17742: modify multi_host/aws example's nginx

to use individual certificates and allow custom certs
Arvados-DCO-1.1-Signed-off-by: Javier Bértoli <jbertoli@curii.com>

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_controller_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_controller_configuration.sls
index 68c8512e76eca15a134ebe7cdea3bb5505695a43..1f088a8a7d8b670902a20c68bf63310e9e0ea81a 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_controller_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_controller_configuration.sls
@@ -6,13 +6,5 @@
 ### LETSENCRYPT
 letsencrypt:
   domainsets:
-    __CLUSTER__.__DOMAIN__:
+    controller.__CLUSTER__.__DOMAIN__:
       - __CLUSTER__.__DOMAIN__
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    __CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepproxy_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepproxy_configuration.sls
index 3056b89d4d7321df971111b118e0f421c761f9ca..b2945e611f44de3f85a16c46f834b72a7cf45e79 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepproxy_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepproxy_configuration.sls
@@ -6,13 +6,5 @@
 ### LETSENCRYPT
 letsencrypt:
   domainsets:
-    keep.__CLUSTER__.__DOMAIN__:
+    keepproxy.__CLUSTER__.__DOMAIN__:
       - keep.__CLUSTER__.__DOMAIN__
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    keep.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/keep.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/keep.__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls
index c1720ad04bc3c40c2ae15161e11c39f1ee493125..f95d7e619d4cb7971dc73026c75a9a35f08ba8d0 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls
@@ -11,14 +11,3 @@ letsencrypt:
     collections.__CLUSTER__.__DOMAIN__:
       - collections.__CLUSTER__.__DOMAIN__
       - '*.collections.__CLUSTER__.__DOMAIN__'
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    download.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/download.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/download.__CLUSTER__.__DOMAIN__/privkey.pem
-    collections.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/collections.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/collections.__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_webshell_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_webshell_configuration.sls
index e9d2bb018c4595e25cc63f5849f1eab5ec33a3b0..17e6422f420f0aad181695b0c40cd18a27d3a28f 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_webshell_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_webshell_configuration.sls
@@ -8,11 +8,3 @@ letsencrypt:
   domainsets:
     webshell.__CLUSTER__.__DOMAIN__:
       - webshell.__CLUSTER__.__DOMAIN__
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    webshell.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/webshell.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/webshell.__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_websocket_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_websocket_configuration.sls
index d24431fac880b335667f233a46fa0e634fcd0628..6515b3bd0b38e4420a801d1a251ddb37fc153907 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_websocket_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_websocket_configuration.sls
@@ -6,13 +6,5 @@
 ### LETSENCRYPT
 letsencrypt:
   domainsets:
-    ws.__CLUSTER__.__DOMAIN__:
+    websocket.__CLUSTER__.__DOMAIN__:
       - ws.__CLUSTER__.__DOMAIN__
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    ws.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/ws.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/ws.__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench2_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench2_configuration.sls
index 5aa6342866b800ee55a10fa786e1cce8f05fb9fd..2bcf2b7841e5fd553a1370d1be34e59e8e230c83 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench2_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench2_configuration.sls
@@ -8,11 +8,3 @@ letsencrypt:
   domainsets:
     workbench2.__CLUSTER__.__DOMAIN__:
       - workbench2.__CLUSTER__.__DOMAIN__
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    workbench2.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/workbench2.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/workbench2.__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench_configuration.sls
index 4620f79e37d3927a8baa3af73b22004402d20bef..9ef348719423c21ab29ea1895ce4fb8db157bf16 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_workbench_configuration.sls
@@ -8,11 +8,3 @@ letsencrypt:
   domainsets:
     workbench.__CLUSTER__.__DOMAIN__:
       - workbench.__CLUSTER__.__DOMAIN__
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    workbench.__CLUSTER__.__DOMAIN___letsencrypt_cert.conf:
-      - ssl_certificate: /etc/letsencrypt/live/workbench.__CLUSTER__.__DOMAIN__/fullchain.pem
-      - ssl_certificate_key: /etc/letsencrypt/live/workbench.__CLUSTER__.__DOMAIN__/privkey.pem

