cert-monitor: Reload nginx daily to update certs

Signed-off-by: Matthew Wild <mwild1@gmail.com>

cert-monitor.sh

@@ -12,6 +12,9 @@ while sleep 10; do
 			/usr/local/bin/render-template.sh "/etc/nginx/templates/$proto" "/etc/nginx/sites-enabled/$proto";
 		done
 		/usr/sbin/nginx -s reload
-		exit 0;
 	fi
 done
+
+while sleep 86400; do
+	/usr/sbin/nginx -s reload;
+done

nginx/https.template

@@ -36,7 +36,7 @@ server {
 
     location /upload/ {
         client_max_body_size 16M;
-        proxy_pass http://localhost:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT};
+        proxy_pass http://${SNIKKET_TWEAK_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT};
         proxy_set_header  Host            $host;
         proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header  X-Forwarded-Proto https;

nginx/snikket-common.template

@@ -12,6 +12,10 @@ location /invites_api {
 	try_files none @prosody;
 }
 
+location /invites_bootstrap {
+	try_files none @prosody;
+}
+
 location /oauth2 {
 	try_files none @prosody;
 }
@@ -28,15 +32,57 @@ location /upload {
 	try_files none @prosody;
 }
 
+location /http-bind {
+	try_files none @prosodyws;
+}
+
+location /xmpp-websocket {
+	try_files none @prosodyws;
+}
+
+location = /.well-known/host-meta {
+	try_files none @prosody;
+}
+
+location = /.well-known/host-meta.json {
+	try_files none @prosody;
+}
+
 location @portal {
-	proxy_pass http://localhost:${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT};
+	proxy_pass http://${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT};
 	proxy_set_header  Host            $host;
 	proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
 	proxy_set_header  X-Forwarded-Proto https;
 }
 
 location @prosody {
-	proxy_pass http://localhost:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT};
+	proxy_pass http://${SNIKKET_TWEAK_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT};
+	proxy_set_header  Host            $host;
+	proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header  X-Forwarded-Proto https;
+}
+
+location @prosodyws {
+	proxy_pass http://${SNIKKET_TWEAK_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT};
+	proxy_http_version 1.1;
+	proxy_set_header  Host            $host;
+	proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header  X-Forwarded-Proto https;
+	proxy_set_header Connection $http_connection;
+	proxy_set_header Upgrade $http_upgrade;
+
+	proxy_read_timeout 900s;
+}
+
+location /_health/portal {
+	proxy_pass http://${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT}/_health;
+	proxy_set_header  Host            $host;
+	proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header  X-Forwarded-Proto https;
+}
+
+location /_health/xmpp {
+	proxy_pass http://${SNIKKET_TWEAK_INTERNAL_HTTP_HOST}:${SNIKKET_TWEAK_INTERNAL_HTTP_PORT}/host_status_check;
 	proxy_set_header  Host            $host;
 	proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
 	proxy_set_header  X-Forwarded-Proto https;

render-template.sh

@@ -1,10 +1,17 @@
 #!/bin/bash
 
-export SNIKKET_TWEAK_HTTP_PORT=${SNIKKET_TWEAK_HTTP_PORT-80}
-export SNIKKET_TWEAK_HTTPS_PORT=${SNIKKET_TWEAK_HTTPS_PORT-443}
+# Prosody host/port
+export SNIKKET_TWEAK_INTERNAL_HTTP_HOST=${SNIKKET_TWEAK_INTERNAL_HTTP_HOST-localhost}
 export SNIKKET_TWEAK_INTERNAL_HTTP_PORT=${SNIKKET_TWEAK_INTERNAL_HTTP_PORT-5280}
+
+# Portal host/port
+export SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_HOST=${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_HOST-localhost}
 export SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT=${SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT-5765}
 
-exec envsubst '$SNIKKET_DOMAIN $SNIKKET_TWEAK_HTTP_PORT $SNIKKET_TWEAK_HTTPS_PORT $SNIKKET_TWEAK_INTERNAL_HTTP_PORT $SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT' \
+# External ports
+export SNIKKET_TWEAK_HTTP_PORT=${SNIKKET_TWEAK_HTTP_PORT-80}
+export SNIKKET_TWEAK_HTTPS_PORT=${SNIKKET_TWEAK_HTTPS_PORT-443}
+
+exec envsubst '$SNIKKET_DOMAIN $SNIKKET_TWEAK_HTTP_PORT $SNIKKET_TWEAK_HTTPS_PORT $SNIKKET_TWEAK_INTERNAL_HTTP_PORT $SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_PORT $SNIKKET_TWEAK_INTERNAL_HTTP_HOST $SNIKKET_TWEAK_PORTAL_INTERNAL_HTTP_HOST' \
   < "$1" \
   > "$2";