Implement feedback

* Bundle well-known location http passthrough into base ssl template.
* Always configure to listen on ipv4 and v6

Author: featheredtoast

templates/web.letsencrypt.ssl.template.yml

@@ -19,20 +19,6 @@ run:
         LE_WORKING_DIR="${LETSENCRYPT_DIR}" ./acme.sh --upgrade --auto-upgrade
         LE_WORKING_DIR="${LETSENCRYPT_DIR}" ./acme.sh --set-default-ca  --server  letsencrypt
 
-        cat << EOF > /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
-        server {
-          listen 80;
-
-          location ~ /.well-known {
-            root /var/www/discourse/public;
-            allow all;
-          }
-          location / {
-            return 301 https://${DISCOURSE_HOSTNAME}$request_uri;
-          }
-        }
-        EOF
-
         cat << EOF > /etc/nginx/letsencrypt.conf
         user www-data;
         worker_processes auto;
@@ -54,6 +40,7 @@ run:
 
           server {
             listen 80;
+            listen [::]:80;
 
             location ~ /.well-known {
               root /var/www/discourse/public;
@@ -63,11 +50,6 @@ run:
         }
         EOF
 
-        if [ -f "/proc/net/if_inet6" ] ; then
-          sed -i 's/listen 80;/listen 80;\nlisten [::]:80;/g' /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
-          sed -i 's/listen 80;/listen 80;\nlisten [::]:80;/g' /etc/nginx/letsencrypt.conf
-        fi
-
         sed -Ei "s/^#?ACCOUNT_EMAIL=.+/ACCOUNT_EMAIL=${LETSENCRYPT_ACCOUNT_EMAIL}/" \
           /shared/letsencrypt/account.conf
 

templates/web.ssl.template.yml

@@ -27,6 +27,13 @@ run:
         cat << EOF > /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
         server {
           listen 80;
+          listen [::]:80;
+
+          location ~ /.well-known {
+            root /var/www/discourse/public;
+            allow all;
+          }
+
           return 301 https://${DISCOURSE_HOSTNAME}$request_uri;
         }
         EOF
@@ -35,6 +42,7 @@ run:
 
         cat << EOF > /etc/nginx/conf.d/outlets/server/20-https.conf
         listen 443 ssl;
+        listen [::]:443 ssl;
         http2 on;
 
         ssl_protocols TLSv1.2 TLSv1.3;
@@ -58,8 +66,3 @@ run:
         cat << EOF > /etc/nginx/conf.d/outlets/discourse/20-https.conf
         add_header Strict-Transport-Security 'max-age=31536000';
         EOF
-
-        if [ -f "/proc/net/if_inet6" ] ; then
-          sed -i 's/listen 80;/listen 80;\nlisten [::]:80;/g' /etc/nginx/conf.d/outlets/before-server/20-redirect-http-to-https.conf
-          sed -i 's/listen 443 ssl;/listen 443 ssl;\nlisten [::]:443 ssl;/g' /etc/nginx/conf.d/outlets/server/20-https.conf
-        fi