2 files changed, 53 insertions, 6 deletions
diff --git a/internal/tmpl/nginx-app.conf.tmpl b/internal/tmpl/nginx-app.conf.tmpl
index b55a332..66ce0d5 100644
--- a/internal/tmpl/nginx-app.conf.tmpl
+++ b/internal/tmpl/nginx-app.conf.tmpl
@@ -2,14 +2,48 @@ upstream {{.Name}}_upstream {
 	server {{.IP}}:{{.Port}};
 }
 
+{{range .Domains}}
 server {
 	listen 80;
-	server_name {{.ServerName}};
+	server_name {{.Hostname}};
+
+	location ^~ /.well-known/acme-challenge/ {
+		root {{$.Webroot}};
+	}
+
+	location / {
+{{if .CertLive}}
+		return 301 https://{{$.PrimaryHostname}}$request_uri;
+{{else if .Primary}}
+		proxy_pass http://{{$.Name}}_upstream;
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+{{else if $.PrimaryCertLive}}
+		return 301 https://{{$.PrimaryHostname}}$request_uri;
+{{else}}
+		return 301 http://{{$.PrimaryHostname}}$request_uri;
+{{end}}
+	}
+}
+{{if .CertLive}}
+server {
+	listen 443 ssl;
+	server_name {{.Hostname}};
+
+	ssl_certificate     {{$.PrimaryLiveDir}}/fullchain.pem;
+	ssl_certificate_key {{$.PrimaryLiveDir}}/privkey.pem;
 
 	location / {
-		proxy_pass http://{{.Name}}_upstream;
+{{if .Primary}}
+		proxy_pass http://{{$.Name}}_upstream;
 		proxy_set_header Host $host;
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 		proxy_set_header X-Forwarded-Proto $scheme;
+{{else}}
+		return 301 https://{{$.PrimaryHostname}}$request_uri;
+{{end}}
 	}
 }
+{{end}}
+{{end}}
diff --git a/internal/tmpl/tmpl.go b/internal/tmpl/tmpl.go
index 12baa70..0213919 100644
--- a/internal/tmpl/tmpl.go
+++ b/internal/tmpl/tmpl.go
@@ -46,11 +46,24 @@ type RCData struct{ Name string }
 
 func RCScript(d RCData) (string, error) { return Render(rcScript, d) }
 
+// NginxDomain is one hostname in an app's vhost. CertLive gates HTTPS.
+type NginxDomain struct {
+	Hostname string
+	Primary  bool
+	CertLive bool
+}
+
 type NginxAppData struct {
-	Name       string
-	IP         string
-	Port       int
-	ServerName string
+	Name    string
+	IP      string
+	Port    int
+	Webroot string // ACME HTTP-01 challenge webroot, shared across apps
+
+	PrimaryHostname string
+	PrimaryCertLive bool
+	PrimaryLiveDir  string // certbot's live dir for the app's shared cert
+
+	Domains []NginxDomain
 }
 
 func NginxApp(d NginxAppData) (string, error) { return Render(nginxApp, d) }