JonasAlfredsson / docker-nginx-certbot

Automatically create and renew website certificates for free using the Let's Encrypt certificate authority.
https://hub.docker.com/r/jonasal/nginx-certbot
MIT License
889 stars 158 forks source link

How to set second default_server? #260

Closed CoWayger closed 1 day ago

CoWayger commented 3 weeks ago

Hi, I have migrated my configs from existing nginx deployment. Container refuses to start, duplicate default_server tag. I have removed it from my configs, but now nginx serves first random domain. Is there a way to fuse this two use cases together?

I understand that default_server is set for serving letencrypt webroot files required by challenge.

JonasAlfredsson commented 3 weeks ago

Can you provide your configs so it is a bit easier for me to see?

A plus is if you provide debug logs as well :)

JonasAlfredsson commented 2 weeks ago

Any updates to this?

CoWayger commented 2 weeks ago

Hi, sorry for delay.

Lets presume I have 3 domains on server, which are served by their configs:

default domain-a.conf domain-b.conf

in default there is a block:

server{
    server_name hello.cz default_server;

    location / {
        proxy_buffering off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://192.168.0.100:80;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/hello.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/hello.cz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

The intention is: when my server reaches domain not registered in any nginx config it should endup in my default config. But this repo is setting default_server in another vhost, because off handling all renews that end up on http?

Link

JonasAlfredsson commented 2 weeks ago

The redirector.conf is the default server for traffic on port 80, I think you can add another default server on another port as well.

The redirector only change http to https for any incoming request.

However, with https you will get other errors in case the incoming domain is not present in the certificate provided.