Add support for http challenges for tls certificates

2 files changed, 54 insertions, 1 deletions

diff --git a/jobs/certificates.nomad.hcl b/jobs/certificates.nomad.hcl
index f5452a3..7284deb 100644
--- a/jobs/certificates.nomad.hcl
+++ b/jobs/certificates.nomad.hcl
@@ -16,6 +16,20 @@ job "certificates" {
       source = "ca-certificates"
     }
 
+    network {
+      port "http" { }
+    }
+
+    service {
+      name     = "certificates"
+      port     = "http"
+      provider = "nomad"
+
+      tags = [
+        "nginx.hijack_http=.dinlugnastund.se",
+      ]
+    }
+
     task "lego" {
       driver = "exec"
 
@@ -31,6 +45,7 @@ job "certificates" {
       template {
         data = <<EOF
 #!/usr/bin/env bash
+
 function dns() {
     [ -f "/lego/certificates/$1.key" ] && cmd="renew --days 45" || cmd=run
     /local/lego \
@@ -41,9 +56,22 @@ function dns() {
         $${@/#/-d=} \
         $cmd
 }
+
+function http() {
+    [ -f "/lego/certificates/$1.key" ] && cmd="renew --days 45" || cmd=run
+    /local/lego \
+        --accept-tos \
+        --path /lego \
+        --email mathias+certs@magnusson.space \
+        --http --http.port ":$NOMAD_PORT_http" \
+        $${@/#/-d=} \
+        $cmd
+}
+
 dns magnusson.space *.magnusson.space
 dns magnusson.wiki *.magnusson.wiki
 dns xn--srskildakommandorrelsegruppen-0pc88c.se *.xn--srskildakommandorrelsegruppen-0pc88c.se
+http dinlugnastund.se www.dinlugnastund.se
 EOF
         destination = "local/certs.sh"
       }
diff --git a/jobs/virtual-hosting.nomad.hcl b/jobs/virtual-hosting.nomad.hcl
index 638a1c9..fcf4f91 100644
--- a/jobs/virtual-hosting.nomad.hcl
+++ b/jobs/virtual-hosting.nomad.hcl
@@ -41,6 +41,26 @@ job "virtual-hosting" {
 
       template {
         data = <<EOF
+{{- $hijackHTTPHostnames := sprig_list -}}
+{{- $hijackUpstream := "" -}}
+{{- range $s := nomadServices -}}
+{{- range $tag := $s.Tags -}}
+  {{- if $tag | regexMatch "nginx.hijack_http=" -}}
+    {{- $hijackHTTPHostnames = $tag | replaceAll "nginx.hijack_http=" "" | split "," -}}
+    {{- $hijackUpstream = $s.Name | toLower | regexReplaceAll "[^a-z0-9\\-._]" "" -}}
+upstream {{ $hijackUpstream }} {
+  {{- range nomadService $s.Name }}
+  server {{ .Address }}:{{ .Port }};
+  {{- end }}
+}
+    {{- break -}}
+  {{- end -}}
+  {{- if ne (len $hijackHTTPHostnames) 0 -}}
+    {{- break -}}
+  {{- end -}}
+{{- end -}}
+{{- end }}
+
 {{- range nomadServices -}}
 
 {{- $hostname := "" -}}
@@ -77,8 +97,13 @@ server {
   server_name {{ $hostname }};
 
   location / {
-    proxy_pass http://{{ $upstream }};
+    {{ if $hijackHTTPHostnames | contains $hostname -}}
+      proxy_pass http://{{ $hijackUpstream }};
+    {{- else -}}
+      proxy_pass http://{{ $upstream }};
+    {{- end }}
 
+    proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Port $server_port;