8000 chore/doc: explicit policy on missing certificate by pini-gh · Pull Request #2465 · nginx-proxy/nginx-proxy · GitHub
[go: up one dir, main page]
Skip to content

chore/doc: explicit policy on missing certificate #2465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
May 27, 2024
Merged

chore/doc: explicit policy on missing certificate #2465

merged 3 commits into from
May 27, 2024

Conversation

pini-gh
Copy link
Contributor
@pini-gh pini-gh commented May 27, 2024

This doesn't change the current nginx-proxy behavior, but makes explicit the current HTTPS_METHOD policy on missing certificate.

@pini-gh
chore/doc: explicit policy on missing certificate
3ef2afb 
This doesn't change the current nginx-proxy behavior, but makes explicit
the current HTTPS_METHOD policy on missing certificate.
@pini-gh pini-gh mentioned this pull request May 27, 2024
Merged
buchdag
buchdag reviewed May 27, 2024
View reviewed changes
@pini-gh @buchdag
fix: bad wording about missing certificate
4729220 
Co-authored-by: Nicolas Duchon <nicolas.duchon@gmail.com>
buchdag
buchdag reviewed May 27, 2024
View reviewed changes
@buchdag buchdag merged commit 5f3ec18 into nginx-proxy:main May 27, 2024
0 of 2 checks passed
@pini-gh pini-gh deleted the pini-explicit-https-method-policy branch May 27, 2024 20:23
@ConnorNelson
Copy link

I use nginx-proxy, and acme-companion. In my production setup, both run successfully. In my development setup, I allow acme-companion to fail to generate a certificate (DNS isn't pointed at CI). This worked great, my development setup would just stick to HTTP, and I didn't need to support any special-case logic.

Now, I get 503s. This seems to be coming from:

# nginx -s reload
2024/05/28 23:40:30 [emerg] 305#305: duplicate location "/.well-known/acme-challenge/" in /etc/nginx/vhost.d/default:2
nginx: [emerg] duplicate location "/.well-known/acme-challenge/" in /etc/nginx/vhost.d/default:2

Inside /etc/nginx/conf.d/default.conf:

...
server {
    server_name localhost.pwn.college;
    access_log /var/log/nginx/access.log vhost;
    http2 on;
    listen 80 default_server;
    location /.well-known/acme-challenge/ {
        auth_basic off;
        allow all;
        root /usr/share/nginx/html;
        try_files $uri =404;
        break;
    }
    listen 443 ssl default_server;
    # No certificate found for this vhost, so use the default certificate and
    # return an error code if the user connects via https.
    ssl_certificate /etc/nginx/certs/default.crt;
    ssl_certificate_key /etc/nginx/certs/default.key;
    if ($https) {
        return 500;
    }
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://localhost.pwn.college;
        set $upstream_keepalive false;
        include /etc/nginx/vhost.d/default_location;
    }
}

Inside /etc/nginx/vhost.d/default:

## Start of configuration add by letsencrypt container
location ^~ /.well-known/acme-challenge/ {
    auth_basic off;
    auth_request off;
    allow all;
    root /usr/share/nginx/html;
    try_files $uri =404;
    break;
}
## End of configuration add by letsencrypt container

It seems like this (coupled with #2446) has broken my use-case.
Pinning from :latest to 1.5 has resolved this issue.

@pini-gh
Copy link
Contributor Author
pini-gh commented May 29, 2024

It seems like this (coupled with #2446) has broken my use-case.

Now that nginx-proxy handles ACME HTTP challenge correctly I guess acme-companion should be updated so it doesn't add this configuration when it already exists.

In the meantime - as it seems to be a requested feature - I'd like to guard nginx-proxy ACME HTTP Challenge configuration by an environment variable. I'll propose a PR on this topic soon.

pini-gh added a commit to pini-gh/nginx-proxy that referenced this pull request May 29, 2024
@pini-gh
feat: boolean variable ACME_HTTP_CHALLENGE
d8495d1 
Enable / disable ACME HTTP Challenge blocks generation by nginx-proxy.

Default: true.

This feature is currently needed because acme-companion may generate
the HTTP Challenge configuration while it was done already by nginx-proxy
(see nginx-proxy#2465#issuecomment-2136361373).

Also sometimes a hardcoded ACME challenge location is not wanted because
the challenge validation is not done with acme-companion / Let's Encrypt,
and with a challenge location setup differently.
@pini-gh pini-gh mentioned this pull request May 29, 2024
Merged
pini-gh added a commit to pini-gh/nginx-proxy that referenced this pull request May 30, 2024
@pini-gh
feat: variable ACME_HTTP_CHALLENGE
b5b1320 
Values:
* `legacy` (default): generate location blocks for ACME HTP Challenge
  excepted when `HTTPS_METHOD=noredirect` or there is no certificate for
  the domain
* `true`: generate location blocks for ACME HTP Challenge in all cases
* `false`: do not generate location blocks for ACME HTP Challenge

This feature is currently needed because acme-companion may generate
the HTTP Challenge configuration while it was done already by nginx-proxy
(see nginx-proxy#2465#issuecomment-2136361373).

Also sometimes a hardcoded ACME challenge location is not wanted because
the challenge validation is not done with acme-companion / Let's Encrypt,
and with a challenge location setup differently.
pini-gh added a commit to pini-gh/nginx-proxy that referenced this pull request May 30, 2024
@pini-gh
feat: variable ACME_HTTP_CHALLENGE_LOCATION
854427c 
Values:
* `legacy` (default): generate location blocks for ACME HTP Challenge
  excepted when `HTTPS_METHOD=noredirect` or there is no certificate for
  the domain
* `true`: generate location blocks for ACME HTP Challenge in all cases
* `false`: do not generate location blocks for ACME HTP Challenge

This feature is currently needed because acme-companion may generate
the HTTP Challenge configuration while it was done already by nginx-proxy
(see nginx-proxy#2465#issuecomment-2136361373).

Also sometimes a hardcoded ACME challenge location is not wanted because
the challenge validation is not done with acme-companion / Let's Encrypt,
and with a challenge location setup differently.
buchdag pushed a commit that referenced this pull request May 30, 2024
@pini-gh
feat: variable ACME_HTTP_CHALLENGE_LOCATION (#2468)
9cf736f 
Values:
* `legacy` (default): generate location blocks for ACME HTP Challenge
  excepted when `HTTPS_METHOD=noredirect` or there is no certificate for
  the domain
* `true`: generate location blocks for ACME HTP Challenge in all cases
* `false`: do not generate location blocks for ACME HTP Challenge

This feature is currently needed because acme-companion may generate
the HTTP Challenge configuration while it was done already by nginx-proxy
(see #2465#issuecomment-2136361373).

Also sometimes a hardcoded ACME challenge location is not wanted because
the challenge validation is not done with acme-companion / Let's Encrypt,
and with a challenge location setup differently.
f403 pushed a commit to f403/nginx-proxy that referenced this pull request Jul 25, 2024
@pini-gh @buchdag
docs: explicit policy on missing certificate (nginx-proxy#2465)
8a3eb7c 
* chore/doc: explicit policy on missing certificate

This doesn't change the current nginx-proxy behavior, but makes explicit
the current HTTPS_METHOD policy on missing certificate.

* fix: bad wording about missing certificate

Co-authored-by: Nicolas Duchon <nicolas.duchon@gmail.com>

* docs: typo in suggestion

---------

Co-authored-by: Nicolas Duchon <nicolas.duchon@gmail.com>
f403 pushed a commit to f403/nginx-proxy that referenced this pull request Jul 25, 2024
@pini-gh
feat: variable ACME_HTTP_CHALLENGE_LOCATION (nginx-proxy#2468)
deaa467 
Values:
* `legacy` (default): generate location blocks for ACME HTP Challenge
  excepted when `HTTPS_METHOD=noredirect` or there is no certificate for
  the domain
* `true`: generate location blocks for ACME HTP Challenge in all cases
* `false`: do not generate location blocks for ACME HTP Challenge

This feature is currently needed because acme-companion may generate
the HTTP Challenge configuration while it was done already by nginx-proxy
(see nginx-proxy#2465#issuecomment-2136361373).

Also sometimes a hardcoded ACME challenge location is not wanted because
the challenge validation is not done with acme-companion / Let's Encrypt,
and with a challenge location setup differently.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@buchdag buchdag buchdag approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@pini-gh @ConnorNelson @buchdag
0