mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-06 20:28:46 +01:00
Kristian Klausen
0991324392
It provides a better UX compared to certbot and is one less moving part. The switch is done where it is possible and sensible. That is basically all the places where nginx is the sole user of the certificate. Certificates using the DNS-01 challenge (e.g. geo mirrors) or which are used with stream (e.g. rsync over TLS) still require certbot as it is currently not supported in the native integration[2][3]. [1] https://blog.nginx.org/blog/native-support-for-acme-protocol [2] https://github.com/nginx/nginx-acme/issues/11 [3] https://github.com/nginx/nginx-acme/issues/13
37 lines
1.1 KiB
Django/Jinja
37 lines
1.1 KiB
Django/Jinja
server {
|
|
# We don't redirect to HTTPS because a redirect is considered a captive portal.
|
|
include snippets/listen-80.conf;
|
|
|
|
include snippets/listen-443.conf;
|
|
server_name {{ ping_domain }};
|
|
|
|
access_log /var/log/nginx/{{ ping_domain }}/access.log reduced;
|
|
access_log /var/log/nginx/{{ ping_domain }}/access.log.json json_reduced;
|
|
error_log /var/log/nginx/{{ ping_domain }}/error.log;
|
|
|
|
include snippets/letsencrypt.conf;
|
|
|
|
acme_certificate letsencrypt;
|
|
ssl_certificate $acme_certificate;
|
|
ssl_certificate_key $acme_certificate_key;
|
|
|
|
default_type text/plain;
|
|
|
|
location = / {
|
|
return 200 'This domain is used for connectivity checking (captive portal detection).\n';
|
|
}
|
|
|
|
# https://man.archlinux.org/man/NetworkManager.conf.5#CONNECTIVITY_SECTION
|
|
location = /nm-check.txt {
|
|
access_log off;
|
|
include snippets/headers.conf;
|
|
add_header Cache-Control "max-age=0, must-revalidate";
|
|
return 200 'NetworkManager is online\n';
|
|
}
|
|
|
|
location / {
|
|
access_log off;
|
|
return 404;
|
|
}
|
|
}
|