From bd5b2b210c4c9a8c52d37e9c85106cfddc767984 Mon Sep 17 00:00:00 2001
From: Stafford Brunk <wingrunr21@gmail.com>
Date: Wed, 2 Apr 2014 19:18:23 -0600
Subject: [PATCH] Factor common SSL settings out to the http block

---
 plugins/nginx-vhosts/install     | 13 ++++++++++++-
 plugins/nginx-vhosts/post-deploy | 14 ++++++++------
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install
index a62d4505a..3d4f91d05 100755
--- a/plugins/nginx-vhosts/install
+++ b/plugins/nginx-vhosts/install
@@ -14,8 +14,19 @@ if ! grep -q dokku-nginx-reload "/etc/sudoers"; then
   rm /tmp/sudoers.new
 fi
 
-echo "include $DOKKU_ROOT/*/nginx.conf;" > /etc/nginx/conf.d/dokku.conf
+cat<<EOF > /etc/nginx/conf.d/dokku.conf
+include $DOKKU_ROOT/*/nginx.conf;
 
+ssl_session_cache shared:SSL:20m;
+ssl_session_timeout 10m;
+
+ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
+ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
+ssl_prefer_server_ciphers on;
+
+#ssl_certificate $DOKKU_ROOT/ssl/server.crt;
+#ssl_certificate_key $DOKKU_ROOT/ssl/server.key;
+EOF
 sed -i 's/# server_names_hash_bucket_size/server_names_hash_bucket_size/' /etc/nginx/nginx.conf
 
 if [[ ! -f  "$DOKKU_ROOT/VHOST" ]]; then
diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy
index d897ac8a5..3b895883b 100755
--- a/plugins/nginx-vhosts/post-deploy
+++ b/plugins/nginx-vhosts/post-deploy
@@ -15,8 +15,14 @@ if [[ -f "$DOKKU_ROOT/VHOST" ]]; then
 
   if [[ -f "$SSL/server.crt" ]] && [[ -f "$SSL/server.key" ]]; then
     SSL_INUSE="$SSL"
+    SSL_DIRECTIVES=$(cat <<EOF
+  ssl_certificate     $SSL_INUSE/server.crt;
+  ssl_certificate_key $SSL_INUSE/server.key;
+EOF
+)
   elif  [[ -f "$WILDCARD_SSL/server.crt" ]] && [[ -f "$WILDCARD_SSL/server.key" ]] && [[ $hostname = `openssl x509 -in $WILDCARD_SSL/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-` ]]; then
     SSL_INUSE="$WILDCARD_SSL"
+    SSL_DIRECTIVES=""
   fi
 
   # ssl based nginx.conf
@@ -34,12 +40,8 @@ server {
   listen      [::]:443 ssl;
   listen      443 ssl;
   server_name $hostname;
-
-  ssl_certificate     $SSL_INUSE/server.crt;
-  ssl_certificate_key $SSL_INUSE/server.key;
-  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
-  ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
-  ssl_prefer_server_ciphers on;
+$SSL_DIRECTIVES
+  keepalive_timeout   70;
 
   location    / {
     proxy_pass  http://$APP;