activating https://test.taler.net

3 files changed, 37 insertions, 27 deletions

diff --git a/etc/nginx/sites-enabled/test b/etc/nginx/sites-enabled/test
deleted file mode 100644
index 1f4dd2d..0000000
--- a/etc/nginx/sites-enabled/test
+++ /dev/null
@@ -1,16 +0,0 @@
-root /home/test/landing/;
-index index.html;
-
-# Make site accessible from http://localhost/
-server_name test.taler.net;
-server_name www.test.taler.net;
-
-rewrite ^/bank $scheme://bank.test.taler.net/ redirect;
-rewrite ^/shop $scheme://shop.test.taler.net/ redirect;
-rewrite ^/blog $scheme://blog.test.taler.net/ redirect;
-
-location ~ \.php$ {
-    fastcgi_pass unix:/var/run/php5-fpm.sock;
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    include fastcgi_params;
-}
diff --git a/etc/nginx/sites-enabled/test-ssl.site b/etc/nginx/sites-enabled/test-ssl.site
new file mode 100644
index 0000000..8bf8871
--- /dev/null
+++ b/etc/nginx/sites-enabled/test-ssl.site
@@ -0,0 +1,33 @@
+server {
+	listen   443 ssl; ## listen for ipv4; this line is default and implied
+ 	# 	listen   [::]:80 default_server ipv6only=on; ## listen for ipv6
+
+	root /home/test/landing/;
+        index index.html;
+
+	# Make site accessible from http://localhost/
+	server_name test.taler.net;
+	server_name www.test.taler.net;
+	ssl_certificate /etc/letsencrypt/live/taler.net/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/taler.net/privkey.pem;
+	ssl_prefer_server_ciphers on;
+        ssl_session_cache shared:SSL:10m;
+        ssl_dhparam /etc/ssl/certs/dhparam.pem;
+	ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
+	ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+
+	add_header Strict-Transport-Security "max-age=63072000; preload";
+
+        location ~ \.php$ {
+            fastcgi_pass unix:/var/run/php5-fpm.sock;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            include fastcgi_params;
+        }
+
+        location /extension {
+            root /home/test/wallet/wallet_button/firefox_src/xpi/;
+            rewrite /extension /taler-wallet.xpi break;
+        }
+
+        include conf.d/test.redirects;
+}
diff --git a/etc/nginx/sites-enabled/test.site b/etc/nginx/sites-enabled/test.site
index 6d7ff17..b1392a2 100644
--- a/etc/nginx/sites-enabled/test.site
+++ b/etc/nginx/sites-enabled/test.site
@@ -1,13 +1,6 @@
 server {
-  listen 80;
-  #ssi on;
-  rewrite ^ https://$server_name$request_uri? permanent;
-  #include conf.d/test.redirects;
-}
-server {
-  listen 443 ssl;
-  ssi on;
-  include sites-enabled/test;
-  include talerssl;
-  include conf.d/test.redirects;
+	listen 80;
+	server_name test.taler.net;
+	server_name www.test.taler.net;
+	rewrite ^ https://$server_name$request_uri? permanent;
 }