My current setup is nginx for a specific domain, which redirects all requests to https. But I have several subdomains which point directly to Google for Apps services (email, calendar, drive). These cannot be https because Google of course does not have a certificate for those. My end-goal is to have a HSTS header which has an includeSubdomains part for the main-domain.
To achieve this: Instead of having a CNAME of these subdomains point to ghs.google.com (email.example.com, calender.example.com, drive.example.com), which is the recommended option. I want to point them to my own server and redirect to the specific (but personalised) urls:
- https://mail.google.com/a/example.com
- https://www.google.com/calendar/hosted/example.com
- https://drive.google.com/a/example.com
Question 1: Do you recommend against this? Any other possibilities?
However, it seems the recommended way to redirect a domain in nginx, is to have a separate server-block for each domain, if you want to have them point to a different url. But those ssl-server blocks are quite large even for a simple redirect:
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name email.example.com;
access_log /var/log/nginx/ghs.example.com/access.log;
error_log /var/log/nginx/ghs.example.com/error.log;
ssl_certificate /etc/letsencrypt/live/ghs.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ghs.example.com/privkey.pem;
gzip off;
add_header Strict-Transport-Security "max-age=15811200 includeSubDomains";
include server.d/letsencrypt.conf;
return 302 https://mail.google.com/a/example.com;
}
Repeated 3 times.
I would much rather have this bock have server_name email.example.com calendar.example.com drive.example.com; and a redirect which separates them to their specific urls. But the nginx docs always quite explicitly recommends against this. And says I should use separate server blocks.
Question 2: Which options do I use? Is there another option to reduce the size of the duplicate configurations?
