Switch to http2

Switch to http2

### Redirects ###

# Change IP address to domain name
server {
    server_name     $server_addr;
    add_header      X-Frame-Options "SAMEORIGIN";
    return          301 https://www.albertyw.com$request_uri;
}

server {
    listen          80;
    server_name     _; # catch-all
    rewrite         ^ https://www.albertyw.com$request_uri;
}

# Change naked domain to www
server {
    listen          443 ssl http2;
    server_name     albertyw.com;

    ssl on;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers   on;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         10m;
    ssl_certificate             /etc/nginx/ssl/1_albertyw.com_bundle.crt;
    ssl_certificate_key         /etc/nginx/ssl/server.key;
    ssl_dhparam                 /etc/nginx/ssl/dhparams.pem;

    rewrite         ^ https://www.albertyw.com$request_uri;
}

### Servers ###

server {
    listen          443 ssl http2 default_server;
    server_name     www.albertyw.com;
    access_log      /var/log/nginx/website.access.log;
    error_log       /var/log/nginx/website.error.log;

    ssl on;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers   on;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         10m;
    ssl_certificate             /etc/nginx/ssl/1_albertyw.com_bundle.crt;
    ssl_certificate_key         /etc/nginx/ssl/server.key;
    ssl_dhparam                 /etc/nginx/ssl/dhparams.pem;

    gzip on;
    gzip_disable "msie6";

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;

    # static files used for the website
    location /static {
        alias        "/var/www/website/app/static/";
        try_files $uri.html $uri $uri/ =404;
        expires     7d;
        add_header Cache-Control "public";
    }

    location / {
        uwsgi_pass      unix://tmp/website.sock;
        include         uwsgi_params;
        uwsgi_param     UWSGI_SCHEME $scheme;
        uwsgi_param     SERVER_SOFTWARE    nginx/$nginx_version;
        expires     7d;
        add_header Cache-Control "public";
    }
}

### Redirects ###

# Change IP address to domain name
server {
    server_name     $server_addr;
    add_header      X-Frame-Options "SAMEORIGIN";
    return          301 https://www.albertyw.com$request_uri;
}

server {
    listen          80;
    server_name     _; # catch-all
    rewrite         ^ https://www.albertyw.com$request_uri;
}

# Change naked domain to www
server {
    listen          443 spdy;
    server_name     albertyw.com;

    ssl on;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers   on;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         10m;
    ssl_certificate             /etc/nginx/ssl/1_albertyw.com_bundle.crt;
    ssl_certificate_key         /etc/nginx/ssl/server.key;
    ssl_dhparam                 /etc/nginx/ssl/dhparams.pem;

    rewrite         ^ https://www.albertyw.com$request_uri;
}

### Servers ###

server {
    listen          443 spdy;
    server_name     www.albertyw.com;
    access_log      /var/log/nginx/website.access.log;
    error_log       /var/log/nginx/website.error.log;

    ssl on;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers   on;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         10m;
    ssl_certificate             /etc/nginx/ssl/1_albertyw.com_bundle.crt;
    ssl_certificate_key         /etc/nginx/ssl/server.key;
    ssl_dhparam                 /etc/nginx/ssl/dhparams.pem;

    gzip on;
    gzip_disable "msie6";

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;

    # static files used for the website
    location /static {
        alias        "/var/www/website/app/static/";
        try_files $uri.html $uri $uri/ =404;
        expires     7d;
        add_header Cache-Control "public";
    }

    location / {
        uwsgi_pass      unix://tmp/website.sock;
        include         uwsgi_params;
        uwsgi_param     UWSGI_SCHEME $scheme;
        uwsgi_param     SERVER_SOFTWARE    nginx/$nginx_version;
        expires     7d;
        add_header Cache-Control "public";
    }
}


Step 6 bash script

Step 6 bash script

cd ~/projects/iri/data/DataPrep

#$ -S /bin/bash
#$ -l h_vmem=4.0G
#$ -m e
#$ -M wellermatt@hotmail.com
#$ -q serial
#$ -N mjw_job1

source /etc/profile

module add intel
module add R

echo Job running on compute node `uname -n`

Rscript --vanilla 06_prepare_regression_data.R "beer"

Rscript --vanilla 06_prepare_regression_data.R "milk"

