better key generation flow

.gitignore

@@ -1 +1 @@
-/ssl
+/tls

Justfile

@@ -9,11 +9,8 @@ sh:
 logs:
 	podman logs --follow {{ NAME }}
 
-genssl DOMAIN='website.com':
-	mkdir -p ssl
-	openssl req -x509 -new -keyout ssl/key.pem -out ssl/cert.pem -noenc -days 3 \
-		-addext 'subjectAltName=DNS:sub.a.{{DOMAIN}},DNS:a.{{ DOMAIN }},DNS:b.{{DOMAIN}}' \
-		-subj '/CN={{ DOMAIN }}'
+@setup-tls:
+	make setup-tls
 
 container:
 	podman run \
@@ -22,5 +19,5 @@ container:
 		--publish 8443:443 \
 		--volume ./conf.d:/etc/nginx/conf.d:ro,z \
 		--volume ./www:/srv/www:ro,z \
-		--volume ./ssl:/etc/nginx/ssl:ro,z \
+		--volume ./tls:/etc/nginx/tls:ro,z \
 		nginx:alpine

Makefile

@@ -0,0 +1,16 @@
+.PHONY: setup-tls
+
+DOMAIN ::= website.com
+
+setup-tls: tls/cert.pem
+
+tls/cert.pem: tls/key.pem
+	openssl req -x509 -new -key $< -out $@ -noenc -days 365 \
+		-addext 'subjectAltName=DNS:sub.a.$(DOMAIN),DNS:a.$(DOMAIN),DNS:b.$(DOMAIN)' \
+		-subj '/CN=$(DOMAIN)'
+
+tls/key.pem: tls/
+	openssl genpkey -out $@ -algorithm RSA -pkeyopt bits:4096
+
+tls/:
+	mkdir $@

conf.d/server.conf

@@ -5,8 +5,8 @@ map $host $flavour {
 }
 server {
 	listen 443 ssl;
-	ssl_certificate /etc/nginx/ssl/cert.pem;
-	ssl_certificate_key /etc/nginx/ssl/key.pem;
+	ssl_certificate /etc/nginx/tls/cert.pem;
+	ssl_certificate_key /etc/nginx/tls/key.pem;
 	server_name a.website.com b.website.com sub.a.website.com;
 
 	include 'conf.d/cookieattr.part';