feat: add proxy-setup.sh

[bap2pecs]

Summary

Snapchain/babylon-deployment#47

Test Plan

make l2-proxy-setup

then check success

$ echo $?
0

also see

verify the certs

sudo openssl x509 -in /etc/letsencrypt/live/tohma.snapchain.dev/fullchain.pem -text | grep DNS:
                DNS:bridge.tohma.snapchain.dev, DNS:explorer.tohma.snapchain.dev, DNS:rpc.tohma.snapchain.dev

now restart the explorer after setting .env.explorer with

COMMON_HOST=explorer.tohma.snapchain.dev
API_PROTOCOL=https # http | https
API_WEBSOCKET_PROTOCOL=wss # ws | wss

see https://explorer.tohma.snapchain.dev/ can load

also https://bridge.tohma.snapchain.dev/ loads

also rpc works cast chain-id --rpc-url https://rpc.tohma.snapchain.dev/

[bap2pecs]

this is needed b/c otherwise sudo certbot certonly --nginx will fail with

[bap2pecs]

@parketh jfyi, the cert won't be called bridge.tohma.snapchain.dev, explorer.tohma.snapchain.dev

now all certs are created under the same dir

# 2. obtain the SSL certificate for each subdomain
# the certs will be stored in /etc/letsencrypt/live/${CERTBOT_DOMAIN_SUFFIX}
# 
# note that Certbot creates a single certificate that's valid for all those 
# domains (called a SAN - Subject Alternative Names certificate)
# 
# after running the command, you can verify by:
#   sudo openssl x509 -in /etc/letsencrypt/live/${CERTBOT_DOMAIN_SUFFIX}/fullchain.pem -text | grep DNS:
# 
# reference: https://eff-certbot.readthedocs.io/en/latest/using.html
certbot certonly --nginx --non-interactive --agree-tos -m ${CERTBOT_EMAIL} \
  --cert-name ${CERTBOT_DOMAIN_SUFFIX} \
  -d rpc.${CERTBOT_DOMAIN_SUFFIX} \
  -d bridge.${CERTBOT_DOMAIN_SUFFIX} \
  -d explorer.${CERTBOT_DOMAIN_SUFFIX}

[parketh]

so do we generate one certificate for the domain, and reuse it across tohma-devnet and tohma-finality-system servers? or are these two different certificates for the same domain?

[bap2pecs]

yes there is only one file

sudo ls /etc/letsencrypt/live/tohma.snapchain.dev                                                                                 ─╯
README	cert.pem  chain.pem  fullchain.pem  privkey.pem

and you can run this command on the server to test

sudo openssl x509 -in /etc/letsencrypt/live/tohma.snapchain.dev/fullchain.pem -text | grep DNS:                                   ─╯
                DNS:bridge.tohma.snapchain.dev, DNS:explorer.tohma.snapchain.dev, DNS:rpc.tohma.snapchain.dev

[bap2pecs]

it's a single cert the valid for all domains