Rscript --vanilla 06_prepare_regression_data.R "carbbev"

cd ~/projects/exp1.1/DataPrep
#$ -S /bin/bash
#$ -l h_vmem=4.0G
#$ -m e
#$ -M wellermatt@hotmail.com
#$ -q serial
#$ -N mjw_job1

source /etc/profile

module add intel
module add R

echo Job running on compute node `uname -n`

Rscript --vanilla 06_prepare_regression_data.R "beer"

Rscript --vanilla 06_prepare_regression_data.R "milk"

Rscript --vanilla 06_prepare_regression_data.R "carbbev"


Added proxy to dockerhost

Added proxy to dockerhost

This will use an /etc/hosts file in the container to get to the Docker
host to run the webhook script.

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        root /usr/share/nginx/html;
        index index.html index.htm;

        # Make site accessible from http://localhost/
        server_name localhost,test.justindirose.com;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ /index.html;
                # Uncomment to enable naxsi on this location
                # include /etc/nginx/naxsi.rules
        }
        location /hubhook {
                proxy_pass https://dockerhost:3000;
        }
}

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        root /usr/share/nginx/html;
        index index.html index.htm;

        # Make site accessible from http://localhost/
        server_name localhost,test.justindirose.com;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ /index.html;
                # Uncomment to enable naxsi on this location
                # include /etc/nginx/naxsi.rules
        }
}


A hack to make sure access() will give us the correct answer about the accessability of an "empty" directory.  Thsi *is* weird, and a better solution will be provided in apps/ca.c, when I get time to hack at it.

