move nginx https setup into a snippet

2 files changed, 15 insertions, 51 deletions

diff --git a/nginx/server.conf b/nginx/server.conf
index 60886400..802ba956 100644
--- a/nginx/server.conf
+++ b/nginx/server.conf
@@ -1,7 +1,6 @@
 server {
     listen 80;
     listen [::]:80;
-
     server_name www.grapheneos.org grapheneos.org;
 
     root /var/empty;
@@ -10,40 +9,18 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
+    include /etc/nginx/snippets/https.conf;
     server_name www.grapheneos.org;
 
-    ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
     root /var/empty;
 
     return 301 https://grapheneos.org$request_uri;
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
+    include /etc/nginx/snippets/https.conf;
     server_name grapheneos.org;
 
-    ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
     root /var/www/html;
 
     charset utf-8;
@@ -112,7 +89,6 @@ server {
 server {
     listen 80;
     listen [::]:80;
-
     server_name connectivitycheck.grapheneos.org;
 
     root /var/empty;
@@ -121,20 +97,9 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
+    include /etc/nginx/snippets/https.conf;
     server_name connectivitycheck.grapheneos.org;
 
-    ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
     root /var/empty;
 
     include /etc/nginx/snippets/security-headers.conf;
@@ -147,7 +112,6 @@ server {
 server {
     listen 80;
     listen [::]:80;
-
     server_name mta-sts.grapheneos.org;
 
     root /var/empty;
@@ -156,20 +120,9 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
+    include /etc/nginx/snippets/https.conf;
     server_name mta-sts.grapheneos.org;
 
-    ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-    ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
     root /var/www/mta-sts;
 
     include /etc/nginx/snippets/security-headers.conf;
diff --git a/nginx/snippets/https.conf b/nginx/snippets/https.conf
new file mode 100644
index 00000000..290a1e95
--- /dev/null
+++ b/nginx/snippets/https.conf
@@ -0,0 +1,11 @@
+listen 443 ssl http2;
+listen [::]:443 ssl http2;
+
+ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
+include /etc/letsencrypt/options-ssl-nginx.conf;
+ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
+ssl_stapling on;
+ssl_stapling_verify on;