Letsencrypt on Ubuntu 16.04 with Nginx, Rails and Capistrano-Unicorn-Nginx

letsencrypt_setup.md

Install Letsencrypt

Install with apt-get

$ sudo apt-get update    
$ sudo apt-get install letsencrypt

Generate a strong DH

$ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Configure nginx

Generate the templates to customize

$ bundle exec rails g capistrano:unicorn_nginx:config

Copy the contents of nginx.conf.erb into the template file generated by capistrano-unicorn-nginx. Now run a setup to have the well-known directory already linked, so letsencrypt can be started:

$ bundle exec cap production setup

On the server, start letsencrypt. Webroot must be pointed to /usr/share/nginx/html.

$ sudo letsencrypt certonly -a webroot --webroot-path=/usr/share/nginx/html -d myhost.com

And follow the steps for the authentication. After the cert is generated, the certfiles will be in /etc/letsencrypt/live/myhost.com. Capistrano-unicorn-nginx is looking for cert files in /etc/ssl, so we want to just symlink.

$ sudo ln -s /etc/letsencrypt/live/myhost.com /etc/ssl/certs
$ sudo ln -s /etc/letsencrypt/live/myhost.com /etc/ssl/private

Enable SSL

In deploy/production.rb add the configuration for the ssl cert:

set :nginx_use_ssl, true
set :nginx_upload_local_cert, false
set :nginx_ssl_cert, "#{fetch(:nginx_server_name)}/fullchain.pem"
set :nginx_ssl_cert_key, "#{fetch(:nginx_server_name)}/privkey.pem"

Deploy

Now once again, run setup through capistrano

$ bundle exec cap production setup

If needed, restart unicorn and nginx.

Setup auto-renewal

$ sudo crontab -e

add the following lines:

30 2 * * 1 /usr/bin/letsencrypt renew >> /var/log/le-renew.log
35 2 * * 1 /bin/systemctl reload nginx

Done!

nginx.conf.erb

upstream unicorn_<%= fetch(:nginx_config_name) %> {
<% if fetch(:unicorn_use_tcp) %>
  <% roles(:app).each do |role| %>
    server <%= role.hostname %>:<%= fetch(:unicorn_tcp_listen_port)%> fail_timeout=0;
  <% end %>
<% else %>
  server unix:/tmp/unicorn.<%= fetch(:nginx_config_name) %>.sock fail_timeout=0;
<% end %>
}

<% if fetch(:nginx_use_ssl) %>
server {
  listen 80;
  server_name <%= fetch(:nginx_server_name) %>;
  rewrite ^(.*) https://$host$1 permanent;
}
<% end %>

server {
<% if fetch(:nginx_use_ssl) %>
  <% if fetch(:nginx_use_spdy) %>
  listen 443 spdy;
  <% else %>
  listen 443;
  <% end %>
  ssl on;
  ssl_certificate <%= nginx_ssl_cert_file %>;
  ssl_certificate_key <%= nginx_ssl_cert_key_file %>;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_dhparam /etc/ssl/certs/dhparam.pem;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_stapling on;
  ssl_stapling_verify on;
  add_header Strict-Transport-Security max-age=15768000;
<% else %>
  listen 80;
<% end %>

  client_max_body_size 4G;
  keepalive_timeout 10;

  error_page 500 502 504 /500.html;
  error_page 503 @503;

  server_name <%= fetch(:nginx_server_name) %>;
  root <%= current_path %>/public;
  try_files $uri/index.html $uri @unicorn_<%= fetch(:nginx_config_name) %>;

  location ~ /.well-known {
    allow all;
    root /usr/share/nginx/html;
  }

  location @unicorn_<%= fetch(:nginx_config_name) %> {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
<% if fetch(:nginx_use_ssl) %>
    proxy_set_header X-Forwarded-Proto https;
<% end %>
    proxy_pass http://unicorn_<%= fetch(:nginx_config_name) %>;
    # limit_req zone=one;
    access_log <%= nginx_access_log_file %>;
    error_log <%= nginx_error_log_file %>;
  }

