# The "auto_ssl" shared dict should be defined with enough storage space to # hold your certificate data. 1MB of storage holds certificates for # approximately 100 separate domains. lua_shared_dict auto_ssl 1m; # The "auto_ssl" shared dict is used to temporarily store various settings # like the secret used by the hook server on port 8999. Do not change or # omit it. lua_shared_dict auto_ssl_settings 64k; # A DNS resolver must be defined for OCSP stapling to function. # # This example uses Google's DNS server. You may want to use your system's # default DNS servers, which can be found in /etc/resolv.conf. If your network # is not IPv6 compatible, you may wish to disable IPv6 results by using the # "ipv6=off" flag (like "resolver 8.8.8.8 ipv6=off"). resolver $RESOLVER_ADDRESS; # Initial setup tasks. init_by_lua_block { auto_ssl = (require "resty.auto-ssl").new() auto_ssl:set("ca", '$LETSENCRYPT_URL') -- Define a function to determine which SNI domains to automatically handle -- and register new certificates for. Defaults to not allowing any domains, -- so this must be configured. auto_ssl:set("allow_domain", function(domain) return ngx.re.match(domain, '$ALLOWED_DOMAINS', 'ijo') end) auto_ssl:init() } init_worker_by_lua_block { auto_ssl:init_worker() } server { listen 127.0.0.1:8999; # Increase the body buffer size, to ensure the internal POSTs can always # parse the full POST contents into memory. client_body_buffer_size 128k; client_max_body_size 128k; location / { content_by_lua_block { auto_ssl:hook_server() } } }