mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-03-07 18:26:23 +01:00
0991324392
It provides a better UX compared to certbot and is one less moving part. The switch is done where it is possible and sensible. That is basically all the places where nginx is the sole user of the certificate. Certificates using the DNS-01 challenge (e.g. geo mirrors) or which are used with stream (e.g. rsync over TLS) still require certbot as it is currently not supported in the native integration[2][3]. [1] https://blog.nginx.org/blog/native-support-for-acme-protocol [2] https://github.com/nginx/nginx-acme/issues/11 [3] https://github.com/nginx/nginx-acme/issues/13
37 lines
962 B
Django/Jinja
37 lines
962 B
Django/Jinja
limit_req_zone $binary_remote_addr zone=testlimit:10m rate=1r/s;
|
|
limit_req_status 429;
|
|
|
|
server {
|
|
include snippets/listen-80.conf;
|
|
|
|
server_name {{ public_domain }};
|
|
root /srv/http/test;
|
|
|
|
access_log /var/log/nginx/{{ public_domain }}/access.log main;
|
|
error_log /var/log/nginx/{{ public_domain }}/error.log;
|
|
|
|
include snippets/letsencrypt.conf;
|
|
|
|
location / {
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
include snippets/listen-443.conf;
|
|
server_name {{ public_domain }};
|
|
root /srv/http/test;
|
|
|
|
access_log /var/log/nginx/{{ public_domain }}/access.log main;
|
|
error_log /var/log/nginx/{{ public_domain }}/error.log;
|
|
|
|
acme_certificate letsencrypt;
|
|
ssl_certificate $acme_certificate;
|
|
ssl_certificate_key $acme_certificate_key;
|
|
|
|
location /index.html {
|
|
alias /srv/http/test/index.html;
|
|
limit_req zone=testlimit;
|
|
}
|
|
}
|