ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > SSL ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ืึธืงืขืจ ื•ื•ืขื‘-ืึทืคึผ

SSL ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ืึธืงืขืจ ื•ื•ืขื‘-ืึทืคึผ

ืื™ืŸ ื“ืขื ืึทืจื˜ื™ืงืœ, ืื™ืš ื•ื•ื™ืœืŸ ืฆื• ื˜ื™ื™ืœืŸ ืžื™ื˜ ืื™ืจ ืึท ืื•ืคึฟืŸ ืคึฟืึทืจ ืงืจื™ื™ื™ื˜ื™ื ื’ ืึท SSL ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ื™ื™ืŸ ื•ื•ืขื‘ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืคืœื™ืกื ื“ื™ืง ืื•ื™ืฃ ื“ืึธืงืงืขืจ, ื•ื•ื™ื™ึทืœ ... ืื™ืš ื”ืึธื‘ ื ื™ื˜ ื’ืขืคึฟื•ื ืขืŸ ืึทื–ืึท ืึท ืœื™ื™ื–ื•ื ื’ ืื™ืŸ ื“ืขืจ ืจื•ืกื™ืฉ-ืฉืคึผืจืึทืš ื˜ื™ื™ืœ ืคื•ืŸ ื“ืขืจ ืื™ื ื˜ืขืจื ืขืฅ.

SSL ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ืึธืงืขืจ ื•ื•ืขื‘-ืึทืคึผ

ืžืขืจ ื“ืขื˜ืึทื™ืœืก ืื•ื ื˜ืขืจ ื“ื™ ืึธืคึผื˜ื™ื™ืœื•ื ื’.

ืžื™ืจ ื”ืึธื‘ืŸ docker v.17.05, docker-compose v.1.21, Ubuntu Server 18 ืื•ืŸ ืึท ืคึผื™ื ื˜ ืคื•ืŸ ืจื™ื™ืŸ Let'sEncrypt. ืขืก ืื™ื– ื ื™ืฉื˜ ืึทื– ืขืก ืื™ื– ื ื™ื™ื˜ื™ืง ืฆื• ืฆืขื•ื•ื™ืงืœืขืŸ ืคึผืจืึธื“ื•ืงืฆื™ืข ืื•ื™ืฃ ื“ืึธืงืงืขืจ. ืึธื‘ืขืจ ืึทืžืึธืœ ืื™ืจ ืึธื ื”ื™ื™ื‘ืŸ ืฆื• ื‘ื•ื™ืขืŸ ื“ืึธืงืขืจ, ืขืก ื•ื•ืขืจื˜ ืฉื•ื•ืขืจ ืฆื• ื”ืึทืœื˜ืŸ.

ืึทื–ื•ื™, ืฆื• ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜, ืื™ืš ื•ื•ืขืœ ื’ืขื‘ืŸ ื“ื™ ื ืึธืจืžืึทืœ ืกืขื˜ื˜ื™ื ื’ืก - ื•ื•ืึธืก ืžื™ืจ ื”ืึธื‘ืŸ ืื™ืŸ ื“ื™ ื“ืขื•ื• ื‘ื™ื ืข, ื“.ื”. ืึธืŸ ืคึผืึธืจื˜ 443 ืื•ืŸ SSL ืื™ืŸ ืึทืœื’ืขืžื™ื™ืŸ:

ื“ืึธืงืงืขืจ-ืงืึธืžืคึผืึธืกืข.ื™ืžืœ

version: '2'
services:
    php:
        build: ./php-fpm
        volumes:
            - ./StomUp:/var/www/StomUp
            - ./php-fpm/php.ini:/usr/local/etc/php/php.ini
        depends_on:
            - mysql
        container_name: "StomPHP"
    web:
        image: nginx:latest
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./StomUp:/var/www/StomUp
            - ./nginx/main.conf:/etc/nginx/conf.d/default.conf
        depends_on:
            - php
    mysql:
        image: mysql:5.7
        command: mysqld --sql_mode=""
        environment:
            MYSQL_ROOT_PASSWORD: xxx
        ports:
            - "3333:3306"

nginx/main.conf

 server {
    listen 80;
    server_name *.stomup.ru stomup.ru;
   root /var/www/StomUp/public;
     client_max_body_size 5M;

    location / {
        # try to serve file directly, fallback to index.php
        try_files $uri /index.php$is_args$args;
  }

    location ~ ^/index.php(/|$) {
      #fastcgi_pass unix:/var/run/php7.2-fpm.sock;
       fastcgi_pass php:9000;
       fastcgi_split_path_info ^(.+.php)(/.*)$;
      include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
       fastcgi_param DOCUMENT_ROOT $realpath_root;
        fastcgi_buffer_size 128k;
       fastcgi_buffers 4 256k;
        fastcgi_busy_buffers_size 256k;
       internal;
    }

    location ~ .php$ {
        return 404;
    }

     error_log /var/log/nginx/project_error.log;
    access_log /var/log/nginx/project_access.log;
}

ื“ืขืจื ืึธืš, ืžื™ืจ ื˜ืึทืงืข ื“ืึทืจืคึฟืŸ ืฆื• ื™ื ืกื˜ืจื•ืžืขื ื˜ SSL. ืฆื• ื–ื™ื™ืŸ ืขืจืœืขืš, ืื™ืš ืคืืจื‘ืจืื›ื˜ ื•ื•ืขื’ืŸ 2 ืฉืขื” ืฆื• ืœืขืจื ืขืŸ ื“ื™ ืงืึทื ื–ืึธื ืข. ืึทืœืข ื“ื™ ืึธืคึผืฆื™ืขืก ื’ืขืคึฟื™ื ื˜ ื“ืึธืจื˜ ื–ืขื ืขืŸ ื˜ืฉื™ืงืึทื•ื•ืข. ืื‘ืขืจ ืื™ืŸ ื“ื™ ืงืจืึทื ื˜ ื‘ื™ื ืข ืคื•ืŸ โ€‹โ€‹ื“ื™ ืคึผืจื•ื™ืขืงื˜, ืžื™ืจ (ื“ื™ ื’ืขืฉืขืคื˜) ื“ืืจืฃ ืฆื• ื’ืขืฉื•ื•ื™ื ื“ ืื•ืŸ ืจื™ืœื™ื™ืึทื‘ืœื™ ืฉืจื•ื™ืฃ SSL ื–ืืœ ืกืขื ืงื˜ื™ืคึผื˜ ะบ ื ื’ื™ื ืงืก ืงืึทื ื˜ื™ื™ื ืขืจ ืื•ืŸ ื’ืึธืจื ื™ืฉื˜ ืžืขืจ.

ืขืจืฉื˜ืขืจ ืคื•ืŸ ืึทืœืข, ืžื™ืจ ืื™ื ืกื˜ืึทืœื™ืจืŸ ืขืก ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ certbot
sudo apt-get install certbot

ื“ืขืจื ืึธืš, ืžื™ืจ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ื•ื•ื™ืœื“ืงืึทืจื“ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืคึฟืึทืจ ืื•ื ื“ื–ืขืจ ืคืขืœื“

sudo certbot certonly -d stomup.ru -d *.stomup.ru --manual --preferred-challenges dns


ื ืึธืš ื“ื•ืจื›ืคื™ืจื•ื ื’, ืกืขืจื˜ื‘ืึธื˜ ื•ื•ืขื˜ ืฆื•ืฉื˜ืขืœืŸ ืื•ื ื“ื– 2 ื˜ืงืกื˜ ืจืขืงืึธืจื“ืก ื•ื•ืึธืก ื“ืึทืจืคึฟืŸ ืฆื• ื–ื™ื™ืŸ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ ื“ื ืก ืกืขื˜ื˜ื™ื ื’ืก. 

_acme-challenge.stomup.ru TXT {ั‚ะพั‚ะšะปัŽั‡ะšะพั‚ะพั€ั‹ะนะ’ะฐะผะ’ั‹ะดะฐะปCertBot}


ืื•ืŸ ื“ืจื™ืงืŸ ืึทืจื™ื™ึทืŸ.

