# sudo systemctl stop nginx.service
# sudo systemctl disable nginx.service
# sudo userdel -r nginx
# sudo rm -rf /etc/nginx
# sudo rm -rf /var/log/nginx
# sudo rm -rf /var/cache/nginx/
# sudo rm -rf /usr/lib/systemd/system/nginx.service

> Debian and Ubuntu users

You're recommended to install the following packages using apt-get:

$ apt-get install libpcre3-dev \
    libssl-dev perl make build-essential curl

> Fedora and RedHat users

You're recommended to install the following packages using yum:

$ yum install pcre-devel openssl-devel gcc curl

nginx path prefix: "/usr/local/openresty/nginx"
nginx binary file: "/usr/local/openresty/nginx/sbin/nginx"
nginx modules path: "/usr/local/openresty/nginx/modules"
nginx configuration prefix: "/usr/local/openresty/nginx/conf"
nginx configuration file: "/usr/local/openresty/nginx/conf/nginx.conf"
nginx pid file: "/usr/local/openresty/nginx/logs/nginx.pid"
nginx error log file: "/usr/local/openresty/nginx/logs/error.log"
nginx http access log file: "/usr/local/openresty/nginx/logs/access.log"
nginx http client request body temporary files: "client_body_temp"
nginx http proxy temporary files: "proxy_temp"
nginx http fastcgi temporary files: "fastcgi_temp"
nginx http uwsgi temporary files: "uwsgi_temp"
nginx http scgi temporary files: "scgi_temp"

 On the fly (and free) SSL registration and renewal inside OpenResty/nginx with Let's Encrypt.

$ sudo apt install build-essential libreadline-dev unzip

$ wget https://luarocks.org/releases/luarocks-3.8.0.tar.gz

$ tar zxpf luarocks-3.8.0.tar.gz

$ cd luarocks-3.8.0

# Note that in this command line separators are important

$ ./configure --prefix=/usr/local/openresty/luajit \

 --lua-suffix=jit \

 --with-lua-include=/usr/local/openresty/luajit/include/luajit-2.1 \

--with-lua=/usr/local/openresty/luajit/

$ sudo ln -s /usr/local/openresty/luajit/bin/luarocks /usr/bin/luarocks

$ sudo luarocks install lua-resty-auto-ssl

$ sudo mkdir /etc/resty-auto-ssl

$ sudo chown www-data /etc/resty-auto-ssl

http {
    # Conf for lua-auto-ssl
    # The "auto_ssl" shared dict should be defined with enough storage space to
    # hold your certificate data. 1MB of storage holds certificates for
    # approximately 100 separate domains.
    lua_shared_dict auto_ssl 2m;

    # The "auto_ssl_settings" shared dict is used to temporarily store various settings
    # like the secret used by the hook server on port 8999. Do not change or
    # omit it.
    lua_shared_dict auto_ssl_settings 64k;

    # A DNS resolver must be defined for OCSP stapling to function.
    #
    # This example uses Google's DNS server. You may want to use your system's
    # default DNS servers, which can be found in /etc/resolv.conf. If your network
    # is not IPv6 compatible, you may wish to disable IPv6 results by using the
    # "ipv6=off" flag (like "resolver 8.8.8.8 ipv6=off").
    resolver 8.8.8.8;

    # Initial setup tasks.
    init_by_lua_block {
        auto_ssl = (require "resty.auto-ssl").new()
        -- Define a function to determine which SNI domains to automatically handle
        -- and register new certificates for. Defaults to not allowing any domains,
        -- so this must be configured.
        auto_ssl:set("allow_domain", function(domain)
            -- ngx.log(ngx.STDERR, domain)
            -- Return false of restricted domains and IP address

            if string.find(domain, "www.example.com") then
                    return false
            end

            local http = require("resty.http")
            local httpc = http.new()
            httpc:set_timeout(3000)

            -- Make a API call to your web server for some custom logic to check whether to issue certificate for this domain or not
            local uri = "https://api.example.com/check-domain/" .. domain
            local res, err = httpc:request_uri(uri, {
                    ssl_verify = false,
                    method = "GET"
            })

            if not res then
                    return false
            end

            if res.status == 200 then
                    return true
            else
                    return false
            end

        end)

        -- This line should be present during development otherwise your account may hit rate limiting issues

        auto_ssl:set("ca", "https://acme-staging-v02.api.letsencrypt.org/directory")

        -- All certificates will be checked for renewal every 12 hrs
        -- Renewal happens if certificate expires in less than 30 days

        auto_ssl:set("renew_check_interval", 43200)

        auto_ssl:init()
    }

    init_worker_by_lua_block {
            auto_ssl:init_worker()
    }

    # Internal server running on port 8999 for handling certificate tasks.
    server {
    listen 127.0.0.1:8999;

    # Increase the body buffer size, to ensure the internal POSTs can always
    # parse the full POST contents into memory.
    client_body_buffer_size 128k;
    client_max_body_size 128k;

    location / {
        content_by_lua_block {
        auto_ssl:hook_server()
        }
    }
    }

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include conf.d/*.conf;
}

# Endpoint used for performing domain verification with Let's Encrypt.
location /.well-known/acme-challenge/ {
  content_by_lua_block {
    auto_ssl:challenge_server()
  }
}

# NextJS to serve custom domain
location / {
    proxy_pass http://localhost:3000;
    proxy_set_header Host $host;
}