Setup Let’s Encrypt + non-www > www

위키 시스템 관리자
,
1

I finally made it work, and thought to put everything together in case someone needs it.
This info is assembled from different topics on this forum. Thanks to @brahn and @techAPJ.
This assumes you’ve completed the initial Let’s Encrypt setup:

After you’ve done it, the following needs to be added to the app.yml in hooks section. It will do two things:

  1. setup SSL for both example.com and www.example.com. Just replace example.com with your domain name.
  2. redirect example.com to www.example.com

If anybody knows how to improve it, please let me know.

hooks:
  after_code:
    - exec:
        cd: $home/plugins
        cmd:
          - git clone https://github.com/discourse/docker_manager.git


  after_web_config:
    - replace:
        filename: /etc/nginx/nginx.conf
        from: /sendfile.+on;/
        to: |
          server_names_hash_bucket_size 64;
          sendfile on;
    - file:
        path: /etc/nginx/conf.d/discourse_redirect_1.conf
        contents: |
          server {
            listen 443;
            server_name example.com;
            return 301 $scheme://www.example.com$request_uri;
          }
  after_ssl:
    - replace:
        filename: "/etc/runit/1.d/letsencrypt"
        from: /-k 4096 -w \/var\/www\/discourse\/public/
        to: |
          -d www.example.com -d example.com -k 4096 -w /var/www/discourse/public

    - replace:
        filename: "/etc/runit/1.d/letsencrypt"
        from: /-k 4096 --force -w \/var\/www\/discourse\/public/
        to: |
          -d www.example.com -d example.com -k 4096 --force -w /var/www/discourse/public

    - replace:
        filename: "/etc/nginx/conf.d/discourse.conf"
        from: /return 301 https.+/
        to: |
          return 301 https://$host$request_uri;

    - replace:
        filename: "/etc/nginx/conf.d/discourse.conf"
        from: /gzip on;[^\}]+\}/m
        to: |
          gzip on;
          add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for th$

as always, remember that spacing and indentation is extremely important in the app.yml file. After you’ve done editing, you have to rebuild the container with:

cd /var/discourse
./launcher rebuild app
6개의 좋아요
Non www to www without certificate error
Can't reach web server after update to 3.4
Sysadmins Index
2

I wonder if this part is needed, since we already have the “force https” option in Admin settings.
@brahn, this is your part of the code, can you explain why is this necessary?

- replace:
    filename: "/etc/nginx/conf.d/discourse.conf"
    from: /return 301 https.+/
    to: |
      return 301 https://$host$request_uri;
1개의 좋아요
3

I’m not really sure, does that setting redirect or just block non-https requests?

1개의 좋아요
7

완전한 컨텍스트를 제공해야 합니다.
나는 꽤 최신 버전인 2.7.0.beta7을 사용 중인데, www와 non-www 설정이 잘못되어 있습니다. 수정하려고 시도하고 있습니다.

위 설명(복사/붙여넣기)을 시도했는데, 이제 non-www가 작동하지 않습니다.

1개의 좋아요
8

해당 경로는 컨테이너 내부에 있으므로, 호스트 OS에서 찾고 있다면 잘못된 위치를 보고 있는 것입니다.

여러 도메인으로 Let’s Encrypt 설정하기 문서를 확인하여 해당 지침이 다른지 살펴볼 수 있습니다. 다른 도메인도 동일한 방식으로 추가하면 됩니다.

또한 https://www.forcewww.com/ 사이트를 참고할 수도 있습니다.

4개의 좋아요
9

이 방법이 더 이상 작동하지 않고 인스턴스에 접근할 수 없게 만드는 것 같습니다. 대신 다음 방법을 사용하여 다시 정상 작동하도록 했습니다:

2개의 좋아요