Convert Nginx code

[fred666333]

Hello,
I cannot figure out how to allow access to certain directories. I need this Nginx code converted to Unit:

location ~ /.well-known { allow all; }

Thanks

Fred

[ac000]

Maybe this help...

[fred666333]

Not exactly. Nginx needs the above code in order to renew with webroot plugin. Otherwise it throws a 403 error. Certbot renew with unit throws a 404 error. So I guess I need an equivalent code for unit. I can't see that your link address this.

BTW: I changed the Nginx code to

location ~ /.well-known/ { allow 192.168.0.0/24; } , which should be more secure.

Fred

[ac000]

403 vs 404 so not same problem...

Seeing as you're getting a 404, looks like you need to point to the right location... in nginx like so

        location /.well-known/acme-challenge {
                alias /path/to/.well-known/acme-challenge;
        }

In Unit

"acme": [
            {
                "match": {
                    "uri": "/.well-known/acme-challenge/*"
                },

                "action": {
                    "share": "/path/to/parent_of_.well-known$uri/"
                }
            }
        ]

[fred666333]

Thanks,
Part of your code I have already tested:

{ "match": { "uri": "/.well-known/acme-challenge/*" }, "action": { "share": "/path/to/parent_of_.well-known$uri/" } }
It was still 404.

I did not use the bracelets. "acme": []. Is that important?

Fred

[ac000]

That's to link the routes to the listener... see the full example here.

[fred666333]

Thanks,

My code looks like this.
{ "listeners": { "*:80": { "pass": "routes" }, "*:443": { "pass": "routes", "tls": { "certificate": "bundle2" } } }, "routes": [ { "match": { "scheme": "http" }, "action": { "return": 301, "location": "https://$host$request_uri" }
Below these lines I placed:
{ "match": { "uri": "/.well-known/acme-challenge/*" }, "action": { "share": "/path/to/parent_of_.well-known$uri/" } }

It gave a 404.

Now I have given up the webroot plugin and use standalone. With a pre_hook "systemctl stop unit" and a post_hook "systemctl start unit" I could do a dry-run sucessfully.

Fred