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_api_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_api_configuration.sls
index c0b087045ecc8d11430b48153e4cefaa28a8ca6a..9fbf90dd2c478b0ebf64be603a6e6511f468cf10 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_api_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_api_configuration.sls
@@ -13,7 +13,7 @@ nginx:
   ### SITES
   servers:
     managed:
-      arvados_api:
+      arvados_api.conf:
         enabled: true
         overwrite: true
         config:

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_collections_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_collections_configuration.sls
new file mode 100644 (file)
index 0000000..00be378
--- /dev/null
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_collections_configuration.sls
@@ -0,0 +1,51 @@
+---
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
+### NGINX
+nginx:
+  servers:
+    managed:
+      ### DEFAULT
+      arvados_collections_default.conf:
+        enabled: true
+        overwrite: true
+        config:
+          - server:
+            - server_name: '~^(.*\.)?collections\.__CLUSTER__\.__DOMAIN__'
+            - listen:
+              - 80
+            - location /:
+              - return: '301 https://$host$request_uri'
+
+      ### COLLECTIONS
+      arvados_collections_ssl.conf:
+        enabled: true
+        overwrite: true
+        requires:
+          __CERT_REQUIRES__
+        config:
+          - server:
+            - server_name: '~^(.*\.)?collections\.__CLUSTER__\.__DOMAIN__'
+            - listen:
+              - __KEEPWEB_EXT_SSL_PORT__ http2 ssl
+            - index: index.html index.htm
+            - location /:
+              - proxy_pass: 'http://collections_downloads_upstream'
+              - proxy_read_timeout: 90
+              - proxy_connect_timeout: 90
+              - proxy_redirect: 'off'
+              - proxy_set_header: X-Forwarded-Proto https
+              - proxy_set_header: 'Host $http_host'
+              - proxy_set_header: 'X-Real-IP $remote_addr'
+              - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
+              - proxy_buffering: 'off'
+            - client_max_body_size: 0
+            - proxy_http_version: '1.1'
+            - proxy_request_buffering: 'off'
+            - include: snippets/ssl_hardening_default.conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
+            - access_log: /var/log/nginx/collections.__CLUSTER__.__DOMAIN__.access.log combined
+            - error_log: /var/log/nginx/collections.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls
index aa11cca74e7ff5d4b6558255b2596b9c47dc850d..41d6e1365a6e2235dfd1d7be334c65aef65f6745 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls
@@ -21,7 +21,7 @@ nginx:
   servers:
     managed:
       ### DEFAULT
-      arvados_controller_default:
+      arvados_controller_default.conf:
         enabled: true
         overwrite: true
         config:
@@ -29,14 +29,16 @@ nginx:
             - server_name: __CLUSTER__.__DOMAIN__
             - listen:
               - 80 default
+            - location /.well-known:
+              - root: /var/www
             - location /:
               - return: '301 https://$host$request_uri'
 
-      arvados_controller_ssl:
+      arvados_controller_ssl.conf:
         enabled: true
         overwrite: true
         requires:
-          cmd: create-initial-cert-__CLUSTER__.__DOMAIN__-__CLUSTER__.__DOMAIN__
+          __CERT_REQUIRES__
         config:
           - server:
             - server_name: __CLUSTER__.__DOMAIN__
@@ -54,7 +56,8 @@ nginx:
               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
               - proxy_set_header: 'X-External-Client $external_client'
             - include: snippets/ssl_hardening_default.conf
-            - include: snippets/__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
             - access_log: /var/log/nginx/controller.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/controller.__CLUSTER__.__DOMAIN__.error.log
             - client_max_body_size: 128m

