nginxtended/template.https.conf at master · WowMuchName/nginxtended · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{{ with $root := .}}{{ range $alias := .Aliases }}
server {
    listen {{$root.Port}} ssl http2;
    server_name {{$alias}};

    ssl_dhparam /etc/letsencrypt/live/{{$root.Domain}}/dhparam.pem;

    # Certs
    ssl_certificate /etc/letsencrypt/live/{{$root.Domain}}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{{$root.Domain}}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{$root.Domain}}/chain.pem;

    location / {
        return 301 https://{{$root.Domain}}$request_uri;
    }
}
{{ end }}{{ end }}
server {
    listen {{.Port}} ssl http2;
    server_name {{.Domain}};

{{ if .KeyAuth }}
    # Client-Key Authentication
    ssl_client_certificate /etc/letsencrypt/live/{{.Domain}}/{{.Domain}}.client.crt;
    ssl_verify_client on;
    add_header X-Client-DN $ssl_client_s_dn;
    add_header X-Client-SN $ssl_client_serial;

{{ end }}
    ssl_dhparam /etc/letsencrypt/live/{{.Domain}}/dhparam.pem;

    # Certs
    ssl_certificate /etc/letsencrypt/live/{{.Domain}}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{{.Domain}}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{.Domain}}/chain.pem;

    add_header Strict-Transport-Security "max-age=31536000" always;

    location / {
        set $upstream {{.URL}};
        proxy_pass $upstream;
    }
}