From 53a582be8330c1becc3a34b168bfa7b1db2d60bd Mon Sep 17 00:00:00 2001 From: Catalin Constantin Mititiuc Date: Mon, 16 Jun 2025 20:18:05 -0700 Subject: [PATCH] Add config to redirect from old domain --- conf/nginx.conf | 49 ++++++++++++--- dehydrated/config | 134 +++++++++++++++++++++++++++++++++++++++++ dehydrated/domains.txt | 32 ++++++++++ 3 files changed, 208 insertions(+), 7 deletions(-) create mode 100644 dehydrated/config create mode 100644 dehydrated/domains.txt diff --git a/conf/nginx.conf b/conf/nginx.conf index 2a718e3..cf315e0 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -8,14 +8,14 @@ events { http { server { listen 80; - listen 443 ssl; + listen 443 ssl; include mime.types; charset utf-8; default_type text/html; - ssl_certificate /var/www/certs/miti.sh/fullchain.pem; - ssl_certificate_key /var/www/certs/miti.sh/privkey.pem; + ssl_certificate /var/www/certs/miti.sh/fullchain.pem; + ssl_certificate_key /var/www/certs/miti.sh/privkey.pem; location ^~ /.well-known/acme-challenge { alias /var/www/dehydrated; @@ -23,6 +23,7 @@ http { try_files $uri $uri/ $uri.html =404; + # return `/posts/index.html` from `/posts` location = /posts { rewrite ^ /posts/ break; } @@ -39,14 +40,14 @@ http { } server { - listen 443 ssl; - server_name git.miti.sh; + listen 443 ssl; + server_name git.miti.sh; location ^~ /.well-known/acme-challenge { alias /var/www/dehydrated; } - location / { + location / { client_max_body_size 1024M; proxy_pass http://localhost:3000; proxy_set_header Connection $http_connection; @@ -59,7 +60,41 @@ http { } server { - server_name apps.miti.sh; + server_name apps.miti.sh; + + location ^~ /.well-known/acme-challenge { + alias /var/www/dehydrated; + } + } + + server { + listen 443 ssl; + server_name webdevcat.me; + + include mime.types; + charset utf-8; + default_type text/html; + + ssl_certificate /var/www/certs/webdevcat.me/fullchain.pem; + ssl_certificate_key /var/www/certs/webdevcat.me/privkey.pem; + + location ^~ /.well-known/acme-challenge { + alias /var/www/dehydrated; + } + + return 301 https://miti.sh$request_uri; + } + server { + listen 443 ssl; + server_name git.webdevcat.me; + + location ^~ /.well-known/acme-challenge { + alias /var/www/dehydrated; + } + } + server { + listen 443 ssl; + server_name apps.webdevcat.me; location ^~ /.well-known/acme-challenge { alias /var/www/dehydrated; diff --git a/dehydrated/config b/dehydrated/config new file mode 100644 index 0000000..a326229 --- /dev/null +++ b/dehydrated/config @@ -0,0 +1,134 @@ +######################################################## +# This is the main config file for dehydrated # +# # +# This file is looked for in the following locations: # +# $SCRIPTDIR/config (next to this script) # +# /usr/local/etc/dehydrated/config # +# /etc/dehydrated/config # +# ${PWD}/config (in current working-directory) # +# # +# Default values of this config are in comments # +######################################################## + +# Which user should dehydrated run as? This will be implicitly enforced when running as root +#DEHYDRATED_USER= + +# Which group should dehydrated run as? This will be implicitly enforced when running as root +#DEHYDRATED_GROUP= + +# Resolve names to addresses of IP version only. (curl) +# supported values: 4, 6 +# default: +#IP_VERSION= + +# URL to certificate authority or internal preset +# Presets: letsencrypt, letsencrypt-test, zerossl, buypass, buypass-test +# default: letsencrypt +CA="letsencrypt" +#CA="letsencrypt-test" + +# Path to old certificate authority +# Set this value to your old CA value when upgrading from ACMEv1 to ACMEv2 under a different endpoint. +# If dehydrated detects an account-key for the old CA it will automatically reuse that key +# instead of registering a new one. +# default: https://acme-v01.api.letsencrypt.org/directory +#OLDCA="https://acme-v01.api.letsencrypt.org/directory" + +# Which challenge should be used? Currently http-01, dns-01 and tls-alpn-01 are supported +CHALLENGETYPE="http-01" + +# Path to a directory containing additional config files, allowing to override +# the defaults found in the main configuration file. Additional config files +# in this directory needs to be named with a '.sh' ending. +# default: +#CONFIG_D= + +# Directory for per-domain configuration files. +# If not set, per-domain configurations are sourced from each certificates output directory. +# default: +#DOMAINS_D= + +# Base directory for account