mirror of
https://github.com/certbot/certbot.git
synced 2026-07-31 18:34:41 +02:00
Jacob Hoffman-Andrews
8f984bd24f
Raise MisconfigurationError on restart failure, so we don't attempt to continue with an authorization we know will fail. Log at debug level the config files that are about to be written out, so it's easier to debug restart failures. Fix https://github.com/letsencrypt/letsencrypt/issues/942: Error out if adding a conflicting directive. Remove unnecessarily-inserted access_log and error_log directives. These were added to make integration testing easier but are no longer needed. Incidentally this makes the plugin work with some configs where it wouldn't have worked previously. Change the semantics of add_server_directives with replace=True so only the first instance of a given directive is replaced, not all of them. This works fine with the one place in the code that calls add_server_directives with replace=True, because all of the involved directives aren't allowed to be duplicated in a given block. Make add_http_directives do inserts into the structure itself, since its needs were significantly different than the more general add_server_directives. This also allows us to narrow the scope of the `block.insert(0, directive)` hack that we inserted to work around https://trac.nginx.org/nginx/ticket/810, since it's only necessary for http blocks.
66 lines
1.8 KiB
Bash
Executable File
66 lines
1.8 KiB
Bash
Executable File
# Based on
|
|
# https://www.exratione.com/2014/03/running-nginx-as-a-non-root-user/
|
|
# https://github.com/exratione/non-root-nginx/blob/9a77f62e5d5cb9c9026fd62eece76b9514011019/nginx.conf
|
|
|
|
cat <<EOF
|
|
# This error log will be written regardless of server scope error_log
|
|
# definitions, so we have to set this here in the main scope.
|
|
#
|
|
# Even doing this, Nginx will still try to create the default error file, and
|
|
# log a non-fatal error when it fails. After that things will work, however.
|
|
error_log $root/error.log;
|
|
|
|
# The pidfile will be written to /var/run unless this is set.
|
|
pid $root/nginx.pid;
|
|
|
|
worker_processes 1;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
# Set an array of temp, cache and log file options that will otherwise default to
|
|
# restricted locations accessible only to root.
|
|
client_body_temp_path $root/client_body;
|
|
fastcgi_temp_path $root/fastcgi_temp;
|
|
proxy_temp_path $root/proxy_temp;
|
|
#scgi_temp_path $root/scgi_temp;
|
|
#uwsgi_temp_path $root/uwsgi_temp;
|
|
access_log $root/error.log;
|
|
|
|
# This should be turned off in a Virtualbox VM, as it can cause some
|
|
# interesting issues with data corruption in delivered files.
|
|
sendfile off;
|
|
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
|
|
#include /etc/nginx/mime.types;
|
|
index index.html index.htm index.php;
|
|
|
|
log_format main '\$remote_addr - \$remote_user [\$time_local] \$status '
|
|
'"\$request" \$body_bytes_sent "\$http_referer" '
|
|
'"\$http_user_agent" "\$http_x_forwarded_for"';
|
|
|
|
default_type application/octet-stream;
|
|
|
|
server {
|
|
# IPv4.
|
|
listen 8081;
|
|
# IPv6.
|
|
listen [::]:8081 default ipv6only=on;
|
|
|
|
root $root/webroot;
|
|
|
|
location / {
|
|
# First attempt to serve request as file, then as directory, then fall
|
|
# back to index.html.
|
|
try_files \$uri \$uri/ /index.html;
|
|
}
|
|
}
|
|
}
|
|
EOF
|