From 29eb2e6cc469d9534c2586e98b782f1879bd8c76 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Mon, 6 Oct 2025 13:18:33 +0300
Subject: Refactor, add certbot to cron

---
 templates/ingress/etc_crontab.j2                   | 10 +++
 .../ingress/usr_local_etc_nginx_nginx.conf.j2      | 77 ++++++++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 templates/ingress/etc_crontab.j2
 create mode 100644 templates/ingress/usr_local_etc_nginx_nginx.conf.j2

(limited to 'templates/ingress')

diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2
new file mode 100644
index 0000000..7308565
--- /dev/null
+++ b/templates/ingress/etc_crontab.j2
@@ -0,0 +1,10 @@
+# /etc/crontab - root's crontab for FreeBSD
+#
+#
+SHELL=/bin/sh
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+#
+#minute hour    mday    month   wday    who     command
+
+# Update LetsEncrypt certificates every day at 2:00 AM
+0       2       *       *       *       root    certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ items }}
diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
new file mode 100644
index 0000000..cee7878
--- /dev/null
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -0,0 +1,77 @@
+worker_processes auto;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    server {
+        listen 80 default_server;
+        server_name _;
+
+        location / {
+            return 404;
+        }
+    }
+
+    {% for site in static_sites -%}
+    {% if site.tls -%}
+    server {
+        server_name {{ site.host }};
+        root /usr/local/www/{{ site.site }};
+
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+
+        index index.html;
+
+        location / {
+            try_files $uri $uri.html $uri/ =404;
+        }
+
+        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
+        access_log /var/log/nginx/{{ site.site }}/access.log;
+        error_log /var/log/nginx/{{ site.site }}/error.log;
+
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem;
+        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
+        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
+    }
+    {% endif -%}
+
+    server {
+        listen 80;
+        server_name {{ site.host }};
+
+        return 301 https://$host$request_uri;
+
+        access_log /var/log/nginx/{{ site.site }}/access.log;
+        error_log /var/log/nginx/{{ site.site }}/error.log;
+    }
+
+    {% endfor -%}
+    {% for jail in jails -%}
+    server {
+        listen 80;
+        server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems;
+
+        location / {
+            proxy_pass http://192.168.2.{{ jail.num }};
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+    {% endfor %}
+}
-- 
cgit v1.3