diff --git a/Dockerfile b/Dockerfile index 53693c9..1e2a326 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,9 +22,7 @@ ADD nginx/nginx.conf /etc/nginx/nginx.conf ADD nginx/snikket-common.template /etc/nginx/templates/snikket-common ADD nginx/startup.template /etc/nginx/templates/startup ADD nginx/http.template /etc/nginx/templates/http -ADD nginx/https.template /etc/nginx/templates/https ADD supervisord.conf /etc/supervisord/supervisord.conf -ADD cert-monitor.sh /usr/local/bin/cert-monitor.sh ADD static /var/www/html/static ADD startup.html /var/www/html/index.html ADD error-pages /var/www/html/_errors diff --git a/cert-monitor.sh b/cert-monitor.sh index 8df4f8b..6910602 100755 --- a/cert-monitor.sh +++ b/cert-monitor.sh @@ -1,20 +1,10 @@ #!/bin/bash -CERT_PATH="/snikket/letsencrypt/live/$SNIKKET_DOMAIN/cert.pem" - -while sleep 10; do - if test -f "$CERT_PATH"; then - if test -f /etc/nginx/sites-enabled/startup; then - rm /etc/nginx/sites-enabled/startup; - fi - /usr/local/bin/render-template.sh "/etc/nginx/templates/snikket-common" "/etc/nginx/snippets/snikket-common.conf" - for proto in http https; do - /usr/local/bin/render-template.sh "/etc/nginx/templates/$proto" "/etc/nginx/sites-enabled/$proto"; - done - /usr/sbin/nginx -s reload - fi -done - -while sleep 86400; do - /usr/sbin/nginx -s reload; +if test -f /etc/nginx/sites-enabled/startup; then + rm /etc/nginx/sites-enabled/startup; +fi +/usr/local/bin/render-template.sh "/etc/nginx/templates/snikket-common" "/etc/nginx/snippets/snikket-common.conf" +for proto in http https; do + /usr/local/bin/render-template.sh "/etc/nginx/templates/$proto" "/etc/nginx/sites-enabled/$proto"; done +/usr/sbin/nginx -s reload diff --git a/nginx/https.template b/nginx/https.template deleted file mode 100644 index 1f26232..0000000 --- a/nginx/https.template +++ /dev/null @@ -1,70 +0,0 @@ -server { - listen ${SNIKKET_TWEAK_HTTPS_PORT} ssl; - listen [::]:${SNIKKET_TWEAK_HTTPS_PORT} ssl; - - ssl_certificate /snikket/letsencrypt/live/${SNIKKET_DOMAIN}/fullchain.pem; - ssl_certificate_key /snikket/letsencrypt/live/${SNIKKET_DOMAIN}/privkey.pem; - - ssl_session_cache shared:le_nginx_SSL:1m; - ssl_session_timeout 1440m; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_prefer_server_ciphers on; - ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; - - server_name ${SNIKKET_DOMAIN}; - server_name groups.${SNIKKET_DOMAIN}; - - include "/etc/nginx/snippets/snikket-common.conf"; -} - -server { - listen ${SNIKKET_TWEAK_HTTPS_PORT} ssl; - listen [::]:${SNIKKET_TWEAK_HTTPS_PORT} ssl; - - ssl_certificate /snikket/letsencrypt/live/${SNIKKET_DOMAIN}/fullchain.pem; - ssl_certificate_key /snikket/letsencrypt/live/${SNIKKET_DOMAIN}/privkey.pem; - - ssl_session_cache shared:le_nginx_SSL:1m; - ssl_session_timeout 1440m; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_prefer_server_ciphers on; - ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; - - server_name share.${SNIKKET_DOMAIN}; - - root /var/www/html; - - location /upload/ { - client_max_body_size 16M; - proxy_pass http://${SNIKKET_TWEAK_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT}; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto https; - } -} - -# Fail requests to unknown domains -server { - listen ${SNIKKET_TWEAK_HTTPS_PORT} ssl default_server; - listen [::]:${SNIKKET_TWEAK_HTTPS_PORT} ssl default_server; - - ssl_certificate /snikket/letsencrypt/live/${SNIKKET_DOMAIN}/fullchain.pem; - ssl_certificate_key /snikket/letsencrypt/live/${SNIKKET_DOMAIN}/privkey.pem; - - ssl_session_cache shared:le_nginx_SSL:1m; - ssl_session_timeout 1440m; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_prefer_server_ciphers on; - ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"; - - error_page 404 /_errors/404_site.html; - - location = /_errors/404_site.html { - root /var/www/html; - internal; - } - - location / { - try_files none =404; - } -} diff --git a/startup.html b/startup.html index c6a32c4..fca41f9 100644 --- a/startup.html +++ b/startup.html @@ -1,35 +1,51 @@ - - + + - - - Snikket is starting + - + Snikket is starting - - - - - - - - - - - -
- Snikket -

Snikket is starting

-

We are currently obtaining SSL/TLS certificates to secure your Snikket service.

-

The login page should appear in a moment. If not, please reload the page.

-
-

If this page appears for more than a few minutes, there may be a problem. Check that - all components of Snikket are started properly, that your DNS is correct, and that port - 80 is open. -

-
- + + + + + + + + + + + + + +
+ Snikket +

Snikket is starting

+

+ The login page should appear in a moment. If not, please reload the + page. +

+
+

+ If this page appears for more than a few minutes, there may be a + problem. Check that all components of Snikket are started properly, that + your DNS is correct, and that port 80 is open. +

+
+