mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-06 06:48:55 +01:00
Kristian Klausen
0991324392
It provides a better UX compared to certbot and is one less moving part. The switch is done where it is possible and sensible. That is basically all the places where nginx is the sole user of the certificate. Certificates using the DNS-01 challenge (e.g. geo mirrors) or which are used with stream (e.g. rsync over TLS) still require certbot as it is currently not supported in the native integration[2][3]. [1] https://blog.nginx.org/blog/native-support-for-acme-protocol [2] https://github.com/nginx/nginx-acme/issues/11 [3] https://github.com/nginx/nginx-acme/issues/13
53 lines
1.6 KiB
Django/Jinja
53 lines
1.6 KiB
Django/Jinja
server {
|
|
include snippets/listen-80.conf;
|
|
|
|
server_name {{ domain['domain_name'] }};
|
|
|
|
access_log /var/log/nginx/{{ archweb_domain }}/access.log reduced;
|
|
access_log /var/log/nginx/{{ archweb_domain }}/access.log.json json_reduced;
|
|
error_log /var/log/nginx/{{ archweb_domain }}/error.log;
|
|
|
|
include snippets/letsencrypt.conf;
|
|
|
|
location / {
|
|
access_log off;
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
include snippets/listen-443.conf;
|
|
server_name {{ domain['domain_name'] }};
|
|
|
|
access_log /var/log/nginx/{{ archweb_domain }}/access.log reduced;
|
|
access_log /var/log/nginx/{{ archweb_domain }}/access.log.json json_reduced;
|
|
error_log /var/log/nginx/{{ archweb_domain }}/error.log;
|
|
|
|
ssl_ciphers AES128-SHA:AES256-SHA:AES128-SHA256:AES256-SHA256;
|
|
|
|
acme_certificate letsencrypt key=rsa:4096;
|
|
ssl_certificate $acme_certificate;
|
|
ssl_certificate_key $acme_certificate_key;
|
|
|
|
location /releng/netboot/ {
|
|
access_log /var/log/nginx/{{ archweb_domain }}/access.log main;
|
|
access_log /var/log/nginx/{{ archweb_domain }}/access.log.json json_main;
|
|
include uwsgi_params;
|
|
uwsgi_pass archweb;
|
|
}
|
|
|
|
# Cache django's css, js and png files.
|
|
location /static/ {
|
|
expires 30d;
|
|
include snippets/headers.conf;
|
|
add_header Pragma public;
|
|
add_header Cache-Control "public";
|
|
alias /srv/http/archweb/collected_static/;
|
|
}
|
|
|
|
location / {
|
|
access_log off;
|
|
return 301 https://{{ archweb_domain }}$request_uri;
|
|
}
|
|
}
|