un1ko85

Let's Encrypt with Nginx

Here's how I set up a tiny Nginx/Rails server that uses HTTPS via a Let's Encrypt issued certificate.

https://letsencrypt.paddd.de/

Server

I use the smallest DigitalOcean droplet (512 MB) here, which is built from the "Ubuntu Ruby on Rails on 14.04" image provided by them.

un1ko85

Install Supervisor with sudo apt-get install supervisor. Ensure it's started with sudo service supervisor restart.

In /etc/supervisord/conf.d/ create a .conf file. In this example, laravel_queue.conf (contents below). Give it execute permissions: chmod +x laravel_queue.conf.

This file points at /usr/local/bin/run_queue.sh, so create that file there. Give this execute permissions, too: chmod +x run_queue.sh.

Now update Supervisor with: sudo supervisorctl reread. And start using those changes with: sudo supervisorctl update.

un1ko85

server {
    listen       80;
    server_name  site.dev;
    index        index.php;
    root         /Users/balkon_smoke/Sites/site.dev/web;

    error_log   /Users/balkon_smoke/Sites/site.dev/logs/error.log;
    access_log  /Users/balkon_smoke/Sites/site.dev/logs/access.log;

    location / {

un1ko85

<script type="text/javascript">
    (function () {
      "use strict";
      // once cached, the css file is stored on the client forever unless
      // the URL below is changed. Any change will invalidate the cache
      var css_href = './index_files/web-fonts.css';
      // a simple event handler wrapper
      function on(el, ev, callback) {
        if (el.addEventListener) {
          el.addEventListener(ev, callback, false);

un1ko85

# read more at https://terrty.net/2014/ssl-tls-in-nginx/
# latest version on https://gist.github.com/paskal/628882bee1948ef126dd/126e4d1daeb5244aacbbd847c5247c2e293f6adf
# security test score: https://www.ssllabs.com/ssltest/analyze.html?d=terrty.net
# your nginx version might not have all directives included, test this configuration before using in production against your nginx:
# $ nginx -c /etc/nginx/nginx.conf -t

server {
        # public key, contains your public key and class 1 certificate, to create:
        # (example for startssl)
        # $ (cat example.com.pem & wget -O - https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem) | tee -a /etc/nginx/ssl/domain.pem > /dev/null

un1ko85

// Fonts mixin
font-url(file)
  return '../fonts/' + file

webfont(family, file, hack-chrome-windows = false, weight = 'normal')
  @font-face
    font-family family
    src url(font-url(file + '.eot'))
    src url(font-url(file + '.eot?#iefix')) format('embedded-opentype'),
        url(font-url(file + '.woff')) format('woff'),