Fix cert-only acme challenge issue.

2 files changed, 15 insertions, 0 deletions

diff --git a/template/nginx/cert-only.conf.template b/template/nginx/cert-only.conf.template
new file mode 100644
index 0000000..08daa8a
--- /dev/null
+++ b/template/nginx/cert-only.conf.template
@@ -0,0 +1,13 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ${CRUPEST_NGINX_SUBDOMAIN}.${CRUPEST_DOMAIN};
+
+    location / {
+        return 444;
+    }
+
+    location /.well-known/acme-challenge {
+        root /srv/acme;
+    }
+}
diff --git a/template/nginx/forbid_unknown_domain.conf b/template/nginx/forbid_unknown_domain.conf
index 661a2b6..ae96393 100644
--- a/template/nginx/forbid_unknown_domain.conf
+++ b/template/nginx/forbid_unknown_domain.conf
@@ -1,6 +1,8 @@
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
 
     return 444;
 }