Attention ! Gitlab fournissant maintenant nativement des certificats Let’s Encrypt aux domaines personnalisés des Gitlab Pages, nous avons coupé notre service qui le faisait automatiquement pour vous.

Il est impératif, pour que votre domaine personnalisé continue à avoir un certificat Let’s Encrypt à jour, d’activer la fonctionnalité native dans les paramètres de votre projet. Cette activation remplacera votre certificat actuel par un nouveau certificat Let’s Encrypt géré par Gitlab.

Voir les détails sur https://docs.framasoft.org/fr/gitlab/gitlab-pages-le.html

Commit 803d354f authored by hellekin's avatar hellekin

Add Nginx configuration example for development (refs: #6)

- Follow numbered instructions found in *.conf
- Renew api.example.net certificate
- Add self-signed-cert utility: to renew the certificate, run:
  `./self-signed-cert api`
- Related documentation : https://talk.incommon.cc/t/nginx-setup/393
parent b6904553
#
## api.example.net
#
# 1. Add an entry in /etc/hosts: `echo '127.0.0.1 api.example.net' >> /etc/hosts`
# 2. Edit this file (see inline)
# 3. Place this file in /etc/nginx/sites-available
# 4. Ensure referenced files are in place! (See each file)
# 5. Enable the server by symlinking it to sites-enabled:
# `cd /etc/nginx/sites-enabled; ln -s ../sites-available/api.example.net`
# 6. Restart nginx: `/etc/init.d/nginx reload`
upstream incommon_api {
# 2. Replace with the correct path
# server unix:///path/to/incommon-api/tmp/sockets/puma.sock;
}
server {
listen 80;
server_name api.example.net;
return 302 https://api.example.net$uri;
}
server {
listen 443 ssl http2;
server_name api.example.net;
# 2. Replace with the correct path
root /srv/www/incommon.cc/api;
index index.html;
access_log /var/log/nginx/api.incommon.cc_access.log main;
error_log /var/log/nginx/api.incommon.cc_errors.log;
try_files $uri $uri/ $uri.html =404;
include le.conf;
include le-ssl.conf;
include gdpr-compliance.conf;
ssl_certificate /etc/nginx/certs/api.example.net.crt;
ssl_certificate_key /etc/nginx/certs/api.example.net.key;
location * {
if ($request_method = OPTIONS) {
add_header Content-Length '0';
return 200;
}
}
location / {
add_header 'Content-Security-Policy-Report-Only' "default-src 'self' https://adm.example.net https://talk.incommon.cc https://api.incommon.cc; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'" always;
proxy_pass http://incommon_api;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_intercept_errors off;
}
}
-----BEGIN CERTIFICATE-----
MIIC9zCCAd+gAwIBAgIJAI6bfKfouNw1MA0GCSqGSIb3DQEBCwUAMBoxGDAWBgNV
BAMMD2FwaS5leGFtcGxlLm5ldDAeFw0xODEwMTcwMjQ0NTJaFw0xODExMTYwMjQ0
