generate https SNI terminating reverse proxy config for nginx + acmetool (note: everything in /etc/nginx/)

nginx.conf

user nginx;
worker_processes  10;

events {
  worker_connections  1024;
}

http {
  include       mime.types;
  default_type  application/octet-stream;

  sendfile        on;

  keepalive_timeout  65;

  upstream acmetool {
    server 127.0.0.1:402;
  }

  server {
    listen 80 default_server;
    listen [::]:80 default_server;

    location /.well-known/acme-challenge/ {
      proxy_pass http://acmetool;
    }

    location / {
      return 301 https://$host$request_uri;
    }
  }

  include /etc/nginx/vhosts/*.gen;
}

vhosts.map

# example map file

# lines starting with # or empty lines are ignored

# lines starting with / invoke a include directive:
www1.example.com /absolute/path/to/custom/include.conf

# all others invoke a location / { proxy_pass } directive:
www.example.com http://127.0.0.1:8080

vhosts.sh

#!/bin/zsh
rm /etc/nginx/vhosts/*.gen
grep -v '^\s*$\|^\s*\#' /etc/nginx/vhosts.map | while read name proxy
  do touch /var/lib/acme/desired/$name
  cat > /etc/nginx/vhosts/$name.gen <<END
server {
  server_name $name;
  ssl_certificate /var/lib/acme/live/$name/cert;
  ssl_certificate_key /var/lib/acme/live/$name/privkey;
  include /etc/nginx/vhosts_common.conf;
END
if [[ $proxy == '/'* ]]
  then echo "include $proxy;" >> /etc/nginx/vhosts/$name.gen
else
  cat >> /etc/nginx/vhosts/$name.gen <<END
  location / {
    proxy_pass   $proxy;
  }
END
fi
echo '}' >> /etc/nginx/vhosts/$name.gen
done

vhosts_common.conf

listen       443 ssl http2;
listen       [::]:443 ssl http2;

ssl_session_timeout 50m;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security max-age=15768000;