ssl - avoid hardcoded cert pahts
diff --git a/nginx/files/_ssl.conf b/nginx/files/_ssl.conf
index 2914885..f073653 100644
--- a/nginx/files/_ssl.conf
+++ b/nginx/files/_ssl.conf
@@ -1,5 +1,11 @@
{%- if site.get('ssl', {'enabled': False}).get('enabled', False) %}
+
+ {%- set ca_file=site.ssl.get('ca_file', '') %}
+ {%- set key_file=site.ssl.get('key_file', '/etc/ssl/private/{0}.key'.format(site.host.name)) %}
+ {%- set cert_file=site.ssl.get('cert_file', '/etc/ssl/certs/{0}.crt'.format(site.host.name)) %}
+ {%- set chain_file=site.ssl.get('chain_file', '/etc/ssl/certs/{0}-with-chain.crt'.format(site.host.name)) %}
+
ssi on;
ssl on;
ssl_session_cache shared:SSL:10m;
@@ -7,16 +13,11 @@
{%- if site.ssl.engine is not defined %}
- {%- if site.ssl.key_file is defined %}
- ssl_certificate_key {{ site.ssl.key_file }};
- ssl_certificate {{ site.ssl.cert_file }};
- {%- else %}
- ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
+ ssl_certificate_key {{ key_file }};
{%- if site.ssl.chain is defined or site.ssl.authority is defined %}
- ssl_certificate /etc/ssl/certs/{{ site.host.name }}-with-chain.crt;
+ ssl_certificate {{ chain_file }};
{%- else %}
- ssl_certificate /etc/ssl/certs/{{ site.host.name }}.crt;
- {%- endif %}
+ ssl_certificate {{ cert_file }};
{%- endif %}
{%- elif site.ssl.engine == 'letsencrypt' %}
@@ -29,8 +30,8 @@
{%- elif site.ssl.engine == 'salt' %}
- ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
- ssl_certificate /etc/ssl/certs/{{ site.host.name }}-with-chain.crt;
+ ssl_certificate_key {{ key_file }};
+ ssl_certificate {{ chain_file }};
{%- endif %}