Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Docker Nginx Auto Ssl
Commits
e0d27d99
Commit
e0d27d99
authored
Dec 18, 2017
by
Valian
Browse files
support for BACKENDS environment variable for the most common use case
parent
538bf902
Changes
6
Show whitespace changes
Inline
Side-by-side
Dockerfile
View file @
e0d27d99
...
@@ -12,7 +12,9 @@ RUN apk --no-cache add bash openssl \
...
@@ -12,7 +12,9 @@ RUN apk --no-cache add bash openssl \
-subj
'/CN=sni-support-required-for-valid-ssl'
\
-subj
'/CN=sni-support-required-for-valid-ssl'
\
-keyout
/etc/ssl/resty-auto-ssl-fallback.key
\
-keyout
/etc/ssl/resty-auto-ssl-fallback.key
\
-out
/etc/ssl/resty-auto-ssl-fallback.crt
\
-out
/etc/ssl/resty-auto-ssl-fallback.crt
\
&&
openssl dhparam
-out
/usr/local/openresty/nginx/conf/dhparam.pem 2048
&&
openssl dhparam
-out
/usr/local/openresty/nginx/conf/dhparam.pem 2048
\
# let's remove default open resty configuration, we'll conditionally add modified version in entrypoint.sh
&& rm /etc/nginx/conf.d/default.conf
COPY
nginx.conf snippets /usr/local/openresty/nginx/conf/
COPY
nginx.conf snippets /usr/local/openresty/nginx/conf/
COPY
entrypoint.sh /entrypoint.sh
COPY
entrypoint.sh /entrypoint.sh
...
...
entrypoint.sh
View file @
e0d27d99
#!/bin/sh
#!/bin/bash
RESTY_CONF_DIR
=
"/usr/local/openresty/nginx/conf"
NGINX_CONF_DIR
=
"/etc/nginx/conf.d"
# openresty will change it later on his own, right now we're just giving it access
# openresty will change it later on his own, right now we're just giving it access
chmod
777 /etc/resty-auto-ssl
chmod
777 /etc/resty-auto-ssl
...
@@ -8,11 +11,48 @@ if [ ! -f "/etc/resty-auto-ssl/dhparam.pem" ]; then
...
@@ -8,11 +11,48 @@ if [ ! -f "/etc/resty-auto-ssl/dhparam.pem" ]; then
if
[
-n
"
$DIFFIE_HELLMAN
"
]
;
then
if
[
-n
"
$DIFFIE_HELLMAN
"
]
;
then
openssl dhparam
-out
/etc/resty-auto-ssl/dhparam.pem 2048
openssl dhparam
-out
/etc/resty-auto-ssl/dhparam.pem 2048
else
else
cp
/usr/local/openresty/nginx/conf
/dhparam.pem /etc/resty-auto-ssl/dhparam.pem
cp
${
RESTY_CONF_DIR
}
/dhparam.pem /etc/resty-auto-ssl/dhparam.pem
fi
fi
fi
fi
envsubst
'$ALLOWED_DOMAINS'
< /usr/local/openresty/nginx/conf/resty-http.conf
>
/usr/local/openresty/nginx/conf/resty-http.conf.copy
mv
/usr/local/openresty/nginx/conf/resty-http.conf.copy /usr/local/openresty/nginx/conf/resty-http.conf
# if $BACKENDS is defined, we should prepare configuration files
# example usage:
#
# -e BACKENDS="db.example.com=localhost:5432;app.example.com=http://localhost:8080"
#
# it will create 2 files:
#
# 1. /etc/nginx/conf.d/db.example.com.conf using $SERVER_ENDPOINT=localhost:5432 and $SERVER_NAME=db.example.com
# 2. /etc/nginx/conf.d/app.example.com.conf using $SERVER_ENDPOINT=localhost:8080 and $SERVER_NAME=app.example.com
if
[
-n
"
$BACKENDS
"
]
;
then
# lets read all backends, separated by ';'
IFS
=
\;
read
-a
BACKENDS_SEPARATED
<<<
"
$BACKENDS
"
# for each backend (in form of server_name=endpoint:port) we create proper file
for
NAME_EQ_ENDPOINT
in
"
${
BACKENDS_SEPARATED
[@]
}
"
;
do
RAW_SERVER_ENDPOINT
=
${
NAME_EQ_ENDPOINT
#*=
}
export
SERVER_NAME
=
${
NAME_EQ_ENDPOINT
%=*
}
export
SERVER_ENDPOINT
=
${
RAW_SERVER_ENDPOINT
#*//
}
# it clears url scheme, like http:// or https://
envsubst
'$SERVER_NAME $SERVER_ENDPOINT'
\
<
${
RESTY_CONF_DIR
}
/server-backend.conf
\
>
${
NGINX_CONF_DIR
}
/
${
SERVER_NAME
}
.conf
done
unset
SERVER_NAME SERVER_ENDPOINT
# if $BACKENDS isn't defined, let's check if $NGINX_CONF_DIR is empty
elif
[
!
