diff --git a/seed/nginx-common/dictionaries/21_nginx.xml b/seed/nginx-common/dictionaries/21_nginx.xml
index 0ab1a528..0d34c376 100644
--- a/seed/nginx-common/dictionaries/21_nginx.xml
+++ b/seed/nginx-common/dictionaries/21_nginx.xml
@@ -11,8 +11,8 @@
/sysusers.d/nginx.conf
/tmpfiles.d/nginx.conf
revprox_ca_file
- /etc/pki/tls/certs/nginx.crt
- /etc/pki/tls/private/nginx.key
+ revprox_crt_file
+ revprox_key_file
/tests/nginx-common.yml
@@ -38,6 +38,10 @@
32
+
+
+
+
@@ -45,8 +49,6 @@
Fedora
nginx_fedora
nginx_default
- nginx_default_http
- nginx_default_https
@@ -62,5 +64,31 @@
/
revprox_ca_file
+
+ tls_cert_directory
+ nginx.crt
+ /
+ revprox_crt_file
+
+
+ tls_key_directory
+ nginx.key
+ /
+ revprox_key_file
+
+
+ nginx
+ www-data
+ os_name
+ Fedora
+ nginx_owner
+
+
+ nginx
+ adm
+ os_name
+ Fedora
+ nginx_group
+
diff --git a/seed/nginx-common/templates/nginx.conf b/seed/nginx-common/templates/nginx.conf
index b8cf4220..ddb9d6e6 100644
--- a/seed/nginx-common/templates/nginx.conf
+++ b/seed/nginx-common/templates/nginx.conf
@@ -27,11 +27,9 @@ events {
}
http {
-%if %%os_name == 'Fedora'
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
-%end if
#GNUNUX access_log /var/log/nginx/access.log main;
#>GNUNUX
access_log syslog:server=unix:/dev/log combined;
@@ -51,8 +49,7 @@ http {
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
-%if %%os_name == 'Fedora'
- %if %%nginx_default_http
+%if %%nginx_default_http
server {
listen 80;
listen [::]:80;
@@ -70,36 +67,38 @@ http {
location = /50x.html {
}
}
- %end if
+%end if
# Settings for a TLS enabled server.
#
- %if %%nginx_default_https
+%if %%nginx_default_https
server {
listen 443 ssl http2;
- %if %%getVar('revprox_client_external_domainnames', None)
- %for %%domain in %%revprox_client_external_domainnames
+ %if %%getVar('revprox_client_external_domainnames', None)
+ %for %%domain in %%revprox_client_external_domainnames
server_name %%domain;
- %end for
- %else
+ %end for
+ %else
server_name _;
- %end if
+ %end if
root %%nginx_root;
# ssl_certificate "/etc/pki/nginx/server.crt";
# ssl_certificate_key "/etc/pki/nginx/private/server.key";
- ssl_certificate /etc/pki/tls/certs/nginx.crt;
- ssl_certificate_key /etc/pki/tls/private/nginx.key;
- %if %%getVar('revprox_client_external_domainnames', None)
+ ssl_certificate %%revprox_crt_file;
+ ssl_certificate_key %%revprox_key_file;
+ %if %%getVar('revprox_client_external_domainnames', None)
ssl_client_certificate %%revprox_ca_file;
- %else
+ %else
ssl_client_certificate /etc/pki/ca-trust/source/anchors/ca_HTTP.crt;
- %end if
+ %end if
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
+
+ %if %%os_name == 'Fedora'
ssl_ciphers PROFILE=SYSTEM;
ssl_prefer_server_ciphers on;
-
+ %end if
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
@@ -111,11 +110,6 @@ http {
location = /50x.html {
}
}
- %end if
-%else
- include /etc/nginx/sites-enabled/*;
%end if
-%if not %%getVar('revprox_client_external_domainnames', None)
include /etc/nginx/sites-enabled/*;
-%end if
}
diff --git a/seed/nginx-common/templates/tmpfiles.nginx.conf b/seed/nginx-common/templates/tmpfiles.nginx.conf
index 310157f2..b8b1e47e 100644
--- a/seed/nginx-common/templates/tmpfiles.nginx.conf
+++ b/seed/nginx-common/templates/tmpfiles.nginx.conf
@@ -1,9 +1,2 @@
# this directory is not used, but must be created
-%if %%os_name == 'Fedora'
- %set %%usr = "nginx"
- %set %%grp = %%usr
-%else
- %set %%usr = "www-data"
- %set %%grp = "adm"
-%end if
-d /var/log/nginx/ 0750 %%usr %%grp -
+d /var/log/nginx/ 0750 %%nginx_owner %%nginx_group -
diff --git a/seed/nginx-https/applicationservice.yml b/seed/nginx-https/applicationservice.yml
index f8097545..e163e060 100644
--- a/seed/nginx-https/applicationservice.yml
+++ b/seed/nginx-https/applicationservice.yml
@@ -1,5 +1,5 @@
format: '0.1'
-description: Nginx as reverse proxy
+description: Nginx as HTTPS web site
depends:
- nginx-common
- reverse-proxy-client