News for hackers. Stuff that matters.

A comment on The future of Nginx: Getting back to our open source roots. Parent comment

Re:The future of Nginx: Getting back to our open source roots by Avamander on Wednesday August 24, 2022 @08:23AM (#32578430)
I'm using all three, Apache, Caddy and nginx almost daily. For the trivial, Caddy is amazing. When things get more complex alongside needs themselves, nginx is amazingly powerful. Apache at the same point becomes overly verbose, anomalous and painful. It does take some discipline though, to comment and structure your configuration files, but that applies to anything that isn't trivial. return 444; alone is a great feature I can't do without, not to mention all the modules one can use.

The thing with certificates is that most tutorials are terrible. A very seamless way is to use the webroot method. Create a nginx configuration file that places LE's challenges to a specified folder on your system, include that config into your server blocks. Then you instruct certbot to use that folder. Really quite easy.

[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by TheRealDunkirk on Wednesday August 24, 2022 @09:39AM (#32579296)
> Really quite easy.

“Your ideas are intriguing to me, and I wish to subscribe to your newsletter.”

Is there a detailed writeup on this? This sounds great, but I don't want to faff about with it.

[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by Avamander on Wednesday August 24, 2022 @10:27AM (#32579898)
In its most simple form, it works as follows.

/etc/nginx/letsencrypt.conf:

    location /.well-known/acme-challenge {
        default_type "text/plain";
        try_files    $uri $uri/ =404;
        root /tmp/letsencrypt-auto;
    }
/etc/nginx/sites-enabled/default:

    server {
        [...]

        include letsencrypt.conf;

        [...]
    }
Reload nginx.

Invoke certbot for the new domain once with:

    certbot certonly --webroot -w /tmp/letsencrypt-auto/ [--must-staple] -d example.com
[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by braiam on Wednesday August 24, 2022 @11:07AM (#32580420)
Wait, how does that makes nginx use the certificates? For me it doesn't have any cerbot/letsencrytpt specific configuration as I use DNS-01. I just point ssl_certificate and ssl_certificate_key to the correct path where cerbot saves the certificates and be done with it.
[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by Avamander on Wednesday August 24, 2022 @11:29AM (#32580700)
Making use is easy as well, like you described. Just a matter of specifying ssl_certificate(_key) path. It doesn't support variables so it can't be based on the server block's domain/variables unfortunately.

DNS challenges are a bit more seamless, but I personally don't like giving access to entire zones to a single machine. Like most DNS APIs force you to.

[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by jefurii on Thursday August 25, 2022 @12:43PM (#32596337)
The LetsEncrypt tutorial showed me exactly this configuration.
[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by everybodyknows on Wednesday August 24, 2022 @11:59AM (#32581197)
For us non-specialists, is 444 a shorthand "terminate with extreme prejudice" upon suspected hacking?

https://serverfault.com/questions/822484/nginx-444-error-eqi...

[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by Avamander on Thursday August 25, 2022 @03:49AM (#32590835)
It's great if you want to not even bother replying to some requests. I like to use it to not reply to requests that come without a valid SNI/Host.
[ Parent | on HN ]
Re:The future of Nginx: Getting back to our open source roots by mholt on Wednesday August 24, 2022 @09:54AM (#32579486)
What's keeping you from using Caddy exclusively?
[ Parent | on HN ]