {
+        proxy_pass http://127.0.0.1:5000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+
+        # WebSocket support (if needed)
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Timeout settings
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    # Static files
+    location /static/ {
+        alias $APP_DIR/static/;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+}
+EOF
+
+# Enable the site
+sudo ln -sf "$NGINX_CONF" /etc/nginx/sites-enabled/
+sudo rm -f /etc/nginx/sites-enabled/default
+
+# Test nginx configuration
+log_info "Testing nginx configuration..."
+if sudo nginx -t; then
+    log_success "Nginx configuration is valid"
+else
+    log_error "Nginx configuration has errors"
+    exit 1
+fi
+
+# Restart nginx
+sudo systemctl restart nginx
+sudo systemctl enable nginx
+
+log_success "Nginx configured to serve $DNS_DOMAIN on port 80"
+
 # Create systemd service file
 log_info "Creating systemd service..."
 SERVICE_FILE="/etc/systemd/system/pdf-sort-merge.service"
@@ -173,7 +249,8 @@ mkdir -p results static templates
 
 # Set up firewall (optional)
 log_info "Configuring firewall..."
-sudo ufw allow 5000/tcp || log_warning "Failed to configure firewall - you may need to do this manually"
+sudo ufw allow 80/tcp || log_warning "Failed to configure firewall for port 80 - you may need to do this manually"
+sudo ufw allow ssh/tcp || log_warning "Failed to configure firewall for SSH - you may need to do this manually"
 
 # Enable and start service
 log_info "Enabling and starting service..."
@@ -235,18 +312,30 @@ log_success "Installation completed!"
 echo ""
 echo "=================================================================="
 echo "NEXT STEPS:"
-echo "1. Edit the .env file with your Azure AD credentials:"
+echo "1. Point your DNS for $DNS_DOMAIN to this server's IP address"
-echo "   nano $APP_DIR/.env"
 echo ""
-echo "2. Configure your Azure AD app registration with redirect URI:"
+echo "2. If you have SSL certificates, update the nginx config:"
-echo "   http://your-server-ip:5000/auth/callback"
+echo "   sudo nano /etc/nginx/sites-available/pdf-sort-merge"
+echo "   (add SSL configuration and change listen 80 to 443)"
 echo ""
-echo "3. Access the application at:"
+echo "3. Update your Azure AD app registration redirect URI to:"
-echo "   http://localhost:5000"
+if [[ "$USE_HTTPS" == "true" ]]; then
+    echo "   https://$SERVER_HOST/auth/callback"
+else
+    echo "   http://$SERVER_HOST/auth/callback"
+fi
+echo ""
+echo "4. Access the application at:"
+if [[ "$DNS_DOMAIN" != "localhost" ]]; then
+    echo "   http://$DNS_DOMAIN"
+else
+    echo "   http://localhost:5000"
+fi
 echo ""
 echo "MANAGEMENT COMMANDS:"
 echo "  Start service:   sudo systemctl start pdf-sort-merge"
 echo "  Stop service:    sudo systemctl stop pdf-sort-merge"
+echo "  Restart nginx:   sudo systemctl restart nginx"
 echo "  Check status:    sudo systemctl status pdf-sort-merge"
 echo "  View logs:       sudo journalctl -u pdf-sort-merge -f"
 echo "  Update app:      ./manage.sh update"