An open API service indexing awesome lists of open source software.

https://github.com/betahuhn/nginx-certbot

A nginx configuration file to use with Let's Encrypt HTTPS certificates
https://github.com/betahuhn/nginx-certbot

nginx nginx-configuration nginx-proxy nodejs

Last synced: 2 months ago
JSON representation

A nginx configuration file to use with Let's Encrypt HTTPS certificates

Awesome Lists containing this project

README

          

# nginx-certbot
A nginx configuration file to use with Let's Encrypt HTTPS certificates.

## Certbot
### Install Certbot

Add repository:

`sudo add-apt-repository ppa:certbot/certbot`

Update package list:

`sudo apt update`

Install certbot nginx package:

`sudo apt-get install python-certbot-nginx`

### Certbot commands

Generate certificate for one or more domains:

`sudo certbot certonly --nginx -d domain.com -d www.domain.com`

Generate wildcard certificate:

`sudo certbot certonly --manual -d *.domain.com -d domain.com --preferred-challenges dns`

> Note: You will need to add two TXT records in your DNS for the acme-challenge

Renew all certificates:

`sudo certbot renew`

> Note: Only works for none wildcard certificates

## Firewall

View current settings:

`sudo ufw status`

Run:

`sudo ufw allow 'Nginx Full'`

and

`sudo ufw delete allow 'Nginx HTTP'`

## Nginx

### Config file

```
server {
listen 80;
root *PATH TO ROOT FOLDER*;
server_name *DOMAIN*;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
client_max_body_size 5000M;
root *PATH TO ROOT FOLDER*;
server_name *DOMAIN*;

ssl_certificate /etc/letsencrypt/live/*DOMAIN*/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/*DOMAIN*/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;

ssl_dhparam /etc/letsencrypt/dhparam.pem;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security "max-age=63072000" always;

ssl_stapling on;
ssl_stapling_verify on;

ssl_trusted_certificate /etc/letsencrypt/live/*DOMAIN*/chain.pem;

resolver 8.8.8.8;

location / {
proxy_pass http://localhost:*PORT NUMBER*;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_cache_bypass $http_upgrade;
proxy_intercept_errors on;
proxy_pass_request_headers on;
}
}
```

### Commands

Verify config:

`sudo nginx -t`

Restart nginx:

`sudo service restart nginx`