Commit 7543ab34 authored by Pablo Zaidenvoren's avatar Pablo Zaidenvoren
Browse files

configurable letsencrypt endpoint

parent 81146ba9
FROM openresty/openresty:alpine-fat
# allowed domains should be lua match pattern
ENV DIFFIE_HELLMAN='' ALLOWED_DOMAINS='.*' AUTO_SSL_VERSION='0.11.1' FORCE_HTTPS='true' SITES=''
ENV DIFFIE_HELLMAN='' ALLOWED_DOMAINS='.*' AUTO_SSL_VERSION='0.11.1' FORCE_HTTPS='true' SITES='' LETSENCRYPT_URL='https://acme-v01.api.letsencrypt.org/directory'
# Here we install open resty and generate dhparam.pem file.
# You can specify DIFFIE_HELLMAN=true to force regeneration of that file on first run
# also we create fallback ssl keys
RUN apk --no-cache add bash openssl \
&& /usr/local/openresty/luajit/bin/luarocks install lua-resty-auto-ssl $AUTO_SSL_VERSION \
&& openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
&& /usr/local/openresty/luajit/bin/luarocks install lua-resty-auto-ssl $AUTO_SSL_VERSION \
&& openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
-subj '/CN=sni-support-required-for-valid-ssl' \
-keyout /etc/ssl/resty-auto-ssl-fallback.key \
-out /etc/ssl/resty-auto-ssl-fallback.crt \
&& openssl dhparam -out /usr/local/openresty/nginx/conf/dhparam.pem 2048 \
# let's remove default open resty configuration, we'll conditionally add modified version in entrypoint.sh
&& rm /etc/nginx/conf.d/default.conf
&& openssl dhparam -out /usr/local/openresty/nginx/conf/dhparam.pem 2048 \
# let's remove default open resty configuration, we'll conditionally add modified version in entrypoint.sh
&& rm /etc/nginx/conf.d/default.conf
COPY nginx.conf snippets /usr/local/openresty/nginx/conf/
COPY entrypoint.sh /entrypoint.sh
......
......@@ -19,7 +19,7 @@ resolver 8.8.8.8;
# Initial setup tasks.
init_by_lua_block {
auto_ssl = (require "resty.auto-ssl").new()
auto_ssl::set("ca", '$LETSENCRYPT_URL')
-- Define a function to determine which SNI domains to automatically handle
-- and register new certificates for. Defaults to not allowing any domains,
-- so this must be configured.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment