Skip to content

Instantly share code, notes, and snippets.

@mezbahalam
Created October 1, 2019 14:02
Show Gist options
  • Save mezbahalam/af8cc3db270628a6893bb36b702e458c to your computer and use it in GitHub Desktop.
Save mezbahalam/af8cc3db270628a6893bb36b702e458c to your computer and use it in GitHub Desktop.
conflict for multidomain ssl
## /etc/openresty/nginx.conf
user www-data;
events {
worker_connections 1024;
}
http {
lua_shared_dict auto_ssl 1m;
lua_shared_dict auto_ssl_settings 64k;
resolver 8.8.8.8 ipv6=off;
init_by_lua_block {
auto_ssl = (require "resty.auto-ssl").new()
auto_ssl:set("allow_domain", function(domain)
return true
end)
auto_ssl:init()
}
init_worker_by_lua_block {
auto_ssl:init_worker()
}
access_log /var/log/openresty/access.log;
error_log /var/log/openresty/error.log;
server {
listen 127.0.0.1:8999;
client_body_buffer_size 128k;
client_max_body_size 128k;
location / {
content_by_lua_block {
auto_ssl:hook_server()
}
}
}
include /etc/nginx/sites-enabled/*;
}
## /etc/openresty/sites-enabled/00_app.conf
upstream app_server {
server unix:///home/rails/html/shared/tmp/sockets/puma.sock fail_timeout=0;
}
server {
listen 443 ssl http2 default_server;
server_name _;
ssl_certificate_by_lua_block {
auto_ssl:ssl_certificate()
}
ssl_certificate /root/.acme.sh/fullchain.cer;
ssl_certificate_key /root/.acme.sh/app.key;
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# ssl_ciphers HIGH:!aNULL:!MD5;
root /home/rails/html/current/public;
index index.html index.htm;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri/index.html $uri.html $uri @app;
}
location ~* ^.+\.(jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|mp3|flv|mpeg|avi)$ {
try_files $uri @app;
}
location @app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_redirect off;
proxy_pass http://app_server;
}
}
## /etc/openresty/sites-enabled/00_http2https.conf
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
# Required to verify domain with LetsEncrypt
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}
location / { return 301 https://$host$request_uri; }
}
## /etc/nginx/sites-available/default
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment