iankelling.org Git - basic-https-conf/blob - nginx-site

   1 #!/bin/bash -l
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 set -eE -o pipefail
  17 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  18
  19
  20 usage() {
  21     cat <<EOF
  22 Usage: ${0##*/} [EXTRA_SETTINGS_FILE] DOMAIN
  23 Note: this is less tested and mature than the apache site script.
  24
  25 Setup nginx config with https using
  26 ssl config provided by let's encrypt and my standard
  27 location for storing certs.
  28
  29 EXTRA_SETTINGS_FILE can be - for stdin
  30 -p PORT    Proxy to PORT
  31 -h|--help  Print help and exit
  32
  33 TODO: add https redir site.
  34 EOF
  35     exit $1
  36 }
  37
  38 ##### begin command line parsing ########
  39
  40 proxy_port=
  41 extra_settings=
  42 args=()
  43 while [[ $1 ]]; do
  44     case $1 in
  45         -p) proxy_port="$2"; shift 2 ;;
  46         --) shift; break ;;
  47         -?*|-h|--help) usage ;;
  48         *) args+=("$1"); shift ;;
  49     esac
  50 done
  51 args+=("$@")
  52
  53 if (( ${#args[@]} == 2 )); then
  54     read extra_settings h <<<"${args[@]}"
  55 else
  56     read h <<<"${args[@]}"
  57 fi
  58
  59 if [[ ! $h ]]; then
  60     echo "$0: error: expected domain arg"
  61     usage 1
  62 fi
  63
  64
  65 ##### end command line parsing ########
  66
  67 sudo rm -f /etc/nginx/sites-enabled/default
  68
  69 cdir=/p/c/machine_specific/$HOSTNAME/webservercerts
  70 sudo dd of=/etc/nginx/sites-enabled/$h.conf <<EOF
  71 # https://mozilla.github.io/server-side-tls/ssl-config-generator/
  72 server {
  73     server_name $h www.$h;
  74     root /var/www/$h/html;
  75     listen 443 ssl;
  76     listen [::]:443 ssl;
  77
  78     # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
  79     ssl_certificate $cdir/$h-chained.pem;
  80     ssl_certificate_key $cdir/$h-domain.key;
  81     ssl_session_timeout 1d;
  82     ssl_session_cache shared:SSL:50m;
  83     ssl_session_tickets off;
  84
  85     # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
  86     ssl_dhparam $cdir/dh2048.pem;
  87
  88     # modern configuration. tweak to your needs.
  89     ssl_protocols TLSv1.2;
  90     ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  91     ssl_prefer_server_ciphers on;
  92
  93     # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
  94     add_header Strict-Transport-Security max-age=15768000;
  95
  96     # OCSP Stapling ---
  97     # fetch OCSP records from URL in ssl_certificate and cache them
  98     ssl_stapling on;
  99     ssl_stapling_verify on;
 100
 101     ## verify chain of trust of OCSP response using Root CA and Intermediate certs
 102     #ssl_trusted_certificate $cdir/$h-fullchain.pem;
 103
 104     # ian: also not needed, our local resolver works fine.
 105     #resolver <IP DNS resolver>;
 106 EOF
 107 if [[ $extra_settings ]]; then
 108     cat $extra_settings | sudo tee -a /etc/nginx/sites-enabled/$h.conf
 109 fi
 110
 111 if [[ $proxy_port ]]; then
 112     sudo tee -a /etc/nginx/sites-enabled/$h.conf <<EOF
 113     location / {
 114         proxy_set_header Host \$host;
 115         proxy_set_header X-Real-IP \$remote_addr;
 116         proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 117         proxy_set_header X-Forwarded-Ssl on;
 118         proxy_set_header X-Forwarded-Port 443;
 119         proxy_pass http://127.0.0.1:$proxy_port;
 120     }
 121 EOF
 122
 123
 124 sudo tee -a /etc/nginx/sites-enabled/$h.conf <<EOF
 125 }
 126 EOF
 127 sudo mkdir -p /var/www/$h/html
 128 sudo chown -R ian:ian /var/www/$h
 129 sudo service nginx restart