DigitalOcean LetsEncrypt Nginx Config

sites-available-ghost

server {
    listen 80;
    listen [::]:80;

    server_name robertnealan.com;
    root /var/www/ghost/system/nginx-root;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:2368;

    }

    location ~ /.well-known {
        allow all;
    }

    client_max_body_size 50m;

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/robertnealan.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/robertnealan.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = robertnealan.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80 ;
    listen [::]:80 ;
    server_name robertnealan.com;
    return 404; # managed by Certbot
}

Right on! Thanks, this was a breeze to set up.

@robertnealan Just wanted to say awesome article. I wanted to throw something in and didn't know of another way to reach out. If you test the strength of the ssl cert issued by this tutorial on ssllabs you get a B. For an easy upgrade to an A just run sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 and drop this into the nginx configssl_dhparam /etc/ssl/certs/dhparam.pem;

That will make for a stronger SSL.

Thanks, Robert. This is awesome. For anyone wondering, this gist is linked in https://robertnealan.com/setting-up-ssl-for-ghost-on-digitalocean-with-lets-encrypt/

Best guide and the one that works for the purpose. Thanks a lot @robertnealan for this!

Heads up all that I've just updated this Gist and the post to reflect the latest updates in DigitalOcean's Ghost droplet, the new Ghost CLI, and LetsEncrypt's newest CertBot CLI. The archived version of this Gist can be found here: https://gist.github.com/robertnealan/84c8fbe1956244bd2f57c7f0ac7715ab

I hate you, struggled so much with it and now it works. Thanks