Clojurians Log v2

> Is /etc/nginx/sites-available/app the nginx config file? > vs /etc/nginx/sites-available/default Yeah, Biff uses /etc/nginx/sites-available/app

You can add another A record for that points to the droplet, and then run certbot --nginx on the server again (that command is the last part of server-setup.sh and when it asks for the domains, do ,

certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: groundedsol.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

Following up on nginx: Added below rule to /etc/nginx/sites-available/default

server {
    listen 80;
    server_name ;
    
    # Redirect  to 
    return 301 $$request_uri;
}

So far still getting error when trying to load address.

Your connection is not private
Attackers might be trying to steal your information from  (for example, passwords, messages, or credit cards). Learn more about this warning
net::ERR_CERT_COMMON_NAME_INVALID

> But when I log into to root via ssh and run certbot --nginx`` I get below prompt. I don’t see option to include the www variant. hm, I guess you have to somehow tell certbot that you want an entirely new certificate or something. the easiest thing might be to just the entire nginx config first, i.e. run this bit from server-setup.sh manually on the server (as root):

cat > /etc/nginx/sites-available/app << EOD
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    root /home/app/target/resources/public;
    location / {
        try_files \$uri \$uri/index.html @resources;
    }
    location @resources {
        root /home/app/resources/public;
        try_files \$uri \$uri/index.html @proxy;
    }
    location @proxy {
        proxy_pass ;
        proxy_http_version 1.1;
        proxy_set_header Host \$host;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Real-IP \$remote_addr;
    }
}
EOD

> So far still getting error when trying to load address. [...] yeah, that'll happen until you get the letsencrypt cert working.

After running that bit of script, certbot --nginx command did indeed ask for the domain list as a string. It seemed to recognize one domain already existed in the cert, and offered to “expand” and “renew” the cert. http://www.groundedsol.com seems to be resolving now without browser warning. 👏 🎉 Thank for for the detailed instructions!

Is /etc/nginx/sites-available/app the nginx config file? vs /etc/nginx/sites-available/default

Now nginx config looks like this:

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    root /home/app/target/resources/public;
    location / {
        try_files $uri $uri/index.html @resources;
    }
    location @resources {
        root /home/app/resources/public;
        try_files $uri $uri/index.html @proxy;
    }
    location @proxy {
        proxy_pass ;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Real-IP $remote_addr;
    }
}
server {
    server_name groundedsol.com www.groundedsol.com; # managed by Certbot
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    root /home/app/target/resources/public;
    location / {
        try_files $uri $uri/index.html @resources;
    }
    location @resources {
        root /home/app/resources/public;
        try_files $uri $uri/index.html @proxy;
    }
    location @proxy {
        proxy_pass ;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Real-IP $remote_addr;
    }


    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/groundedsol.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/groundedsol.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}server {
    if ($host = www.groundedsol.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = groundedsol.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80 ;
    listen [::]:80 ;
    server_name groundedsol.com www.groundedsol.com;
    return 404; # managed by Certbot

}

You can add another A record for that points to the droplet, and then run certbot --nginx on the server again (that command is the last part of server-setup.sh and when it asks for the domains, do ,. It might be best to also redirect one of the domains to the other... it'd be easy to write some middleware for that, or I'm sure you could do it in the nginx config without too much trouble.

Thanks for the leads! I’ll try that