Configure resolvers for stapling with nginx
authorTom Hughes <tom@compton.nu>
Tue, 14 Feb 2017 19:15:35 +0000 (19:15 +0000)
committerTom Hughes <tom@compton.nu>
Tue, 14 Feb 2017 19:15:35 +0000 (19:15 +0000)
cookbooks/imagery/resources/site.rb
cookbooks/imagery/templates/default/nginx_imagery.conf.erb

index f8ab667..137153a 100644 (file)
@@ -94,11 +94,15 @@ action :create do
     domains base_domains.flat_map { |d| [d, "a.#{d}", "b.#{d}", "c.#{d}"] }
   end
 
+  resolvers = node[:networking][:nameservers].map do |resolver|
+    IPAddr.new(resolver).ipv6? ? "[#{resolver}]" : resolver
+  end
+
   nginx_site new_resource.name do
     template "nginx_imagery.conf.erb"
     directory "/srv/imagery/#{name}"
     restart_nginx false
-    variables new_resource.to_hash
+    variables new_resource.to_hash.merge(:resolvers => resolvers)
   end
 end
 
index b926d47..7001f79 100644 (file)
@@ -13,6 +13,8 @@ server {
     ssl_session_timeout 30m;
     ssl_stapling on;
     ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    resolver <%= @resolvers.join(" ") %>;
+    resolver_timeout 5s;
 
     root "/srv/<%= @name %>";
     rewrite ^/\.well-known/acme-challenge/(.*)$ http://acme.openstreetmap.org/.well-known/acme-challenge/$1 permanent;