github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Factor common SSL settings out to the http block

Browse Source
This commit is contained in:
Stafford Brunk
2014-04-02 19:18:23 -06:00
parent e33f5c94a5
commit bd5b2b210c
2 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
plugins/nginx-vhosts/install
View File

@@ -14,8 +14,19 @@ if ! grep -q dokku-nginx-reload "/etc/sudoers"; then
rm /tmp/sudoers.new
fi
echo "include $DOKKU_ROOT/*/nginx.conf;" > /etc/nginx/conf.d/dokku.conf
cat<<EOF > /etc/nginx/conf.d/dokku.conf
include $DOKKU_ROOT/*/nginx.conf;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 10m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
#ssl_certificate $DOKKU_ROOT/ssl/server.crt;
#ssl_certificate_key $DOKKU_ROOT/ssl/server.key;
EOF
sed -i 's/# server_names_hash_bucket_size/server_names_hash_bucket_size/' /etc/nginx/nginx.conf
if [[ ! -f "$DOKKU_ROOT/VHOST" ]]; then

14
plugins/nginx-vhosts/post-deploy
View File

@@ -15,8 +15,14 @@ if [[ -f "$DOKKU_ROOT/VHOST" ]]; then
if [[ -f "$SSL/server.crt" ]] && [[ -f "$SSL/server.key" ]]; then
SSL_INUSE="$SSL"
SSL_DIRECTIVES=$(cat <<EOF
ssl_certificate $SSL_INUSE/server.crt;
ssl_certificate_key $SSL_INUSE/server.key;
EOF
)
elif [[ -f "$WILDCARD_SSL/server.crt" ]] && [[ -f "$WILDCARD_SSL/server.key" ]] && [[ $hostname = `openssl x509 -in $WILDCARD_SSL/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-` ]]; then
SSL_INUSE="$WILDCARD_SSL"
SSL_DIRECTIVES=""
fi
# ssl based nginx.conf
@@ -34,12 +40,8 @@ server {
listen [::]:443 ssl;
listen 443 ssl;
server_name $hostname;
ssl_certificate $SSL_INUSE/server.crt;
ssl_certificate_key $SSL_INUSE/server.key;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
$SSL_DIRECTIVES
keepalive_timeout 70;
location / {
proxy_pass http://$APP;