Unverified Commit d2aade55 authored by Jakub Skałecki's avatar Jakub Skałecki Committed by GitHub
Browse files

Merge pull request #7 from PabloZaiden/master

Support for Let's Encrypt staging CA through env variable
parents 81146ba9 d04513fc
FROM openresty/openresty:alpine-fat FROM openresty/openresty:alpine-fat
# allowed domains should be lua match pattern # allowed domains should be lua match pattern
ENV DIFFIE_HELLMAN='' ALLOWED_DOMAINS='.*' AUTO_SSL_VERSION='0.11.1' FORCE_HTTPS='true' SITES='' ENV DIFFIE_HELLMAN='' ALLOWED_DOMAINS='.*' AUTO_SSL_VERSION='0.11.1' FORCE_HTTPS='true' SITES='' LETSENCRYPT_URL='https://acme-v01.api.letsencrypt.org/directory'
# Here we install open resty and generate dhparam.pem file. # Here we install open resty and generate dhparam.pem file.
# You can specify DIFFIE_HELLMAN=true to force regeneration of that file on first run # You can specify DIFFIE_HELLMAN=true to force regeneration of that file on first run
......
...@@ -29,6 +29,7 @@ Available configuration options: ...@@ -29,6 +29,7 @@ Available configuration options:
| DIFFIE_HELLMAN | `true` | Force regeneration of `dhparam.pem`. If not specified, default one is used. | | DIFFIE_HELLMAN | `true` | Force regeneration of `dhparam.pem`. If not specified, default one is used. |
| SITES | `db.com=localhost:5432; *.app.com=localhost:8080`, `_=localhost:8080` | Shortcut for defining multiple proxies, in form of `domain1=endpoint1; domain2=endpoint2`. Default template for proxy is [here](https://github.com/Valian/docker-nginx-auto-ssl/blob/master/snippets/server-proxy.conf). Name `_` means default server, just like in nginx configuration | | SITES | `db.com=localhost:5432; *.app.com=localhost:8080`, `_=localhost:8080` | Shortcut for defining multiple proxies, in form of `domain1=endpoint1; domain2=endpoint2`. Default template for proxy is [here](https://github.com/Valian/docker-nginx-auto-ssl/blob/master/snippets/server-proxy.conf). Name `_` means default server, just like in nginx configuration |
| FORCE_HTTPS | `true`, `false` | If `true`, automatically adds location to `resty-server-http.conf` redirecting traffic from http to https. `true` by default. | | FORCE_HTTPS | `true`, `false` | If `true`, automatically adds location to `resty-server-http.conf` redirecting traffic from http to https. `true` by default. |
| LETSENCRYPT_URL | `https://acme-v01.api.letsencrypt.org/directory`, `https://acme-staging.api.letsencrypt.org/directory` | Let's Encrypt server URL to use |
If you want to proxy multiple sites (probably the most common case, that's why I've made it possible to achieve without custom configuration): If you want to proxy multiple sites (probably the most common case, that's why I've made it possible to achieve without custom configuration):
......
...@@ -58,8 +58,8 @@ if [ "$FORCE_HTTPS" == "true" ]; then ...@@ -58,8 +58,8 @@ if [ "$FORCE_HTTPS" == "true" ]; then
fi fi
# let's substitute $ALLOWED_DOMAINS into OpenResty configuration # let's substitute $ALLOWED_DOMAINS and $LETSENCRYPT_URL into OpenResty configuration
envsubst '$ALLOWED_DOMAINS' \ envsubst '$ALLOWED_DOMAINS,$LETSENCRYPT_URL' \
< ${RESTY_CONF_DIR}/resty-http.conf \ < ${RESTY_CONF_DIR}/resty-http.conf \
> ${RESTY_CONF_DIR}/resty-http.conf.copy \ > ${RESTY_CONF_DIR}/resty-http.conf.copy \
&& mv ${RESTY_CONF_DIR}/resty-http.conf.copy ${RESTY_CONF_DIR}/resty-http.conf && mv ${RESTY_CONF_DIR}/resty-http.conf.copy ${RESTY_CONF_DIR}/resty-http.conf
......
...@@ -19,7 +19,7 @@ resolver 8.8.8.8; ...@@ -19,7 +19,7 @@ resolver 8.8.8.8;
# Initial setup tasks. # Initial setup tasks.
init_by_lua_block { init_by_lua_block {
auto_ssl = (require "resty.auto-ssl").new() auto_ssl = (require "resty.auto-ssl").new()
auto_ssl:set("ca", '$LETSENCRYPT_URL')
-- Define a function to determine which SNI domains to automatically handle -- Define a function to determine which SNI domains to automatically handle
-- and register new certificates for. Defaults to not allowing any domains, -- and register new certificates for. Defaults to not allowing any domains,
-- so this must be configured. -- so this must be configured.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment