Added nginx CT

2021-09-21 00:37:58 +00:00
parent 361661babf
commit f46df35d6d
12 changed files with 278 additions and 3 deletions
--- a/CT-Files/nginx/Configs/acmesh.conf
+++ b/CT-Files/nginx/Configs/acmesh.conf
@@ -0,0 +1,9 @@
+#LOG_FILE="/etc/acmesh/data/acme.sh.log"
+#LOG_LEVEL=1
+AUTO_UPGRADE="1"
+NOTIFY_LEVEL='1'
+#NO_TIMESTAMP=1
+CERT_HOME="/etc/acmesh/certs"
+LE_WORKING_DIR="/opt/acmesh"
+LE_CONFIG_HOME="/etc/acmesh/data"
+USER_PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin'
--- a/CT-Files/nginx/Configs/nginx.conf
+++ b/CT-Files/nginx/Configs/nginx.conf
@@ -0,0 +1,63 @@
+user  nginx;
+worker_processes  auto;
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+    client_body_buffer_size 10K;
+    client_header_buffer_size 1k;
+    client_max_body_size 8m;
+    large_client_header_buffers 4 4k;
+    server_names_hash_bucket_size 64;
+    root   /usr/share/nginx/html;
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log off;
+    error_log /var/log/nginx/error.log;
+    #Gzip
+    gzip on;
+    gzip_proxied any;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
+    gzip_comp_level 2;
+    gzip_disable "msie6";
+    gzip_buffers 16 8k;
+    #SSL
+    resolver 8.8.8.8;
+    ssl_ecdh_curve secp384r1;
+    ssl_session_cache shared:le_nginx_SSL:1m;
+    ssl_session_timeout 1440m;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_prefer_server_ciphers on;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+    add_header X-Frame-Options sameorigin;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Xss-Protection "1; mode=block";
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    ssl_dhparam /etc/acmesh/certs/ssl-dhparams.pem;
+    #Load Other configs
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+
+    #Server config for unconfigured domains
+    server {
+        listen 80 default_server;
+        listen [::]:80 default_server;
+        server_name _;
+        add_header Content-Type text/html;
+        return 200 '<html><head></head><body>Nginx is functioning normally</body></html>';
+    }
+
+}
--- a/CT-Files/nginx/Configs/nginx_template_nossl
+++ b/CT-Files/nginx/Configs/nginx_template_nossl
@@ -0,0 +1,11 @@
+server {
+    listen 80;
+    listen [::]:80;
+	server_name   DOMAINname;
+
+#beginConf
+        add_header Content-Type text/html;
+        return 200 '<html><head></head><body>Nginx is config for DOMAINname is created</body></html>';
+#endConf
+
+}
--- a/CT-Files/nginx/Configs/nginx_template_ssl
+++ b/CT-Files/nginx/Configs/nginx_template_ssl
@@ -0,0 +1,22 @@
+server {
+    listen 80;
+    listen [::]:80;
+	server_name   DOMAINname;
+    
+    location / {
+        return 301 https://$host$request_uri;
+    }
+    
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2; 
+    server_name   DOMAINname;
+    ssl_certificate /etc/acmesh/inst/DOMAINname/fullchain.pem;
+    ssl_certificate_key /etc/acmesh/inst/DOMAINname/key.pem;
+    ssl_trusted_certificate /etc/acmesh/inst/DOMAINname/fullchain.pem;   
+
+#ConfHere
+
+}
--- a/CT-Files/nginx/Configs/profile
+++ b/CT-Files/nginx/Configs/profile
@@ -0,0 +1,3 @@
+export LE_WORKING_DIR="/opt/acmesh"
+export LE_CONFIG_HOME="/etc/acmesh/data"
+alias acmesh="/opt/acmesh/acme.sh --config-home '/etc/acmesh/data'"
--- a/CT-Files/nginx/Scripts/AddDomain.sh
+++ b/CT-Files/nginx/Scripts/AddDomain.sh
@@ -0,0 +1,94 @@
+#!/bin/ash
+
+self=$0
+create=false
+request=false
+
+show_help () {
+    cat <<END_HELP
+Usage: $self [-c] [-r] <Domain name>
+
+Options:
+    -c,    Will create nginx config for domain
+    -r,    Will request ssl for domain
+
+END_HELP
+}
+
+while getopts crh opt; do
+    case $opt in
+        c) create=true ;;
+        r) request=true ;;
+        h) show_help
+           exit ;;
+        *) echo 'Error in parsing options' >&2
+           exit 1
+    esac
+done
+
+shift "$(( OPTIND - 1 ))"
+for domain do
+    domain=$domain
+done
+
+#if no flags given quit with help promt
+if ! $create && ! $request; then
+    echo "No option set"
+    show_help
+    exit 1
+fi
+
+#if only request test if domain exists
+if ! $create && $request; then
+    if ! test -f /etc/nginx/sites-enabled/"$domain" ; then
+    echo 'Domain does not exist yet, please create it using the `-c` option'
+    show_help
+    exit 1
+    fi
+fi
+
+echo $domain
+echo $create
+echo $request
+
+if $create; then
+    mkdir -p /etc/acmesh/inst/$domain
+    cp /etc/nginx/sites-available/nginx_template_nossl /etc/nginx/sites-available/"$domain"_nossl
+    sed -i -e 's/DOMAINname/'$domain'/g' /etc/nginx/sites-available/"$domain"_nossl
+    cp /etc/nginx/sites-available/nginx_template_ssl /etc/nginx/sites-available/"$domain"_ssl
+    sed -i -e 's/DOMAINname/'$domain'/g' /etc/nginx/sites-available/"$domain"_ssl
+    ln -s /etc/nginx/sites-available/"$domain"_nossl /etc/nginx/sites-enabled/"$domain"
+    service nginx reload
+fi
+
+if $request; then
+    #Backing-up and removing current config
+    sed -n '/#beginConf/,/#endConf/p' /etc/nginx/sites-available/"$domain"_nossl > /tmp/"$domain"-config
+    sed -n -i '/#beginConf/{:a;N;/#endConf/!ba;N;s/.*\n/#ConfHere\n/};p' /etc/nginx/sites-available/"$domain"_nossl
+    service nginx reload
+
+    #Enabling SSL
+    /opt/acmesh/acme.sh --config-home '/etc/acmesh/data' --issue --nginx --ocsp --keylength 'ec-384' -d "$domain"
+    certsatus=$?
+    
+    if test $certsatus -eq 0
+    then
+        site_ext="ssl"
+        mkdir -p /etc/acmesh/inst/$domain
+        /opt/acmesh/acme.sh  --config-home '/etc/acmesh/data' --install-cert --ecc --domain $domain --cert-file /etc/acmesh/inst/$domain/cert.pem --key-file /etc/acmesh/inst/$domain/key.pem --ca-file /etc/acmesh/inst/$domain/ca.cer --fullchain-file /etc/acmesh/inst/$domain/fullchain.pem --reloadcmd 'service nginx reload'
+    else
+        site_ext="nossl"
+        rm -rf /etc/acmesh/certs/$domain*
+        echo "LE failed, restoring configuration"
+    fi
+    unset certsatus
+
+    #Restoring config
+    sed -i -e "1,/^#ConfHere/s/\(^#Conf.*\)/#ConfHere1 /" -e "/#ConfHere1/ r /tmp/"$domain"-config" -e '/#ConfHere/c\' /etc/nginx/sites-available/"$domain"_"$site_ext"
+
+
+    rm /etc/nginx/sites-enabled/"$domain"
+    ln -s /etc/nginx/sites-available/"$domain"_"$site_ext" /etc/nginx/sites-enabled/"$domain"
+    service nginx reload
+fi
+   
--- a/CT-Files/nginx/Scripts/FirstRun.sh
+++ b/CT-Files/nginx/Scripts/FirstRun.sh
@@ -0,0 +1,9 @@
+#!/bin/ash
+read -p "Enter the E-Mail to use for LE:  "  email
+openssl dhparam -dsaparam -out /etc/acmesh/certs/ssl-dhparams.pem 4096
+#Setup LE account in Acme.sh
+/opt/acmesh/acme.sh --config-home "/etc/acmesh/data" --register-account
+/opt/acmesh/acme.sh --config-home "/etc/acmesh/data" --update-account --accountemail "$email"
+
+#Update ReadMe
+echo 'Use `ash /opt/AddDomain.sh` to add domains, and install SSL certs' > ~/ReadMe
--- a/CT-Files/nginx/Scripts/Init.sh
+++ b/CT-Files/nginx/Scripts/Init.sh
@@ -0,0 +1,31 @@
+#!/bin/ash
+#Setup Nginx repo
+echo "@nginx http://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories
+mv /opt/Setup/nginx_signing.rsa.pub /etc/apk/keys/nginx_signing.rsa.pub
+
+#Install Nginx
+apk add nginx@nginx
+
+#Configure Nginx
+mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /etc/nginx/snippets /etc/nginx/modules-available /etc/nginx/modules-enabled /etc/nginx/snippets/
+rm -rf /etc/nginx/conf.d/*
+mv /opt/Setup/Configs/nginx.conf /etc/nginx/nginx.conf
+mv /opt/Setup/Configs/nginx_template_* /etc/nginx/sites-available/
+
+#Install AcmeSH
+mkdir -p /opt/acmesh /etc/acmesh/data /etc/acmesh/certs
+tar -zxf /opt/Setup/acmesh.tar.gz -C /opt/acmesh --strip-components=1
+rm -rf /opt/Setup/acmesh.tar.gz
+
+#Configure AcmeSH
+mv /opt/Setup/Configs/profile ~/.profile
+mv /opt/Setup/Configs/acmesh.conf /etc/acmesh/data/account.conf
+/opt/acmesh/acme.sh --home "/opt/acmesh/" --config-home "/etc/acmesh/data" --upgrade
+/opt/acmesh/acme.sh --config-home "/etc/acmesh/data" --set-default-ca  --server  letsencrypt
+echo '42      0       *       *       *      "/opt/acmesh/acme.sh" --cron --home "/opt/acmesh/" --config-home "/etc/acmesh/data" > /dev/null' >> /etc/crontabs/root
+
+#Add `AddDomain` script
+mv /opt/Setup/Scripts/AddDomain.sh /opt/AddDomain.sh
+
+#Enable nginx on boot
+rc-update add nginx