[Fix] Stronger match for acme-challenge nginx location

[jlescher]

The problem

If an application (for instance roundcube) installed at the root of a
subdomain has the following nginx configuration:

location ~ ^/(.+/|)\. {
	deny all;
}

acme-challenge matching location:

location '/.well-known/acme-challenge'
{
	default_type "text/plain";
	alias /tmp/acme-challenge-public/;
}

will not be used.

Solution

After acme-challenge match, prevent further matching by regular expressions.

PR Status

How to test

Create a subdomain.
Install roundcube on the subdomain.
Try to generate a lets encrypt certificate.

Validation

• Principle agreement 0/2 :
• Quick review 0/1 :
• Simple test 0/1 :
• Deep review 0/1 :

[alexAubin]

Hey, thank you very much for this ! That looks like an easy fix !

The tricky part though (or maybe not so tricky ?) would be to update existing files on people's setup.

Recently I was thinking that in the short/mid-term, we should also maybe move this file to be handled as common snippet called directly in the domain.tld.conf file (somewhere around here), which makes more sense than adding a file in domain.tld.d/ for all each domain.

[jlescher]

Hello and thank you for your answer !

I don't really know how to take the next steps (I only installed yunohost today and I am not a web developer). If I manage to find some spare time, I can try to dig into this but it is highly unlikely.

Feel free to make any modification that you wish !

[alexAubin]

No problem, I'll try to have a look :) Thanks for the PR !

[Psycojoker]

That PR looks good to me :)

I have yet to test it but I think we can merge it without that much risks quite soon.

Thanks for your contribution ❤️

[JimboJoe]

LGTM and tested successfully with a previously failing certificate renewal with netdata 👍

[Psycojoker]

Great, merging, thanks a lot for this pr ❤️