NTJaMBoxGDAWBgNVBAMMD2FwaS5leGFtcGxlLm5ldDCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAMBslJUK2RhIccN/wPjQ/23m+g4tfNoJsWZItsUGQ7Zz
M4TXNoJmszwjgS1fX701ZzrX/w+0otLOJReOTkS9vcjyfABtJJJboh5NGFQXzxnQ
di7SO7MbP7TyLirePHIJex9VsdssYgZvwLb09XzlL/6vwbr5PaYYrtfhXOxYii0U
DqPqMZGS+5+I/7TbQo3e2njLskXqAMLxi64l7agm04eCTT1SxOGhym5PtGXPnOuq
r+alKEQIIgWsPdlZbMyyHGSxu3qN6SySmY5ggyPdjH6XYDtKkDERbG0VfQDZxunS
QJVoIYfV/+DcocrO5eYTjTi9ONWH9Djvg/ZdmpFZtqUCAwEAAaNAMD4wGgYDVR0R
MIIC9zCCAd+gAwIBAgIJAJ2qpoy7Xju9MA0GCSqGSIb3DQEBCwUAMBoxGDAWBgNV
BAMMD2FwaS5leGFtcGxlLm5ldDAeFw0xODExMjExNjI4MThaFw0xODEyMjExNjI4
MThaMBoxGDAWBgNVBAMMD2FwaS5leGFtcGxlLm5ldDCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAMFOHOXtJs3B9clhi/LpyO+CH1TXhc38Gy8Y67DkNjXp
ySc/KjVuXx28bUsqiybWZLtCagVkatF8n3HatiZQUxzCnB27CUCFzH4Op7Vhee0s
VS+XXkdxWu4Dd0hwGNbLKjoi9W4W2Q+9drBKZuMH/cG+eQlVL4Y/Z8YEOmJAeWvH
f5+y3AtNfk6GDDvh7hIS7z+38pk7dPhQmeKRNB/TRsufl4af9H8LZuz+muesRjFA
inn5w3TIwFBRNFqO+4mpPNWzz8wAGQfS5PMw57HzkBibAq+LH21DHkEtpdPrhol5
x8iRN/o5ZWjZeDLGSMfFZBe5FHVw0vkLka8I2M1ZJw8CAwEAAaNAMD4wGgYDVR0R
BBMwEYIPYXBpLmV4YW1wbGUubmV0MAsGA1UdDwQEAwIHgDATBgNVHSUEDDAKBggr
BgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEAGC1NQqub8fQB6ebGtCNC2iWVOTD6
X0/4SFUAwAjU9ysm5bMMQdtbDHPcycp1lTchQzgZFxJj6mKdd/+JUVX/yAFB6Dij
k2FYhtHsgjyclukxid7gj8SVECssCa/CMlJEfwqZe5CuaXMxS8yzlG90kKOIbC90
yTuFrA2XKs/RxL0aKOO6TW2K/CVFwfpOWr4GkYZOuiD3nWj0OTOv58L2IUeQDNyX
EqzN7qwiyBnv8+4XpC8GyUE2lFOj4oiMVRsT5Qb0hz8W8XmbWUVKyYSCTHK6NDRE
YnZ7n2A7Jka6KhO24ARHvcUYsmgDzTrpvwBqYa8RKNdrwQLXNywgoZwxOg==
BgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEAPYhRoOUCQoB+vsXAaTNgDZq+KYa7
SUvqzi50cvDBADSSlWJ21PFh9qPngfzOyLofKpeT/Vy02mADM5iH2E+xxr2H/hRG
ahsf61Ya3FxxyCQjuusulteWCD0cmekQ8S/uc0vpXDm5UMg9St08GASTAfybAtR/
abbAmXHtUptRWVJjVCxANlDWbH1FGvv1IjfFNiHOseE4P7lkkSPtoHc+hwaeG8Oe
kYNhwB6JNSPtqDk7pUs0J+Tn1Xe66yf49iJK7la5hikmYdnNjJyJjMf0Dhjvh+fB
aMgdVbxIaI9XtifUvQHhrcGDqSHaZXguHNJ5ujsCrOL8Ijv//xhOVDD8/g==
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDAbJSVCtkYSHHD
f8D40P9t5voOLXzaCbFmSLbFBkO2czOE1zaCZrM8I4EtX1+9NWc61/8PtKLSziUX
jk5Evb3I8nwAbSSSW6IeTRhUF88Z0HYu0juzGz+08i4q3jxyCXsfVbHbLGIGb8C2
9PV85S/+r8G6+T2mGK7X4VzsWIotFA6j6jGRkvufiP+020KN3tp4y7JF6gDC8Yuu
Je2oJtOHgk09UsThocpuT7Rlz5zrqq/mpShECCIFrD3ZWWzMshxksbt6jekskpmO
YIMj3Yx+l2A7SpAxEWxtFX0A2cbp0kCVaCGH1f/g3KHKzuXmE404vTjVh/Q474P2
XZqRWbalAgMBAAECggEAaw/+265dfBVStuOuCsK+W/fXyWulu+sIuVBb4OPLaQhP
8emMeqGJuDxI82XNbwj3ltX3JFXtAj2Qhbq38adgoR3JwLL5VjWFzjY3AxL8N/C0
0PhIHy9aEuNsrI1aNFjyGE0l2Dypjcs//ovsysD6I0rHD7D9jBzPq23ItffNaaZ4
AvzDTTAtC0Wvr2IV5B2phkoEF2ysbv6OE1F1da451ornNOAoGmZep1gpFzFG7LB1
GACSytV47HALFou4ui6tkNP6GM0uQ9bWOhrS1sKkqOjPCnRMXKro8yVx8I0Awro5
