initial commit

README.md

@@ -0,0 +1,16 @@
+# nginx + letsencrypt setup
+
+### Configuration
+
+Modify `./data/nginx/app.conf` to your needs.
+You will need to at least update the server name
+and paths for the certificates.
+
+### Installation
+
+1. Grab set of certificates first with
+    `./init-certificates.sh`
+2. Enable auto-renewal of certificates with
+    `./init-autorenew.sh`
+3. Launch nginx
+    `./start-nginx.sh`

data/nginx/app.conf

@@ -0,0 +1,117 @@
+proxy_read_timeout 600;
+
+server {
+    listen 80;
+    server_name dittmar.dev;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+}
+
+server {
+    listen 80;
+    server_name cantropee.dittmar.dev;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+}
+
+server {
+   listen 80;
+   server_name gitlab.dittmar.dev;
+
+   location / {
+       return 301 https://$host$request_uri;
+   }
+
+   location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name dittmar.dev;
+
+    ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
+
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://home-app:3000;
+    }
+
+
+    location /vault {
+        return 302 /vault/;
+    }
+    location /vault/ {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://10.222.0.2:80/;
+    }
+
+    location /trilium {
+        return 302 /trilium/;
+    }
+    location /trilium/ {
+        proxy_set_header Host $host;
+        proxy_pass http://trilium:8080/;
+    }
+    location /panorama {
+        root /usr/share/nginx/html;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name gitlab.dittmar.dev;
+
+    ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
+
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://10.222.0.2:8081;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name cantropee.dittmar.dev;
+
+    ssl_certificate /etc/letsencrypt/live/dittmar.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dittmar.dev/privkey.pem;
+
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        proxy_pass http://cantropee:3000;
+    }
+}
+

init-autorenew.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+CRON_FILE=/etc/cron.d/renew_ssl_certificates
+
+if [ -f "$CRON_FILE" ]; then
+    echo "$CRON_FILE already exists, aborting."
+    exit 1
+fi
+
+echo "SHELL=/bin/sh" >> $CRON_FILE
+echo "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin" >> $CRON_FILE
+echo "" >> $CRON_FILE
+echo "0 2 * * * $(pwd)/renew-certificates.sh" >> $CRON_FILE
+
+systemctl restart cron
+
+echo "> created cronjob"

init-certificates.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+
+if ! [ -x "$(command -v docker)" ]; then
+  echo 'Error: docker is not installed.' >&2
+  exit 1
+fi
+
+
+certbot_path="./data/certbot"
+rsa_key_size=4096
+domains=(dittmar.dev gitlab.dittmar.dev cantropee.dittmar.dev)
+email="robindittmar@gmail.com" # Adding a valid address is strongly recommended
+staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
+
+echo "> cleaning up data directory"
+rm -Rf $certbot_path
+
+echo "> downloading recommended TLS parameters ..."
+mkdir -p "$certbot_path/conf"
+curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$certbot_path/conf/options-ssl-nginx.conf"
+curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$certbot_path/conf/ssl-dhparams.pem"
+
+echo "> creating temporary certificates for domains $domains ..."
+certs_path="/etc/letsencrypt/live/$domains"
+mkdir -p "$certbot_path/conf/live/$domains"
+docker run --rm \
+  -v $certbot_path/conf:/etc/letsencrypt \
+  --entrypoint openssl \
+  certbot/certbot \
+  req -x509 -nodes -newkey rsa:$rsa_key_size -days 1 -keyout "$certs_path/privkey.pem" -out "$certs_path/fullchain.pem" -subj '/CN=localhost'
+
+echo "> starting nginx with temporary certificates ..."
+./start-nginx.sh
+
+echo "> removing temporary certificates ..."
+docker run --rm \
+  -v $certbot_path/conf:/etc/letsencrypt \
+  --entrypoint /bin/sh \
+  certbot/certbot \
+  -c "rm -Rf /etc/letsencrypt/live/$domains && \
+      rm -Rf /etc/letsencrypt/archive/$domains && \
+      rm -Rf /etc/letsencrypt/renewal/$domains.conf" \
+
+domain_args=""
+for domain in "${domains[@]}"; do
+  domain_args="$domain_args -d $domain"
+done
+
+case "$email" in
+  "") email_arg="--register-unsafely-without-email" ;;
+  *) email_arg="--email $email" ;;
+esac
+
+if [ $staging != "0" ]; then staging_arg="--staging"; fi
+
+echo "> requesting letsencrypt certificate for $domains ..."
+docker run --rm \
+  -v $certbot_path/conf:/etc/letsencrypt \
+  -v $certbot_path/www:/var/www/certbot \
+  certbot/certbot \
+  certonly --webroot -w /var/www/certbot \
+      $staging_arg \
+      $email_arg \
+      $domain_args \
+      --rsa-key-size $rsa_key_size \
+      --agree-tos \
+      --force-renewal
+
+./stop-nginx.sh

reload-nginx.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+
+docker exec nginx nginx -s reload
+

renew-certificates.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+docker run \
+  --rm \
+  --name certbot \
+  -v ./data/certbot/conf:/etc/letsencrypt \
+  -v ./data/certbot/www:/var/www/certbot \
+  --network=dittmar.dev \
+  certbot/certbot \
+  renew
+
+
+docker restart nginx
+
+echo "updated $(date)" >> updated.txt
+

start-nginx.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+docker run -d \
+  --name nginx \
+  -p 80:80 \
+  -p 443:443 \
+  -v ./data/nginx:/etc/nginx/conf.d \
+  -v ./data/certbot/conf:/etc/letsencrypt \
+  -v ./data/certbot/www:/var/www/certbot \
+  -v ./data/lobby-web:/usr/share/nginx/html \
+  --restart=unless-stopped \
+  --network=dittmar.dev \
+  nginx
+

stop-nginx.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+docker stop nginx
+docker rm nginx