Konfigurimi i marrjes automatike të sertifikave letsencrypt me docker në linux

Recently, I changed my virtual server and had to configure everything from scratch. I prefer the website to be accessible via https, with Letsencrypt certificates obtained and renewed automatically. This can be achieved by using two Docker images: nginx-proxy and nginx-proxy-companion.

This guide explains how to set up a website on Docker with a proxy that automatically obtains Certifikatat SSL. A virtual server based on CentOS 7 is used.

I assume that the server is already purchased, configured, accessed via key, and that fail2ban is installed, etc.

First, you need to install Docker.

1. First, you need to install the dependencies

   $ sudo yum install -y yum-utils device-mapper-persistent-data lvm2

2. Connect the repository

   $ sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

3. Then install Docker Community Edition

   $ sudo yum install docker-ce docker-ce-cli containerd.io

4. Add Docker to the autoload and start it

   $ sudo systemctl enable docker
   $ sudo systemctl start docker

5. Add the user to the Docker group to be able to run Docker without sudo

   $ usermod -aG docker user

The next step is to install Docker Compose. The utility can be installed in several ways, but I prefer to install it via pip manager and virtualenv to avoid cluttering the system with unnecessary packages.

1. Install pip

   $ sudo yum install python-pip

2. Install virtualenv

   $ pip install virtualenv

3. Next, you need to create a folder for the project and initialize it. The folder containing all necessary package management files will be named ve.

   $ mkdir docker
   $ cd docker
   $ virtualenv ve

4. To start using the virtual environment, you need to execute the following command in the project folder.

   $ source ve/bin/activate

5. You can install Docker Compose.

   pip install docker-compose

   To ensure the containers can see each other, let's create a network. The bridge driver is used by default.

   $ docker network create network

   Next, you need to configure Docker Compose, with the proxy residing in the proxy folder and the test website in the test folder. For this example, I will use the domain name example.com.

   $ mkdir proxy
   $ mkdir test
   $ touch proxy/docker-compose.yml
   $ touch test/docker-compose.yml

   Përmbajtja proxy/docker-compose.yml

   version: '3'
   
   networks:
     default:
       external:
         name: network
   
   services:
     nginx-proxy:
       container_name: nginx-proxy
       image: jwilder/nginx-proxy
       ports:
         - 80:80
         - 443:443
       volumes:
         - certs:/etc/nginx/certs
         - vhost.d:/etc/nginx/vhost.d
         - html:/usr/share/nginx/html
         - /var/run/docker.sock:/tmp/docker.sock:ro
   
     nginx-proxy-letsencrypt:
       container_name: nginx-proxy-letsencrypt
       image: jrcs/letsencrypt-nginx-proxy-companion
       volumes: 
         - certs:/etc/nginx/certs
         - vhost.d:/etc/nginx/vhost.d
         - html:/usr/share/nginx/html
         - /var/run/docker.sock:/var/run/docker.sock:ro
       environment:
         - NGINX_PROXY_CONTAINER=nginx-proxy
   
   volumes:
     certs:
     vhost.d:
     html:

   Variabla e Mjedisit NGINX_PROXY_CONTAINER nevojitet që kontejneri letsencrypt të shohë kontejnerin proxy. Folderët /etc/nginx/certs, /etc/nginx/vhost.d dhe /usr/share/nginx/html duhet të përdoren nga të dy kontejnerët. Për funksionimin e duhur të kontejnerit letsencrypt, aplikacioni duhet të jetë i aksesueshëm në portin 80 dhe 443.

   Përmbajtja test/docker-compose.yml

   version: '3'
   
   networks:
     default:
       external:
         name: network
   
   services:
   
     nginx:
       container_name: nginx
       image: nginx:latest
       environment:
         - VIRTUAL_HOST=example.com
         - LETSENCRYPT_HOST=example.com
         - LETSENCRYPT_EMAIL=admin@example.com

   Këtu variablat e ambientit janë të nevojshme për të siguruar që proxy të trajtojë saktë kërkesën për serverin dhe të kërkojë certifikatën për emrin e duhur të domenit.

   Duhet vetëm të nisim docker-compose-in

   $ cd proxy
   $ docker-compose up -d
   $ cd ../test
   $ docker-compose up -d

Burimi: habr.com