Skip to content

Commit ddbfdf6

Browse files
the1tsjc21
authored andcommitted
Open up lets Encrypt acme challenge config (#165)
Since Lets Encrypt don't publish IP ranges that their acme challenge service will be sourced from, we need to allow free access to this location special to override any IP ACLs added by Advanced Custom Nginx Configuration. Due to the way Nginx config is applied, this only applies to the regex and below, keeping the IP ACLs working for the rest of the website.
1 parent 43c7063 commit ddbfdf6

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

rootfs/etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@
22
# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
33
# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
44
location ^~ /.well-known/acme-challenge/ {
5+
# Since this is for letsencrypt authentication of a domain and they do not give IP ranges of their infrastructure
6+
# we need to open up access by turning off auth and IP ACL for this location.
57
auth_basic off;
8+
allow all;
69

710
# Set correct content type. According to this:
811
# https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29

0 commit comments

Comments
 (0)