Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Docker Nginx
Commits
ca25eaf3
Commit
ca25eaf3
authored
Jun 15, 2022
by
name
Browse files
优化
parent
30899665
Changes
4
Hide whitespace changes
Inline
Side-by-side
Dockerfile
View file @
ca25eaf3
...
@@ -10,7 +10,7 @@ RUN set -ex \
...
@@ -10,7 +10,7 @@ RUN set -ex \
&&
cd
/acme_src
&&
./acme.sh
--install
--cert-home
/acme_cert
\
&&
cd
/acme_src
&&
./acme.sh
--install
--cert-home
/acme_cert
\
&&
apk del git
\
&&
apk del git
\
&&
rm
-rf
/acme_src /var/cache/apk/
*
\
&&
rm
-rf
/acme_src /var/cache/apk/
*
\
&&
mkdir
-p
/etc/nginx/ssl/
app
&&
mkdir
-p
/etc/nginx/ssl/
COPY
./nginx.conf /etc/nginx/nginx.conf
COPY
./nginx.conf /etc/nginx/nginx.conf
COPY
./default.conf /etc/nginx/conf.d/default.conf
COPY
./default.conf /etc/nginx/conf.d/default.conf
...
...
README.md
View file @
ca25eaf3
...
@@ -30,10 +30,10 @@ https://github.com/xiaojun207/docker-nginx
...
@@ -30,10 +30,10 @@ https://github.com/xiaojun207/docker-nginx
```
shell
```
shell
docker run
-d
-p
80:80
-p
443:443
-v
"/data/web"
:/data/web
\
docker run
-d
-p
80:80
-p
443:443
-v
"/data/web"
:/data/web
\
-v
"/data/nginx/nginx/ssl"
:/etc/nginx/ssl
\
-v
"/data/
my
nginx/nginx/ssl"
:/etc/nginx/ssl
\
-v
"/data/nginx/nginx/conf.d"
:/etc/nginx/conf.d
\
-v
"/data/
my
nginx/nginx/conf.d"
:/etc/nginx/conf.d
\
-v
"/data/nginx/acme_cert"
:/acme_cert
\
-v
"/data/
my
nginx/acme_cert"
:/acme_cert
\
-e
DOMAINS
=
"example.com
www.example.com
test.example.com
test2.example.com"
\
-e
SslDomains
=
"example.com
;
www.example.com
;
test.example.com
;
test2.example.com"
\
-e
SslServer
=
"zerossl"
\
-e
SslServer
=
"zerossl"
\
-e
mail
=
"youmail@example.com"
\
-e
mail
=
"youmail@example.com"
\
--name
nginx xiaojun207/nginx:latest
--name
nginx xiaojun207/nginx:latest
...
@@ -44,18 +44,19 @@ https://github.com/xiaojun207/docker-nginx
...
@@ -44,18 +44,19 @@ https://github.com/xiaojun207/docker-nginx
*
3、测试部署时,建议使用letsencrypt的测试地址(即参数,-e SslServer="https://acme-staging-v02.api.letsencrypt.org/directory")。
*
3、测试部署时,建议使用letsencrypt的测试地址(即参数,-e SslServer="https://acme-staging-v02.api.letsencrypt.org/directory")。
# 使用说明
# 使用说明
默认情况下, 使用的是服务器验证方式(非dns方式),所以请确保,需要申请证书的域名可以正常访问
到
nginx
容器(正确访问
http端口)。
默认情况下, 使用的是服务器验证方式(非dns方式),所以请确保,需要申请证书的域名
http端口
可以正常访问
(本
nginx
启动的
http端口)。
# 参数说明
# 参数说明
| 参数 | 是否必填 | 说明 |
| 参数 | 是否必填 | 说明 |
|------------|------|----------------------------------------------------------------------------------------------------------------------------------------|
|------------|------|----------------------------------------------------------------------------------------------------------------------------------------|
|
DOMAINS
| 必填 |
域名列表参数是acme用来自动获取ssl,多域名以空格分隔
。如果为空或不填,这就是个普通的nginx镜像,哈哈。
|
|
SslDomains
| 必填 |
需要获取参数ssl的域名列表。多个域名间以英文分号分隔(即:;)
。如果为空或不填,这就是个普通的nginx镜像,哈哈。 |
| mail | 必填 | 你的邮箱,用于获取ssl时配置,有的证书服务商有网页管理端,可以根据邮箱查看相关的证书。如果为空可能会导致注册到证书服务商失败,因此如果参数为空会使用默认邮箱。
|
| mail | 必填 | 你的邮箱,用于获取ssl时配置,有的证书服务商有网页管理端,可以根据邮箱查看相关的证书。如果为空可能会导致注册到证书服务商失败,因此如果参数为空会使用默认邮箱。 |
| SslServer | 否 | 证书服务商(名字或地址),默认:zerossl,你还可以使用:letsencrypt,buypass,ssl等等,
<br>
或者letsencrypt的测试地址:https://acme-staging-v02.api.letsencrypt.org/directory |
| SslServer | 否 | 证书服务商(名字或地址),默认:zerossl,你还可以使用:letsencrypt,buypass,ssl等等,
<br>
或者letsencrypt的测试地址:https://acme-staging-v02.api.letsencrypt.org/directory |
| dns | 否 | 域名是否采用dns验证,可选参数为:空格,dns_ali,dns_aws,dns_cf,dns_dp,,。。。
<br>
更多参数请查看:https://github.com/acmesh-official/acme.sh/wiki/dnsapi
<br>
例如1: -e dns=" ", 空格时,请查看控制台日志中的dns记录,并手动为域名添加解析;
<br>
例如2: -e dns="dns_ali" -e Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" -e Ali_Secret="jlsdflanljkljlfdsaklkjflsa" 使用云厂商api,请添加对应的key、secret等"添加域名解析"授权参数 |
# 证书路径和nginx配置方法
# 证书路径和nginx配置方法
容器启动,会创建一个默认证书,避免nginx启动失败。 证书获取成功后,将会被安装到/etc/nginx/ssl/
app/,
容器启动,会创建一个默认证书,避免nginx启动失败。 证书获取成功后,将会被安装到
固定路径:
/etc/nginx/ssl/
nginx配置方法如下:
nginx配置方法如下:
```
shell
```
shell
...
