efd6bc8ccb
649505d869 added some new content between `listen 80;` and `gzip on;`, which broke these replacements.
This commit reorders & updates the replacements so that they should work reliably with versions of core before and after that change.
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
run:
|
|
- exec:
|
|
cmd:
|
|
- "mkdir -p /shared/ssl/"
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /listen 80;\s+listen \[::\]:80;/m
|
|
to: |
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
SSL_TEMPLATE_SSL_BLOCK
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /listen 80;/
|
|
to: |
|
|
listen 443 ssl;
|
|
http2 on;
|
|
SSL_TEMPLATE_SSL_BLOCK
|
|
- replace:
|
|
hook: ssl
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /SSL_TEMPLATE_SSL_BLOCK/
|
|
to: |
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
ssl_certificate /shared/ssl/ssl.crt;
|
|
ssl_certificate_key /shared/ssl/ssl.key;
|
|
|
|
ssl_session_tickets off;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:1m;
|
|
|
|
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
|
|
|
|
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
|
|
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
|
|
}
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: "location @discourse {"
|
|
to: |
|
|
location @discourse {
|
|
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
|
|
- replace:
|
|
filename: "/etc/nginx/conf.d/discourse.conf"
|
|
from: /server.+{/
|
|
to: |
|
|
server {
|
|
listen 80;
|
|
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
|
|
}
|
|
server {
|