commit 972682dc9b186ffc24fa59d376b7ff8a241dada4
Author: Robin Dittmar <robindittmar@gmail.com>
Date:   Wed Oct 18 15:19:16 2023 +0000

    initial commit

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..0fd19a7
--- /dev/null
+++ b/README.md
@@ -0,0 +1,16 @@
+# nginx + letsencrypt setup
+
+### Configuration
+
+Modify `./data/nginx/app.conf` to your needs.
+You will need to at least update the server name
+and paths for the certificates.
+
+### Installation
+
+1. Grab set of certificates first with
+    `./init-certificates.sh`
+2. Enable auto-renewal of certificates with
+    `./init-autorenew.sh`
+3. Launch nginx
+    `./start-nginx.sh`
diff --git a/data/nginx/app.conf b/data/nginx/app.conf
new file mode 100644
index 0000000..91da6c7
--- /dev/null
+++ b/data/nginx/app.conf
@@ -0,0 +1,117 @@
+proxy_read_timeout 600;
+
+server {
+    listen 80;
+    server_name dittmar.dev;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+}
+
+server {
+    listen 80;
+    server_name cantropee.dittmar.dev;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+}
+
+server {
+   listen 80;
+   server_name gitlab.dittmar.dev;
+
+   location / {
+       return 301 https://$host$request_uri;
+   }
+
+   location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name dittmar.dev;
+
+    ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
+
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://home-app:3000;
+    }
+
+
+    location /vault {
+        return 302 /vault/;
+    }
+    location /vault/ {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://10.222.0.2:80/;
+    }
+
+    location /trilium {
+        return 302 /trilium/;
+    }
+    location /trilium/ {
+        proxy_set_header Host $host;
+        proxy_pass http://trilium:8080/;
+    }
+    location /panorama {
+        root /usr/share/nginx/html;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name gitlab.dittmar.dev;
+
+    ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
+
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://10.222.0.2:8081;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name cantropee.dittmar.dev;
+
+    ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
+
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://cantropee:3000;
+    }
+}
+
diff --git a/init-autorenew.sh b/init-autorenew.sh
new file mode 100755
index 0000000..1110ae9
--- /dev/null
+++ b/init-autorenew.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+CRON_FILE=/etc/cron.d/renew_ssl_certificates
+
+if [ -f "$CRON_FILE" ]; then
+    echo "$CRON_FILE already exists, aborting."
+    exit 1
+fi
+
+echo "SHELL=/bin/sh" >> $CRON_FILE
+echo "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin" >> $CRON_FILE
+echo "" >> $CRON_FILE
+echo "0 2 * * * $(pwd)/renew-certificates.sh" >> $CRON_FILE
+
+systemctl restart cron
+
+echo "> created cronjob"
diff --git a/init-certificates.sh b/init-certificates.sh
new file mode 100755
index 0000000..5090833
--- /dev/null
+++ b/init-certificates.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+if ! [ -x "$(command -v docker)" ]; then
+  echo 'Error: docker is not installed.' >&2
+  exit 1
+fi
+
+
+certbot_path="./data/certbot"
+rsa_key_size=4096
+domains=(dittmar.dev gitlab.dittmar.dev cantropee.dittmar.dev)
+email="robindittmar@gmail.com" # Adding a valid address is strongly recommended
+staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
+
+echo "> cleaning up data directory"
+rm -Rf $certbot_path
+
+echo "> downloading recommended TLS parameters ..."
+mkdir -p "$certbot_path/conf"
+curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$certbot_path/conf/options-ssl-nginx.conf"
+curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$certbot_path/conf/ssl-dhparams.pem"
+
+echo "> creating temporary certificates for domains $domains ..."
+certs_path="/etc/letsencrypt/live/$domains"
+mkdir -p "$certbot_path/conf/live/$domains"
+docker run --rm \
+  -v $certbot_path/conf:/etc/letsencrypt \
+  --entrypoint openssl \
+  certbot/certbot \
+  req -x509 -nodes -newkey rsa:$rsa_key_size -days 1 -keyout "$certs_path/privkey.pem" -out "$certs_path/fullchain.pem" -subj '/CN=localhost'
+
+echo "> starting nginx with temporary certificates ..."
+./start-nginx.sh
+
+echo "> removing temporary certificates ..."
+docker run --rm \
+  -v $certbot_path/conf:/etc/letsencrypt \
+  --entrypoint /bin/sh \
+  certbot/certbot \
+  -c "rm -Rf /etc/letsencrypt/live/$domains && \
+      rm -Rf /etc/letsencrypt/archive/$domains && \
+      rm -Rf /etc/letsencrypt/renewal/$domains.conf" \
+
+domain_args=""
+for domain in "${domains[@]}"; do
+  domain_args="$domain_args -d $domain"
+done
+
+case "$email" in
+  "") email_arg="--register-unsafely-without-email" ;;
+  *) email_arg="--email $email" ;;
+esac
+
+if [ $staging != "0" ]; then staging_arg="--staging"; fi
+
+echo "> requesting letsencrypt certificate for $domains ..."
+docker run --rm \
+  -v $certbot_path/conf:/etc/letsencrypt \
+  -v $certbot_path/www:/var/www/certbot \
+  certbot/certbot \
+  certonly --webroot -w /var/www/certbot \
+      $staging_arg \
+      $email_arg \
+      $domain_args \
+      --rsa-key-size $rsa_key_size \
+      --agree-tos \
+      --force-renewal
+
+./stop-nginx.sh
diff --git a/reload-nginx.sh b/reload-nginx.sh
new file mode 100755
index 0000000..3513f0e
--- /dev/null
+++ b/reload-nginx.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+
+docker exec nginx nginx -s reload
+
diff --git a/renew-certificates.sh b/renew-certificates.sh
new file mode 100755
index 0000000..60df4c3
--- /dev/null
+++ b/renew-certificates.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+docker run \
+  --rm \
+  --name certbot \
+  -v ./data/certbot/conf:/etc/letsencrypt \
+  -v ./data/certbot/www:/var/www/certbot \
+  --network=dittmar.dev \
+  certbot/certbot \
+  renew
+
+
+docker restart nginx
+
+echo "updated $(date)" >> updated.txt
+
diff --git a/start-nginx.sh b/start-nginx.sh
new file mode 100755
index 0000000..582e26b
--- /dev/null
+++ b/start-nginx.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+docker run -d \
+  --name nginx \
+  -p 80:80 \
+  -p 443:443 \
+  -v ./data/nginx:/etc/nginx/conf.d \
+  -v ./data/certbot/conf:/etc/letsencrypt \
+  -v ./data/certbot/www:/var/www/certbot \
+  -v ./data/lobby-web:/usr/share/nginx/html \
+  --restart=unless-stopped \
+  --network=dittmar.dev \
+  nginx
+
diff --git a/stop-nginx.sh b/stop-nginx.sh
new file mode 100755
index 0000000..a8a4acd
--- /dev/null
+++ b/stop-nginx.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+docker stop nginx
+docker rm nginx