Nginx introduces native support for ACME protocol

Post by 0x457 » Fri, Aug 15, 2025, 3:57 PM UTC

petee wrote: post #280

0x457 wrote: post #279

Earlier quoted context omitted.

I mean, you just repeated my explanation why supporting dns-01 in nginx isn't straightforward has http-01. I've explained why dns-01 challenge is still useful and might be required for some users.

I misread your first paragraph, and was more responding to the second that I took as supporting the adding the dns implementation in reply to the OP. It may still be required by some users, but I don't think that it makes sense for nginx

Post by cpach » Fri, Aug 15, 2025, 4:09 PM UTC

Arch-TK wrote: post #257

kind of feels unnecessary honestly... Automating webroot is trivial and I would rather use an external rust utility to handle it than a module for nginx. I guess if you _only_ need certs for your website then this helps but I have certs for a lot of other things too, so I need an external utility anyway. And no dns-01 support yet.

Post by aorth » Sun, Aug 17, 2025, 9:10 AM UTC

kstrauser wrote: post #17

elashri wrote: post #8

Earlier quoted context omitted.

What I really like about Caddy is their better syntax. I actually use nginx (via nginx proxy manager) and Traefik but recently I did one project with Caddy and found it very nice. I might get the time to change my selfhosted setup to use Caddy in the future but probably will go with something like pangolin [1] because it provides alternative to cloudflare tunnels too. [1] https://github.com/fosrl/pangolin

I agree. That, and the sane defaults are almost always nearly perfect for me. Here is the entire configuration for a TLS-enabled HTTP/{1.1,2,3} static server: something.example.com { root * /var/www/something.example.com file_server } That's the whole thing. Here's the setup of a WordPress site with all the above, plus PHP, plus compression: php.example.com { root * /var/www/wordpress encode php_fastcgi unix//run/php…

  (harden-wordpress) {
      @harden-wordpress expression `(
      !{path}.matches("/wp-includes/ms-files.php$")
          && ({path}.matches("(?i)/wp-includes/.*\\.php")
              || {path}.matches("(?i)/wp-admin/includes/.*\\.php")
              || {path}.matches("(?i)/wp-content/uploads/.*\\.php")
      )
      )`
      respond @harden-wordpress "Access denied" 403
  }

Post by selfmodruntime » Fri, Aug 22, 2025, 6:41 PM UTC

mholt wrote: post #291

selfmodruntime wrote: post #256

Earlier quoted context omitted.

Sure. University / Government sector. I know quite some unis/projects in that field that switched to caddy, since gigantic ip ranges and deep subdomains with stakeholders of many different classes have certain PKI requirements and caddy makes using ACME easy. We deploy a self serving tool where people can generate EAB-Ids and Hmac keys for a sub domain they own. Complex root domain routing and complex dynamic rewrite…

Thank you, this is amazing feedback/info. Yeah, we think the Tailscale integration is pretty neat too!