Sfoglia il codice sorgente

Included steps for adding SSL certificate from a CA other than letsencrypt

master
jfederico 4 anni fa
parent
commit
17e89295e3
5 ha cambiato i file con 42 aggiunte e 8 eliminazioni
  1. 0
    1
      .gitignore
  2. 27
    1
      README.md
  3. 10
    6
      docker-compose.yml
  4. 5
    0
      nginx/sites.template
  5. 0
    0
      nginx/ssl/.placeholder_for_ssl_certificates

+ 0
- 1
.gitignore Vedi File

3
 /data*
3
 /data*
4
 
4
 
5
 /nginx/log*
5
 /nginx/log*
6
-/nginx/ssl*
7
 /nginx/sites-available*
6
 /nginx/sites-available*
8
 /nginx/sites-enabled*
7
 /nginx/sites-enabled*
9
 /nginx/letsencrypt/live/*
8
 /nginx/letsencrypt/live/*

+ 27
- 1
README.md Vedi File

175
 
175
 
176
 #### Build your own image
176
 #### Build your own image
177
 
177
 
178
-If you don;t have access to the DockerHub registry, you can always build your own image. Either by running `docker build` where scalelite code is placed, or using the build script provided in this repo at `scripts/build.sh`. The only advantage of using the script is that the last commit is included as the build number.
178
+If no access to the DockerHub registry is available, it is still possible to build the image. Either by running `docker build` where scalelite code is placed, or using the build script provided in this repo at `scripts/build.sh`. The only advantage of using the script is that the last commit is included as the build number.
179
 
179
 
180
 ```
180
 ```
181
 cd <YOUR ROOT>/scalelite
181
 cd <YOUR ROOT>/scalelite
190
 ```
190
 ```
191
 
191
 
192
 Keep in mind that the docker-compose.yml script makes use of some other configuration files that are mounted inside the containers. If any modification to nginx is needed it has to be done on the sites.template file. Also, whatever name is chosen for the image should match the one used in docker-compose.yml.
192
 Keep in mind that the docker-compose.yml script makes use of some other configuration files that are mounted inside the containers. If any modification to nginx is needed it has to be done on the sites.template file. Also, whatever name is chosen for the image should match the one used in docker-compose.yml.
193
+
194
+#### Setup SSL certificate from a CA other than letsencrypt
195
+
196
+For adding an SSL certificate from an CA other than letsencrypt,
197
+
198
+1. DO NOT execute the `./init-letsencrypt.sh` script
199
+
200
+2. Place the SSL Certificate, Intermediate Certificate (or Bundle with both of them if you have it) and Private Key files inside `nginx/ssl` as fullchain.pem and privkey.pem.
201
+E.g.
202
+```
203
+cd ~/
204
+cat your_domain_name.crt Intermediate.crt >> bundle.crt
205
+cp bundle.crt <YOUR ROOT>/scalelite/nginx/ssl/fullchain.pem
206
+cp private.key <YOUR ROOT>/scalelite/nginx/ssl/privkey.pem
207
+```
208
+
209
+3. Edit the template for nginx.
210
+```
211
+cd <YOUR ROOT>/scalelite
212
+vi nginx/sites.template
213
+```
214
+Comment the lines referencing the letsencrypt Certificate and uncomment the other two
215
+
216
+4. Comment out in `docker-compose.yml` the certbot container.
217
+
218
+5. Start the containers as usual.

+ 10
- 6
docker-compose.yml Vedi File

14
       - ./nginx/sites.template:/etc/nginx/sites-available/sites.template
14
       - ./nginx/sites.template:/etc/nginx/sites-available/sites.template
15
       - ./nginx/default/html:/var/www/html
15
       - ./nginx/default/html:/var/www/html
16
       - ./nginx/log/nginx:/var/log/nginx
16
       - ./nginx/log/nginx:/var/log/nginx
17
+## Configuration for Letsencrypt SSL Certificate
17
       - ./data/certbot/conf:/etc/letsencrypt
18
       - ./data/certbot/conf:/etc/letsencrypt
18
       - ./data/certbot/www:/var/www/certbot
19
       - ./data/certbot/www:/var/www/certbot
20
+## Configuration for Letsencrypt SSL Certificate
21
+#      - ./nginx/ssl/:/etc/ssl
19
     ports:
22
     ports:
20
       - "80:80"
23
       - "80:80"
21
       - "443:443"
24
       - "443:443"
26
     command: /bin/bash -c "envsubst '$$NGINX_HOSTNAME' < /etc/nginx/sites-available/sites.template > /etc/nginx/sites-enabled/sites.conf && while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g 'daemon off;'"
29
     command: /bin/bash -c "envsubst '$$NGINX_HOSTNAME' < /etc/nginx/sites-available/sites.template > /etc/nginx/sites-enabled/sites.conf && while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g 'daemon off;'"
27
 
30
 
28
 
31
 
32
+## Configuration for Letsencrypt SSL Certificate
33
+## comment out when using an SSL Certificate from a CA other than Letsencrypt
29
   certbot:
34
   certbot:
30
     image: certbot/certbot
35
     image: certbot/certbot
31
     volumes:
36
     volumes:
35
 
40
 
36
 
41
 
37
   redis:
42
   redis:
38
-    image: redis
43
+    image: redis:5.0-alpine
39
     restart: "no"
44
     restart: "no"
40
     ports:
45
     ports:
41
       - 127.0.0.1:6379:6379
46
       - 127.0.0.1:6379:6379
44
 
49
 
45
 
50
 
46
   postgres:
51
   postgres:
47
-    image: postgres:9.5
52
+    image: postgres:11.7-alpine
48
     restart: "no"
53
     restart: "no"
49
     ports:
54
     ports:
50
       - 127.0.0.1:5432:5432
55
       - 127.0.0.1:5432:5432
51
     volumes:
56
     volumes:
52
       - ./data/postgres/:/var/lib/postgresql/data
57
       - ./data/postgres/:/var/lib/postgresql/data
53
     environment:
58
     environment:
54
-      - PGHOST=postgres
55
-      - PGDATABASE=postgres
56
-      - PGUSER=postgres
57
-      - PGPASSWORD=password
59
+      - POSTGRES_DB=postgres
60
+      - POSTGRES_USER=postgres
61
+      - POSTGRES_PASSWORD=password
58
 
62
 
59
 
63
 
60
   scalelite.api:
64
   scalelite.api:

+ 5
- 0
nginx/sites.template Vedi File

25
     listen 443 ssl;
25
     listen 443 ssl;
26
     listen [::]:443;
26
     listen [::]:443;
27
 
27
 
28
+    ## Configuration for Letsencrypt SSL Certificate
28
     ssl_certificate /etc/letsencrypt/live/$NGINX_HOSTNAME/fullchain.pem;
29
     ssl_certificate /etc/letsencrypt/live/$NGINX_HOSTNAME/fullchain.pem;
29
     ssl_certificate_key /etc/letsencrypt/live/$NGINX_HOSTNAME/privkey.pem;
30
     ssl_certificate_key /etc/letsencrypt/live/$NGINX_HOSTNAME/privkey.pem;
30
 
31
 
32
+    ## Configuration for SSL Certificate from a CA other than Letsencrypt
33
+    #ssl_certificate /etc/ssl/fullchain.pem;
34
+    #ssl_certificate_key /etc/ssl/privkey.pem;
35
+
31
     location / {
36
     location / {
32
             proxy_pass  http://docker-scalelite;
37
             proxy_pass  http://docker-scalelite;
33
             proxy_read_timeout 60s;
38
             proxy_read_timeout 60s;

+ 0
- 0
nginx/ssl/.placeholder_for_ssl_certificates Vedi File


Loading…
Annulla
Salva