From 802fd78a9c00e0e6712891bf1fd6a5cb746b6e8d Mon Sep 17 00:00:00 2001
From: kevinnls <developer@kevinnlsamuel.com>
Date: Wed, 2 Sep 2026 14:20:49 +0530
Subject: [PATCH] better key generation flow

---
 .gitignore         |  2 +-
 Justfile           |  9 +++------
 Makefile           | 16 ++++++++++++++++
 conf.d/server.conf |  4 ++--
 4 files changed, 22 insertions(+), 9 deletions(-)
 create mode 100644 Makefile

diff --git a/.gitignore b/.gitignore
index 4a151c7..09196ba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-/ssl
+/tls
diff --git a/Justfile b/Justfile
index 2e3b3bb..c1a20c1 100644
--- a/Justfile
+++ b/Justfile
@@ -9,11 +9,8 @@ sh:
 logs:
 	podman logs --follow {{ NAME }}
 
-genssl DOMAIN='website.com':
-	mkdir -p ssl
-	openssl req -x509 -new -keyout ssl/key.pem -out ssl/cert.pem -noenc -days 3 \
-		-addext 'subjectAltName=DNS:sub.a.{{DOMAIN}},DNS:a.{{ DOMAIN }},DNS:b.{{DOMAIN}}' \
-		-subj '/CN={{ DOMAIN }}'
+@setup-tls:
+	make setup-tls
 
 container:
 	podman run \
@@ -22,5 +19,5 @@ container:
 		--publish 8443:443 \
 		--volume ./conf.d:/etc/nginx/conf.d:ro,z \
 		--volume ./www:/srv/www:ro,z \
-		--volume ./ssl:/etc/nginx/ssl:ro,z \
+		--volume ./tls:/etc/nginx/tls:ro,z \
 		nginx:alpine
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..b9a1da4
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,16 @@
+.PHONY: setup-tls
+
+DOMAIN ::= website.com
+
+setup-tls: tls/cert.pem
+
+tls/cert.pem: tls/key.pem
+	openssl req -x509 -new -key $< -out $@ -noenc -days 365 \
+		-addext 'subjectAltName=DNS:sub.a.$(DOMAIN),DNS:a.$(DOMAIN),DNS:b.$(DOMAIN)' \
+		-subj '/CN=$(DOMAIN)'
+
+tls/key.pem: tls/
+	openssl genpkey -out $@ -algorithm RSA -pkeyopt bits:4096
+
+tls/:
+	mkdir $@
diff --git a/conf.d/server.conf b/conf.d/server.conf
index bd374a9..0c8e6c8 100644
--- a/conf.d/server.conf
+++ b/conf.d/server.conf
@@ -5,8 +5,8 @@ map $host $flavour {
 }
 server {
 	listen 443 ssl;
-	ssl_certificate /etc/nginx/ssl/cert.pem;
-	ssl_certificate_key /etc/nginx/ssl/key.pem;
+	ssl_certificate /etc/nginx/tls/cert.pem;
+	ssl_certificate_key /etc/nginx/tls/key.pem;
 	server_name a.website.com b.website.com sub.a.website.com;
 
 	include 'conf.d/cookieattr.part';