Continue to fix nginx.

6 files changed, 9 insertions, 13 deletions

diff --git a/template/nginx/forbid_unknown_domain.conf b/template/nginx/forbid_unknown_domain.conf
index ae96393..661a2b6 100644
--- a/template/nginx/forbid_unknown_domain.conf
+++ b/template/nginx/forbid_unknown_domain.conf
@@ -1,8 +1,6 @@
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
-    listen 443 ssl http2 default_server;
-    listen [::]:443 ssl http2 default_server;
 
     return 444;
 }
diff --git a/template/nginx/reverse-proxy.conf.template b/template/nginx/reverse-proxy.conf.template
index d7eebdf..3526471 100644
--- a/template/nginx/reverse-proxy.conf.template
+++ b/template/nginx/reverse-proxy.conf.template
@@ -7,9 +7,6 @@ server {
     listen [::]:443 ssl http2;
     server_name ${CRUPEST_NGINX_SUBDOMAIN}.${CRUPEST_DOMAIN};
 
-    ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
-
     location / {
         proxy_pass http://${CRUPEST_NGINX_UPSTREAM_NAME};
         proxy_http_version 1.1;
diff --git a/template/nginx/root.conf.template b/template/nginx/root.conf.template
index a6992c7..8214bf7 100644
--- a/template/nginx/root.conf.template
+++ b/template/nginx/root.conf.template
@@ -3,9 +3,6 @@ server {
     listen [::]:443 ssl http2;
     server_name ${CRUPEST_DOMAIN};
 
-    ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
-
     root /srv/www;
 }
 
diff --git a/template/nginx/ssl.conf b/template/nginx/ssl.conf.template
index f2aadba..54205f1 100644
--- a/template/nginx/ssl.conf
+++ b/template/nginx/ssl.conf.template
@@ -4,6 +4,9 @@
 # the up-to-date file that you will need to refer to when manually updating
 # this file. Contents are based on https://ssl-config.mozilla.org
 
+ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
+
 ssl_session_cache shared:le_nginx_SSL:10m;
 ssl_session_timeout 1440m;
 ssl_session_tickets off;
diff --git a/template/nginx/static-file.conf.template b/template/nginx/static-file.conf.template
index 1597d10..0ada7cd 100644
--- a/template/nginx/static-file.conf.template
+++ b/template/nginx/static-file.conf.template
@@ -3,9 +3,6 @@ server {
     listen [::]:443 ssl http2;
     server_name ${CRUPEST_NGINX_SUBDOMAIN}.${CRUPEST_DOMAIN};
 
-    ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
-
     root ${CRUPEST_NGINX_ROOT};
 
     client_max_body_size 5G;
diff --git a/tool/modules/nginx.py b/tool/modules/nginx.py
index ebbbee5..398f6f7 100755
--- a/tool/modules/nginx.py
+++ b/tool/modules/nginx.py
@@ -16,8 +16,9 @@ with open(os.path.join(nginx_template_dir, 'server.schema.json')) as f:
 
 jsonschema.validate(server, schema)
 
-non_template_files = ['ssl.conf', 'forbid_unknown_domain.conf']
+non_template_files = ['forbid_unknown_domain.conf']
 
+ssl_template = Template(os.path.join(nginx_template_dir, 'ssl.conf.template'))
 root_template = Template(os.path.join(
     nginx_template_dir, 'root.conf.template'))
 static_file_template = Template(os.path.join(
@@ -38,6 +39,9 @@ def nginx_config_gen(domain: str, dest: str) -> None:
         dst = os.path.join(dest, filename)
         shutil.copyfile(src, dst)
     config = {"CRUPEST_DOMAIN": domain}
+    # generate ssl.conf
+    with open(os.path.join(dest, 'ssl.conf'), 'w') as f:
+        f.write(ssl_template.generate(config))
     # generate root.conf
     with open(os.path.join(dest, f'{domain}.conf'), 'w') as f:
         f.write(root_template.generate(config))
@@ -80,7 +84,7 @@ def certbot_command_gen(domain: str, action, test=False) -> str:
 
 
 def nginx_config_dir_check(dir_path: str, domain: str) -> list:
-    good_files = [*non_template_files, *
+    good_files = [*non_template_files, "ssl.conf", *
                   [f"{full_domain}.conf" for full_domain in list_domains(domain)]]
     bad_files = []
     for path in os.listdir(dir_path):