diff --git a/Makefile b/Makefile index 6a787c3..b86c791 100644 --- a/Makefile +++ b/Makefile @@ -28,11 +28,10 @@ tarball: $(RPM_TARBALL_PATH) .PHONY: install install: - install --directory $(DESTDIR)$(RPM_SYSCONFDIR)/netoik-rp - install --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/netoik-rp/ conf/netoik-rp.conf - install --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/netoik-rp/ conf/ovh.ini - install --directory $(DESTDIR)$(RPM_UNITDIR) - install --target-directory=$(DESTDIR)$(RPM_UNITDIR)/ services/netoik-rp.service + install --directory $(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d + install --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d/ conf/security.conf + install --directory $(DESTDIR)$(RPM_SYSCONFDIR)/certbot + install --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/certbot/ conf/ovh.ini install --directory $(DESTDIR)/opt/certbot install --directory $(DESTDIR)$(RPM_SBINDIR) touch $(DESTDIR)$(RPM_SBINDIR)/certbot diff --git a/conf/netoik-rp.conf b/conf/netoik-rp.conf deleted file mode 100644 index 8d6d299..0000000 --- a/conf/netoik-rp.conf +++ /dev/null @@ -1,61 +0,0 @@ -# For more information on configuration -# See: http://nginx.org/en/docs/ - -# Configure core -# See: https://nginx.org/en/docs/ngx_core_module.html -user nginx; -worker_processes auto; -error_log /var/log/nginx/error.log; -pid /run/nginx.pid; - -# Load dynamic modules -# See: /usr/share/doc/nginx/README.dynamic. -include /usr/share/nginx/modules/*.conf; - -events { - worker_connections 1024; -} - -http { - # Configure logs - # See: https://nginx.org/en/docs/http/ngx_http_log_module.html - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - access_log /var/log/nginx/access.log main; - - # Configure core - # See: https://nginx.org/en/docs/ngx_core_module.html - include /etc/nginx/mime.types; - default_type text/html; - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 4096; - - # Configure ssl module - # See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_certificate /etc/letsencrypt/live/netoik.io/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/netoik.io/privkey.pem; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - ssl_session_cache shared:SSL:1m; - ssl_prefer_server_ciphers on; - - # Configure headers - # See: https://nginx.org/en/docs/http/ngx_http_headers_module.html - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always; - - # Configure http2 - # See: https://nginx.org/en/docs/http/ngx_http_v2_module.html - http2 on; - - # Configure http3 - # See: https://nginx.org/en/docs/http/ngx_http_v3_module.html - http3 on; - - # Load modular configuration files from the /etc/nginx/conf.d directory. - # See: http://nginx.org/en/docs/ngx_core_module.html#include - include /etc/nginx/conf.d/*.conf; -} diff --git a/conf/security.conf b/conf/security.conf new file mode 100644 index 0000000..2a9ad9b --- /dev/null +++ b/conf/security.conf @@ -0,0 +1,11 @@ +# Configure ssl module +# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html +include /etc/letsencrypt/options-ssl-nginx.conf; +ssl_certificate /etc/letsencrypt/live/netoik.io/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/netoik.io/privkey.pem; +ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + +# Configure headers +# See: https://nginx.org/en/docs/http/ngx_http_headers_module.html +add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always; + diff --git a/netoik-rp.spec b/netoik-rp.spec index e8c2cfe..0bba04f 100644 --- a/netoik-rp.spec +++ b/netoik-rp.spec @@ -24,26 +24,23 @@ Install the reverse proxy called nginx with a predefined configuration and with %post if [ $1 == 1 ]; then # Replace secrets in ovh.ini - %{_bindir}/env envsubst < %{_sysconfdir}/%{name}/ovh.ini > %{_sysconfdir}/%{name}/ovh.ini.tmp - %{_bindir}/env mv %{_sysconfdir}/%{name}/ovh.ini.tmp %{_sysconfdir}/%{name}/ovh.ini + %{_bindir}/env envsubst < %{_sysconfdir}/certbot/ovh.ini > %{_sysconfdir}/certbot/.ovh.ini.tmp + %{_bindir}/env mv %{_sysconfdir}/certbot/.ovh.ini.tmp %{_sysconfdir}/certbot/ovh.ini # Create virutal env with certbot cli %{_bindir}/env python3 -m venv /opt/certbot /opt/certbot/bin/pip install --upgrade pip certbot certbot-dns-ovh %{_bindir}/env ln --symbolic --force --target-directory %{_sbindir} /opt/certbot/bin/certbot - %{_bindir}/env certbot certonly --non-interactive --agree-tos --email samuel.campos@netoik.io --dns-ovh --dns-ovh-credentials "%{_sysconfdir}/%{name}/ovh.ini" -d "*.netoik.io" -d "*.samuel-campos.fr" + %{_bindir}/env certbot certonly --non-interactive --agree-tos --email samuel.campos@netoik.io --dns-ovh --dns-ovh-credentials "%{_sysconfdir}/certbot/ovh.ini" -d "*.netoik.io" -d "*.samuel-campos.fr" %{_bindir}/env printf "\nAutomatic certbot renew\n0 12 * * * root sleep $((RANDOM % 3600)) && certbot renew -q\n" >> %{_sysconfdir}/crontab fi -%{_bindir}/env systemctl disable nginx -%{_bindir}/env systemctl stop nginx -%{_bindir}/env systemctl enable %{name} -%{_bindir}/env systemctl start %{name} +%{_bindir}/env systemctl enable nginx +%{_bindir}/env systemctl restart nginx %files -%attr(755, root, root) %dir %{_sysconfdir}/%{name} -%attr(600, root, root) %config %{_sysconfdir}/%{name}/ovh.ini -%attr(644, root, root) %config %{_sysconfdir}/%{name}/netoik-rp.conf -%attr(644, root, root) %config %{_unitdir}/%{name}.service +%attr(644, root, root) %config %{_sysconfdir}/nginx/conf.d/security.conf +%attr(755, root, root) %dir %{_sysconfdir}/certbot +%attr(600, root, root) %config %{_sysconfdir}/certbot/ovh.ini %attr(755, root, root) %dir /opt/certbot %attr(755, root, root) %{_sbindir}/certbot