From 29eb2e6cc469d9534c2586e98b782f1879bd8c76 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Mon, 6 Oct 2025 13:18:33 +0300 Subject: Refactor, add certbot to cron --- templates/ingress/etc_crontab.j2 | 10 +++ .../ingress/usr_local_etc_nginx_nginx.conf.j2 | 77 ++++++++++++++++++++++ templates/usr_local_etc_nginx_nginx.conf.j2 | 77 ---------------------- 3 files changed, 87 insertions(+), 77 deletions(-) create mode 100644 templates/ingress/etc_crontab.j2 create mode 100644 templates/ingress/usr_local_etc_nginx_nginx.conf.j2 delete mode 100644 templates/usr_local_etc_nginx_nginx.conf.j2 (limited to 'templates') diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2 new file mode 100644 index 0000000..7308565 --- /dev/null +++ b/templates/ingress/etc_crontab.j2 @@ -0,0 +1,10 @@ +# /etc/crontab - root's crontab for FreeBSD +# +# +SHELL=/bin/sh +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin +# +#minute hour mday month wday who command + +# Update LetsEncrypt certificates every day at 2:00 AM +0 2 * * * root certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ items }} diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 new file mode 100644 index 0000000..cee7878 --- /dev/null +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -0,0 +1,77 @@ +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + include mime.types; + default_type application/octet-stream; + + sendfile on; + keepalive_timeout 65; + + server { + listen 80 default_server; + server_name _; + + location / { + return 404; + } + } + + {% for site in static_sites -%} + {% if site.tls -%} + server { + server_name {{ site.host }}; + root /usr/local/www/{{ site.site }}; + + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + + index index.html; + + location / { + try_files $uri $uri.html $uri/ =404; + } + + # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 + add_header Strict-Transport-Security "max-age=63072000" always; + + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; + + ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem; + include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + } + {% endif -%} + + server { + listen 80; + server_name {{ site.host }}; + + return 301 https://$host$request_uri; + + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; + } + + {% endfor -%} + {% for jail in jails -%} + server { + listen 80; + server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems; + + location / { + proxy_pass http://192.168.2.{{ jail.num }}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } + {% endfor %} +} diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2 deleted file mode 100644 index cee7878..0000000 --- a/templates/usr_local_etc_nginx_nginx.conf.j2 +++ /dev/null @@ -1,77 +0,0 @@ -worker_processes auto; - -events { - worker_connections 1024; -} - -http { - include mime.types; - default_type application/octet-stream; - - sendfile on; - keepalive_timeout 65; - - server { - listen 80 default_server; - server_name _; - - location / { - return 404; - } - } - - {% for site in static_sites -%} - {% if site.tls -%} - server { - server_name {{ site.host }}; - root /usr/local/www/{{ site.site }}; - - listen 443 ssl; - listen [::]:443 ssl; - http2 on; - - index index.html; - - location / { - try_files $uri $uri.html $uri/ =404; - } - - # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 - add_header Strict-Transport-Security "max-age=63072000" always; - - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; - - ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem; - include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - } - {% endif -%} - - server { - listen 80; - server_name {{ site.host }}; - - return 301 https://$host$request_uri; - - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; - } - - {% endfor -%} - {% for jail in jails -%} - server { - listen 80; - server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems; - - location / { - proxy_pass http://192.168.2.{{ jail.num }}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - } - {% endfor %} -} -- cgit v1.3