diff --git a/README.md b/README.md index 4fc6666..d4f7ec8 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ bring up servers for certbot challenges. Now launch certbot: ``` docker-compose up -d -docker-compose run --rm certbot certonly --webroot --webroot-path /var/www/certbot/ --dry-run -d www.vostan.org -d drive.vostan.org +./cert.sh ``` If dry run is successful then generate certificates removing --dry-run. Make sure to uncomment configurations and restart nginx. diff --git a/cert.sh b/cert.sh new file mode 100755 index 0000000..3fbee3d --- /dev/null +++ b/cert.sh @@ -0,0 +1,14 @@ +docker-compose run --rm certbot certonly --webroot --webroot-path /var/www/certbot/ \ + --dry-run \ + -d www.vostan.org \ + -d drive.vostan.org \ + -d books.app.vostan.org \ + -d music.app.vostan.org \ + -d gerbera.app.vostan.org \ + -d pihole.app.vostan.org \ + -d wireguard.app.vostan.org \ + -d gitea.app.vostan.org \ + -d drive.app.vostan.org \ + -d deluge.app.vostan.org + + diff --git a/docker-compose.yml b/docker-compose.yml index 0bfe879..d7754b3 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,16 +12,9 @@ services: - ./certbot/www/:/var/www/certbot/:ro - ./certbot/conf/live/:/etc/nginx/ssl/live/:ro - ./certbot/conf/archive/:/etc/nginx/ssl/archive/:ro - - ./sites/default.conf:/etc/nginx/conf.d/default.conf:ro - - ./sites/default_ssl.conf:/etc/nginx/conf.d/default_ssl.conf:ro - - ./sites/org.vostan.books:/etc/nginx/conf.d/org.vostan.books.conf:ro - - ./sites/org.vostan.deluge:/etc/nginx/conf.d/org.vostan.deluge.conf:ro - - ./sites/org.vostan.drive:/etc/nginx/conf.d/org.vostan.drive.conf:ro - - ./sites/org.vostan.gerbera:/etc/nginx/conf.d/org.vostan.gerbera.conf:ro - - ./sites/org.vostan.gitea:/etc/nginx/conf.d/org.vostan.gitea.conf:ro - - ./sites/org.vostan.pihole:/etc/nginx/conf.d/org.vostan.pihole.conf:ro - - ./sites/org.vostan.wireguard:/etc/nginx/conf.d/org.vostan.wireguard.conf:ro - - ./sites/org.vostan.www:/etc/nginx/conf.d/org.vostan.www.conf:ro + # - ./sites/default.conf:/etc/nginx/conf.d/default.conf:ro # In order to + # add new sites to cert bot uncomment this line and comment the line below + - ./sites/:/etc/nginx/conf.d/:ro network_mode: host # command: [nginx-debug, '-g', 'daemon off;'] certbot: diff --git a/sites/default.conf b/sites/default.conf index f811e76..9b291b7 100644 --- a/sites/default.conf +++ b/sites/default.conf @@ -35,8 +35,8 @@ server { return 301 https://$host$request_uri; } - # If host name is not known, then simply return 404 - # + ## If host name is not known, then simply return 404 + ## set $known_host 0; if ($host = www.vostan.org) { set $known_host 1; @@ -44,7 +44,10 @@ server { if ($host = drive.vostan.org) { set $known_host 1; } + if ($host ~* "^.+\.app\.vostan\.org$") { + set $known_host 1; + } if ($known_host != 1) { - return 404; + return 404; } } diff --git a/sites/org.vostan.books b/sites/org.vostan.app.books.conf similarity index 92% rename from sites/org.vostan.books rename to sites/org.vostan.app.books.conf index c819049..48d9199 100644 --- a/sites/org.vostan.books +++ b/sites/org.vostan.app.books.conf @@ -14,12 +14,10 @@ ## server { - listen 80; - listen [::]:80; - #listen 443 ssl; - #listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; http2 on; - server_name books.vostan.org; + server_name books.app.vostan.org; # SSL configuration # diff --git a/sites/org.vostan.deluge b/sites/org.vostan.app.deluge.conf similarity index 95% rename from sites/org.vostan.deluge rename to sites/org.vostan.app.deluge.conf index add6349..9c6ae98 100644 --- a/sites/org.vostan.deluge +++ b/sites/org.vostan.app.deluge.conf @@ -14,12 +14,10 @@ ## server { - # listen 80; - # listen [::]:80; listen 443 ssl; listen [::]:443 ssl; http2 on; - server_name deluge.vostan.org; + server_name deluge.app.vostan.org; # SSL configuration # diff --git a/sites/org.vostan.app.drive.conf b/sites/org.vostan.app.drive.conf new file mode 100644 index 0000000..746577c --- /dev/null +++ b/sites/org.vostan.app.drive.conf @@ -0,0 +1,42 @@ +## +# You should look at the following URL's in order to grasp a solid understanding of Nginx configuration files in order to fully unleash the power of Nginx. +# https://www.nginx.com/resources/wiki/start/ https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ https://wiki.debian.org/Nginx/DirectoryStructure +# +# In most cases, administrators will remove this file from sites-enabled/ and +# leave it as reference inside of sites-available where it will continue to be +# updated by the nginx packaging team. +# +# This file will automatically load configuration files provided by other +# applications, such as Drupal or Wordpress. These applications will be made +# available underneath a path with that package name, such as /drupal8. +# +# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. +## + +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name drive.app.vostan.org; + + # SSL configuration + # + ssl_certificate /etc/nginx/ssl/live/www.vostan.org/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/www.vostan.org/privkey.pem; + + # + set $upstream 192.168.11.4; + location / { + proxy_pass_header Authorization; + proxy_pass http://$upstream:8090; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_buffering off; + client_max_body_size 0; + proxy_read_timeout 36000s; + proxy_redirect off; + } +} diff --git a/sites/org.vostan.gerbera b/sites/org.vostan.app.gerbera.conf similarity index 92% rename from sites/org.vostan.gerbera rename to sites/org.vostan.app.gerbera.conf index 13a33b6..f3bb5e9 100644 --- a/sites/org.vostan.gerbera +++ b/sites/org.vostan.app.gerbera.conf @@ -14,12 +14,10 @@ ## server { - listen 80; - listen [::]:80; - #listen 443 ssl; - #listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; http2 on; - server_name gerbera.vostan.org; + server_name gerbera.app.vostan.org; # SSL configuration # diff --git a/sites/org.vostan.gitea b/sites/org.vostan.app.gitea.conf similarity index 92% rename from sites/org.vostan.gitea rename to sites/org.vostan.app.gitea.conf index ad127ac..35d99dc 100644 --- a/sites/org.vostan.gitea +++ b/sites/org.vostan.app.gitea.conf @@ -14,12 +14,10 @@ ## server { - listen 80; - listen [::]:80; - #listen 443 ssl; - #listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; http2 on; - server_name gitea.vostan.org; + server_name gitea.app.vostan.org; # SSL configuration # diff --git a/sites/org.vostan.pihole b/sites/org.vostan.app.pihole.conf similarity index 92% rename from sites/org.vostan.pihole rename to sites/org.vostan.app.pihole.conf index 18c9d82..9e37267 100644 --- a/sites/org.vostan.pihole +++ b/sites/org.vostan.app.pihole.conf @@ -14,12 +14,10 @@ ## server { - listen 80; - listen [::]:80; - #listen 443 ssl; - #listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; http2 on; - server_name pihole.vostan.org; + server_name pihole.app.vostan.org; # SSL configuration # diff --git a/sites/org.vostan.wireguard b/sites/org.vostan.app.wireguard.conf similarity index 92% rename from sites/org.vostan.wireguard rename to sites/org.vostan.app.wireguard.conf index 270ddcc..8acfa6a 100644 --- a/sites/org.vostan.wireguard +++ b/sites/org.vostan.app.wireguard.conf @@ -14,12 +14,10 @@ ## server { - listen 80; - listen [::]:80; - #listen 443 ssl; - #listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; http2 on; - server_name wireguard.vostan.org; + server_name wireguard.app.vostan.org; # SSL configuration # diff --git a/sites/org.vostan.drive b/sites/org.vostan.drive.conf similarity index 100% rename from sites/org.vostan.drive rename to sites/org.vostan.drive.conf diff --git a/sites/org.vostan.private b/sites/org.vostan.private.conf similarity index 100% rename from sites/org.vostan.private rename to sites/org.vostan.private.conf diff --git a/sites/org.vostan.www b/sites/org.vostan.www.conf similarity index 100% rename from sites/org.vostan.www rename to sites/org.vostan.www.conf