ื ืึธืš ื“ืขื, ืกืขืจื˜ื‘ืึธื˜ ื•ื•ืขื˜ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ื‘ื™ื™ึทื–ื™ื™ึทืŸ ืคื•ืŸ ื“ื™ ืจืขืงืึธืจื“ืก ืื™ืŸ ื“ื ืก ืื•ืŸ ืฉืึทืคึฟืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืคึฟืึทืจ ืื™ืจ.
ืื•ื™ื‘ ืื™ืจ ื”ืึธื˜ ืฆื•ื’ืขื’ืขื‘ืŸ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืึธื‘ืขืจ certbot ืื™ืš ืงืขืŸ ื ื™ืฉื˜ ื’ืขืคึฟื™ื ืขืŸ ืขืก - ืคึผืจื•ึผื•ื•ื˜ ืจื™ืกื˜ืึทืจื˜ื™ื ื’ ื“ื™ ื‘ืึทืคึฟืขืœ ื ืึธืš 5-10 ืžื™ื ื•ื˜.

ื ื•, ื“ืึธ ืžื™ืจ ื–ืขื ืขืŸ ื“ื™ ืฉื˜ืึธืœืฅ ืึธื•ื ืขืจื– ืคื•ืŸ ืึท Let'sEncrypt ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ 90 ื˜ืขื’, ืึธื‘ืขืจ ืื™ืฆื˜ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืฆื•ืคึฟืขืœื™ืงืขืจ ืขืก ืฆื• ื“ืึธืงืขืจ.

ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืื™ืŸ ื“ื™ ืžืขืจืกื˜ ื˜ืจื™ื•ื•ื™ืึทืœ ื•ื•ืขื’, ืื™ืŸ docker-compose.yml, ืื™ืŸ ื“ื™ nginx ืึธืคึผื˜ื™ื™ืœื•ื ื’, ืžื™ืจ ืœื™ื ืง ื“ื™ ื“ื™ืจืขืงื˜ืขืจื™ื–.

ื‘ื™ื™ึทืฉืคึผื™ืœ docker-compose.yml ืžื™ื˜ ืกืกืœ

version: '2'
services:
    php:
        build: ./php-fpm
        volumes:
            - ./StomUp:/var/www/StomUp
            - /etc/letsencrypt/live/stomup.ru/:/etc/letsencrypt/live/stomup.ru/
            - ./php-fpm/php.ini:/usr/local/etc/php/php.ini
        depends_on:
            - mysql
        container_name: "StomPHP"
    web:
        image: nginx:latest
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./StomUp:/var/www/StomUp
            - /etc/letsencrypt/:/etc/letsencrypt/
            - ./nginx/main.conf:/etc/nginx/conf.d/default.conf
        depends_on:
            - php
    mysql:
        image: mysql:5.7
        command: mysqld --sql_mode=""
        environment:
            MYSQL_ROOT_PASSWORD: xxx
        ports:
            - "3333:3306"

ืคึฟืึทืจื‘ื•ื ื“ืŸ? ื’ืจื•ื™ืก - ืœืึธืžื™ืจ ืคืึธืจื–ืขืฆืŸ:

ืื™ืฆื˜ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื ื’ื™ื ืงืก ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ 443 ืคึผืึธืจื˜ ืื•ืŸ ืกืกืœ ื‘ื›ืœืœ:

ื‘ื™ื™ึทืฉืคึผื™ืœ main.conf config ืžื™ื˜ ืกืกืœ

#
server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name *.stomup.ru stomup.ru;
	set $base /var/www/StomUp;
	root $base/public;

	# SSL
	ssl_certificate /etc/letsencrypt/live/stomup.ru/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/stomup.ru/privkey.pem;
	ssl_trusted_certificate /etc/letsencrypt/live/stomup.ru/chain.pem;

      client_max_body_size 5M;

      location / {
          # try to serve file directly, fallback to index.php
          try_files $uri /index.php$is_args$args;
      }

      location ~ ^/index.php(/|$) {
          #fastcgi_pass unix:/var/run/php7.2-fpm.sock;
          fastcgi_pass php:9000;
          fastcgi_split_path_info ^(.+.php)(/.*)$;
          include fastcgi_params;
          fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
          fastcgi_param DOCUMENT_ROOT $realpath_root;
          fastcgi_buffer_size 128k;
          fastcgi_buffers 4 256k;
          fastcgi_busy_buffers_size 256k;
          internal;
      }

      location ~ .php$ {
          return 404;
      }

      error_log /var/log/nginx/project_error.log;
      access_log /var/log/nginx/project_access.log;
}