key, generated certificates and list of domains (default: $SCRIPTDIR -- uses config directory if undefined) +#BASEDIR=$SCRIPTDIR +BASEDIR=/var/www + +# File containing the list of domains to request certificates for (default: $BASEDIR/domains.txt) +DOMAINS_TXT="${BASEDIR}/domains.txt" + +# Output directory for generated certificates +CERTDIR="${BASEDIR}/certs" + +# Output directory for alpn verification certificates +ALPNCERTDIR="${BASEDIR}/alpn-certs" + +# Directory for account keys and registration information +ACCOUNTDIR="${BASEDIR}/accounts" + +# Output directory for challenge-tokens to be served by webserver or deployed in HOOK (default: /var/www/dehydrated) +WELLKNOWN="/var/www/dehydrated" + +# Default keysize for private keys (default: 4096) +#KEYSIZE="4096" + +# Path to openssl config file (default: - tries to figure out system default) +#OPENSSL_CNF= + +# Path to OpenSSL binary (default: "openssl") +#OPENSSL="openssl" + +# Extra options passed to the curl binary (default: ) +#CURL_OPTS= + +# Program or function called in certain situations +# +# After generating the challenge-response, or after failed challenge (in this case altname is empty) +# Given arguments: clean_challenge|deploy_challenge altname token-filename token-content +# +# After successfully signing certificate +# Given arguments: deploy_cert domain path/to/privkey.pem path/to/cert.pem path/to/fullchain.pem +# +# BASEDIR and WELLKNOWN variables are exported and can be used in an external program +# default: +#HOOK= + +# Chain clean_challenge|deploy_challenge arguments together into one hook call per certificate (default: no) +#HOOK_CHAIN="no" + +# Minimum days before expiration to automatically renew certificate (default: 30) +#RENEW_DAYS="30" + +# Regenerate private keys instead of just signing new certificates on renewal (default: yes) +#PRIVATE_KEY_RENEW="yes" + +# Create an extra private key for rollover (default: no) +#PRIVATE_KEY_ROLLOVER="no" + +# Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1 +#KEY_ALGO=secp384r1 + +# E-mail to use during the registration (default: ) +CONTACT_EMAIL=webdevcat@proton.me + +# Lockfile location, to prevent concurrent access (default: $BASEDIR/lock) +LOCKFILE="${BASEDIR}/lock" + +# Option to add CSR-flag indicating OCSP stapling to be mandatory (default: no) +#OCSP_MUST_STAPLE="no" + +# Fetch OCSP responses (default: no) +#OCSP_FETCH="no" + +# OCSP refresh interval (default: 5 days) +#OCSP_DAYS=5 + +# Issuer chain cache directory (default: $BASEDIR/chains) +CHAINCACHE="${BASEDIR}/chains" + +# Automatic cleanup (default: no) +#AUTO_CLEANUP="no" + +# ACME API version (default: auto) +#API=auto + +# Preferred issuer chain (default: -> uses default chain) +#PREFERRED_CHAIN= diff --git a/dehydrated/domains.txt b/dehydrated/domains.txt new file mode 100644 index 0000000..27c2efd --- /dev/null +++ b/dehydrated/domains.txt @@ -0,0 +1,32 @@ +# Create certificate for 'example.org' with an alternative name of +# 'www.example.org'. It will be stored in the directory ${CERT_DIR}/example.org +#example.org www.example.org +miti.sh git.miti.sh apps.miti.sh +webdevcat.me git.webdevcat.me apps.webdevcat.me + +# Create certificate for 'example.com' with alternative names of +# 'www.example.com' & 'wiki.example.com'. It will be stored in the directory +# ${CERT_DIR}/example.com +#example.com www.example.com wiki.example.com + +# Using the alias 'certalias' create certificate for 'example.net' with +# alternate name 'www.example.net' and store it in the directory +# ${CERTDIR}/certalias +#example.net www.example.net > certalias + +# Using the alias 'service_example_com' create a wildcard certificate for +# '*.service.example.com' and store it in the directory +# ${CERTDIR}/service_example_com +# NOTE: It is NOT a certificate for 'service.example.com' +#*.service.example.com > service_example_com + +# Using the alias 'star_service_example_org' create a wildcard certificate for +# '*.service.example.org' with an alternative name of `service.example.org' +# and store it in the directory ${CERTDIR}/star_service_example_org +# NOTE: It is a certificate for 'service.example.org' +#*.service.example.org service.example.org > star_service_example_org + +# Create a certificate for 'service.example.net' with an alternative name of +# '*.service.example.net' (which is a wildcard domain) and store it in the +# directory ${CERTDIR}/service.example.net +#service.example.net *.service.example.net