ajwsurfer/snginx

By ajwsurfer

•Updated almost 7 years ago

Image

194

Overview Tags

ajwsurfer/snginx repository overview

⁠SSL over HTTP using Let's Encrypt and Nginx

⁠Supported tags and respective Dockerfile links

latest

⁠Maintained by:

ajwsurfer at juno.com

⁠Supported architectures:

amd64

⁠Why snginx?

The purpose of this image is to have a ready built Nginx image capable of using LetsEncrypt out of the box.

⁠How to use this image

If ssh access is available on the server, it is recomended to use fail2ban with max failed logins to 3, and time to "permanent" in order to keep the server secure.
Test image
- Fire up a docker container: docker run --name snginx -d -p 80:80 -p 443:443 ajwsurfer/snginx:latest
- Look at website in browser: localhost
While container is running - Extract files and build directory structure
- For this example start in the /< serviceDirectory >/snginx directory
  - mkdir -p /< serviceDirectory >/snginx/
  - cd /< serviceDirectory >/snginx
- Put together a directory structure
  - mkdir -p etc/conf.d
  - mkdir html
  - docker cp snginx: /etc/nginx/nginx.conf ./etc
  - docker cp snginx: /etc/nginx//conf.d/default.conf ./etc/conf.d
  - docker cp snginx: /usr/share/nginx/html/index.html ./html
  - docker cp snginx: /usr/share/nginx/html/50x.html ./html
  - mkdir logs
  - mkdir -p ssl/etc
  - mkdir -p ssl/opt
  - mkdir compose
  - sudo chown www-data:www-data -Rf /< serviceDirectory >/snginx
- All the rest of the changes in /< serviceDirectory >/snginx directory will need to be done as root
If all went well, try again using the external directory structure
- Stop and remove the orginal container docker stop snginx docker rm snginx

* Option #1 Run the container using `docker`

        docker run --name snginx -d -p 80:80 -p 443:443 
            -v /< serviceDirectory >/snginx/html:/usr/share/nginx/html: \
            -v /< serviceDirectory >/snginx/etc/nginx.conf:/etc/nginx/nginx.conf: \
            -v /< serviceDirectory >/snginx/etc/conf.d:/etc/nginx/conf.d: \
            -v /< serviceDirectory >/snginx/logs:/var/log/nginx \
            -v /< serviceDirectory >/snginx/etc:/etc/letsencrypt \
            -v /< serviceDirectory >/snginx/opt:/opt/letsencrypt \
            ajwsurfer/snginx:latest

* Option #2 Use `docker-compose`
    * Place this file in the `/< serviceDirectory >/snginx/compose/` directory and name it `docker-compose.yml`

version: '2'

services:
  sngnix:
    image: ajwsurfer/snginx:latest
    ports:
      - 80:80
      - 443:443
    volumes:
      - /< serviceDirectory >/snginx/html:/usr/share/nginx/html
      - /< serviceDirectory >/snginx/etc/nginx.conf:/etc/nginx/nginx.conf
      - /< serviceDirectory >/snginx/etc/conf.d:/etc/nginx/conf.d
      - /< serviceDirectory >/snginx/logs:/var/log/nginx
      - /< serviceDirectory >/snginx/etc:/etc/letsencrypt
      - /< serviceDirectory >/snginx/opt:/opt/letsencrypt

    restart: always

    * Start the container 
        `cd /< serviceDirectory >/snginx/compose`
        `docker-compose up -d
    * Stop the container
        `docker-compose stop`

* It is now possible to make changes in the `/<serviceDirectory>/sgnix/htm` directory and they will be reflected in on the server

* One of the first changes, to get the reverse proxy going with good encryption and max performance is to ramp up the `/< serviceDirectory >/snginx/etc/nginx.conf` file.

   
user www-data www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;

        ##
        # Timeouts
        keepalive_timeout 300;
        send_timeout 10;
        client_body_timeout 12;
        client_header_timeout 12;

        types_hash_max_size 2048;

        server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        #ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        #ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        #access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Buffer Sizes
        client_body_buffer_size 16k;
        client_header_buffer_size 1k;
        client_max_body_size 8m;
        large_client_header_buffers 2 1k;

        ##
        # Gzip Settings
        # gzip on;                                                                                                                     
        # gzip_disable "msie6";
        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript;
        # gzip_types text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        include /etc/nginx/conf.d/*.conf;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

* Next update the `/< serviceDirectory >/snginx/etc/conf.d/default.conf` file.

