Ma kēia ʻatikala, makemake wau e kaʻana like me ʻoe i kahi ala no ka hana ʻana i kahi palapala SSL no kāu noi pūnaewele e holo ana ma Docker, no ka mea ... ʻAʻole i loaʻa iaʻu kahi hopena ma ka ʻāpana ʻōlelo Lūkini o ka Pūnaewele.
Nā kikoʻī hou aku ma lalo o ka ʻoki.
Loaʻa iā mākou ka docker v.17.05, docker-compose v.1.21, Ubuntu Server 18 a me kahi pint o Let'sEncrypt maʻemaʻe. ʻAʻole ia he mea pono e kau i ka hana ma Docker. Akā ke hoʻomaka ʻoe e kūkulu iā Docker, lilo ia i mea paʻakikī ke hoʻōki.
No laila, e hoʻomaka, e hāʻawi wau i nā hoʻonohonoho maʻamau - i loaʻa iā mākou ma ke kahua dev, ʻo ia hoʻi. me ka ʻole o ka port 443 a me SSL ma ka laulā:
docker-compose.yml
version: '2'
services:
php:
build: ./php-fpm
volumes:
- ./StomUp:/var/www/StomUp
- ./php-fpm/php.ini:/usr/local/etc/php/php.ini
depends_on:
- mysql
container_name: "StomPHP"
web:
image: nginx:latest
ports:
- "80:80"
- "443:443"
volumes:
- ./StomUp:/var/www/StomUp
- ./nginx/main.conf:/etc/nginx/conf.d/default.conf
depends_on:
- php
mysql:
image: mysql:5.7
command: mysqld --sql_mode=""
environment:
MYSQL_ROOT_PASSWORD: xxx
ports:
- "3333:3306"
nginx/main.conf
server {
listen 80;
server_name *.stomup.ru stomup.ru;
root /var/www/StomUp/public;
client_max_body_size 5M;
location / {
# try to serve file directly, fallback to index.php
try_files $uri /index.php$is_args$args;
}
location ~ ^/index.php(/|$) {
#fastcgi_pass unix:/var/run/php7.2-fpm.sock;
fastcgi_pass php:9000;
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
internal;
}
location ~ .php$ {
return 404;
}
error_log /var/log/nginx/project_error.log;
access_log /var/log/nginx/project_access.log;
}
A laila, pono mākou e hoʻokō SSL. ʻO kaʻoiaʻiʻo, ua hoʻohana wau ma kahi o 2 mau hola e aʻo ai i ka com zone. ʻO nā koho a pau i hāʻawiʻia ma laila he mea hoihoi. Akā i kēia manawa o ka papahana, pono mākou (ka ʻoihana) e wikiwiki a hilinaʻi SSL Let'sEntypet к nginx ipu a ʻaʻohe mea ʻē aʻe.
ʻO ka mea mua, ua hoʻokomo mākou iā ia ma ke kikowaena kelepona
sudo apt-get install certbot
Ma hope aʻe, hana mākou i nā palapala hōʻoia wildcard no kā mākou pūnaewele
sudo certbot certonly -d stomup.ru -d *.stomup.ru --manual --preferred-challenges dns
ma hope o ka hoʻokō ʻana, e hāʻawi ʻo certbot iā mākou i nā moʻolelo 2 TXT e pono e kuhikuhi ʻia i nā hoʻonohonoho DNS.
_acme-challenge.stomup.ru TXT {тотКлючКоторыйВамВыдалCertBot}
A kaomi enter.
Ma hope o kēia, e nānā ʻo certbot no ka loaʻa ʻana o kēia mau moʻolelo ma DNS a hana i nā palapala hōʻoia no ʻoe.
inā ua hoʻohui ʻoe i kahi palapala akā kelepona ʻaʻole i loaʻa - e hoʻāʻo e hoʻomaka hou i ke kauoha ma hope o 5-10 mau minuke.
ʻAe, eia mākou nā mea haʻaheo o kahi palapala Let'sEncrypt no 90 mau lā, akā i kēia manawa pono mākou e hoʻouka iā Docker.
No ka hana ʻana i kēia, ma ke ala liʻiliʻi loa, ma docker-compose.yml, ma ka ʻāpana nginx, hoʻopili mākou i nā papa kuhikuhi.
Ka laʻana docker-compose.yml me SSL
version: '2'
services:
php:
build: ./php-fpm
volumes:
- ./StomUp:/var/www/StomUp
- /etc/letsencrypt/live/stomup.ru/:/etc/letsencrypt/live/stomup.ru/
- ./php-fpm/php.ini:/usr/local/etc/php/php.ini
depends_on:
- mysql
container_name: "StomPHP"
web:
image: nginx:latest
ports:
- "80:80"
- "443:443"
volumes:
- ./StomUp:/var/www/StomUp
- /etc/letsencrypt/:/etc/letsencrypt/
- ./nginx/main.conf:/etc/nginx/conf.d/default.conf
depends_on:
- php
mysql:
image: mysql:5.7
command: mysqld --sql_mode=""
environment:
MYSQL_ROOT_PASSWORD: xxx
ports:
- "3333:3306"
Pili? Nui - e hoʻomau kākou:
I kēia manawa pono mākou e hoʻololi i ka config nginx e hana pū me 443 awa a me SSL maʻamau:
Laʻana main.conf config me SSL
#
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name *.stomup.ru stomup.ru;
set $base /var/www/StomUp;
root $base/public;
# SSL
ssl_certificate /etc/letsencrypt/live/stomup.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/stomup.ru/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/stomup.ru/chain.pem;
client_max_body_size 5M;
location / {
# try to serve file directly, fallback to index.php
try_files $uri /index.php$is_args$args;
}
location ~ ^/index.php(/|$) {
#fastcgi_pass unix:/var/run/php7.2-fpm.sock;
fastcgi_pass php:9000;
fastcgi_split_path_info ^(.+.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
internal;
}
location ~ .php$ {
return 404;
}
error_log /var/log/nginx/project_error.log;
access_log /var/log/nginx/project_access.log;
}
# HTTP redirect
server {
listen 80;
listen [::]:80;
server_name *.stomup.ru stomup.ru;
location / {
return 301 https://stomup.ru$request_uri;
}
}
ʻOiaʻiʻo, ma hope o kēia mau manipulations, hele mākou i ka papa kuhikuhi me Docker-compose, kākau docker-compose up -d. A nānā mākou i ka hana o SSL. Pono e wehe nā mea a pau.
ʻO ka mea nui ʻaʻole e poina ua hoʻopuka ʻia ka palapala Let'sEnctypt no 90 mau lā a pono ʻoe e hoʻohou iā ia ma o ke kauoha. sudo certbot renew, a laila hoʻomaka hou i ka papahana me ke kauoha docker-compose restart
ʻO kahi koho ʻē aʻe e hoʻohui i kēia kaʻina i crontab.
I koʻu manaʻo ʻo kēia ke ala maʻalahi loa e hoʻopili ai i ka SSL i ka Docker Web-app.
PS E ʻoluʻolu e noʻonoʻo ʻoe ʻaʻole hope loa nā palapala āpau i hōʻike ʻia ma ka kikokikona, aia ka papahana i kēia manawa ma ke kahua Dev hohonu, no laila makemake wau e noi iā ʻoe ʻaʻole e hoʻohewa i nā configs - e hoʻololi ʻia lākou i nā manawa he nui.
Source: www.habr.com