taler-deployment

commit c0314d794d1a1a64e9ecc6afe9f0b4cdb1f4d7a5
parent 9b160f8b1d4195db7ad62efe4f8d19e85f2c73cf
Author: Marcello Stanisci <marcello.stanisci@inria.fr>
Date:   Mon, 21 Mar 2016 15:40:53 +0100

activating https://test.taler.net

Diffstat:
D
etc/nginx/sites-enabled/test
 | 
16
----------------
A
etc/nginx/sites-enabled/test-ssl.site
 | 
33
+++++++++++++++++++++++++++++++++
M
etc/nginx/sites-enabled/test.site
 | 
15
++++-----------

3 files changed, 37 insertions(+), 27 deletions(-)
diff --git a/etc/nginx/sites-enabled/test b/etc/nginx/sites-enabled/test
@@ -1,16 +0,0 @@
-root /home/test/landing/;
-index index.html;
-
-# Make site accessible from http://localhost/
-server_name test.taler.net;
-server_name www.test.taler.net;
-
-rewrite ^/bank $scheme://bank.test.taler.net/ redirect;
-rewrite ^/shop $scheme://shop.test.taler.net/ redirect;
-rewrite ^/blog $scheme://blog.test.taler.net/ redirect;
-
-location ~ \.php$ {
-    fastcgi_pass unix:/var/run/php5-fpm.sock;
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    include fastcgi_params;
-}
diff --git a/etc/nginx/sites-enabled/test-ssl.site b/etc/nginx/sites-enabled/test-ssl.site
@@ -0,0 +1,33 @@
+server {
+	listen   443 ssl; ## listen for ipv4; this line is default and implied
+ 	# 	listen   [::]:80 default_server ipv6only=on; ## listen for ipv6
+
+	root /home/test/landing/;
+        index index.html;
+
+	# Make site accessible from http://localhost/
+	server_name test.taler.net;
+	server_name www.test.taler.net;
+	ssl_certificate /etc/letsencrypt/live/taler.net/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/taler.net/privkey.pem;
+	ssl_prefer_server_ciphers on;
+        ssl_session_cache shared:SSL:10m;
+        ssl_dhparam /etc/ssl/certs/dhparam.pem;
+	ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
+	ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+
+	add_header Strict-Transport-Security "max-age=63072000; preload";
+
+        location ~ \.php$ {
+            fastcgi_pass unix:/var/run/php5-fpm.sock;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            include fastcgi_params;
+        }
+
+        location /extension {
+            root /home/test/wallet/wallet_button/firefox_src/xpi/;
+            rewrite /extension /taler-wallet.xpi break;
+        }
+
+        include conf.d/test.redirects;
+}
diff --git a/etc/nginx/sites-enabled/test.site b/etc/nginx/sites-enabled/test.site
@@ -1,13 +1,6 @@
 server {
-  listen 80;
-  #ssi on;
-  rewrite ^ https://$server_name$request_uri? permanent;
-  #include conf.d/test.redirects;
-}
-server {
-  listen 443 ssl;
-  ssi on;
-  include sites-enabled/test;
-  include talerssl;
-  include conf.d/test.redirects;
+	listen 80;
+	server_name test.taler.net;
+	server_name www.test.taler.net;
+	rewrite ^ https://$server_name$request_uri? permanent;
 }