DigitalOcean-Droplet-Deploy/cloud-init.yml at main · marksowell/DigitalOcean-Droplet-Deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#cloud-config
packages:
  - docker.io
  - docker-compose
  - certbot

write_files:
  - path: /srv/nginx/conf.d/default.conf
    permissions: '0644'
    owner: root:root
    content: |
      server {
        listen 80;
        server_name {{FQDN}};
        return 301 https://$host$request_uri;
      }

      server {
        listen 443 ssl http2;
        server_name {{FQDN}};

        ssl_certificate /etc/letsencrypt/live/{{FQDN}}/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/{{FQDN}}/privkey.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers off;

        location / {
          return 200 'nginx over HTTPS is working';
          add_header Content-Type text/plain;
        }
      }

runcmd:
  - systemctl enable docker
  - systemctl start docker
  - |
    while ! docker info >/dev/null 2>&1; do
      echo "Docker not ready yet... retrying in 15s"
      sleep 15
    done
    certbot certonly --standalone --non-interactive --agree-tos \
      -m {{EMAIL}} \
      -d {{FQDN}}
    docker run -d --name nginx-test --restart unless-stopped \
      -p 80:80 -p 443:443 \
      -v /srv/nginx/conf.d:/etc/nginx/conf.d:ro \
      -v /etc/letsencrypt:/etc/letsencrypt:ro \
      nginx:alpine
    mkdir -p /etc/letsencrypt/renewal-hooks/deploy
    echo '#!/bin/bash' > /etc/letsencrypt/renewal-hooks/deploy/restart-nginx-test.sh
    echo 'docker restart nginx-test' >> /etc/letsencrypt/renewal-hooks/deploy/restart-nginx-test.sh
    chmod +x /etc/letsencrypt/renewal-hooks/deploy/restart-nginx-test.sh