add nginx configs

2025-12-19 04:54:18 +01:00 · 2022-02-13 14:17:45 +00:00
parent ece98e8e4e
commit 14299e65c7
3 changed files with 112 additions and 16 deletions
--- a/nginx/README.md
+++ b/nginx/README.md
@@ -1,7 +1,26 @@
-### Set up SSL access for the Ride The Lightning web UI on the RaspiBlitz

-Have a look a the script here: [bonus.SSL_for_RTL.sh](bonus.SSL_for_RTL.sh).
+## Add a custom subdomain
+
+In this example configuration a redirect is added to the mempool instance on the LAN:
+To download, check and run:
+```
+wget https://github.com/openoms/bitcoin-tutorials/raw/master/nginx/custom_website_subdomain.sh 
+
+cat custom_website_subdomain.sh
+
+bash custom_website_subdomain.sh
+```
+
+## Set up SSL access for the Ride The Lightning web UI on the RaspiBlitz
+
+Have a look through the script here: [bonus.SSL_for_RTL.sh](bonus.SSL_for_RTL.sh).
+
+To download, check and run:
+```
+wget https://github.com/openoms/bitcoin-tutorials/raw/master/nginx/bonus.SSL_for_RTL.sh 
+
+cat bonus.SSL_for_RTL.sh
+
+bash bonus.SSL_for_RTL.sh
+```

-To download and run:  
-`wget https://github.com/openoms/bitcoin-tutorials/raw/master/nginx/bonus.SSL_for_RTL.sh && bash bonus.SSL_for_RTL.sh`
-`
--- a/nginx/custom_website_subdomain.md
+++ b/nginx/custom_website_subdomain.md
@@ -0,0 +1,55 @@
+echo "Input your email:
+"
+read EMAIL
+
+echo "Input a subdomain set up with an A record pointing to this server:
+eg.: mempool.example.com
+"
+read SUBDOMAIN
+
+echo "Input the URL to be redirected to:
+eg.: https://192.168.1.42:4081
+"
+read REDIRECT
+
+sudo certbot certonly -a standalone -m $EMAIL --agree-tos \
+-d $SUBDOMAIN --expand -n --pre-hook "service nginx stop" \
+--post-hook "service nginx start" || exit 1
+
+# copy in place if needed
+#sudo cat /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem 
+#sudo cat /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem 
+
+# Add to /etc/nginx/sites-available/btcpayserver
+echo "
+server {
+  listen 443 ssl;
+  server_name $SUBDOMAIN;
+  ssl on;
+
+  ssl_certificate /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem;
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:SSL:50m;
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.1 TLSv1.2;
+  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
+  ssl_prefer_server_ciphers on;
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  ssl_trusted_certificate /etc/letsencrypt/live/$SUBDOMAIN/chain.pem;
+
+  location / {
+          proxy_pass      $REDIRECT;
+  }
+
+}" | sudo tee /etc/nginx/sites-available/$SUBDOMAIN
+
+
+sudo nano /etc/nginx/sites-available/$SUBDOMAIN
+
+sudo ln -s /etc/nginx/sites-available/$SUBDOMAIN /etc/nginx/sites-enabled/
+
+sudo nginx -t || exit 1
+
+sudo systemctl restart nginx
--- a/nginx/electrum_server_subdomain.sh
+++ b/nginx/electrum_server_subdomain.sh
@@ -0,0 +1,76 @@
+echo "Input your email:
+"
+read EMAIL
+
+echo "Input a subdomain set up with an A record pointing to this server:
+eg.: electrum.example.com
+"
+read SUBDOMAIN
+
+echo "Input the TCP port of the Electrum Server to be redirected to:
+eg.: https://192.168.1.42:50021
+"
+read REDIRECT
+
+
+sudo certbot certonly -a standalone -m $EMAIL --agree-tos \
+-d $SUBDOMAIN --expand -n --pre-hook "service nginx stop" \
+--post-hook "service nginx start" || exit 1
+
+
+# Setting up the nginx.conf
+    isConfigured=$(sudo cat /etc/nginx/nginx.conf 2>/dev/null | grep -c 'upstream fulcrum')
+    if [ ${isConfigured} -gt 0 ]; then
+            echo "fulcrum is already configured with Nginx. To edit manually run \`sudo nano /etc/nginx/nginx.conf\`"
+
+    elif [ ${isConfigured} -eq 0 ]; then
+
+            isStream=$(sudo cat /etc/nginx/nginx.conf 2>/dev/null | grep -c 'stream {')
+            if [ ${isStream} -eq 0 ]; then
+
+            echo "\
+stream {
+        upstream fulcrum {
+                server $REDIRECT;
+        }
+        server {
+                listen 50022 ssl;
+                proxy_pass fulcrum;
+                ssl_certificate /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem;
+                ssl_certificate_key /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem ;
+                ssl_session_cache shared:SSL-fulcrum:1m;
+                ssl_session_timeout 4h;
+                ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+                ssl_prefer_server_ciphers on;
+        }
+}" | sudo tee -a /etc/nginx/nginx.conf
+
+            elif [ ${isStream} -eq 1 ]; then
+                    sudo truncate -s-2 /etc/nginx/nginx.conf
+                    echo "\
+        upstream fulcrum {
+                server $REDIRECT;
+        }
+        server {
+                listen 50022 ssl;
+                proxy_pass fulcrum;
+                ssl_certificate /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem;
+                ssl_certificate_key /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem;
+                ssl_session_cache shared:SSL-fulcrum:1m;
+                ssl_session_timeout 4h;
+                ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+                ssl_prefer_server_ciphers on;
+        }
+}" | sudo tee -a /etc/nginx/nginx.conf
+
+            elif [ ${isStream} -gt 1 ]; then
+                    echo " Too many 'stream' commands in nginx.conf. Please edit manually: \`sudo nano /etc/nginx/nginx.conf\` and retry"
+                    exit 1
+            fi
+    fi
+
+# test nginx
+sudo nginx -t || exit 1
+
+# restart
+sudo systemctl restart nginx