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  location = /50x.html {
    root html;
  }

  location = /404.html {
    root html;
  }

  location @503 {
    error_page 405 = /system/maintenance.html;
    if (-f $document_root/system/maintenance.html) {
      rewrite ^(.*)$ /system/maintenance.html break;
    }
    rewrite ^(.*)$ /503.html break;
  }

  if ($request_method !~ ^(GET|HEAD|PUT|PATCH|POST|DELETE|OPTIONS)$ ){
    return 405;
  }

  if (-f $document_root/system/maintenance.html) {
    return 503;
  }

}

nginx.conf.www-redirect.erb

# Use this config when you have a www host and want to redirect all non-www traffic to www
upstream unicorn_<%= fetch(:nginx_config_name) %> {
<% if fetch(:unicorn_use_tcp) %>
  <% roles(:app).each do |role| %>
    server <%= role.hostname %>:<%= fetch(:unicorn_tcp_listen_port)%> fail_timeout=0;
  <% end %>
<% else %>
  server unix:/tmp/unicorn.<%= fetch(:nginx_config_name) %>.sock fail_timeout=0;
<% end %>
}

<% if fetch(:nginx_use_ssl) %>
server {
  listen 80;
  server_name <%= fetch(:nginx_server_name) %>;
  rewrite ^(.*) https://$host$1 permanent;
}
<% if fetch(:nginx_server_name).include?('www.') %>
server {
  <% if fetch(:nginx_use_spdy) %>
      listen 443 spdy;
  <% else %>
      listen 443;
  <% end %>
  ssl on;
  ssl_certificate <%= nginx_ssl_cert_file %>;
  ssl_certificate_key <%= nginx_ssl_cert_key_file %>;
  server_name <%= fetch(:nginx_server_name).gsub('www.', '') %>;
  return 301 https://<%= fetch(:nginx_server_name) %>$request_uri;
}
<% end %>
<% end %>

server {
<% if fetch(:nginx_use_ssl) %>
  <% if fetch(:nginx_use_spdy) %>
  listen 443 spdy;
  <% else %>
  listen 443;
  <% end %>
  ssl on;
  ssl_certificate <%= nginx_ssl_cert_file %>;
  ssl_certificate_key <%= nginx_ssl_cert_key_file %>;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_dhparam /etc/ssl/certs/dhparam.pem;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_stapling on;
  ssl_stapling_verify on;
  add_header Strict-Transport-Security max-age=15768000;
<% else %>
  listen 80;
<% end %>

  client_max_body_size 4G;
  keepalive_timeout 10;

  error_page 500 502 504 /500.html;
  error_page 503 @503;

  server_name <%= fetch(:nginx_server_name) %>;
  root <%= current_path %>/public;
  try_files $uri/index.html $uri @unicorn_<%= fetch(:nginx_config_name) %>;

  location ~ /.well-known {
    allow all;
    root /usr/share/nginx/html;
  }

  location @unicorn_<%= fetch(:nginx_config_name) %> {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
<% if fetch(:nginx_use_ssl) %>
    proxy_set_header X-Forwarded-Proto https;
<% end %>
    proxy_pass http://unicorn_<%= fetch(:nginx_config_name) %>;
    # limit_req zone=one;
    access_log <%= nginx_access_log_file %>;
    error_log <%= nginx_error_log_file %>;
  }

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  location = /50x.html {
    root html;
  }

  location = /404.html {
    root html;
  }

  location @503 {
    error_page 405 = /system/maintenance.html;
    if (-f $document_root/system/maintenance.html) {
      rewrite ^(.*)$ /system/maintenance.html break;
    }
    rewrite ^(.*)$ /503.html break;
  }

  if ($request_method !~ ^(GET|HEAD|PUT|PATCH|POST|DELETE|OPTIONS)$ ){
    return 405;
  }

  if (-f $document_root/system/maintenance.html) {
    return 503;
  }

}

Great =)!!