Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Docker Nginx Auto Ssl
Commits
7543ab34
Commit
7543ab34
authored
Sep 03, 2018
by
Pablo Zaidenvoren
Browse files
configurable letsencrypt endpoint
parent
81146ba9
Changes
2
Hide whitespace changes
Inline
Side-by-side
Dockerfile
View file @
7543ab34
FROM
openresty/openresty:alpine-fat
# allowed domains should be lua match pattern
ENV
DIFFIE_HELLMAN='' ALLOWED_DOMAINS='.*' AUTO_SSL_VERSION='0.11.1' FORCE_HTTPS='true' SITES=''
ENV
DIFFIE_HELLMAN='' ALLOWED_DOMAINS='.*' AUTO_SSL_VERSION='0.11.1' FORCE_HTTPS='true' SITES=''
LETSENCRYPT_URL='https://acme-v01.api.letsencrypt.org/directory'
# Here we install open resty and generate dhparam.pem file.
# You can specify DIFFIE_HELLMAN=true to force regeneration of that file on first run
# also we create fallback ssl keys
RUN
apk
--no-cache
add bash openssl
\
&&
/usr/local/openresty/luajit/bin/luarocks
install
lua-resty-auto-ssl
$AUTO_SSL_VERSION
\
&&
openssl req
-new
-newkey
rsa:2048
-days
3650
-nodes
-x509
\
&&
/usr/local/openresty/luajit/bin/luarocks
install
lua-resty-auto-ssl
$AUTO_SSL_VERSION
\
&&
openssl req
-new
-newkey
rsa:2048
-days
3650
-nodes
-x509
\
-subj
'/CN=sni-support-required-for-valid-ssl'
\
-keyout
/etc/ssl/resty-auto-ssl-fallback.key
\
-out
/etc/ssl/resty-auto-ssl-fallback.crt
\
&&
openssl dhparam
-out
/usr/local/openresty/nginx/conf/dhparam.pem 2048
\
# let's remove default open resty configuration, we'll conditionally add modified version in entrypoint.sh
&& rm /etc/nginx/conf.d/default.conf
&&
openssl dhparam
-out
/usr/local/openresty/nginx/conf/dhparam.pem 2048
\
# let's remove default open resty configuration, we'll conditionally add modified version in entrypoint.sh
&& rm /etc/nginx/conf.d/default.conf
COPY
nginx.conf snippets /usr/local/openresty/nginx/conf/
COPY
entrypoint.sh /entrypoint.sh
...
...
snippets/resty-http.conf
View file @
7543ab34
...
...
@@ -19,7 +19,7 @@ resolver 8.8.8.8;
# Initial setup tasks.
init_by_lua_block
{
auto_ssl
= (
require
"resty.auto-ssl"
).
new
()
auto_ssl
::
set
(
"ca"
,
'$LETSENCRYPT_URL'
)
--
Define
a
function
to
determine
which
SNI
domains
to
automatically
handle
--
and
register
new
certificates
for
.
Defaults
to
not
allowing
any
domains
,
--
so
this
must
be
configured
.
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment