gordonchan/nginx-ssl-ghost repository overview

⁠gordonchan/nginx-ssl-ghost

The official nginx:latest⁠ with a customised default.conf⁠ designed for reverse proxying (with SSL support) to a container running ghost⁠.

Use nginx-ghost⁠ for the non-SSL version.

⁠Let's Encrypt support

The Nginx configuration is also capable of supporting the renewal of SSL/TLS certificates through Let's Encrypt⁠ and its Webroot⁠ method for domain validation. The expected webroot path is /tmp/letsencrypt/www as specified in default.conf⁠. See gordonchan/auto-letsencrypt⁠.

⁠Example Usage

$ docker run -d --link my_ghost_container:ghost gordonchan/nginx-ssl-ghost

⁠Assumptions

This image assumes the hostname ghost will connect to the container running the ghost application. If this is not the correct name, you will need to create an alias as described in the example above.

We also assume the default ghost port is exposed (2368).

⁠SSL certificate and key file

As per the default.conf⁠, this image assumes the certificate and key files are located at /etc/nginx/certs/fullchain.pem and /etc/nginx/certs/privkey.pem on the container respectively. The name of the files match the ones generated by Let's Encrypt⁠.

How do you get the files on the container?

• You could copy files to the container using docker cp.
• You could mount a host directory as a data volume docker run -d -v /path/to/certs:etc/nginx/certs gordonchan/nginx-ssl-ghost.
• You could create and copy the files to a data volume. Then mount the data volume to the container. docker run -d -v certs_data:/etc/nginx/certs gordonchan/nginx-ssl-ghost.
• You could use a Dockerized script to automatically request, renew and install certificates. See gordonchan/auto-letsencrypt⁠.

Creating a data volume gives the most flexibility as it is independent of a container's life cycle. Managing the set up with Docker Compose is ideal. See this docker-compose.yml⁠ for an example.

⁠Nginx Configuration and SSL Cipher Suite

As per the default.conf⁠, all HTTP requests are redirected (301 Permanent Redirect) to the HTTPS equivalent.

We are using the 'moderate' profile cipher suite recommended by Mozilla⁠.

⁠2048-bit Diffie-Hellman Group

With the discovered weakness⁠ with Diffie-Hellman key exchange, the recommendation is generate a strong Diffie-Hellman group greater than 1024 bits (e.g. 2048 bits) or simply not support non-elliptic curve⁠ Diffie-Hellman key exchange.

A 2048-bit Diffie-Hellman group is generated when the container is first launched which may take some time.

⁠License

Copyright (c) 2015 Gordon Chan. Released under the MIT License. It is free software, and may be redistributed under the terms specified in the LICENSE⁠ file.