Commit ccbb4e6e authored by name's avatar name
Browse files

init

parents
ARG NGINX_VERSION
FROM nginx:${NGINX_VERSION}-alpine
LABEL maintainer="xiaojun207 <xiaojun207@126.com>"
RUN set -ex \
&& apk upgrade --update-cache --available \
&& apk add bash openssl git \
&& git clone https://github.com/neilpang/acme.sh.git acme_src \
&& cd /acme_src && ./acme.sh --install --cert-home /acme_cert \
&& apk del git \
&& rm -rf /acme_src /var/cache/apk/* \
&& mkdir /etc/nginx/ssl \
&& mkdir /etc/nginx/ssl/app \
&& mkdir /etc/nginx/ssl/default
COPY ./nginx.conf /etc/nginx/nginx.conf
COPY ./default.conf /etc/nginx/conf.d/default.conf
COPY docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh
WORKDIR /var/www
EXPOSE 80
EXPOSE 443
ENTRYPOINT ["/docker-entrypoint.sh"]
# Nginx 💖 with Auto SSL
[![Docker Image Version (latest semver)](https://img.shields.io/docker/v/xiaojun207/nginx?sort=semver)](https://hub.docker.com/r/xiaojun207/nginx)
[![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/xiaojun207/nginx?sort=semver)](https://hub.docker.com/r/xiaojun207/nginx)
[![Docker Image Size (latest semver)](https://img.shields.io/docker/pulls/xiaojun207/nginx)](https://hub.docker.com/r/xiaojun207/nginx)
arch: linux/amd64, linux/arm64
# 描述(Desc)
这是一个可以自动申请(并更新)ssl证书的nginx镜像。证书申请和更新使用的是开源工具acme.sh。
你可以设置证书服务商:zerossl, letsencrypt,buypass,ssl等等,或是地址,如Letsencrypt测试地址:https://acme-staging-v02.api.letsencrypt.org/directory
nginx with auto ssl image,use acme.sh , you can set default-ca,like: zerossl, letsencrypt,buypass,ssl ...
# 快速启动(Quick Start)
```shell
docker pull xiaojun207/nginx:latest
```
使用例子,如下(eg.):
```shell
docker run -d -p 80:80 -p 443:443 -v "/data/web":/data/web \
-v "/data/nginx/nginx/ssl":/etc/nginx/ssl \
-v "/data/nginx/nginx/conf.d":/etc/nginx/conf.d \
-v "/data/nginx/acme_cert":/acme_cert \
-e DOMAINS="example.com www.example.com test.example.com test2.example.com" \
-e SslServer="zerossl" \
-e mail="youmail@example.com" \
--name nginx xiaojun207/nginx:latest
```
注意:建议把路径/etc/nginx/ssl、/acme_cert中的内容都持久化到宿主机保存,避免容器删除后,启动后会自动再次获取(频繁申请证书会被服务商限制)。
# 使用说明
默认情况下, 使用的是服务器验证,所以请确保,被申请ssl的域名可以访问到nginx容器。
# 参数说明
| 参数 | 是否必填 | 说明 |
|------------|------|----------------------------------------------------------------------------------------------------------------------------------------|
| DOMAINS | 必填 | 域名列表参数是acme用来自动获取ssl,多域名以空格分隔。如果为空或不填,这就是个普通的nginx镜像,哈哈。 |
| mail | 必填 | 你的邮箱,用于获取ssl时配置 |
| SslServer | 否 | 证书服务商(名字或地址),默认:zerossl,你还可以使用:letsencrypt,buypass,ssl等等,<br>或者letsencrypt的测试地址:https://acme-staging-v02.api.letsencrypt.org/directory |
# 证书路径和nginx配置方法
容器启动,会创建一个默认证书,避免nginx启动失败。 证书获取成功后,将会被安装到/etc/nginx/ssl/app/,
nginx配置方法如下:
```shell
server {
# 80端口必须可以正常访问,用来验证你的域名
listen 80;
server_name example.com;
# ...
}
server {
listen 443 ssl;
server_name example.com;
root /data/web/www;
ssl_stapling off;
ssl_certificate /etc/nginx/ssl/app/cert.pem;
ssl_certificate_key /etc/nginx/ssl/app/key.pem;
