diff --git a/automation/roles/nginx/templates/site_node.conf.j2 b/automation/roles/nginx/templates/site_node.conf.j2 index a1d7c894..c41677ce 100644 --- a/automation/roles/nginx/templates/site_node.conf.j2 +++ b/automation/roles/nginx/templates/site_node.conf.j2 @@ -1,5 +1,5 @@ server { - server_name {{ server_name }}; + server_name {{ server_alias }} {{ server_name }}; listen {{ ssl_port }} ssl http2; location / { @@ -29,35 +29,3 @@ server { return 301 https://$host$request_uri; } } - -server { - server_name {{ server_alias }}; - listen {{ ssl_port }} ssl http2; - - location / { - proxy_pass http://127.0.0.1:{{ admin_port }}/; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-Host {{ server_name }}; - proxy_set_header X-Forwarded-Proto https; - } - - location ^~ /.well-known/acme-challenge/ { - default_type "text/plain"; - root /var/www/html; - } - - ssl_certificate /etc/letsencrypt/live/{{ server_alias }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ server_alias }}/privkey.pem; - ssl_session_cache shared:le_nginx_SSL:1m; - ssl_session_timeout 1440m; - - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_prefer_server_ciphers on; - - ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA"; - - if ($scheme != "https") { - return 301 https://$host$request_uri; - } -} \ No newline at end of file diff --git a/automation/roles/nginx/templates/site_sage.conf.j2 b/automation/roles/nginx/templates/site_sage.conf.j2 index dae3ec26..5e5319b6 100644 --- a/automation/roles/nginx/templates/site_sage.conf.j2 +++ b/automation/roles/nginx/templates/site_sage.conf.j2 @@ -1,6 +1,6 @@ server { listen 80; - server_name {{ server_name }}; + server_name {{ server_alias }} {{ server_name }}; location / { proxy_pass http://127.0.0.1:{{ admin_port }}/; @@ -30,36 +30,3 @@ server { return 301 https://$host$request_uri; } } - -server { - listen 80; - server_name {{ server_alias }}; - - location / { - proxy_pass http://127.0.0.1:{{ admin_port }}/; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-Host {{ server_name }}; - proxy_set_header X-Forwarded-Proto https; - } - - location ^~ /.well-known/acme-challenge/ { - default_type "text/plain"; - root /var/www/html; - } - - listen 443 ssl; - ssl_certificate /etc/letsencrypt/live/{{ server_alias }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ server_alias }}/privkey.pem; - ssl_session_cache shared:le_nginx_SSL:1m; - ssl_session_timeout 1440m; - - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_prefer_server_ciphers on; - - ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA"; - - if ($scheme != "https") { - return 301 https://$host$request_uri; - } -}