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_download_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_download_configuration.sls
new file mode 100644 (file)
index 0000000..9246fc1
--- /dev/null
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_download_configuration.sls
@@ -0,0 +1,51 @@
+---
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
+### NGINX
+nginx:
+  servers:
+    managed:
+      ### DEFAULT
+      arvados_download_default.conf:
+        enabled: true
+        overwrite: true
+        config:
+          - server:
+            - server_name: download.__CLUSTER__.__DOMAIN__
+            - listen:
+              - 80
+            - location /:
+              - return: '301 https://$host$request_uri'
+
+      ### DOWNLOAD
+      arvados_download_ssl.conf:
+        enabled: true
+        overwrite: true
+        requires:
+          __CERT_REQUIRES__
+        config:
+          - server:
+            - server_name: download.__CLUSTER__.__DOMAIN__
+            - listen:
+              - __KEEPWEB_EXT_SSL_PORT__ http2 ssl
+            - index: index.html index.htm
+            - location /:
+              - proxy_pass: 'http://collections_downloads_upstream'
+              - proxy_read_timeout: 90
+              - proxy_connect_timeout: 90
+              - proxy_redirect: 'off'
+              - proxy_set_header: X-Forwarded-Proto https
+              - proxy_set_header: 'Host $http_host'
+              - proxy_set_header: 'X-Real-IP $remote_addr'
+              - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
+              - proxy_buffering: 'off'
+            - client_max_body_size: 0
+            - proxy_http_version: '1.1'
+            - proxy_request_buffering: 'off'
+            - include: snippets/ssl_hardening_default.conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
+            - access_log: /var/log/nginx/download.__CLUSTER__.__DOMAIN__.access.log combined
+            - error_log: /var/log/nginx/download.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls
index fac97f3c6c4cfb32a6b569eb9d4fd14669d6ef59..2f00524f987f40a5c8e7b0a6fffee96f901da198 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls
@@ -16,7 +16,7 @@ nginx:
   servers:
     managed:
       ### DEFAULT
-      arvados_keepproxy_default:
+      arvados_keepproxy_default.conf:
         enabled: true
         overwrite: true
         config:
@@ -27,16 +27,16 @@ nginx:
             - location /:
               - return: '301 https://$host$request_uri'
 
-      arvados_keepproxy_ssl:
+      arvados_keepproxy_ssl.conf:
         enabled: true
         overwrite: true
         requires:
-          cmd: create-initial-cert-keep.__CLUSTER__.__DOMAIN__-keep.__CLUSTER__.__DOMAIN__
+          __CERT_REQUIRES__
         config:
           - server:
             - server_name: keep.__CLUSTER__.__DOMAIN__
             - listen:
-              - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
+              - __KEEP_EXT_SSL_PORT__ http2 ssl
             - index: index.html index.htm
             - location /:
               - proxy_pass: 'http://keepproxy_upstream'
@@ -53,6 +53,7 @@ nginx:
             - proxy_http_version: '1.1'
             - proxy_request_buffering: 'off'
             - include: snippets/ssl_hardening_default.conf
-            - include: snippets/keep.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
             - access_log: /var/log/nginx/keepproxy.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/keepproxy.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls
index e99295353e272ea27cb585bf77ef592ae154f1d8..441140e80dff233726dde0c891b0c54a42e1eeac 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls
@@ -3,6 +3,7 @@
 #
 # SPDX-License-Identifier: AGPL-3.0
 