# ...
}
```
# 证书更新
证书会定期检查是否快要过期,如果快要过期,会自动更新并安装证书,你可以高枕无忧了(理论上的,我的证书还没到期,哈哈)。
# 非常感谢,参考连接
https://github.com/neilpang/acme.sh.git
https://github.com/akeylimepie/docker-nginx-letsencrypt
https://blog.csdn.net/dancen/article/details/121044863
#!/bin/bash
set -ex
IMAGE=xiaojun207/nginx
# 版本信息来自nginx官方镜像
# https://hub.docker.com/_/nginx?tab=tags
NGINX_VERSIONS=(
1.21.6
)
function build() {
NGINX_VERSION=$1
if [[ $1 =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
MAJOR=${BASH_REMATCH[1]}
MINOR=${BASH_REMATCH[2]}
PATCH=${BASH_REMATCH[3]}
else
exit 1
fi
TAG_LATEST="${MAJOR}.${MINOR}-latest"
TAG_SPECIAL="${MAJOR}.${MINOR}.${PATCH}"
docker buildx build \
--platform linux/amd64,linux/arm64 \
--build-arg NGINX_VERSION="$NGINX_VERSION" \
--tag $IMAGE:"latest" \
--tag $IMAGE:"$TAG_LATEST" \
--tag $IMAGE:"$TAG_SPECIAL" \
--push \
.
}
for NGINX_VERSION in "${NGINX_VERSIONS[@]}"; do
build "$NGINX_VERSION"
done
server {
listen 80;
}
server {
listen 443 ssl;
ssl_stapling off;
ssl_certificate /etc/nginx/ssl/app/cert.pem;
ssl_certificate_key /etc/nginx/ssl/app/key.pem;
return 403;
}
#!/usr/bin/env bash
DOMAINS=$(echo "$DOMAINS" | tr -s ' ')
SslServer="$SslServer"
mail="$mail"
if [ -z "$DOMAINS" ]; then
echo "[$(date)] Empty env var DOMAINS"
# exit 1
fi
mkdir -p /etc/nginx/ssl/default/
mkdir -p /etc/nginx/ssl/app/
function CreateDefault() {
if [ -e "/etc/nginx/ssl/app/cert.pem" ]; then
echo "[$(date)] default cert exists"
else
openssl req -x509 -newkey rsa:4096 -nodes -days 365 \
-subj "/C=CA/ST=QC/O=Company Inc/CN=example.com" \
-out /etc/nginx/ssl/default/cert.pem \
-keyout /etc/nginx/ssl/default/key.pem
cp /etc/nginx/ssl/default/*.pem /etc/nginx/ssl/app/
chmod +w /etc/nginx/ssl/app/*
fi
}
function StartAcmesh() {
echo "[$(date)] sleep 2 second to start Acme.sh..."
sleep 2
echo "[$(date)] Start Acme.sh..."
IFS=' '
read -ra list <<<"$DOMAINS"
ACME_DOMAIN_OPTION=""
for i in "${!list[@]}"; do
if [[ $i == 0 ]]; then
ACME_DOMAIN_OPTION+="-d ${list[$i]}"
else
ACME_DOMAIN_OPTION+=" -d ${list[$i]}"
fi
done
echo "[$(date)] Issue the cert: $DOMAINS with options $ACME_DOMAIN_OPTION"
if [[ -n "$SslServer" ]]; then
# 测试环境 https://acme-staging-v02.api.letsencrypt.org/directory
/root/.acme.sh/acme.sh --set-default-ca --server $SslServer
fi
echo "[$(date)] acme.sh register .."
/root/.acme.sh/acme.sh --register-account -m $mail
echo "[$(date)] acme.sh issue .."
/root/.acme.sh/acme.sh --issue --nginx --debug $ACME_DOMAIN_OPTION --renew-hook "nginx -s reload"
echo "[$(date)] acme.sh install-cert .."
/root/.acme.sh/acme.sh --install-cert $ACME_DOMAIN_OPTION \
--fullchain-file /etc/nginx/ssl/app/fullchain.pem \
--cert-file /etc/nginx/ssl/app/cert.pem \
--key-file /etc/nginx/ssl/app/key.pem \
--reloadcmd "nginx -s reload"
echo "[$(date)] Start cron"
crond
}
# 生成默认证书, 配置文件中使用,否则nginx启动会失败
CreateDefault
if [[ -n "$DOMAINS" ]]; then
export -f StartAcmesh
nohup bash -c StartAcmesh &
fi
echo "[$(date)] Start nginx"
nginx -g "daemon off;"
user nobody;
worker_processes auto;
events {
worker_connections 1024;
multi_accept on;
}
http {
include mime.types;
default_type application/octet-stream;
server_tokens off;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
keepalive_requests 100;
types_hash_max_size 2048;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;
ssl_session_cache shared:TLS:2m;
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 [2606:4700:4700::1111] 1.0.0.1 [2606:4700:4700::1001] ipv6=on valid=300s;
resolver_timeout 60s;
add_header Strict-Transport-Security 'max-age=31536000; preload' always;
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_types text/plain text/css text/xml text/javascript application/json application/x-javascript application/xml;
access_log /dev/stdout;
error_log /dev/stdout;
include /etc/nginx/conf.d/*.conf;
}
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment