Originally, I had NGINX configured for two services (Radicale and LMS) on two different ports. I did this in /etc/nginx/nginx.conf. Access to MYDOMAIN:8000 and :8009 and 3001 from the internet are redirected to Radicale and LMS respectively.
I set up certificates on the server to enable this and then ran sudo certbot --nginx -d MYDOMAIN to generate letsencrypt certs. Afterwards I disabled my own certs (I just had to set them up to make the config file error-free).
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
types_hash_max_size 2048;
keepalive_timeout 65;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
# reduce logging
access_log off;
# access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
gzip on;
# include /etc/nginx/conf.d/*.conf;
# include /etc/nginx/sites-enabled/*;
auth_basic "NGINX";
auth_basic_user_file /etc/nginx/.htpasswd;
# old, before Certbot
# ssl_certificate ssl/server.crt;
# ssl_certificate_key ssl/server.key;
server {
server_name MYDOMAIN;
listen 8000 ssl;
location / {
proxy_pass http://localhost:8000;
proxy_set_header X-Script-Name /;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Remote-User $remote_user;
proxy_set_header Host $http_host;
proxy_pass_header Authorization;
auth_basic "Nginx-Radicale - Password required";
}
# generated with: sudo certbot --nginx -d MYDOMAIN
ssl_certificate /etc/letsencrypt/live/MYDOMAIN/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
}
server {
server_name MYDOMAIN;
listen 8009;
return 301 https://MYDOMAIN:3001;
}
server {
server_name MYDOMAIN;
listen 3001;
location / {
proxy_pass http://localhost:3000/;
auth_basic "NGINX";
}
}
}
Now I changed my setup and wanted to split the server part of the config into nginx/conf.d subdirectory to have a clean setup. I wanted to let the original nginx.conf as it comes and just adjust my own two files:
pi@RPi64:/etc/nginx $ cat conf.d/radicale.conf
server {
server_name MYDOMAIN;
listen 8000;
# ssl;
location / {
proxy_pass http://localhost:5232;
proxy_set_header X-Script-Name /;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Remote-User $remote_user;
proxy_set_header Host $http_host;
proxy_pass_header Authorization;
auth_basic "Nginx-Radicale - Password required";
}
}
and second file:
pi@RPi64:/etc/nginx $ cat conf.d/LMS.conf
server {
server_name MYDOMAIN;
listen 8009;
return 301 https://MYDOMAIN:3001;
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/MYDMOAIN/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
server_name MYDOMAIN;
listen 3001;
location / {
proxy_pass http://localhost:3000/;
auth_basic "NGINX";
}
}
As you can see I commented out the ssl part in the first file. If I let it in sudo nginx -t was giving the error of missing certificates. I wanted to avoid having to setup my own certs.
Also, you can see that running certbot added five lines into my second file:
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/MYDMOAIN/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
I think certbot found the https in this file and then decided to add the certs there.
However, I wanted to add certificates for the whole server - meaning both sites/files.
Especially since the process of renewing the certs has to be done regularly, I wanted to make sure there is not manual copying involved.
How can I tell Certbot to insert certs for both files? Do I have to add my own certs first for certbot to recognise the requiry?
Or would it make sense to add the certs to the main nginx.conf file? Am I doing something wrong?
