Previously the SSL block always generated a self-signed cert at a
hardcoded /etc/nginx/ssl/<server_name>.{crt,key}. That worked for
test/internal use but is unusable for production HTTPS (Let's Encrypt
/ commercial certs): users couldn't point nginx at their own files
without editing the script after generation.
Add three fields (defaults preserve prior behavior):
ssl_cert_source select self_signed|existing
self_signed (default) - existing behavior,
openssl req generates the cert at
/etc/nginx/ssl/<server_name>.{crt,key}.
existing - skip openssl entirely,
use user-supplied ssl_cert_path /
ssl_key_path.
ssl_cert_path text absolute path to fullchain/cert (existing only)
ssl_key_path text absolute path to private key (existing only)
Validation (raised at render time, before script generation):
- ssl_cert_source=existing requires both paths
- both paths must start with '/' (absolute)
Runtime behavior when existing files aren't readable (e.g. certbot
hasn't run yet): script emits a clear WARN with a hint to deploy the
cert first, and continues. nginx -t will fail in that case but the
operator can re-run the script after the cert is in place, or run
'nginx -s reload' directly.
Verified:
- self_signed: full pipeline OK, real openssl produces a valid cert,
real nginx -t passes.
- existing + Let's Encrypt style paths pointing at real certs:
nginx -t passes; no openssl invocation in the script.
- existing + cert files absent: WARN emitted on stderr, script exits 0,
nginx -t skipped (would fail by design — operator runs certbot then
reloads).
- existing with missing path: ValueError at render time.
- existing with relative path: ValueError at render time.
- All 50 generators still pass 'bash -n'.
Your Name
cb1566c400