$! CA - wrapper around ca to make it easier to use ... basically ca requires
$!      some setup stuff to be done before you can use it and this makes
$!      things easier between now and when Eric is convinced to fix it :-)
$!
$! CA -newca ... will setup the right stuff
$! CA -newreq ... will generate a certificate request
$! CA -sign ... will sign the generated request and output
$!
$! At the end of that grab newreq.pem and newcert.pem (one has the key
$! and the other the certificate) and cat them together and that is what
$! you want/need ... I'll make even this a little cleaner later.
$!
$!
$! 12-Jan-96 tjh    Added more things ... including CA -signcert which
$!                  converts a certificate to a request and then signs it.
$! 10-Jan-96 eay    Fixed a few more bugs and added the SSLEAY_CONFIG
$!                 environment variable so this can be driven from
$!                 a script.
$! 25-Jul-96 eay    Cleaned up filenames some more.
$! 11-Jun-96 eay    Fixed a few filename missmatches.
$! 03-May-96 eay    Modified to use 'openssl cmd' instead of 'cmd'.
$! 18-Apr-96 tjh    Original hacking
$!
$! Tim Hudson
$! tjh@cryptsoft.com
$!
$!
$! default ssleay.cnf file has setup as per the following
$! demoCA ... where everything is stored
$
$ IF F$TYPE(SSLEAY_CONFIG) .EQS. "" THEN SSLEAY_CONFIG := SSLLIB:SSLEAY.CNF
$
$ DAYS   = "-days 365"
$ REQ    = openssl + " req " + SSLEAY_CONFIG
$ CA     = openssl + " ca " + SSLEAY_CONFIG
$ VERIFY = openssl + " verify"
$ X509   = openssl + " x509"
$ PKCS12 = openssl + " pkcs12"
$ echo   = "write sys$Output"
$!
$ s = F$PARSE(F$ENVIRONMENT("DEFAULT"),"[]") - "].;"
$ CATOP  := 's'.demoCA
$ CAKEY  := ]cakey.pem
$ CACERT := ]cacert.pem
$
$ __INPUT := SYS$COMMAND
$ RET = 1
$!
$ i = 1
$opt_loop:
$ if i .gt. 8 then goto opt_loop_end
$
$ prog_opt = F$EDIT(P'i',"lowercase")
$
$ IF (prog_opt .EQS. "?" .OR. prog_opt .EQS. "-h" .OR. prog_opt .EQS. "-help")
$ THEN
$   echo "usage: CA -newcert|-newreq|-newca|-sign|-verify"
$   exit
$ ENDIF
$!
$ IF (prog_opt .EQS. "-input")
$ THEN
$   ! Get input from somewhere other than SYS$COMMAND
$   i = i + 1
$   __INPUT = P'i'
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-newcert")
$ THEN
$   ! Create a certificate.
$   DEFINE/USER SYS$INPUT '__INPUT'
$   REQ -new -x509 -keyout newreq.pem -out newreq.pem 'DAYS'
$   RET=$STATUS
$   echo "Certificate (and private key) is in newreq.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-newreq")
$ THEN
$   ! Create a certificate request
$   DEFINE/USER SYS$INPUT '__INPUT'
$   REQ -new -keyout newreq.pem -out newreq.pem 'DAYS'
$   RET=$STATUS
$   echo "Request (and private key) is in newreq.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-newca")
$ THEN
$   ! If explicitly asked for or it doesn't exist then setup the directory
$   ! structure that Eric likes to manage things.
$   IF F$SEARCH(CATOP+"]serial.") .EQS. ""
$   THEN
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP']
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.certs]
