nginx: rework directory so that certbot works

nginx/certbot-renew

@@ -1,4 +1,6 @@
 #!/bin/bash
+die() { echo >&2 "$@" ; exit 1 ; }
+
 source ../env.production
 source ./env.production
 
@@ -7,12 +9,17 @@ rsa_key_size=2048
 
 set -x
 
+# move the old live directory away
+rm -rf data/certbot/conf/live.old
+mv data/certbot/conf/live data/certbot/conf/live.old
+
 docker-compose run --rm certbot \
   certonly --webroot -w /var/www/certbot \
     $staging_arg \
     --email "admin@$DOMAIN_NAME" \
     --rsa-key-size $rsa_key_size \
     --agree-tos \
+    --no-eff-email \
     --force-renewal \
     $domain_args \
 || die "unable to renew!"

nginx/docker-compose.yaml

@@ -6,11 +6,11 @@ services:
       - "80:80"
       - "443:443"
     volumes:
-      - ./data/nginx/nginx.conf:/etc/nginx/nginx.conf
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
-        #- ./data/nginx/sites-enabled:/etc/nginx/sites-enabled
+      - ./nginx/templates:/etc/nginx/templates
-      - ./data/nginx/templates:/etc/nginx/templates
+      - ./nginx/includes:/etc/nginx/includes
-      - ./data/certbot/conf:/etc/letsencrypt
       - ./data/certbot/www:/var/www/certbot
+      - ./data/certbot/conf:/etc/letsencrypt
     env_file:
       -  ../env.production
       -  env.production

nginx/nginx/templates/000-default.conf.template

@@ -32,9 +32,9 @@ server {
 	listen 443 ssl;
 	ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem;
 	ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem;
-	include /etc/letsencrypt/options-ssl-nginx.conf;
+	include /etc/nginx/includes/options-ssl-nginx.conf;
-	include /etc/letsencrypt/challenge.conf;
+	include /etc/nginx/includes/challenge.conf;
-	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+	ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem;
 
 }
 

nginx/nginx/templates/cloud.conf.template

@@ -45,9 +45,9 @@ server {
 	listen 443 ssl;
 	ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem;
 	ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem;
-	include /etc/letsencrypt/options-ssl-nginx.conf;
+	include /etc/nginx/includes/options-ssl-nginx.conf;
-	include /etc/letsencrypt/challenge.conf;
+	include /etc/nginx/includes/challenge.conf;
-	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+	ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem;
 
 }
 

nginx/nginx/templates/docs.conf.template

@@ -52,9 +52,9 @@ server {
 	listen 443 ssl;
 	ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem;
 	ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem;
-	include /etc/letsencrypt/options-ssl-nginx.conf;
+	include /etc/nginx/includes/options-ssl-nginx.conf;
-	include /etc/letsencrypt/challenge.conf;
+	include /etc/nginx/includes/challenge.conf;
-	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+	ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem;
 }
 
 

nginx/nginx/templates/login.conf.template

@@ -21,9 +21,9 @@ server {
 	listen 443 ssl;
 	ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem;
 	ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem;
-	include /etc/letsencrypt/options-ssl-nginx.conf;
+	include /etc/nginx/includes/options-ssl-nginx.conf;
-	include /etc/letsencrypt/challenge.conf;
+	include /etc/nginx/includes/challenge.conf;
-	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+	ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem;
 }
 
 

nginx/nginx/templates/social.conf.template

@@ -20,9 +20,9 @@ server {
 	listen 443 ssl;
 	ssl_certificate /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem;
 	ssl_certificate_key /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem;
-	include /etc/letsencrypt/options-ssl-nginx.conf;
+	include /etc/nginx/includes/options-ssl-nginx.conf;
-	include /etc/letsencrypt/challenge.conf;
+	include /etc/nginx/includes/challenge.conf;
-	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+	ssl_dhparam /etc/nginx/includes/ssl-dhparams.pem;
 }