+# Keepweb upstream is common to both downloads and collections
 ### NGINX
 nginx:
   ### SERVER
@@ -12,77 +13,3 @@ nginx:
       http:
         upstream collections_downloads_upstream:
           - server: 'localhost:9002 fail_timeout=10s'
-
-  servers:
-    managed:
-      ### DEFAULT
-      arvados_collections_download_default:
-        enabled: true
-        overwrite: true
-        config:
-          - server:
-            - server_name: '~^((.*\.)?collections|download)\.__CLUSTER__\.__DOMAIN__'
-            - listen:
-              - 80
-            - location /:
-              - return: '301 https://$host$request_uri'
-
-      ### COLLECTIONS
-      arvados_collections_ssl:
-        enabled: true
-        overwrite: true
-        requires:
-          cmd: 'create-initial-cert-collections.__CLUSTER__.__DOMAIN__-collections.__CLUSTER__.__DOMAIN__+*.__CLUSTER__.__DOMAIN__'
-        config:
-          - server:
-            - server_name: '*.collections.__CLUSTER__.__DOMAIN__'
-            - listen:
-              - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
-            - index: index.html index.htm
-            - location /:
-              - proxy_pass: 'http://collections_downloads_upstream'
-              - proxy_read_timeout: 90
-              - proxy_connect_timeout: 90
-              - proxy_redirect: 'off'
-              - proxy_set_header: X-Forwarded-Proto https
-              - proxy_set_header: 'Host $http_host'
-              - proxy_set_header: 'X-Real-IP $remote_addr'
-              - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
-              - proxy_buffering: 'off'
-            - client_max_body_size: 0
-            - proxy_http_version: '1.1'
-            - proxy_request_buffering: 'off'
-            - include: snippets/ssl_hardening_default.conf
-            - include: snippets/collections.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
-            - access_log: /var/log/nginx/collections.__CLUSTER__.__DOMAIN__.access.log combined
-            - error_log: /var/log/nginx/collections.__CLUSTER__.__DOMAIN__.error.log
-
-      ### DOWNLOAD
-      arvados_download_ssl:
-        enabled: true
-        overwrite: true
-        requires:
-          cmd: create-initial-cert-download.__CLUSTER__.__DOMAIN__-download.__CLUSTER__.__DOMAIN__
-        config:
-          - server:
-            - server_name: download.__CLUSTER__.__DOMAIN__
-            - listen:
-              - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
-            - index: index.html index.htm
-            - location /:
-              - proxy_pass: 'http://collections_downloads_upstream'
-              - proxy_read_timeout: 90
-              - proxy_connect_timeout: 90
-              - proxy_redirect: 'off'
-              - proxy_set_header: X-Forwarded-Proto https
-              - proxy_set_header: 'Host $http_host'
-              - proxy_set_header: 'X-Real-IP $remote_addr'
-              - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
-              - proxy_buffering: 'off'
-            - client_max_body_size: 0
-            - proxy_http_version: '1.1'
-            - proxy_request_buffering: 'off'
-            - include: snippets/ssl_hardening_default.conf
-            - include: snippets/download.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
-            - access_log: /var/log/nginx/download.__CLUSTER__.__DOMAIN__.access.log combined
-            - error_log: /var/log/nginx/download.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls
index 49c86dd313c22041f1b8001a13d13ddcbbeb3319..f2c88c83cfa632ef41ce9afe23ffad63a25331d2 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls
@@ -17,7 +17,7 @@ nginx:
   ### SITES
   servers:
     managed:
-      arvados_webshell_default:
+      arvados_webshell_default.conf:
         enabled: true
         overwrite: true
         config:
@@ -28,16 +28,16 @@ nginx:
             - location /:
               - return: '301 https://$host$request_uri'
 
-      arvados_webshell_ssl:
+      arvados_webshell_ssl.conf:
         enabled: true
         overwrite: true
         requires:
-          cmd: create-initial-cert-webshell.__CLUSTER__.__DOMAIN__-webshell.__CLUSTER__.__DOMAIN__
+          __CERT_REQUIRES__
         config:
           - server:
             - server_name: webshell.__CLUSTER__.__DOMAIN__
             - listen:
-              - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
+              - __WEBSHELL_EXT_SSL_PORT__ http2 ssl
             - index: index.html index.htm
             - location /shell.__CLUSTER__.__DOMAIN__:
               - proxy_pass: 'http://webshell_upstream'
@@ -69,7 +69,8 @@ nginx:
                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
 
             - include: snippets/ssl_hardening_default.conf
-            - include: snippets/webshell.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
             - access_log: /var/log/nginx/webshell.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/webshell.__CLUSTER__.__DOMAIN__.error.log
 

