From 9378ae4a001dd14ef819afd6559e3414755ba936 Mon Sep 17 00:00:00 2001
From: Pascal <pascal@pdev.dev>
Date: Sat, 6 Jun 2020 17:30:19 -0400
Subject: [PATCH] [add] added 403 catchall for invalid domains

---
 certbot/files/entrypoint.sh |  3 +++
 proxy/files/entrypoint.sh   |  7 ++++++-
 proxy/files/nginx.conf      | 20 ++++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/certbot/files/entrypoint.sh b/certbot/files/entrypoint.sh
index b2e9809..76cf689 100644
--- a/certbot/files/entrypoint.sh
+++ b/certbot/files/entrypoint.sh
@@ -261,6 +261,9 @@ function main()
         # load env variable with domains
         env_domain_file "$domain_file"
 
+        # create nixdomain cert for nginx if none exists (used for direct access)
+        init_cert "nixdomain"
+        
         # create temp certs for domains if none exists
         # nginx need certs to start
         read_file domain_init "$domain_file"
diff --git a/proxy/files/entrypoint.sh b/proxy/files/entrypoint.sh
index 0cbc6e8..9486600 100644
--- a/proxy/files/entrypoint.sh
+++ b/proxy/files/entrypoint.sh
@@ -199,6 +199,11 @@ function cert_exists()
     [ -f "$cert_path/fullchain.pem" ]
 }
 
+function dummy_cert_exists()
+{
+    cert_exists 0 nixdomain
+}
+
 function certs_daemon()
 {
     (
@@ -242,7 +247,7 @@ function nginx_handler()
 
     # wait for certs to exist before starting nginx
     # just have nginx crash after n retries (default 10)
-    while ! read_file cert_exists "$domain_file" && [ "$retries" -lt "$server_retries" ]; do
+    while ! read_file cert_exists "$domain_file" && ! dummy_cert_exists && [ "$retries" -lt "$server_retries" ]; do
         log nginx_handler "Waiting for certs to be created"
         retries=$(( retries+1 ))
         sleep_wait 1
diff --git a/proxy/files/nginx.conf b/proxy/files/nginx.conf
index 5013a92..161f65e 100644
--- a/proxy/files/nginx.conf
+++ b/proxy/files/nginx.conf
@@ -40,6 +40,26 @@ http {
         }
     }
 
+    # catch all non domains
+    server {
+        listen 8443 ssl;
+
+        # prevent redirecting to 8080 port
+        # (e.g. when trailing slash is missed)
+        port_in_redirect off;
+
+        server_name "";
+        
+        ssl_certificate        /service/ssl/nixdomain/fullchain.pem;
+        ssl_certificate_key    /service/ssl/nixdomain/privkey.pem;
+        
+        location / {
+            deny all;
+            return 403;
+        }
+
+    }
+    
     # the following variable is automatically populated via entrypoint.sh 
     #<SERVER>