search

artefactual-labs / ansible-acmetool

An Ansible role for installing the acmetool Let's Encrypt client
GNU Affero General Public License v3.0
5 stars 4 forks source link

Problem: role fails to get cert in nginx when existing configuration has a default server #21

Closed hakamine closed 2 years ago

hakamine commented 3 years ago

For nginx, this role temporarily adds a configuration for a server in order to get an initial LE certificate for a domain. Currently the temporary configuration defines a default server (i.e., a server with the default_server parameter in the listen directive ) in the http port. However, this may not work when the existing nginx configuration has already defined a server as default in the http port (because there must be only one default server) For example, in a server hosting multiple domains, there could be a configuration for a catchall default server, to respond with a 444 (no response) for requests in which no specific server is specified :

server {
   listen 80 default_server; 
   server_name _;
   return 444;
}

This will conflict with the temporary nginx config added by this role, causing the role to fail.