# HTTP redirect
server {
	listen 80;
	listen [::]:80;

	server_name *.stomup.ru stomup.ru;

	location / {
		return 301 https://stomup.ru$request_uri;
	}
}

ืึทืงื˜ื•ืึทืœืœื™, ื ืึธืš ื“ื™ ืžืึทื ื™ืคึผื™ืึทืœื™ื™ืฉืึทื ื–, ืžื™ืจ ื’ื™ื™ืŸ ืฆื• ื“ื™ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืžื™ื˜ Docker-compose, ืฉืจื™ื™ึทื‘ืŸ docker-compose up -d. ืื•ืŸ ืžื™ืจ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ืคืึทื ื’ืงืฉืึทื ืึทืœื™ื˜ื™ ืคื•ืŸ SSL. ืึทืœืฅ ื–ืึธืœ ื ืขืžืขืŸ ืึทื•ื•ืขืง.

ื“ื™ ื”ื•ื™ืคึผื˜ ื–ืึทืš ืื™ื– ื ื™ืฉื˜ ืฆื• ืคืึทืจื’ืขืกืŸ ืึทื– ื“ื™ Let'sEnctypt ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ืืจื•ื™ืก ืคึฟืึทืจ 90 ื˜ืขื’ ืื•ืŸ ืื™ืจ ื•ื•ืขื˜ ื“ืึทืจืคึฟืŸ ืฆื• ื‘ืึทื ื™ื™ึทืขืŸ ืขืก ื“ื•ืจืš ื“ื™ ื‘ืึทืคึฟืขืœ. sudo certbot renew, ืื•ืŸ ื“ืขืžืึธืœื˜ ืจื™ืกื˜ืึทืจื˜ ื“ื™ ืคึผืจื•ื™ืขืงื˜ ืžื™ื˜ ื“ื™ ื‘ืึทืคึฟืขืœ docker-compose restart

ืืŸ ืื ื“ืขืจ ืึธืคึผืฆื™ืข ืื™ื– ืฆื• ืœื™ื™ื’ืŸ ื“ืขื ืกื™ืงื•ื•ืึทื ืก ืฆื• Crontab.

ืื™ืŸ ืžื™ื™ืŸ ืžื™ื™ื ื•ื ื’, ื“ืึธืก ืื™ื– ื“ื™ ื™ื–ื™ืึทืกื˜ ื•ื•ืขื’ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ืกืกืœ ืฆื• ื“ืึธืงืขืจ ื•ื•ืขื‘-ืึทืคึผ.

ืคึผืก ื‘ื™ื˜ืข ื ืขืžืขืŸ ืื™ืŸ ื—ืฉื‘ื•ืŸ ืึทื– ืึทืœืข ื“ื™ ืกืงืจื™ืคึผืก ื“ืขืจืœืื ื’ื˜ ืื™ืŸ ื“ืขื ื˜ืขืงืกื˜ ื–ืขื ืขืŸ ื ื™ืฉื˜ ืœืขืฆื˜, ื“ื™ ืคึผืจื•ื™ืขืงื˜ ืื™ื– ืื™ืฆื˜ ืื™ืŸ ื“ื™ ื˜ื™ืฃ ื“ืขื•ื• ื‘ื™ื ืข, ืึทื–ื•ื™ ืื™ืš ื•ื•ืึธืœื˜ ื•ื•ื™ ืฆื• ืคืจืขื’ืŸ ืื™ืจ ื ื™ืฉื˜ ืฆื• ืงืจื™ื˜ื™ืงื™ืจืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทื ื– - ื–ื™ื™ ื•ื•ืขืœืŸ ื–ื™ื™ืŸ ืžืึทื“ืึทืคื™ื™ื“ ืคื™ืœืข ืžืึธืœ.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’