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.crl]
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.newcerts]
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.private]
$
$     OPEN   /WRITE ser_file 'CATOP']serial.
$     WRITE ser_file "01"
$     CLOSE ser_file
$     APPEND/NEW NL: 'CATOP']index.txt
$
$     ! The following is to make sure access() doesn't get confused.  It
$     ! really needs one file in the directory to give correct answers...
$     COPY NLA0: 'CATOP'.certs].;
$     COPY NLA0: 'CATOP'.crl].;
$     COPY NLA0: 'CATOP'.newcerts].;
$     COPY NLA0: 'CATOP'.private].;
$   ENDIF
$!
$   IF F$SEARCH(CATOP+".private"+CAKEY) .EQS. ""
$   THEN
$     READ '__INPUT' FILE -
	   /PROMT="CA certificate filename (or enter to create)"
$     IF F$SEARCH(FILE) .NES. ""
$     THEN
$       COPY 'FILE' 'CATOP'.private'CAKEY'
$	RET=$STATUS
$     ELSE
$       echo "Making CA certificate ..."
$       DEFINE/USER SYS$INPUT '__INPUT'
$       REQ -new -x509 -keyout 'CATOP'.private'CAKEY' -
		       -out 'CATOP''CACERT' 'DAYS'
$	RET=$STATUS
$     ENDIF
$   ENDIF
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-pkcs12")
$ THEN
$   i = i + 1
$   cname = P'i'
$   IF cname .EQS. "" THEN cname = "My certificate"
$   PKCS12 -in newcert.pem -inkey newreq.pem -certfile 'CATOP''CACERT -
	   -out newcert.p12 -export -name "''cname'"
$   RET=$STATUS
$   exit RET
$ ENDIF
$!
$ IF (prog_opt .EQS. "-xsign")
$ THEN
$!
$   DEFINE/USER SYS$INPUT '__INPUT'
$   CA -policy policy_anything -infiles newreq.pem
$   RET=$STATUS
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF ((prog_opt .EQS. "-sign") .OR. (prog_opt .EQS. "-signreq"))
$ THEN
$!
$   DEFINE/USER SYS$INPUT '__INPUT'
$   CA -policy policy_anything -out newcert.pem -infiles newreq.pem
$   RET=$STATUS
$   type newcert.pem
$   echo "Signed certificate is in newcert.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-signcert")
$  THEN
$!
$   echo "Cert passphrase will be requested twice - bug?"
$   DEFINE/USER SYS$INPUT '__INPUT'
$   X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
$   DEFINE/USER SYS$INPUT '__INPUT'
$   CA -policy policy_anything -out newcert.pem -infiles tmp.pem
y
y
$   type newcert.pem
$   echo "Signed certificate is in newcert.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-verify")
$ THEN
$!
$   i = i + 1
$   IF (p'i' .EQS. "")
$   THEN
$     DEFINE/USER SYS$INPUT '__INPUT'
$     VERIFY "-CAfile" 'CATOP''CACERT' newcert.pem
$   ELSE
$     j = i
$    verify_opt_loop:
$     IF j .GT. 8 THEN GOTO verify_opt_loop_end
$     IF p'j' .NES. ""
$     THEN
$       DEFINE/USER SYS$INPUT '__INPUT'
$       __tmp = p'j'
$       VERIFY "-CAfile" 'CATOP''CACERT' '__tmp'
$       tmp=$STATUS
$       IF tmp .NE. 0 THEN RET=tmp
$     ENDIF
$     j = j + 1
$     GOTO verify_opt_loop
$    verify_opt_loop_end:
$   ENDIF
$
$   GOTO opt_loop_end
$ ENDIF
$!
$ IF (prog_opt .NES. "")
$ THEN
$!
$   echo "Unknown argument ''prog_opt'"
$
$   EXIT 3
$ ENDIF
$
$opt_loop_continue:
$ i = i + 1
$ GOTO opt_loop
$
$opt_loop_end:
$ EXIT 'RET'

$! CA - wrapper around ca to make it easier to use ... basically ca requires
$!      some setup stuff to be done before you can use it and this makes
$!      things easier between now and when Eric is convinced to fix it :-)
$!
$! CA -newca ... will setup the right stuff
$! CA -newreq ... will generate a certificate request
$! CA -sign ... will sign the generated request and output
$!
$! At the end of that grab newreq.pem and newcert.pem (one has the key
$! and the other the certificate) and cat them together and that is what
$! you want/need ... I'll make even this a little cleaner later.
$!
$!
$! 12-Jan-96 tjh    Added more things ... including CA -signcert which
$!                  converts a certificate to a request and then signs it.
$! 10-Jan-96 eay    Fixed a few more bugs and added the SSLEAY_CONFIG
$!                 environment variable so this can be driven from
$!                 a script.
$! 25-Jul-96 eay    Cleaned up filenames some more.
$! 11-Jun-96 eay    Fixed a few filename missmatches.
$! 03-May-96 eay    Modified to use 'openssl cmd' instead of 'cmd'.
$! 18-Apr-96 tjh    Original hacking
$!
$! Tim Hudson
$! tjh@cryptsoft.com
$!
$!
$! default ssleay.cnf file has setup as per the following
$! demoCA ... where everything is stored
$
$ IF F$TYPE(SSLEAY_CONFIG) .EQS. "" THEN SSLEAY_CONFIG := SSLLIB:SSLEAY.CNF
$
$ DAYS   = "-days 365"
$ REQ    = openssl + " req " + SSLEAY_CONFIG
$ CA     = openssl + " ca " + SSLEAY_CONFIG
$ VERIFY = openssl + " verify"
$ X509   = openssl + " x509"
$ PKCS12 = openssl + " pkcs12"
$ echo   = "write sys$Output"
$!
$ s = F$PARSE(F$ENVIRONMENT("DEFAULT"),"[]") - "].;"
$ CATOP  := 's'.demoCA
$ CAKEY  := ]cakey.pem
$ CACERT := ]cacert.pem
$
$ __INPUT := SYS$COMMAND
$ RET = 1
$!
$ i = 1
$opt_loop:
$ if i .gt. 8 then goto opt_loop_end
$
$ prog_opt = F$EDIT(P'i',"lowercase")
$
$ IF (prog_opt .EQS. "?" .OR. prog_opt .EQS. "-h" .OR. prog_opt .EQS. "-help")
$ THEN
$   echo "usage: CA -newcert|-newreq|-newca|-sign|-verify"
$   exit
$ ENDIF
$!
$ IF (prog_opt .EQS. "-input")
$ THEN
$   ! Get input from somewhere other than SYS$COMMAND
$   i = i + 1
$   __INPUT = P'i'
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-newcert")
$ THEN
$   ! Create a certificate.
$   DEFINE/USER SYS$INPUT '__INPUT'
$   REQ -new -x509 -keyout newreq.pem -out newreq.pem 'DAYS'
$   RET=$STATUS
$   echo "Certificate (and private key) is in newreq.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-newreq")
$ THEN
$   ! Create a certificate request
$   DEFINE/USER SYS$INPUT '__INPUT'
$   REQ -new -keyout newreq.pem -out newreq.pem 'DAYS'
$   RET=$STATUS
$   echo "Request (and private key) is in newreq.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-newca")
$ THEN
$   ! If explicitly asked for or it doesn't exist then setup the directory
$   ! structure that Eric likes to manage things.
$   IF F$SEARCH(CATOP+"]serial.") .EQS. ""
$   THEN
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP']
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.certs]
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.crl]
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.newcerts]
$     CREATE /DIR /PROTECTION=OWNER:RWED 'CATOP'.private]
$     OPEN   /WRITE ser_file 'CATOP']serial.
$     WRITE ser_file "01"
$     CLOSE ser_file
$     APPEND/NEW NL: 'CATOP']index.txt
$   ENDIF
$!
$   IF F$SEARCH(CATOP+".private"+CAKEY) .EQS. ""
$   THEN
$     READ '__INPUT' FILE -
	   /PROMT="CA certificate filename (or enter to create)"
$     IF F$SEARCH(FILE) .NES. ""
$     THEN
$       COPY 'FILE' 'CATOP'.private'CAKEY'
$	RET=$STATUS
$     ELSE
$       echo "Making CA certificate ..."
$       DEFINE/USER SYS$INPUT '__INPUT'
$       REQ -new -x509 -keyout 'CATOP'.private'CAKEY' -
		       -out 'CATOP''CACERT' 'DAYS'
$	RET=$STATUS
$     ENDIF
$   ENDIF
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-pkcs12")
$ THEN
$   i = i + 1
$   cname = P'i'
$   IF cname .EQS. "" THEN cname = "My certificate"
$   PKCS12 -in newcert.pem -inkey newreq.pem -certfile 'CATOP''CACERT -
	   -out newcert.p12 -export -name "''cname'"
$   RET=$STATUS
$   exit RET
$ ENDIF
$!
$ IF (prog_opt .EQS. "-xsign")
$ THEN
$!
$   DEFINE/USER SYS$INPUT '__INPUT'
$   CA -policy policy_anything -infiles newreq.pem
$   RET=$STATUS
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF ((prog_opt .EQS. "-sign") .OR. (prog_opt .EQS. "-signreq"))
$ THEN
$!
$   DEFINE/USER SYS$INPUT '__INPUT'
$   CA -policy policy_anything -out newcert.pem -infiles newreq.pem
$   RET=$STATUS
$   type newcert.pem
$   echo "Signed certificate is in newcert.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-signcert")
$  THEN
$!
$   echo "Cert passphrase will be requested twice - bug?"
$   DEFINE/USER SYS$INPUT '__INPUT'
$   X509 -x509toreq -in newreq.pem -signkey newreq.pem -out tmp.pem
$   DEFINE/USER SYS$INPUT '__INPUT'
$   CA -policy policy_anything -out newcert.pem -infiles tmp.pem
y
y
$   type newcert.pem
$   echo "Signed certificate is in newcert.pem"
$   GOTO opt_loop_continue
$ ENDIF
$!
$ IF (prog_opt .EQS. "-verify")
$ THEN
$!
$   i = i + 1
$   IF (p'i' .EQS. "")
$   THEN
$     DEFINE/USER SYS$INPUT '__INPUT'
$     VERIFY "-CAfile" 'CATOP''CACERT' newcert.pem
$   ELSE
$     j = i
$    verify_opt_loop:
$     IF j .GT. 8 THEN GOTO verify_opt_loop_end
$     IF p'j' .NES. ""
$     THEN
$       DEFINE/USER SYS$INPUT '__INPUT'
$       __tmp = p'j'
$       VERIFY "-CAfile" 'CATOP''CACERT' '__tmp'
$       tmp=$STATUS
$       IF tmp .NE. 0 THEN RET=tmp
$     ENDIF
$     j = j + 1
$     GOTO verify_opt_loop
$    verify_opt_loop_end:
$   ENDIF
$
$   GOTO opt_loop_end
$ ENDIF
$!
$ IF (prog_opt .NES. "")
$ THEN
$!
$   echo "Unknown argument ''prog_opt'"
$
$   EXIT 3
$ ENDIF
$
$opt_loop_continue:
$ i = i + 1
$ GOTO opt_loop
$
$opt_loop_end:
$ EXIT 'RET'


