I have an Ubuntu-server 16.04 VPS and Nginx. Now I'm implementing HTTP1 (without TLS, utilizing port 80) but I desire to go "one step forward" and work with HTTP2 (with TLS, utilizing port 443), for all my (Wordpress) websites.
Assuming I adjusted my environment, this way:
1. Firewall
ufw app list # Choose Nginx HTTPS
2. Server blocks
Default server block
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name server_domain_or_IP;
return 302 https://$server_name$request_uri;
}
server {
# SSL configuration
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
include snippets/self-signed.conf;
include snippets/ssl-params.conf;
}
Each site server block
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
root /var/www/html/example.com;
index index.php index.html index.htm index.nginx-debian.html;
example.com www.example.com;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
}
location ~ /\.ht {
deny all;
}
}
Now I need to create OpenSSL certificates, sign them with Let'sEncrypt, and associate them with each site dir, respectively.
My question:
How can the creation of OSSL certs, LE signage, and SDIR associating, be done as much automatic as possible from inside the terminal? Of course there is some part in which I need to verify a domain from my email, but beyond that, AFAIU, everything is done from the terminal, thus can be fully automated.
Can you share a Bash script code example (or a utilization of a particular utility, maybe GNU make
), that helps achieving that?
Notes
I would humbly prefer a dockerless solution (I read here and bedsides the fact it has to do with renewling, it also seems to implement docker which I have no intention to do for a small private server of less than 10 small sites, by means of minimalism).
I understand that creating, signing, and site dir associating, requires a different algorithm than renewaling. I am asking only on creating, signing and associating.
Why I even ask this question:
Well, I just want to use HTTP2 on my self-managed, minimal VPS (no kernel/shell customization, no compilations, almost no contrib utilities), and it seems insane to me to manually implement this algorithm for many sites, or each time a new site is added.