 #server {
  #listen 80 default_server;
  #listen [::]:80 default_server;
  #return 301 https://$host$request_uri;
 #}

server {

        listen 80 default_server;
        listen [::]:80 default_server;

        # SSL configuration

        #listen 443 ssl default_server;
        #listen [::]:443 ssl default_server;

        location ~ /.well-know {
            allow all;
        }

        #ssl_certificate /etc/letsencrypt/live/< website address >/fullchain.pem;
        #ssl_certificate_key /etc/letsencrypt/live/< website address >/privkey.pem;

        #ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        #ssl_prefer_server_ciphers on;
        #ssl_dhparam /etc/ssl/certs/dhparam.pem;
        #ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        #ssl_session_timeout 1d;
        #ssl_session_cache shared:SSL:50m;
        #ssl_stapling on;
        #ssl_stapling_verify on;
        #add_header Strict-Transport-Security max-age=15768000;

        root /usr/share/nginx/html;

        # Add index.php to the list if you are using PHP
        index index.html index.htm;

        # server_name _;
        server_name ajsurf.net;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ =404;
        }      

    location ~ /\.ht {
        deny  all;
    }
}

*  From here it is time to add letsencrypt to the system and switch to ssl over html
    * Get inside the container using the command `$ docker exec -it compose_sngnix_1 /bin/bash`
      or `$ docker exec -it sngnix /bin/bash`
    * Run the command `# certbot certonly --webroot -w /usr/share/nginx/html -d < website address >`
        * add `-d www.< website address >` if needed (add to default.conf as well)
    * That should conclude the aquisition of the ssl certificate.  This will need to be updated periodicly
* Next it is time to add the ssl ciphers
    * While still inside the container, run the commands
        * `# cd /etc/ssl/certs`
        * `# openssl dhparam -out dhparam.pem 4096`
* Finally remove the comments in the `nginx.conf` file at:

   
...
        multi_accept on;
...
        # SSL Settings
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;
...
        # Gzip Settings
         gzip on;                                                                                                                     
         gzip_disable "msie6";
         gzip_vary on;
         gzip_proxied any;
         gzip_comp_level 6;
         gzip_buffers 16 8k;
         gzip_http_version 1.1;
         gzip_types text/plain text/css application/json application/javascript;
         gzip_types text/xml application/xml application/xml+rss text/javascript;
....

* And `default.conf` file at:

   
 server {
  listen 80 default_server;
  listen [::]:80 default_server;
  return 301 https://$host$request_uri;
 }

server {

        #listen 80 default_server;
        #listen [::]:80 default_server;

        # SSL configuration

        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;
...

        ssl_certificate /etc/letsencrypt/live/< website address >/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/< website address >/privkey.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;
 ....

* Finally, restart the server with

    * `$ docker restart snginx`
    * or
        * `$ cd  < serviceDirectory >/snginx/compose`
        * `$ docker-compose restart`

* The nginx service should now be available at `https://< website address >

⁠References:

⁠Dockerfile:

FROM nginx:latest
 
 # Description: a working copy of the latest Ubuntu, Nginx, SSL, Letsencrypt in a Docker container

MAINTAINER Andrew Tomczak [email protected]

 ############# standard update #######################################
RUN apt-get update && apt-get upgrade -y 

 ############ letsencrypt capablity #########################

RUN apt-get install apt-transport-https ca-certificates gnupg-agent software-properties-common -y
RUN apt-get update
RUN apt-get install python-certbot-nginx openssh-server -y

 ############# debug #########################################

 # RUN apt-get install -y mc git bc curl 
ENV TERM xterm

 # port 80 is already exposed 
EXPOSE 443

Tag summary

Recent tags

Content type

Image

Digest

Size

103.1 MB

Last updated

almost 7 years ago

docker pull ajwsurfer/snginx