Removed the fastcgi_cache_key setting as it was a duplicate.

It was already set in cache-exclude.conf.

# www to non-www redirect -- duplicate content is BAD:
# https://github.com/h5bp/html5-boilerplate/blob/5370479476dceae7cc3ea105946536d6bc0ee468/.htaccess#L362
# Choose between www and non-www, listen on the *wrong* one and redirect to
# the right one -- http://wiki.nginx.org/Pitfalls#Server_Name

# Page caching
fastcgi_cache_path /srv/www/EXAMPLE.COM/cache levels=1:2 keys_zone=EXAMPLE_CACHE:100m inactive=60m;

server {
  # don't forget to tell on which port this server listens
  listen [::]:80;
  listen 80;

  # listen on the www host
  server_name www.EXAMPLE.COM;

  # and redirect to the non-www host (declared below)
  return 301 $scheme://EXAMPLE.COM$request_uri;
}

server {
  # Site level settings for fastcgi cache
  fastcgi_cache_use_stale updating error timeout invalid_header http_500 http_503;

  ###################################################
  # Settings to turn on pagespeed and fastcgi cache #
  ###################################################

  # Pagespeed (on/off)
  set $pagespeed_status off

  # Skip fastcgi caching (1/0)
  # 0 = cache is active, 1= cache is set off
  set $skip_cache 0;

  ###################################################

  # listen [::]:80 accept_filter=httpready; # for FreeBSD
  # listen 80 accept_filter=httpready; # for FreeBSD
  # listen [::]:80 deferred; # for Linux
  # listen 80 deferred; # for Linux
  listen [::]:80;
  listen 80;

  # The host name to respond to
  server_name EXAMPLE.COM;

  # Path for static files
  root /srv/www/EXAMPLE.COM/public;

  # Index files
  index index.html index.php;

  # Custom log locations
  error_log  /srv/www/EXAMPLE.COM/logs/error.log warn;
  access_log /srv/www/EXAMPLE.COM/logs/access.log main;

  #Specify a charset
  charset utf-8;

  # Custom 404 page
  error_page 404 /404.html;

  # Redirects for WP sitemaps
  include global/yoast-wordpress-seo.conf;

  # Include global restrictions
  include global/restrictions.conf;

  # Include the basic h5bp config set
  include h5bp/basic.conf;

  # Include page caching exclude configuration.
  include global/cache-exclude.conf;

  location ~ /purge(/.*) {
    fastcgi_cache_purge EXAMPLE_CACHE "$scheme$request_method$host$1";
  }

  # Require authentication to access the directory. If you are using this you must
  # disable the global wordpress confs.
  #location / {
  # auth_basic "Login required";
  # auth_basic_user_file /srv/www/EXAMPLE.COM/htpasswd;
  #}

  # Pagespeed
  pagespeed $pagespeed_status;

  # Enable configuration level
  pagespeed RewriteLevel CoreFilters;

  # Enabled extra rules
  pagespeed EnableFilters collapse_whitespace,insert_dns_prefetch,prioritize_critical_css;

  # Needs to exist and be writable by nginx.  Use tmpfs for best performance.
  pagespeed FileCachePath /var/ngx_pagespeed_cache/EXAMPLE.COM;

  # Needed for WPML directory test to pass
  pagespeed Disallow "*icl_validate_domain=1*";

  # Ensure requests for pagespeed optimized resources go to the pagespeed handler
  # and no extraneous headers get set.
  location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
    add_header "" "";
  }
  location ~ "^/pagespeed_static/" { }
  location ~ "^/ngx_pagespeed_beacon$" { }

  # Only include one of the files below.
  include global/wordpress.conf;
  #include global/wordpress-ms-subdir.conf;

  # Pass all .php files onto a php-fpm/php-fcgi server.
  location ~ [^/]\.php(/|$) {
  	fastcgi_split_path_info ^(.+?\.php)(/.*)$;
  	if (!-f $document_root$fastcgi_script_name) {
  		return 404;
  	}
  	# This is a robust solution for path info security issue and works with "cgi.fix_pathinfo = 1" in /etc/php.ini (default)

  	include fastcgi.conf;
  	fastcgi_index index.php;
  	#fastcgi_intercept_errors on;
  	fastcgi_pass 127.0.0.1:9000;

  	fastcgi_cache_bypass $skip_cache;
  	fastcgi_no_cache $skip_cache;
  	fastcgi_cache EXAMPLE_CACHE;
  	fastcgi_cache_valid 60m;
  }
}

# www to non-www redirect -- duplicate content is BAD:
# https://github.com/h5bp/html5-boilerplate/blob/5370479476dceae7cc3ea105946536d6bc0ee468/.htaccess#L362
# Choose between www and non-www, listen on the *wrong* one and redirect to
# the right one -- http://wiki.nginx.org/Pitfalls#Server_Name

