From c2b553ef9374446b76749c4b8b1cf614aba55291 Mon Sep 17 00:00:00 2001 From: Renzil DSouza Date: Wed, 21 Jul 2021 02:08:36 +0530 Subject: [PATCH 1/2] Deleting app.conf --- data/nginx/app.conf | 31 ------------------------------- 1 file changed, 31 deletions(-) delete mode 100644 data/nginx/app.conf diff --git a/data/nginx/app.conf b/data/nginx/app.conf deleted file mode 100644 index 52dc0e78..00000000 --- a/data/nginx/app.conf +++ /dev/null @@ -1,31 +0,0 @@ -server { - listen 80; - server_name example.org; - server_tokens off; - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - return 301 https://$host$request_uri; - } -} - -server { - listen 443 ssl; - server_name example.org; - server_tokens off; - - ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - - location / { - proxy_pass http://example.org; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } -} From d464c0fcbc87dfddbb64b6f9edecf2874cbd70a8 Mon Sep 17 00:00:00 2001 From: Renzil DSouza Date: Wed, 21 Jul 2021 02:10:57 +0530 Subject: [PATCH 2/2] Externalizing all parameters through .env file --- .gitignore | 2 ++ README.md | 8 ++++++-- init-letsencrypt.sh | 21 ++++++++++++++++++--- templates/nginx/app.conf.template | 31 +++++++++++++++++++++++++++++++ 4 files changed, 57 insertions(+), 5 deletions(-) create mode 100644 templates/nginx/app.conf.template diff --git a/.gitignore b/.gitignore index 68f5d131..72afbf49 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ /data/certbot +/data/nginx/app.conf +.env diff --git a/README.md b/README.md index 8c3bd886..2f8eeb4e 100644 --- a/README.md +++ b/README.md @@ -15,8 +15,12 @@ application. 2. Clone this repository: `git clone https://github.com/wmnnd/nginx-certbot.git .` 3. Modify configuration: -- Add domains and email addresses to init-letsencrypt.sh -- Replace all occurrences of example.org with primary domain (the first one you added to init-letsencrypt.sh) in data/nginx/app.conf +- Create a .env file and add domains and email addresses using the env variables defined below +- NGINX_DOMAIN_LIST - [REQUIRED] the list of domains for nginx (also used by letsencrypt); each domain name should be separated by a space; the first domain name will be taken as the primary domain unless NGINX_PRIMARY_DOMAIN env variable is also provided; defaults to "example.org www.example.org" +- NGINX_PRIMARY_DOMAIN - [OPTIONAL] the primary domain name to use for certificate registration; defaults to "example.org" +- NGINX_PROXY_PASS - [REQUIRED] the url to route all incoming requests on ports 80, 443; for example "http://localhost:8080" to forward all incoming to localhost:8080; defaults to "http://example.org" +- LETSENCRYPT_EMAIL - [OPTIONAL] the email id to use for LetsEncrypt registration; defaults to "" +- LETSENCRYPT_STAGING - [OPTIONAL] Set to 1 if you're testing your setup to avoid hitting request limits; defaults to 0 4. Run the init script: diff --git a/init-letsencrypt.sh b/init-letsencrypt.sh index a3f3cb01..fd2a9be6 100755 --- a/init-letsencrypt.sh +++ b/init-letsencrypt.sh @@ -5,11 +5,26 @@ if ! [ -x "$(command -v docker-compose)" ]; then exit 1 fi -domains=(example.org www.example.org) +if [ -f ./.env ]; then + source ./.env +else + echo "No .env file found, using defaults." +fi + + +domains_env="${NGINX_DOMAIN_LIST:-"example.org www.example.org"}" +IFS=' ' read -r -a domains <<< "$domains_env" +primary_domain=${domains[0]:-$NGINX_PRIMARY_DOMAIN} rsa_key_size=4096 data_path="./data/certbot" -email="" # Adding a valid address is strongly recommended -staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits +email=${LETSENCRYPT_EMAIL:-""} # Adding a valid address is strongly recommended +staging=${LETSENCRYPT_STAGING:-0} # Set to 1 if you're testing your setup to avoid hitting request limits +proxy_pass=${NGINX_PROXY_PASS:-"http://example.org"} +escaped_proxy_pass=$(printf '%s\n' "$proxy_pass" | sed -e 's/[\/&]/\\&/g') + +echo "### Creating nginx app.conf from template ..." +sed "s/\${NGINX_DOMAIN_LIST}/${domains_env}/g; s/\${NGINX_PRIMARY_DOMAIN}/${primary_domain}/g; s/\${NGINX_PROXY_PASS}/${escaped_proxy_pass}/g" ./templates/nginx/app.conf.template > ./data/nginx/app.conf +echo if [ -d "$data_path" ]; then read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision diff --git a/templates/nginx/app.conf.template b/templates/nginx/app.conf.template new file mode 100644 index 00000000..61c53796 --- /dev/null +++ b/templates/nginx/app.conf.template @@ -0,0 +1,31 @@ +server { + listen 80; + server_name ${NGINX_DOMAIN_LIST}; + server_tokens off; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl; + server_name ${NGINX_DOMAIN_LIST}; + server_tokens off; + + ssl_certificate /etc/letsencrypt/live/${NGINX_PRIMARY_DOMAIN}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/${NGINX_PRIMARY_DOMAIN}/privkey.pem; + include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + location / { + proxy_pass ${NGINX_PROXY_PASS}; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } +}