X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=web-conf;h=274f1eb91191274651dd6acacaec6a43a53ef74f;hb=1789ce6a87ccf1d83edf335c3ae3a4ac5ad8c5f6;hp=b953668ee5a6ad797ea92e8407e25356fb0c9c38;hpb=6761d31c8b47efb9361c0d8b69eda24da97769fa;p=basic-https-conf diff --git a/web-conf b/web-conf index b953668..274f1eb 100755 --- a/web-conf +++ b/web-conf @@ -25,7 +25,11 @@ usage() { Usage: ${0##*/} [OPTIONS] [EXTRA_SETTINGS_FILE] apache2|nginx DOMAIN apache/nginx config & let's encrypt -If using tls then it expects certbot to be installed and in PATH. +If using tls then it expects certbot to be installed and in PATH. Also, +certbot cronjob should be taken care of outside this script. In the +debian package, it installs a systemd timer, which I (Ian Kelling) use +and modify to email me on failure. You can see how I do this in my git +repo distro-setup, and log-quiet. EXTRA_SETTINGS_FILE can be - for stdin @@ -33,7 +37,7 @@ EXTRA_SETTINGS_FILE can be - for stdin root@\$(hostname -A|awk '{print $1}') which is root@$(hostname -A|awk '{print $1}') on this host. -f [ADDR:]PORT Enable proxy to [ADDR:]PORT. ADDR default is 127.0.0.1 --i Insecure, no ssl. Not implemented for nginx. +-i Insecure, no ssl. -p PORT Main port to listen on, default 443. 80 implies -i. -r DIR DocumentRoot -h|--help Print help and exit @@ -48,7 +52,7 @@ EOF ssl=true extra_settings= port=443 -temp=$(getopt -l help e:i:f:p:r:h "$@") || usage 1 +temp=$(getopt -l help e:if:p:r:h "$@") || usage 1 eval set -- "$temp" while true; do case $1 in @@ -63,6 +67,7 @@ while true; do esac done +# t = type, h = host if (( ${#@} == 3 )); then read -r extra_settings t h <<<"${@}" else @@ -110,10 +115,14 @@ fi if $ssl; then f=$cert_dir/fullchain.pem - if [[ ! -e $f ]] || openssl x509 -checkend 86400 -noout -in $f; then + threedays=259200 # in seconds + if [[ ! -e $f ]] || openssl x509 -checkend $threedays -noout -in $f; then + # cerbot needs an existing virtualhost. $0 -p 80 $t $h - # adds every security option - certbot certonly -n --hsts --staple-ocsp --uir --must-staple --email $email --staple-ocsp --no-self-upgrade --agree-tos --apache -d $h + # when generating an example config, add all relevant security options: + # --hsts --staple-ocsp --uir --must-staple + certbot certonly -n --email $email --no-self-upgrade \ + --agree-tos --${t%2} -d $h rm $vhost_file fi fi @@ -171,15 +180,16 @@ EOF a2enmod proxy proxy_http # fyi: trailing slash is important # reference: https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html + # retry=0: https://stackoverflow.com/questions/683052/why-am-i-getting-an-apache-proxy-503-error cat >>$vhost_file <>$vhost_file </etc/apache2/conf-enabled/local-custom.conf <<'EOF' -# vhost_combined with %D (request time in microseconds) -# this file is just a convenient place to drop it. -LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" vhost_time_combined -SSLStaplingCache shmcb:/var/run/apache2/stapling_cache(128000) -EOF - echo "$0: creating $redir_file" cat >$redir_file < @@ -224,13 +227,17 @@ EOF # this is a copy of a file certbot, see below. echo "$0: creating $common_ssl_conf" cat >$common_ssl_conf <<'EOF' -# Baseline setting to Include for SSL sites +# This file contains important security parameters. If you modify this file +# manually, Certbot will be unable to automatically provide future security +# updates. Instead, Certbot will print and log an error message with a path to +# the up-to-date file that you will need to refer to when manually updating +# this file. SSLEngine on # Intermediate configuration, tweak to your needs SSLProtocol all -SSLv2 -SSLv3 -SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA +SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS SSLHonorCipherOrder on SSLCompression off @@ -249,7 +256,7 @@ LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common EOF upstream=https://github.com/certbot/certbot/raw/master/certbot-apache/certbot_apache/options-ssl-apache.conf - if ! diff -c <(wget -q -O - $upstream) $common_ssl_conf; then + if ! diff -u <(wget -q -O - $upstream) $common_ssl_conf; then cat </dev/null; then - http2_arg=http2 + if $ssl; then + ssl_arg=ssl + if nginx -V |& grep -- '--with-http_v2_module\b' &>/dev/null; then + # fun fact: nginx can be configured to do http2 without ssl. + ssl_arg+=" http2" + fi fi cat >$common_ssl_conf <<'EOF' @@ -333,14 +344,27 @@ EOF server { server_name $h www.$h; root $root; - listen $port ssl $http2_arg; - listen [::]:$port ssl $http2_arg; + listen $port $ssl_arg; + listen [::]:$port $ssl_arg; - # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate +EOF + if $ssl; then + cat >>$vhost_file <$redir_file <>$vhost_file fi @@ -362,15 +386,14 @@ EOF } EOF - cat >$redir_file </etc/apache2/conf-enabled/local-custom.conf <<'EOF' +# vhost_combined with %D (request time in microseconds) +# this file is just a convenient place to drop it. +LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" vhost_time_combined +SSLStaplingCache shmcb:/var/run/apache2/stapling_cache(128000) +EOF