🥇SSL certificate for Docker web-app

I denne artikel vil jeg dele en metode til at oprette et SSL-certifikat til din webapplikation, der kører på Docker, da jeg ikke kunne finde en lignende løsning i den russisktalende del af internettet.

Læs mere nedenfor.

Vi havde docker v.17.05, docker-compose v.1.21, Ubuntu Server 18 og en ren instans af Let’sEncrypt. Det er ikke nødvendigt at køre produktion på Docker, men når du først er begyndt at samle Docker, bliver det svært at stoppe.

Lad mig starte med de standardindstillinger, vi havde i udviklingsfasen, dvs. uden port 443 og SSL generelt:

docker-compose.yml

version: '2'
services:
    php:
        build: .\/php-fpm
        volumes:
            - .\/StomUp:\/var\/www\/StomUp
            - .\/php-fpm\/php.ini:\/usr\/local\/etc\/php\/php.ini
        depends_on:
            - mysql
        container_name: "StomPHP"
    web:
        image: nginx:latest
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - .\/StomUp:\/var\/www\/StomUp
            - .\/nginx\/main.conf:\/etc\/nginx\/conf.d\/default.conf
        depends_on:
            - php
    mysql:
        image: mysql:5.7
        command: mysqld --sql_mode=""
        environment:
            MYSQL_ROOT_PASSWORD: xxx
        ports:
            - "3333:3306"

nginx\/main.conf

 server {
    listen 80;
    server_name *.stomup.ru stomup.ru;
   root \/var\/www\/StomUp\/public;
     client_max_body_size 5M;

    location \/ {
        # prøv at servere filen direkte, bagefter fallback til index.php
        try_files $uri \/index.php$is_args$args;
  }

    location ~ ^\/index.php(\/|$) {
      #fastcgi_pass unix:\/var\/run\/php7.2-fpm.sock;
       fastcgi_pass php:9000;
       fastcgi_split_path_info ^(.+.php)(\/.*)$;
      include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
       fastcgi_param DOCUMENT_ROOT $realpath_root;
        fastcgi_buffer_size 128k;
       fastcgi_buffers 4 256k;
        fastcgi_busy_buffers_size 256k;
       internal;
    }

    location ~ .php$ {
        return 404;
    }

     error_log \/var\/log\/nginx\/project_error.log;
    access_log \/var\/log\/nginx\/project_access.log;
}

Herefter skal vi implementere SSL. Ærligt talt, jeg studerede com-zonen i cirka 2 timer. Alle de foreslåede løsninger der er interessante, men på nuværende tidspunkt i projektet havde vi (forretningen) brug for hurtigt og pålideligt at tilføje SSL Let’sEncrypt pull-requesten på GitHub nginx til containeren og ikke mere.

Først installerede vi på serveren certbot
sudo apt-get install certbot

Så genererede vi wildcard-certifikater til vores domænet

sudo certbot certonly -d stomup.ru -d *.stomup.ru --manual --preferred-challenges dns

Efter at have kørt certbot vil du få 2 TXT-poster, som skal angives i DNS-indstillingerne.

_acme-challenge.stomup.ru TXT {denNøgleCertBotGavDig}

Og tryk enter.

Herefter vil certbot kontrollere for disse poster i DNS og oprette certifikater til dig.
Hvis du har tilføjet certifikatet, men certbot det ikke blev fundet — prøv at genstarte kommandoen efter 5-10 minutter..

Nu er vi stolte ejere af Let’sEncrypt-certifikatet i 90 dage, men nu skal vi få det implementeret i Docker.

For this, we simply link the directories in the docker-compose.yml file under the nginx section.

Example of docker-compose.yml with SSL

version: '2'
services:
    php:
        build: .\/php-fpm
        volumes:
            - .\/StomUp:\/var\/www\/StomUp
            - \/etc\/letsencrypt\/live\/stomup.ru\/:\/etc\/letsencrypt\/live\/stomup.ru\/
            - .\/php-fpm\/php.ini:\/usr\/local\/etc\/php\/php.ini
        depends_on:
            - mysql
        container_name: "StomPHP"
    web:
        image: nginx:latest
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - .\/StomUp:\/var\/www\/StomUp
            - \/etc\/letsencrypt\/:\/etc\/letsencrypt\/
            - .\/nginx\/main.conf:\/etc\/nginx\/conf.d\/default.conf
        depends_on:
            - php
    mysql:
        image: mysql:5.7
        command: mysqld --sql_mode=""
        environment:
            MYSQL_ROOT_PASSWORD: xxx
        ports:
            - "3333:3306"

Linked? Great — let’s continue:

Now we need to modify the config nginx to work with 443 the port and SSL generelt:

Example of main.conf config with SSL

#
server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name *.stomup.ru stomup.ru;
	set $base /var/www/StomUp;
	root $base/public;

	# SSL
	ssl_certificate /etc/letsencrypt/live/stomup.ru/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/stomup.ru/privkey.pem;
	ssl_trusted_certificate /etc/letsencrypt/live/stomup.ru/chain.pem;

      client_max_body_size 5M;

      location / {
          # try to serve file directly, fallback to index.php
          try_files $uri /index.php$is_args$args;
      }

      location ~ ^/index.php(/|$) {
          #fastcgi_pass unix:/var/run/php7.2-fpm.sock;
          fastcgi_pass php:9000;
          fastcgi_split_path_info ^(.+.php)(/.*)$;
          include fastcgi_params;
          fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
          fastcgi_param DOCUMENT_ROOT $realpath_root;
          fastcgi_buffer_size 128k;
          fastcgi_buffers 4 256k;
          fastcgi_busy_buffers_size 256k;
          internal;
      }

      location ~ .php$ {
          return 404;
      }

      error_log /var/log/nginx/project_error.log;
      access_log /var/log/nginx/project_access.log;
}


# HTTP redirect
server {
	listen 80;
	listen [::]:80;

	server_name *.stomup.ru stomup.ru;

	location / {
		return 301 https://stomup.ru$request_uri;
	}
}

After these steps, go to the directory with Docker-compose, type docker-compose up -d, and check if SSL is working. Everything should start up.

Just don’t forget that the Let’s Encrypt certificate is issued for 90 days, and you will need to renew it using the command sudo certbot renew, and then restart the project with the command docker-compose restart

Alternatively, you can add this sequence to crontab.

In my opinion, this is the simplest way to connect SSL to a Docker web app.

P.S. Please note that all scripts presented in the text are not final; the project is currently in deep development, so I ask you not to criticize the configs – they will change many times.

Kilde: habr.com

SSL-certifikat til Docker-webapplikation