setup_https_mcp.sh

#!/bin/bash
# 为 MCP 服务器配置 HTTPS 的脚本

set -e

# 颜色输出
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

echo -e "${GREEN}🔒 开始为 MCP 服务器配置 HTTPS...${NC}"

# 检查是否为 root 用户
if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}请使用 sudo 运行此脚本${NC}"
    exit 1
fi

# 获取用户输入
read -p "请输入你的域名（如 mcp.yourdomain.com）: " DOMAIN_NAME
read -p "请输入你的邮箱（用于 Let's Encrypt）: " EMAIL

if [ -z "$DOMAIN_NAME" ] || [ -z "$EMAIL" ]; then
    echo -e "${RED}域名和邮箱不能为空${NC}"
    exit 1
fi

echo -e "${YELLOW}配置信息：${NC}"
echo "域名: $DOMAIN_NAME"
echo "邮箱: $EMAIL"
echo ""

# 1. 安装 Nginx 和 Certbot
echo -e "${GREEN}步骤 1: 安装 Nginx 和 Certbot...${NC}"
if command -v yum &> /dev/null; then
    # Amazon Linux
    yum update -y
    yum install -y nginx
    yum install -y python3-pip
    pip3 install certbot certbot-nginx
elif command -v apt &> /dev/null; then
    # Ubuntu
    apt update
    apt install -y nginx certbot python3-certbot-nginx
fi

# 2. 配置 Nginx
echo -e "${GREEN}步骤 2: 配置 Nginx...${NC}"
cat > /etc/nginx/sites-available/mcp-servers << EOF
server {
    listen 80;
    server_name $DOMAIN_NAME;
    
    # 高德地图 MCP 服务器
    location /amap/ {
        proxy_pass http://localhost:8001/;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        
        # WebSocket 支持
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    
    # Tavily MCP 服务器
    location /tavily/ {
        proxy_pass http://localhost:8002/;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
    
    # Fetch MCP 服务器
    location /fetch/ {
        proxy_pass http://localhost:8003/;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
    
    # 12306 MCP 服务器
    location /train/ {
        proxy_pass http://localhost:8004/;
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
    }
    
    # 健康检查
    location /health {
        return 200 'OK';
        add_header Content-Type text/plain;
    }
}
EOF

# 启用站点配置
if [ -d "/etc/nginx/sites-enabled" ]; then
    ln -sf /etc/nginx/sites-available/mcp-servers /etc/nginx/sites-enabled/
else
    # Amazon Linux 没有 sites-enabled 目录
    cat >> /etc/nginx/nginx.conf << EOF

# MCP Servers Configuration
include /etc/nginx/sites-available/mcp-servers;
EOF
fi

# 3. 测试 Nginx 配置
echo -e "${GREEN}步骤 3: 测试 Nginx 配置...${NC}"
nginx -t

# 4. 启动 Nginx
echo -e "${GREEN}步骤 4: 启动 Nginx...${NC}"
systemctl enable nginx
systemctl start nginx

# 5. 获取 SSL 证书
echo -e "${GREEN}步骤 5: 获取 SSL 证书...${NC}"
certbot --nginx -d $DOMAIN_NAME --email $EMAIL --agree-tos --non-interactive

# 6. 设置自动续期
echo -e "${GREEN}步骤 6: 设置证书自动续期...${NC}"
(crontab -l 2>/dev/null; echo "0 12 * * * /usr/bin/certbot renew --quiet") | crontab -

echo -e "${GREEN}✅ HTTPS 配置完成！${NC}"
echo ""
echo -e "${YELLOW}现在你可以使用以下 HTTPS 端点：${NC}"
echo "高德地图: https://$DOMAIN_NAME/amap/"
echo "Tavily: https://$DOMAIN_NAME/tavily/"
echo "Fetch: https://$DOMAIN_NAME/fetch/"
echo "12306: https://$DOMAIN_NAME/train/"
echo ""
echo -e "${YELLOW}在 AgentCore Gateway 中使用：${NC}"
echo "Target Endpoint: https://$DOMAIN_NAME/amap/"
echo ""
echo -e "${YELLOW}测试命令：${NC}"
echo "curl https://$DOMAIN_NAME/amap/health"
echo "curl https://$DOMAIN_NAME/amap/tools/list"