I’m not too sure whats going on here. My redirect files seem to have vanished! Looking at the backup vs the current conf folder, I can see nginx.conf_redirect , nginx.ssl.conf_redirect and nginx.forcessl.conf are missing:
We use hestia to redirect to www for ~800 domains, and these have letsencrypt enabled, so that https:// also works. The www is pointed to a CNAME elsewhere, but I don’t see that that should have any bearing on this.
Seems like it happens on LE renewal, it removes the auto https redirect and the standard redirect to www!
There is definatly something funky going on. It did it on 2 domains again last night. One of them being bestemmingmontferland.nl , looking at the logs I can see:
So it removes the forced ssl, and redirect, and then doesn’t put it back
Just as an update - the issue only seems to occur on sites that have a LE cert, and “force ssl”, and a redirect to another site. I tried doing it without the LE cert, but it won’t do the 301’s ok on the https, due to there obviously not being a valid certificate any more
I only took a quick look to v-add-letsencrypt-domain, but the problem seems to be this:
if [ -n "$mail" ]; then
root_domain=$domain
domain="mail.$root_domain"
webmail=$(get_object_value "mail" "DOMAIN" "$root_domain" '$WEBMAIL')
if [ -n "$webmail" ]; then
aliases="$WEBMAIL_ALIAS.$root_domain"
fi
else
parse_object_kv_list $(grep "DOMAIN='$domain'" $USER_DATA/web.conf)
domain_redirect="$REDIRECT"
if [[ -n "$domain_redirect" ]]; then
domain_redirect_code="$REDIRECT_CODE"
$BIN/v-delete-web-domain-redirect $user $domain
fi
domain_forcessl="$SSL_FORCE"
if [[ "$domain_forcessl" == 'yes' ]]; then
$BIN/v-delete-web-domain-ssl-force $user $domain
fi
fi
When adding or updating a certificate, if the domain has a redirect or is enforcing SSL, the script removes these configurations. The problem arises if the certificate is not issued for any reason: the script will exit, but neither the redirect nor the SSL enforcement will be re-created.
The function check_result terminates the script if an error occurs. There are 17 calls to check_result between the deletion of the redirect/SSL enforcement and their re-creation, meaning:
1.- We could remove the deletion of the redirect and/or SSL enforcement, but I’m not entirely sure why these are removed at the start of the process.
or
2.- We could create a function to reapply the redirect/SSL enforcement (if they previously existed) before calling check_result.
As mentioned, I only took a quick look and did not debug or test this, so there may be additional factors to consider.