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls
index c9671cd0c263625a7262677f27abe00bb95051a5..9658c620cf0f9ac2258a52f43f648c3a1d67efc0 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls
@@ -16,7 +16,7 @@ nginx:
   servers:
     managed:
       ### DEFAULT
-      arvados_websocket_default:
+      arvados_websocket_default.conf:
         enabled: true
         overwrite: true
         config:
@@ -27,11 +27,11 @@ nginx:
             - location /:
               - return: '301 https://$host$request_uri'
 
-      arvados_websocket_ssl:
+      arvados_websocket_ssl.conf:
         enabled: true
         overwrite: true
         requires:
-          cmd: create-initial-cert-ws.__CLUSTER__.__DOMAIN__-ws.__CLUSTER__.__DOMAIN__
+          __CERT_REQUIRES__
         config:
           - server:
             - server_name: ws.__CLUSTER__.__DOMAIN__
@@ -54,6 +54,7 @@ nginx:
             - proxy_http_version: '1.1'
             - proxy_request_buffering: 'off'
             - include: snippets/ssl_hardening_default.conf
-            - include: snippets/ws.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
             - access_log: /var/log/nginx/ws.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/ws.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls
index bd4123539e4192f323a802c57161084829a36e2c..a821b521fa27d88582760ccf77220d5670d820ca 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls
@@ -14,7 +14,7 @@ nginx:
   servers:
     managed:
       ### DEFAULT
-      arvados_workbench2_default:
+      arvados_workbench2_default.conf:
         enabled: true
         overwrite: true
         config:
@@ -25,11 +25,11 @@ nginx:
             - location /:
               - return: '301 https://$host$request_uri'
 
-      arvados_workbench2_ssl:
+      arvados_workbench2_ssl.conf:
         enabled: true
         overwrite: true
         requires:
-          cmd: create-initial-cert-workbench2.__CLUSTER__.__DOMAIN__-workbench2.__CLUSTER__.__DOMAIN__
+          __CERT_REQUIRES__
         config:
           - server:
             - server_name: workbench2.__CLUSTER__.__DOMAIN__
@@ -44,6 +44,7 @@ nginx:
             - location /config.json:
               - return: {{ "200 '" ~ '{"API_HOST":"__CLUSTER__.__DOMAIN__:__CONTROLLER_EXT_SSL_PORT__"}' ~ "'" }}
             - include: snippets/ssl_hardening_default.conf
-            - include: snippets/workbench2.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
             - access_log: /var/log/nginx/workbench2.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/workbench2.__CLUSTER__.__DOMAIN__.error.log

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls
index ec28b98c60da3930d3bb28db35e8c9dfd4fa44b5..32904a12b2cd5cf87899ebe6f74cae534a513db2 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls
@@ -23,7 +23,7 @@ nginx:
   servers:
     managed:
       ### DEFAULT
-      arvados_workbench_default:
+      arvados_workbench_default.conf:
         enabled: true
         overwrite: true
         config:
@@ -34,11 +34,11 @@ nginx:
             - location /:
               - return: '301 https://$host$request_uri'
 
-      arvados_workbench_ssl:
+      arvados_workbench_ssl.conf:
         enabled: true
         overwrite: true
         requires:
-          cmd: create-initial-cert-workbench.__CLUSTER__.__DOMAIN__-workbench.__CLUSTER__.__DOMAIN__
+          __CERT_REQUIRES__
         config:
           - server:
             - server_name: workbench.__CLUSTER__.__DOMAIN__
@@ -55,7 +55,8 @@ nginx:
               - proxy_set_header: 'X-Real-IP $remote_addr'
               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
             - include: snippets/ssl_hardening_default.conf
-            - include: snippets/workbench.__CLUSTER__.__DOMAIN___letsencrypt_cert[.]conf
+            - ssl_certificate: __CERT_PEM__
+            - ssl_certificate_key: __CERT_KEY__
             - access_log: /var/log/nginx/workbench.__CLUSTER__.__DOMAIN__.access.log combined
             - error_log: /var/log/nginx/workbench.__CLUSTER__.__DOMAIN__.error.log