Nginx SSL Setup with Certbot

#!/usr/bin/env bash
set -euo pipefail

DOMAIN="example.com"
EMAIL="admin@example.com"

# Install Certbot
sudo apt update && sudo apt install -y certbot python3-certbot-nginx

# Obtain certificate
sudo certbot --nginx \
  -d "$DOMAIN" \
  -d "www.$DOMAIN" \
  --non-interactive \
  --agree-tos \
  --email "$EMAIL" \
  --redirect

# Verify auto-renewal
sudo certbot renew --dry-run

# Certbot auto-renewal cron (added automatically)
# 0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

# SSL hardening (add to nginx server block):
# ssl_protocols TLSv1.2 TLSv1.3;
# ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
# ssl_prefer_server_ciphers off;
# ssl_session_cache shared:SSL:10m;
# ssl_session_timeout 1d;
# ssl_session_tickets off;
# ssl_stapling on;
# ssl_stapling_verify on;