@@ -72,8 +73,8 @@ nginx配置方法如下:
...
@@ -72,8 +73,8 @@ nginx配置方法如下:
root /data/web/www
;
root /data/web/www
;
ssl_stapling off
;
ssl_stapling off
;
ssl_certificate /etc/nginx/ssl/
app/
cert.pem
;
ssl_certificate /etc/nginx/ssl/cert.pem
;
# 证书自动安装的路径
ssl_certificate_key /etc/nginx/ssl/
app/
key.pem
;
ssl_certificate_key /etc/nginx/ssl/key.pem
;
# 证书自动安装的路径
# ...
# ...
}
}
...
...
default.conf
View file @
ca25eaf3
...
@@ -6,8 +6,8 @@ server {
...
@@ -6,8 +6,8 @@ server {
listen
443
ssl
;
listen
443
ssl
;
ssl_stapling
off
;
ssl_stapling
off
;
ssl_certificate
/
etc
/
nginx
/
ssl
/
app
/
cert
.
pem
;
ssl_certificate
/
etc
/
nginx
/
ssl
/
cert
.
pem
;
ssl_certificate_key
/
etc
/
nginx
/
ssl
/
app
/
key
.
pem
;
ssl_certificate_key
/
etc
/
nginx
/
ssl
/
key
.
pem
;
return
403
;
return
403
;
}
}
docker-entrypoint.sh
View file @
ca25eaf3
#!/usr/bin/env bash
#!/usr/bin/env bash
# author by xiaojun207
# author by xiaojun207
DOMAINS
=
$(
echo
"
$
DOMAINS
"
|
tr
-s
'
'
)
export
DOMAINS
=
$(
echo
"
$
SslDomains
"
|
tr
-s
'
;
'
)
SslServer
=
"
$SslServer
"
export
SslServer
=
"
$SslServer
"
mail
=
"
$mail
"
export
mail
=
"
$mail
"
export
SSL_DIR
=
"/etc/nginx/ssl
/app
"
export
SSL_DIR
=
"/etc/nginx/ssl"
export
RELOAD_CMD
=
"nginx -s reload"
export
RELOAD_CMD
=
"nginx -s reload"
if
[
-z
"
$mail
"
]
;
then
if
[
-z
"
$mail
"
]
;
then
echo
"[
$(
date
)
] Empty env var mail"
echo
"[
$(
date
)
] Empty env var mail
, set mail=
\"
youmail@example.com
\"
"
mail
=
"youmail@example.com"
mail
=
"youmail@example.com"
fi
fi
if
[
-z
"
$DOMAINS
"
]
;
then
if
[
-z
"
$DOMAINS
"
]
;
then
echo
"[
$(
date
)
] Empty env var DOMAINS"
echo
"[
$(
date
)
] Empty env var SslDomains"
# exit 1
fi
fi
mkdir
-p
${
SSL_DIR
}
/
mkdir
-p
${
SSL_DIR
}
/
function
CreateDefault
()
{
function
CreateDefault
()
{
if
[
-e
"
${
SSL_DIR
}
/cert.pem"
]
;
then
# true if the file exists and is not empty
if
[
-s
"
${
SSL_DIR
}
/cert.pem"
]
;
then
echo
"[
$(
date
)
] default cert exists in :
${
SSL_DIR
}
"
echo
"[
$(
date
)
] default cert exists in :
${
SSL_DIR
}
"
else
else
echo
"[
$(
date
)
] create default cert to :
${
SSL_DIR
}
"
echo
"[
$(
date
)
] create default cert to :
${
SSL_DIR
}
"
...
@@ -51,6 +51,10 @@ function StartAcmesh() {
...
@@ -51,6 +51,10 @@ function StartAcmesh() {
else
else
ACME_DOMAIN_OPTION+
=
" -d
${
list
[
$i
]
}
"
ACME_DOMAIN_OPTION+
=
" -d
${
list
[
$i
]
}
"
fi
fi
if
[[
-n
"
$dns
"
]]
;
then
ACME_DOMAIN_OPTION+
=
" --dns
$dns
"
fi
done
done
echo
"[
$(
date
)
] Issue the cert:
$DOMAINS
with options
$ACME_DOMAIN_OPTION
"
echo
"[
$(
date
)
] Issue the cert:
$DOMAINS
with options
$ACME_DOMAIN_OPTION
"
...
@@ -78,8 +82,7 @@ function StartAcmesh() {
...
@@ -78,8 +82,7 @@ function StartAcmesh() {
}
}
if
[[
-n
"
$DOMAINS
"
]]
;
then
if
[[
-n
"
$DOMAINS
"
]]
;
then
echo
"[
$(
date
)
] 生成默认证书, 配置文件中使用,否则nginx启动会失败"
# 生成默认证书, 配置文件中使用,否则nginx启动会失败
CreateDefault
CreateDefault
export
-f
StartAcmesh
export
-f
StartAcmesh
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment