From 5706b4c77e4eb3d6025b771801711ff49ea299e8 Mon Sep 17 00:00:00 2001
From: crupest <crupest@outlook.com>
Date: Sun, 20 Nov 2022 16:32:27 +0800
Subject: Fix cert-only acme challenge issue.

---
 template/nginx/cert-only.conf.template    | 13 +++++++++++++
 template/nginx/forbid_unknown_domain.conf |  2 ++
 2 files changed, 15 insertions(+)
 create mode 100644 template/nginx/cert-only.conf.template

(limited to 'template/nginx')

diff --git a/template/nginx/cert-only.conf.template b/template/nginx/cert-only.conf.template
new file mode 100644
index 0000000..08daa8a
--- /dev/null
+++ b/template/nginx/cert-only.conf.template
@@ -0,0 +1,13 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ${CRUPEST_NGINX_SUBDOMAIN}.${CRUPEST_DOMAIN};
+
+    location / {
+        return 444;
+    }
+
+    location /.well-known/acme-challenge {
+        root /srv/acme;
+    }
+}
diff --git a/template/nginx/forbid_unknown_domain.conf b/template/nginx/forbid_unknown_domain.conf
index 661a2b6..ae96393 100644
--- a/template/nginx/forbid_unknown_domain.conf
+++ b/template/nginx/forbid_unknown_domain.conf
@@ -1,6 +1,8 @@
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
 
     return 444;
 }
-- 
cgit v1.2.3