ZXG6BwaAFfGZ+7NJM21m1sDkC7IHZs1GL2DNWnqmAQKBgQDoNqYvT9a6kPLGC7/J
efUSziLjuRzlsSAYKzQGKPnQdQdMnwx5wGi5/QE69jcA3lOpLolY2kE2hFMIcjpW
PNETzblH9A5az46PiZpfkJVYI1QSye8pP1JoY7lnk6j5od3kHtp2NX+FangqtEHM
K+LTHfOrQLHD968NqiQSnSwFTQKBgQDUIohfpTw9C4jktBpsyk/nimVWAoSDdF3i
Xjdf+gn36wT1nIm2cW/uFe83KnC+44BZ5XM9Tdx1/qVQw9ux/Dm4RvsSC6um9Nme
vKaYf+w9CYEj+FquJ50NfGWYlflNOg+SfwMrin/EEEXMs9UR0Svv4atfcA/ng/Fn
KB4lP7hquQKBgQC8q6paxoOxEhQu1Vz+VhjJLrMqUz0nYsKw4Glkl+ZheLR1jMSW
J77vXqGhRmtqSTmwPB9cEfjqUpkkQ6siZkd5z6y6yZDgN8Oc3DCRdOfitNGacnff
C5PpPR1nCpJAQUQIFQlrAgyaWedIyyyqtv2UisFwYyAMGTIh6BtnBEzAAQKBgQDS
igN3ifMjUxNmiSnA13o+fyjcGFuUbCXRyViENRE3sVWWvuoe3K8OSU7GHaUQj5KP
ph6dtW0c3sMMSZb+KyrOLgR5gIO4jEKAPRPLPwsj+Q7muFKnjkFdZR0gN5jagMl7
x/tJd4ge+1eLNuA9crB8wCjp67qdOGKa00I4DenmYQKBgQCQsZw6dBYkzZDFQtCM
4Nr5KD3U9n0/X0PZ7zTnMXUVMpVwZX9JQUNwrSa0iOgCrbvGTD91V+C0u6cRS68r
MOYhYsrotO3KD13QFbKCCIqBfCPx8rVuvQP0eSMzwHRW54YegHDjnC2haaO+c5HD
AwUX/i0RRb9Hlz13frrspXfz/g==
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDBThzl7SbNwfXJ
YYvy6cjvgh9U14XN/BsvGOuw5DY16cknPyo1bl8dvG1LKosm1mS7QmoFZGrRfJ9x
2rYmUFMcwpwduwlAhcx+Dqe1YXntLFUvl15HcVruA3dIcBjWyyo6IvVuFtkPvXaw
SmbjB/3BvnkJVS+GP2fGBDpiQHlrx3+fstwLTX5Ohgw74e4SEu8/t/KZO3T4UJni
kTQf00bLn5eGn/R/C2bs/prnrEYxQIp5+cN0yMBQUTRajvuJqTzVs8/MABkH0uTz
MOex85AYmwKvix9tQx5BLaXT64aJecfIkTf6OWVo2XgyxkjHxWQXuRR1cNL5C5Gv
CNjNWScPAgMBAAECggEBALiptYOU9N/U7cdOr5ID8heTt/il10Y7E4D/jpCywnLo
fmhGuDzIzoaqrcIDx2D3qM0XGg9CqaSsJ+ltJVsemvc7lkX0mlcQOpUlzOLCVubS
1iIbuU4IpPQBTZ9eruvqs9FL+igMHZoixdKNkRJLXQgLvLbEsRzPT4RkH54it5vU
E+43G4cKRiOJWspb008eLMG+7swOlSxtL6crDgNDTQwvsdSA3TJI1qCAHieaDcWe
F7H2wScUn50sM0dVM57/Ve7HDL9qs5zcQ8LmNagfZI10l6f2TX5f2LQ2a84IVESW
KeK1KPuaIIyrqpg7lmNZ8dmibRSBk/7wVMnCIsMcDTECgYEA8ISrWYb52NEB96Y8
g4G5eZADhwfexPQ/79542DQa4bfULwTuNNqBo82uHZ/QiiOEBW/VKbLLBFXmhc1C
W79wmHKuBBfXwlCeaA1wzZ1cdFWeXqgm3c2IYDZGqBoFqWUnSWs/rOFVJ4Wi1amG
0dLS4wfgkoSGcRtdp69zH5alwEcCgYEAzb9zsphB4QbjUOLeVRjLFdlEQbeKHH87
gy5q4OCdAFjPS/sfXRfX/DDsNUQxmRPkEkDEHbkFUyD/SEzc5o+/rXOfwbVUS5yZ
MXzKPHnJ6VhM2aAN+gGluHHLFWhlOg1vMT8b2yYHcX3WitYxp1FTGQb2mpHEFB2W
zdySMUtYzvkCgYAfJo+qwLiLREak9HrR7XNAM07BpltL1vaQ8pdkKRtyMITishjH
76TqujDa1WAFBCSNL7bD98wje5ynp7X4fArxM6kmDpB7MkXR5Cu/9amLx6sDR3QB
NiV7kIwGKZiiH9++uo08rtKAk+ZLFfHIKy31CYgkcdWXwJuYpDic1r4Q8QKBgQCy
vulc9zoErV8/HlnZxDhrOt452aJ7L24cgW8I/xpm+sDdWcXdsqFJz5bmj+AnBUjX
Mr0utVcS6U/fGCexhqEXp6PbPhWFuv68J5XrBEOOHdBmIM8Dq/q1SucMKi4HSTSY
rCMfOOKujoydAYkRu21eCNalYo3ei/Y/0qiPes4kwQKBgQDiG5W/uZQDduqV9zbq
zeHGntU8JZnphkC6r5IBoy2dReYssPfp4dxG+xN1Qz5ssBgLlj9/tNNryu9zp8et
a/VKRVA3w9QkLzDepehNyIlSXhAuHmhJHmqz6hxodyXQuaL4RTi2LKTuxJEmBlqH
ZeW77aExRyfxIYDCdhG/Zg3k4A==
-----END PRIVATE KEY-----
