HOWTO: Force https AND http2 AND Rewrite to non-www!!
Posted: Tue Nov 22, 2016 12:14 am
- SECURE! -> https / SSL enforcing
FAST! -> http2 (http/2)
MODERN! -> 'www' domains are old school
(THIS INSTRUCTION WAS TESTED AND WORKING ON DEBIAN 8, IT SHOULD WORK ON OTHER LINUX VARIANTS BUT THE FILE PATHS MAY DIFFER)
It all comes down to putting 2 template files in your /usr/local/vesta/data/templates/web/nginx/ folder:
File1 (the non-https to https rewrite file), name it http2-no-www.tpl :
Code: Select all
server {
listen %ip%:%proxy_port%;
server_name %domain_idn% %alias_idn%;
return 301 https://%domain_idn%$request_uri;
}
File2 (the https config file), name it http2-no-www.stpl :
Code: Select all
server {
listen %ip%:%proxy_ssl_port% http2 ssl;
server_name %alias_idn%;
ssl_certificate %ssl_pem%;
ssl_certificate_key %ssl_key%;
return 301 https://%domain_idn%$request_uri;
}
server {
listen %ip%:%proxy_ssl_port% http2 ssl;
server_name %domain_idn%;
ssl_certificate %ssl_pem%;
ssl_certificate_key %ssl_key%;
error_log /var/log/%web_system%/domains/%domain%.error.log error;
location / {
proxy_pass https://%ip%:%web_ssl_port%;
location ~* ^.+\.(%proxy_extentions%)$ {
root %sdocroot%;
access_log /var/log/%web_system%/domains/%domain%.log combined;
access_log /var/log/%web_system%/domains/%domain%.bytes bytes;
expires max;
try_files $uri @fallback;
}
}
location /error/ {
alias %home%/%user%/web/%domain%/document_errors/;
}
location @fallback {
proxy_pass https://%ip%:%web_ssl_port%;
}
location ~ /\.ht {return 404;}
location ~ /\.svn/ {return 404;}
location ~ /\.git/ {return 404;}
location ~ /\.hg/ {return 404;}
location ~ /\.bzr/ {return 404;}
include %home%/%user%/conf/web/s%proxy_system%.%domain%.conf*;
}
Go to your VestaCP panel and apply to your domains of choice, presto!
You don't even have to purchase a SSL certificate anymore if you dont want to, with the newest version of VestaCP you just have to tick the box that says 'Use LetsEncrypt' and you're off!
go check your sites with https://tools.keycdn.com/http2-test
(optionally you can apply the additional security beef-up suggested at https://weakdh.org/sysadmin.html with the exception that you should apply the suggested rules to the abovementioned stpl file, inside the server block), check this out:
ALL RIGHT!!
(leave a comment if it also worked for you)
NB if you're a fan of speed, also check out my PHP7+opcache tutorial: viewtopic.php?t=13053