initial commit
This commit is contained in:
@@ -0,0 +1,16 @@
|
||||
# nginx + letsencrypt setup
|
||||
|
||||
### Configuration
|
||||
|
||||
Modify `./data/nginx/app.conf` to your needs.
|
||||
You will need to at least update the server name
|
||||
and paths for the certificates.
|
||||
|
||||
### Installation
|
||||
|
||||
1. Grab set of certificates first with
|
||||
`./init-certificates.sh`
|
||||
2. Enable auto-renewal of certificates with
|
||||
`./init-autorenew.sh`
|
||||
3. Launch nginx
|
||||
`./start-nginx.sh`
|
||||
@@ -0,0 +1,117 @@
|
||||
proxy_read_timeout 600;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name dittmar.dev;
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name cantropee.dittmar.dev;
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name gitlab.dittmar.dev;
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name dittmar.dev;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
|
||||
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_pass http://home-app:3000;
|
||||
}
|
||||
|
||||
|
||||
location /vault {
|
||||
return 302 /vault/;
|
||||
}
|
||||
location /vault/ {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_pass http://10.222.0.2:80/;
|
||||
}
|
||||
|
||||
location /trilium {
|
||||
return 302 /trilium/;
|
||||
}
|
||||
location /trilium/ {
|
||||
proxy_set_header Host $host;
|
||||
proxy_pass http://trilium:8080/;
|
||||
}
|
||||
location /panorama {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name gitlab.dittmar.dev;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
|
||||
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_pass http://10.222.0.2:8081;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name cantropee.dittmar.dev;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
|
||||
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
proxy_pass http://cantropee:3000;
|
||||
}
|
||||
}
|
||||
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
#!/bin/bash
|
||||
|
||||
CRON_FILE=/etc/cron.d/renew_ssl_certificates
|
||||
|
||||
if [ -f "$CRON_FILE" ]; then
|
||||
echo "$CRON_FILE already exists, aborting."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "SHELL=/bin/sh" >> $CRON_FILE
|
||||
echo "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin" >> $CRON_FILE
|
||||
echo "" >> $CRON_FILE
|
||||
echo "0 2 * * * $(pwd)/renew-certificates.sh" >> $CRON_FILE
|
||||
|
||||
systemctl restart cron
|
||||
|
||||
echo "> created cronjob"
|
||||
Executable
+69
@@ -0,0 +1,69 @@
|
||||
#!/bin/bash
|
||||
|
||||
if ! [ -x "$(command -v docker)" ]; then
|
||||
echo 'Error: docker is not installed.' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
certbot_path="./data/certbot"
|
||||
rsa_key_size=4096
|
||||
domains=(dittmar.dev gitlab.dittmar.dev cantropee.dittmar.dev)
|
||||
email="robindittmar@gmail.com" # Adding a valid address is strongly recommended
|
||||
staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
|
||||
|
||||
echo "> cleaning up data directory"
|
||||
rm -Rf $certbot_path
|
||||
|
||||
echo "> downloading recommended TLS parameters ..."
|
||||
mkdir -p "$certbot_path/conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$certbot_path/conf/options-ssl-nginx.conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$certbot_path/conf/ssl-dhparams.pem"
|
||||
|
||||
echo "> creating temporary certificates for domains $domains ..."
|
||||
certs_path="/etc/letsencrypt/live/$domains"
|
||||
mkdir -p "$certbot_path/conf/live/$domains"
|
||||
docker run --rm \
|
||||
-v $certbot_path/conf:/etc/letsencrypt \
|
||||
--entrypoint openssl \
|
||||
certbot/certbot \
|
||||
req -x509 -nodes -newkey rsa:$rsa_key_size -days 1 -keyout "$certs_path/privkey.pem" -out "$certs_path/fullchain.pem" -subj '/CN=localhost'
|
||||
|
||||
echo "> starting nginx with temporary certificates ..."
|
||||
./start-nginx.sh
|
||||
|
||||
echo "> removing temporary certificates ..."
|
||||
docker run --rm \
|
||||
-v $certbot_path/conf:/etc/letsencrypt \
|
||||
--entrypoint /bin/sh \
|
||||
certbot/certbot \
|
||||
-c "rm -Rf /etc/letsencrypt/live/$domains && \
|
||||
rm -Rf /etc/letsencrypt/archive/$domains && \
|
||||
rm -Rf /etc/letsencrypt/renewal/$domains.conf" \
|
||||
|
||||
domain_args=""
|
||||
for domain in "${domains[@]}"; do
|
||||
domain_args="$domain_args -d $domain"
|
||||
done
|
||||
|
||||
case "$email" in
|
||||
"") email_arg="--register-unsafely-without-email" ;;
|
||||
*) email_arg="--email $email" ;;
|
||||
esac
|
||||
|
||||
if [ $staging != "0" ]; then staging_arg="--staging"; fi
|
||||
|
||||
echo "> requesting letsencrypt certificate for $domains ..."
|
||||
docker run --rm \
|
||||
-v $certbot_path/conf:/etc/letsencrypt \
|
||||
-v $certbot_path/www:/var/www/certbot \
|
||||
certbot/certbot \
|
||||
certonly --webroot -w /var/www/certbot \
|
||||
$staging_arg \
|
||||
$email_arg \
|
||||
$domain_args \
|
||||
--rsa-key-size $rsa_key_size \
|
||||
--agree-tos \
|
||||
--force-renewal
|
||||
|
||||
./stop-nginx.sh
|
||||
Executable
+5
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
docker exec nginx nginx -s reload
|
||||
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
#!/bin/bash
|
||||
|
||||
docker run \
|
||||
--rm \
|
||||
--name certbot \
|
||||
-v ./data/certbot/conf:/etc/letsencrypt \
|
||||
-v ./data/certbot/www:/var/www/certbot \
|
||||
--network=dittmar.dev \
|
||||
certbot/certbot \
|
||||
renew
|
||||
|
||||
|
||||
docker restart nginx
|
||||
|
||||
echo "updated $(date)" >> updated.txt
|
||||
|
||||
Executable
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/bash
|
||||
|
||||
docker run -d \
|
||||
--name nginx \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-v ./data/nginx:/etc/nginx/conf.d \
|
||||
-v ./data/certbot/conf:/etc/letsencrypt \
|
||||
-v ./data/certbot/www:/var/www/certbot \
|
||||
-v ./data/lobby-web:/usr/share/nginx/html \
|
||||
--restart=unless-stopped \
|
||||
--network=dittmar.dev \
|
||||
nginx
|
||||
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
|
||||
docker stop nginx
|
||||
docker rm nginx
|
||||
Reference in New Issue
Block a user