# Page caching
fastcgi_cache_path /srv/www/EXAMPLE.COM/cache levels=1:2 keys_zone=EXAMPLE_CACHE:100m inactive=60m;

server {
  # don't forget to tell on which port this server listens
  listen [::]:80;
  listen 80;

  # listen on the www host
  server_name www.EXAMPLE.COM;

  # and redirect to the non-www host (declared below)
  return 301 $scheme://EXAMPLE.COM$request_uri;
}

server {
  # Site level settings for fastcgi cache
  fastcgi_cache_key "$scheme$request_method$host$request_uri";
  fastcgi_cache_use_stale updating error timeout invalid_header http_500 http_503;

  ###################################################
  # Settings to turn on pagespeed and fastcgi cache #
  ###################################################

  # Pagespeed (on/off)
  set $pagespeed_status off

  # Skip fastcgi caching (1/0)
  # 0 = cache is active, 1= cache is set off
  set $skip_cache 0;

  ###################################################

  # listen [::]:80 accept_filter=httpready; # for FreeBSD
  # listen 80 accept_filter=httpready; # for FreeBSD
  # listen [::]:80 deferred; # for Linux
  # listen 80 deferred; # for Linux
  listen [::]:80;
  listen 80;

  # The host name to respond to
  server_name EXAMPLE.COM;

  # Path for static files
  root /srv/www/EXAMPLE.COM/public;

  # Index files
  index index.html index.php;

  # Custom log locations
  error_log  /srv/www/EXAMPLE.COM/logs/error.log warn;
  access_log /srv/www/EXAMPLE.COM/logs/access.log main;

  #Specify a charset
  charset utf-8;

  # Custom 404 page
  error_page 404 /404.html;

  # Redirects for WP sitemaps
  include global/yoast-wordpress-seo.conf;

  # Include global restrictions
  include global/restrictions.conf;

  # Include the basic h5bp config set
  include h5bp/basic.conf;

  # Include page caching exclude configuration.
  include global/cache-exclude.conf;

  location ~ /purge(/.*) {
    fastcgi_cache_purge EXAMPLE_CACHE "$scheme$request_method$host$1";
  }

  # Require authentication to access the directory. If you are using this you must
  # disable the global wordpress confs.
  #location / {
  # auth_basic "Login required";
  # auth_basic_user_file /srv/www/EXAMPLE.COM/htpasswd;
  #}

  # Pagespeed
  pagespeed $pagespeed_status;

  # Enable configuration level
  pagespeed RewriteLevel CoreFilters;

  # Enabled extra rules
  pagespeed EnableFilters collapse_whitespace,insert_dns_prefetch,prioritize_critical_css;

  # Needs to exist and be writable by nginx.  Use tmpfs for best performance.
  pagespeed FileCachePath /var/ngx_pagespeed_cache/EXAMPLE.COM;

  # Needed for WPML directory test to pass
  pagespeed Disallow "*icl_validate_domain=1*";

  # Ensure requests for pagespeed optimized resources go to the pagespeed handler
  # and no extraneous headers get set.
  location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
    add_header "" "";
  }
  location ~ "^/pagespeed_static/" { }
  location ~ "^/ngx_pagespeed_beacon$" { }

  # Only include one of the files below.
  include global/wordpress.conf;
  #include global/wordpress-ms-subdir.conf;

  # Pass all .php files onto a php-fpm/php-fcgi server.
  location ~ [^/]\.php(/|$) {
  	fastcgi_split_path_info ^(.+?\.php)(/.*)$;
  	if (!-f $document_root$fastcgi_script_name) {
  		return 404;
  	}
  	# This is a robust solution for path info security issue and works with "cgi.fix_pathinfo = 1" in /etc/php.ini (default)

  	include fastcgi.conf;
  	fastcgi_index index.php;
  	#fastcgi_intercept_errors on;
  	fastcgi_pass 127.0.0.1:9000;

  	fastcgi_cache_bypass $skip_cache;
  	fastcgi_no_cache $skip_cache;
  	fastcgi_cache EXAMPLE_CACHE;
  	fastcgi_cache_valid 60m;
  }
}