# nginx-proxy

Shared nginx + certbot (Cloudflare DNS challenge) under /opt/nginx. Apps publish
themselves with `tasks_from: add_vhost`; see the header of tasks/add_vhost.yml.

Layout on the host:

    /opt/nginx/
      docker-compose.yml  .env (0600)
      conf.d/        00-global.conf + one <app>.conf per vhost   -> /etc/nginx/conf.d
      certs/         certbot state (live/, archive/, renewal/)   -> /etc/letsencrypt, /etc/nginx/certs
      cert-domains/  one empty file per domain (filename = domain)
      scripts/       certbot-init.sh

Required variables: `nginx_proxy_certbot_email`, and `vault_cloudflare_api_token`
(or `nginx_proxy_cloudflare_api_token`).

Prerequisite (manual): a DNS record for each app domain pointing at this host.

Staging: set `nginx_proxy_certbot_staging: true` to test the DNS challenge without
using Let's Encrypt rate limits. Staging certs are skipped-as-existing afterwards, so
to move a domain to a real cert: `docker exec certbot certbot delete --cert-name <domain>`
and re-run its play.

Retire a domain: delete its cert-domains/ marker and conf.d/<app>.conf, reload nginx,
then `docker exec certbot certbot delete --cert-name <domain>`.

Pin nginx older than 1.25.1? Set `nginx_proxy_http2: false` (the template uses `http2 on;`).