slightly better docs

[basic-https-conf] / web-conf

diff --git a/web-conf b/web-conf
index b953668ee5a6ad797ea92e8407e25356fb0c9c38..4dc3974f38d4dc04f79593268c69562d8b2e8bf8 100755 (executable)
--- a/web-conf
+++ b/web-conf
@@ -25,7 +25,11 @@ usage() {
 Usage: ${0##*/} [OPTIONS] [EXTRA_SETTINGS_FILE] apache2|nginx DOMAIN
 apache/nginx config & let's encrypt
 
-If using tls then it expects certbot to be installed and in PATH.
+If using tls then it expects certbot to be installed and in PATH.  Also,
+certbot cronjob should be taken care of outside this script. In the
+debian package, it installs a systemd timer, which I (Ian Kelling) use
+and modify to email me on failure. You can see how I do this in my git
+repo distro-setup, and log-quiet.
 
 
 EXTRA_SETTINGS_FILE can be - for stdin
@@ -33,7 +37,7 @@ EXTRA_SETTINGS_FILE can be - for stdin
                   root@\$(hostname -A|awk '{print $1}')
                   which is root@$(hostname -A|awk '{print $1}') on this host.
 -f [ADDR:]PORT    Enable proxy to [ADDR:]PORT. ADDR default is 127.0.0.1
--i                Insecure, no ssl. Not implemented for nginx.
+-i                Insecure, no ssl.
 -p PORT           Main port to listen on, default 443. 80 implies -i.
 -r DIR            DocumentRoot
 -h|--help         Print help and exit
@@ -112,8 +116,10 @@ if $ssl; then
     f=$cert_dir/fullchain.pem
     if [[ ! -e $f ]] || openssl x509 -checkend 86400 -noout -in $f; then
         $0 -p 80 $t $h
-        # adds every security option
-        certbot certonly -n --hsts --staple-ocsp --uir --must-staple  --email $email --staple-ocsp --no-self-upgrade --agree-tos --apache -d $h
+        # when generating an example config, add all relevant security options:
+        # --hsts --staple-ocsp --uir
+        certbot certonly -n --must-staple --email $email --no-self-upgrade \
+                --agree-tos --${t%2} -d $h
         rm $vhost_file
     fi
 fi
@@ -294,8 +300,12 @@ if [[ $t == nginx ]]; then
     cd /etc/nginx
     [[ -e dh2048.pem ]] || openssl dhparam -out dh2048.pem 2048
 
-    if nginx -V |& grep -- '--with-http_v2_module\b' &>/dev/null; then
-        http2_arg=http2
+    if $ssl; then
+        ssl_arg=ssl
+        if nginx -V |& grep -- '--with-http_v2_module\b' &>/dev/null; then
+            # fun fact: nginx can be configured to do http2 without ssl.
+            ssl_arg+=" http2"
+        fi
     fi
 
     cat >$common_ssl_conf <<'EOF'
@@ -333,14 +343,27 @@ EOF
 server {
     server_name $h www.$h;
     root $root;
-    listen $port ssl $http2_arg;
-    listen [::]:$port ssl $http2_arg;
+    listen $port $ssl_arg;
+    listen [::]:$port $ssl_arg;
 
-    # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
+EOF
+    if $ssl; then
+        cat >>$vhost_file <<EOF
     ssl_certificate $cert_dir/fullchain.pem;
     ssl_certificate_key $cert_dir/privkey.pem;
     include $common_ssl_conf;
 EOF
+
+        cat >$redir_file <<EOF
+server {
+    server_name $h www.$h;
+    listen 80 $http2_arg;
+    listen [::]:80 $http2_arg;
+    return 301 https://$server_name$request_uri;
+}
+EOF
+    fi # end if $ssl
+
     if [[ $extra_settings ]]; then
         cat $extra_settings >>$vhost_file
     fi
@@ -362,14 +385,6 @@ EOF
 }
 EOF
 
-    cat >$redir_file <<EOF
-server {
-    server_name $h www.$h;
-    listen 80 $http2_arg;
-    listen [::]:80 $http2_arg;
-    return 301 https://$server_name$request_uri;
-}
-EOF
 
     service nginx restart