"
$(
ls
-A
${
NGINX_CONF_DIR
}
)
"
]
;
then
# if yes, just copy default server (similar to default from docker-openresty, but using https)
cp
${
RESTY_CONF_DIR
}
/server-default.conf
${
NGINX_CONF_DIR
}
/default.conf
fi
# let's substitute $ALLOWED_DOMAINS into OpenResty configuration
envsubst
'$ALLOWED_DOMAINS'
\
<
${
RESTY_CONF_DIR
}
/resty-http.conf
\
>
${
RESTY_CONF_DIR
}
/resty-http.conf.copy
\
&&
mv
${
RESTY_CONF_DIR
}
/resty-http.conf.copy
${
RESTY_CONF_DIR
}
/resty-http.conf
exec
"
$@
"
exec
"
$@
"
\ No newline at end of file
nginx.conf
View file @
e0d27d99
...
@@ -4,14 +4,11 @@ events {
...
@@ -4,14 +4,11 @@ events {
http
{
http
{
include
resty-http.conf
;
include
mime.types
;
default_type
application/octet-stream
;
server
{
sendfile
on
;
listen
443
ssl
;
include
ssl.conf
;
include
resty-http.conf
;
include
resty-server-https.conf
;
}
server
{
server
{
listen
80
default_server
;
listen
80
default_server
;
...
@@ -19,4 +16,5 @@ http {
...
@@ -19,4 +16,5 @@ http {
include
resty-server-http.conf
;
include
resty-server-http.conf
;
}
}
include
/etc/nginx/conf.d/*.conf
;
}
}
\ No newline at end of file
snippets/resty-server-https.conf
View file @
e0d27d99
...
@@ -5,3 +5,5 @@ ssl_certificate_by_lua_block {
...
@@ -5,3 +5,5 @@ ssl_certificate_by_lua_block {
ssl_certificate
/
etc
/
ssl
/
resty
-
auto
-
ssl
-
fallback
.
crt
;
ssl_certificate
/
etc
/
ssl
/
resty
-
auto
-
ssl
-
fallback
.
crt
;
ssl_certificate_key
/
etc
/
ssl
/
resty
-
auto
-
ssl
-
fallback
.
key
;
ssl_certificate_key
/
etc
/
ssl
/
resty
-
auto
-
ssl
-
fallback
.
key
;
include
ssl
.
conf
;
\ No newline at end of file
snippets/server-backend.conf
0 → 100644
View file @
e0d27d99
# this configuration will be used for each server
# specified using $BACKENDS variable
# more in README
server
{
listen
443
ssl
;
server_name
$
SERVER_NAME
;
include
resty
-
server
-
https
.
conf
;
location
/ {
proxy_pass
http
://$
SERVER_ENDPOINT
;
proxy_set_header
Host
$
host
;
proxy_set_header
X
-
Real
-
IP
$
remote_addr
;
proxy_set_header
X
-
Forwarded
-
For
$
proxy_add_x_forwarded_for
;
proxy_set_header
X
-
Forwarded
-
Proto
$
scheme
;
}
}
\ No newline at end of file
snippets/server-default.conf
0 → 100644
View file @
e0d27d99
# default open resty blank configuration, just to show that it's working
server
{
listen
443
ssl
default_server
;
include
resty
-
server
-
https
.
conf
;
error_page
500
502
503
504
/
50
x
.
html
;
location
/ {
root
/
usr
/
local
/
openresty
/
nginx
/
html
;
index
index
.
html
index
.
htm
;
}
location
= /
50
x
.
html
{
root
/
usr
/
local
/
openresty
/
nginx
/
html
;
}
}
\ No newline at end of file
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment