create 4 nginx 30.11.21:16.09

certbot4mail/examples/nginx/sites-avalable/http_mail-mydomen

@@ -5,7 +5,7 @@ server {
     if ($http_host !~ "^mail.mydomen.ru$"){
         rewrite ^(.*)$ http://mail.mydomen.ru$1 redirect;
     }
-    root /home/wwwmails/mail-mydomen;
+    root /home/www/letsencrypt;
 
     error_log /var/log/nginx/err-mail_mydomen_ru.log;
     access_log /var/log/nginx/access-mail_mydomen_ru.log;

certbot4mail/examples/nginx/templates/letsencrypt.conf

@@ -1,7 +1,7 @@
 location /.well-known {
    allow all;
    default_type "text/plain";
-   alias /home/wwwmails/letsencrypt/.well-known;
+   alias /home/www/letsencrypt/.well-known;
  }
 
  location = /.well-known {

certbot4nginx/auto4certbot.conf

@@ -0,0 +1,5 @@
+webcrt="/home/www/letsencrypt";
+## domains & email
+domains=( 
+ '"mydomen.ru" "admin@mydomen.ru"'
+ );

certbot4nginx/auto4certbot.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+#
+# необходимы для работы: nginx,certbot
+# create new cert
+path_ssl="/etc/ssl";
+path_cert="/etc/letsencrypt/live";
+source "/etc/scripts/auto4certbot/auto4certbot.conf";
+log="/var/log/syslog";
+#
+cmd=$1;
+#
+
+function createCert() {
+for ((dmn=0; dmn != ${#domains[@]}; dmn++))
+    do
+eval local dreg="(" $(echo -e ${domains[$dmn]}) ")";
+certbot certonly --webroot -w $webcrt -d ${dreg[0]}
+done
+}
+
+function renew() {
+certbot renew;
+valtrue=0;
+rdate=$(date +%Y-%m-%d);
+rtime=$(date +%H:%M);
+for ((dmn=0; dmn != ${#domains[@]}; dmn++))
+    do
+    eval local dreg="(" $(echo -e ${domains[$dmn]}) ")";
+     keydate=$(ls -l --time-style=long-iso $path_cert/${dreg[0]}/cert.pem |awk {'print$6'});
+     keytime=$(ls -l --time-style=long-iso $path_cert/${dreg[0]}/cert.pem |awk {'print$7'});
+     if [ "$keydate" = "$rdate" ] && [ "$keytime" = "$rtime" ];
+        then
+         ((valtrue++));
+        cat $path_cert/${dreg[0]}/cert.pem > $path_ssl/private/${dreg[0]}.pem;
+        cat $path_cert/${dreg[0]}/chain.pem >> $path_ssl/private/${dreg[0]}.pem;
+        cat $path_cert/${dreg[0]}/fullchain.pem >> $path_ssl/private/${dreg[0]}.pem;
+        cat $path_cert/${dreg[0]}/privkey.pem >> $path_ssl/private/${dreg[0]}.pem;
+#
+	cp -f $path_ssl/private/${dreg[0]}.pem $path_ssl/certs/${dreg[0]}.pem
+    	cd $path_ssl/certs
+    	chmod 600 ${dreg[0]}.pem
+	ln -sf ${dreg[0]}.pem `openssl x509 -noout -hash < ${dreg[0]}.pem`.0
+        cd $path_ssl
+        echo "$(date) - auto4certbot.sh: update cert for  ${domains[$dmn]}">> $log;
+      fi
+done
+if [ $valtrue != 0 ];
+   then
+     :>/etc/ssl/crt-list.txt
+        for ((icrt=0; icrt != ${#domains[@]}; icrt++))
+         do
+          echo "$path_ssl/${domains[$icrt]}.pem">>/etc/ssl/crt-list.txt
+        done
+fi
+}
+
+
+case "$cmd" in
+
+## create cert
+"--create" | "--create" )
+createCert;
+;;
+
+## update cert
+"--update" | "--update" )
+renew;
+;;
+
+## start defaults
+
+* )
+echo "please input pameters: auto4certbot.sh --create | --update";
+echo "auto4certbot.sh --create; create new certificate"
+echo "auto4certbot.sh --update; update certificates;"
+;;
+esac

certbot4nginx/examples/nginx.conf

@@ -0,0 +1,74 @@
+user  www-data;
+worker_processes  1;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    #access_log  /var/log/nginx/access.log  main;
+    access_log off;
+
+    sendfile        on;
+    tcp_nopush     on;
+    server_tokens off;
+    keepalive_timeout  65;
+
+    gzip  on;
+###
+    gzip_disable "msie6";
+    gzip_comp_level 4;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+    
+### include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+####
+    tcp_nodelay on;
+    types_hash_max_size 2048;
+    
+### codepage
+    charset        utf8;
+    source_charset utf8;
+    
+#### Tuning system....
+    ## - Защита
+    # Максимальный размер буфера для хранения тела запроса клиента
+    ##client_body_buffer_size 1K;
+    # Максимальный размер буфера для хранения заголовков запроса клиента
+    ##client_header_buffer_size 1k;
+    # Максимальный размер тела запроса клиента, прописанный в поле Content-Length заголовка. Если сервер должен поддерживать загрузку файлов, это значение необходимо увеличить
+    ##client_max_body_size 1k;
+    # для Rouncube
+    client_max_body_size 40M;
+    # Количество и размер буферов для чтения большого заголовка запроса клиента
+    ##large_client_header_buffers 2 1k;
+    
+    
+    ## - Увеличиваем скорость
+    # Таймаут при чтении тела запроса клиента
+    client_body_timeout   10;
+    # Таймаут при чтении заголовка запроса клиента
+    client_header_timeout 10;
+    # Таймаут, по истечению которого keep-alive соединение с клиентом не будет закрыто со стороны сервера
+    ##keepalive_timeout     5 5;
+    # Таймаут при передаче ответа клиенту
+    send_timeout          10;
+    ## transparent ip
+    set_real_ip_from 127.0.0.1;
+    real_ip_header X-Real-IP;
+}

certbot4nginx/examples/nginx/sites-avalable/http_mail-mydomen

@@ -0,0 +1,16 @@
+server {
+    listen      192.4.1.6:80;
+
+    server_name mail.mydomen.ru;
+    if ($http_host !~ "^mail.mydomen.ru$"){
+        rewrite ^(.*)$ http://mail.mydomen.ru$1 redirect;
+    }
+    root /home/wwwmails/mail-mydomen;
+
+    error_log /var/log/nginx/err-mail_mydomen_ru.log;
+    access_log /var/log/nginx/access-mail_mydomen_ru.log;
+
+    include /etc/nginx/templates/content.conf;
+    include /etc/nginx/templates/letsencrypt.conf;
+}
+

certbot4nginx/examples/nginx/sites-avalable/https_mail-mydomen

@@ -0,0 +1,27 @@
+server {
+    listen 194.4.1.6:443 ssl proxy_protocol;
+    server_name mydomen.ru www.mydomen.ru;
+    set_real_ip_from 91.193.62.251;
+    real_ip_header proxy_protocol;
+    
+    include     /etc/nginx/ssl/ssl_mydomen-ru.conf;
+
+    if ( $scheme = "http" ) {
+          rewrite ^/(.*)$       https://$host/$1 permanent;
+        }
+    ssi on;
+
+
+    server_name mydomen.ru;
+    if ($http_host !~ "^mydomen.ru$"){
+        rewrite ^(.*)$ http://mydomen.ru$1 redirect;
+    }
+    root /home/www/mydomen;
+
+    error_log /var/log/nginx/err-mydomen_ru.log;
+    access_log /var/log/nginx/access-mydomen_ru.log;
+
+    include /etc/nginx/templates/content.conf;
+    include /etc/nginx/templates/letsencrypt.conf;
+}
+

certbot4nginx/examples/nginx/ssl/ssl_mydomen-ru.conf

@@ -0,0 +1,5 @@
+ssl_certificate                 /etc/letsencrypt/live/mydomen.ru/cert.pem;
+ssl_certificate_key             /etc/letsencrypt/live/mydomen.ru/privkey.pem;
+ssl_trusted_certificate         /etc/letsencrypt/live/mydomen.ru/fullchain.pem;
+
+include /etc/letsencrypt/options-ssl-nginx.conf;

certbot4nginx/examples/nginx/templates/content.conf

@@ -0,0 +1,11 @@
+  error_page 404 /404.html;
+   error_page 500 502 503 504 /50x.html;
+
+ location ~* \.(css|js|jpg|jpeg|gif|png|ico|txt|woff|otf|eot|svg|ttf|html|xml|css|js)$ {
+   expires 30d;
+   error_page 404 @notfound;
+ }
+
+ location = /50x.html {
+   root /usr/share/nginx/html;
+ }

certbot4nginx/examples/nginx/templates/index_php.conf

@@ -0,0 +1,9 @@
+ location / {
+   if ($http_host ~* "^www\.(.+)$"){
+   rewrite ^(.*)$ http://%1/$1 redirect; 
+   } 
+   if (!-e $request_filename){ 
+   rewrite ^(.*)$ /index.php; 
+   }
+   index   index.htm index.html index.php;
+ }

certbot4nginx/examples/nginx/templates/letsencrypt.conf

@@ -0,0 +1,9 @@
+location /.well-known {
+   allow all;
+   default_type "text/plain";
+   alias /home/wwwmails/letsencrypt/.well-known;
+ }
+
+ location = /.well-known {
+   return 404;
+ }

certbot4nginx/examples/nginx/templates/php7.x-fpm.conf

@@ -0,0 +1,19 @@
+location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
+   deny all;
+}
+
+location ~ ^/(bin|SQL)/ {
+   deny all;
+}
+
+location ~ \.php$ {
+   try_files $uri $uri/ /index.php =404;
+   fastcgi_pass  localhost:9000;
+   fastcgi_index index.php;
+   fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+   include fastcgi_params;
+}
+
+location ~ /.ht {
+    deny all;
+}

certbot4nginx/examples/nginx/templates/proxy.conf

@@ -0,0 +1,13 @@
+proxy_redirect              off;
+proxy_set_header            Host $host;
+proxy_set_header            X-Real-IP $remote_addr;
+proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
+client_max_body_size        10m;
+client_body_buffer_size     128k;
+proxy_connect_timeout       90;
+proxy_send_timeout          90;
+proxy_read_timeout          90;
+proxy_buffer_size           4k;
+proxy_buffers               4 32k;
+proxy_busy_buffers_size     64k;
+proxy_temp_file_write_size  64k;