bundles/{letsencrypt,nginx}: fix ocsp stapling
Some checks failed
bundlewrap/pipeline/head There was a failure building this commit
Some checks failed
bundlewrap/pipeline/head There was a failure building this commit
This commit is contained in:
parent
245559ee09
commit
f7eb0cc150
4 changed files with 9 additions and 2 deletions
|
@ -3,3 +3,5 @@ BASEDIR=/var/lib/dehydrated
|
|||
WELLKNOWN="${BASEDIR}/acme-challenges"
|
||||
DOMAINS_TXT="/etc/dehydrated/domains.txt"
|
||||
HOOK="/etc/dehydrated/hook.sh"
|
||||
OCSP_MUST_STAPLE="yes"
|
||||
OCSP_FETCH="yes"
|
||||
|
|
|
@ -6,7 +6,7 @@ pkg_apt = {
|
|||
|
||||
actions = {
|
||||
'letsencrypt_update_certificates': {
|
||||
'command': 'dehydrated --cron --accept-terms --ocsp --challenge http-01',
|
||||
'command': 'dehydrated --cron --accept-terms --challenge http-01',
|
||||
'triggered': True,
|
||||
'needs': {
|
||||
'pkg_apt:dehydrated',
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
def crontab(metadata):
|
||||
return {
|
||||
'cron': {
|
||||
'letsencrypt_renew': '20 4 * * * root /usr/bin/dehydrated --cron --accept-terms --ocsp --challenge http-01 > /dev/null',
|
||||
'letsencrypt_renew': '20 4 * * * root /usr/bin/dehydrated --cron --accept-terms --challenge http-01 > /dev/null',
|
||||
'letsencrypt_cleanup': '42 23 * * 0 root /usr/bin/dehydrated --cleanup > /dev/null',
|
||||
},
|
||||
}, DEFAULTS, DONE
|
||||
|
|
|
@ -6,6 +6,7 @@ server {
|
|||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
ssl_trusted_certificate /var/lib/dehydrated/certs/${domain}/chain.pem;
|
||||
ssl_certificate /var/lib/dehydrated/certs/${domain}/fullchain.pem;
|
||||
ssl_certificate_key /var/lib/dehydrated/certs/${domain}/privkey.pem;
|
||||
ssl_dhparam /etc/ssl/certs/dhparam.pem;
|
||||
|
@ -15,6 +16,10 @@ server {
|
|||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
ssl_stapling_file /var/lib/dehydrated/certs/${domain}/ocsp.der;
|
||||
|
||||
resolver 8.8.8.8 8.8.4.4 valid=300s;
|
||||
resolver_timeout 5s;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31104000; preload";
|
||||
|
||||
|
|
Loading…
Reference in a new issue