# Do not log IP addresses
access_log /var/log/nginx/access_$host.log anonymized;
error_log /var/log/nginx/error_$host.log warn;
# Do not log uninteresting files
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
# SSL Configuration
#
# In /etc/nginx/sites-available/ssl.example.org:
#
# 1. Replace 'ssl.example.org' with your secure domain
# 2. Add the resulting lines to your server configuration:
#
# include le-ssl.conf
# ssl_certificate /etc/letsencrypt/live/ssl.example.org/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/ssl.example.org/privkey.pem;
# deprecated: use listen 443 ssl instead
# ssl on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
ssl_buffer_size 4k;
ssl_dhparam /etc/ssl/dhparams.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_session_timeout 1d;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/lets-encrypt-x3-cross-signed.pem;
add_header Strict-Transport-Security 'max-age=63072000';
# Discourse docker handles this:
# add_header Referrer-Policy 'strict-origin-when-cross-origin';
# 3. Replace resolver entries with your local DNS IP addresses
resolver 213.133.100.100 213.133.99.99 valid=300s;
resolver_timeout 3s;
# LE configuration for 80 and 443
# 1. Place this file in /etc/nginx
# 2. Include this file in your server stanzas, e.g.,
# include le.conf
# 3. mkdir -p /srv/www/.well-known/acme-challenge
# chown -R www-data /srv/www/.well-known
location /.well-known/acme-challenge {
alias /srv/www/.well-known/acme-challenge;
}
# Add some more security headers
add_header X-Content-Type-Options nosniff;
#add_header X-Frame-Options SAMEORIGIN;
#add_header X-XSS-Protection "1; mode=block";
# Anonymized log format to comply with GPDR
# Place this file in /etc/nginx/conf.d/
# This is the default:
# log_format combined '$remote_addr - $remote_user [$time_local] '
# '"$request" $status $body_bytes_sent '
# '"$http_referer" "$http_user_agent"';
log_format anonymized '0.0.0.0 - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
#!/bin/zsh
host="${1:-localhost}"
if [ "$host" = "localhost" ]; then
openssl req -x509 -out localhost.crt -keyout localhost.key \
-newkey rsa:2048 -nodes -sha256 \
-subj '/CN=localhost' -extensions EXT -config <( \
printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
else
openssl req -x509 -out ${host}.example.net.crt -keyout ${host}.example.net.key \
-newkey rsa:2048 -nodes -sha256 \
-subj "/CN=${host}.example.net" -extensions EXT -config <( \
printf "[dn]\nCN=${host}.example.net\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:${host}.example.net\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
fi
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment