diff --git a/base.template b/base.template index 94b97e1..005d32a 100644 --- a/base.template +++ b/base.template @@ -7,10 +7,18 @@ server { # Generated with nginx-le-setup listen 80; listen [::]:80; - listen 443 ssl http2; - ${HTTP3:+listen 443 http3 reuseport;} - listen [::]:443 ssl http2; - ${HTTP3:+listen [::]:443 http3 reuseport;} + + listen 443 ssl ${HTTP2:-http2}; + ${HTTP3:+listen 443 quic;} + + listen [::]:443 ssl ${HTTP2:-http2}; + ${HTTP3:+listen [::]:443 quic;} + + ${HTTP3:+add_header alt-svc 'h3=\":443\"; ma=86400';} + ${HTTP3:+http3 on;} + ${HTTP2:+http2 on;} + ${HTTP3:+quic_retry on;} + server_name ${VDOMAINS}; ${CONFIG} @@ -38,6 +46,7 @@ server { ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; + ssl_early_data on; # http3 ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers off; @@ -50,8 +59,8 @@ server { add_header X-protocol $server_protocol always; - ${HTTP3:+ add_header alt-svc 'h3=\":443\"; ma=86400';} - ${HTTP3:+ quic_retry on;} + + # HSTS (ngx_http_headers_module is required) 6 months add_header Strict-Transport-Security \"max-age=15768000; ${HSTS}\"; diff --git a/nginx-le-setup.sh b/nginx-le-setup.sh index 2dfb02a..c374ab7 100755 --- a/nginx-le-setup.sh +++ b/nginx-le-setup.sh @@ -7,6 +7,7 @@ NGINX_DIR="/etc/nginx" CONFIRM=0 FORCE=0 _BACKUP=0 +HTTP2="" HTTP3="" # shellcheck disable=SC2034 HSTS="" @@ -52,12 +53,19 @@ _initialize_variables() { # shellcheck disable=SC2034 HTTP3=1 fi - + if _version_gt "${_NGINX_VERSION}" "1.25.1"; then + HTTP2=1 + fi # Check for a config file if [ -r ~/.nginx-le-setup ]; then # shellcheck source=/dev/null . ~/.nginx-le-setup fi + # Generate certbot directories if they don't exist + # https://github.com/certbot/certbot/issues/9530 + if [ -d /etc/letsencrypt/renewal-hooks/ ]; then + certbot certificates &>/dev/null || echo "Error during creation of certbot directories" + fi } @@ -74,10 +82,7 @@ _create_certbot_hook() { echo "Certbot hook is not installed or not readable, installing it" fi - if (echo -e "${_HOOK}" >"${_POST_HOOK_PATH}"); then - echo "Error when deploying post hook in ${_POST_HOOK_DIR}" - return - fi + echo -e "${_HOOK}" >"${_POST_HOOK_PATH}" chmod 755 "${_POST_HOOK_PATH}" && echo "Post hook deployed in ${_POST_HOOK_PATH}" }