Skip to content

Commit a7950e0

Browse files
daN4catdaN4cat
committed
docker-compose for nginx reverse proxy and letsencrypt certbot
1 parent 0491c18 commit a7950e0

12 files changed

+315
-40
lines changed

‎.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,7 @@ vendor/
3232
*.log
3333
.env
3434
package-lock.json
35+
!/docker/.env
36+
/docker/data/database/db/*
37+
/docker/data/certbot/conf/*
38+
/docker/data/ospos/app/*

‎.travis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ script:
2020
- sed -i "s/'\(dev\)'/'$rev'/g" application/config/config.php
2121
- docker run --rm -it -v $(pwd):/app -w /app digitallyseamless/nodejs-bower-grunt
2222
sh -c "npm install && bower install && grunt package"
23-
- docker-compose build
23+
- /bin/bash docker/install-local.sh
2424
env:
2525
- TAG=$(echo ${TRAVIS_BRANCH} | sed s/feature\\///)
2626
after_success: '[ -n ${DOCKER_USERNAME} ] && docker login -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"

‎Dockerfile

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
FROM php:7.2.18-apache
1+
FROM php:7.2-apache
22
MAINTAINER jekkos
3+
34
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
45
libicu-dev \
56
libgd-dev \

‎database/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM debian:jessie
1+
FROM alpine
22
MAINTAINER jekkos
33

44
ADD database.sql /docker-entrypoint-initdb.d/database.sql

‎docker-compose.yml

+75-37
Original file line numberDiff line numberDiff line change
@@ -5,63 +5,101 @@ volumes:
55
driver: local
66

77
networks:
8-
ospos_net:
8+
app_net:
9+
db_net:
910

1011
services:
1112
sqlscript:
1213
build:
1314
context: database/
1415
dockerfile: Dockerfile
1516

16-
php:
17+
ospos:
1718
build:
1819
context: .
1920
dockerfile: Dockerfile
20-
container_name: php
21+
container_name: ospos
2122
restart: always
2223
depends_on:
23-
- mysql
24-
ports:
25-
- "80:80"
24+
- mysql
25+
expose:
26+
- "80"
2627
networks:
27-
- ospos_net
28+
- app_net
29+
- db_net
2830
volumes:
29-
- uploads:/app/public/uploads
31+
- uploads:/app/public/uploads
3032
environment:
31-
- FORCE_HTTPS=false
32-
- PHP_TIMEZONE=UTC
33-
- MYSQL_USERNAME=admin
34-
- MYSQL_PASSWORD=pointofsale
35-
- MYSQL_DB_NAME=ospos
36-
- MYSQL_HOST_NAME=mysql
33+
- FORCE_HTTPS=true
34+
- PHP_TIMEZONE=UTC
35+
- MYSQL_USERNAME=${OSPOS_MYSQL_USERNAME}
36+
- MYSQL_PASSWORD=${OSPOS_MYSQL_PASSWORD}
37+
- MYSQL_DB_NAME=ospos
38+
- MYSQL_HOST_NAME=mysql
3739

3840
mysql:
39-
image: mariadb:10.3.9
41+
image: mariadb:10.3
4042
container_name: mysql
4143
restart: always
42-
ports:
43-
- "3306:3306"
44+
expose:
45+
- "3306"
4446
networks:
45-
- ospos_net
47+
- db_net
4648
volumes_from:
47-
- sqlscript
49+
- sqlscript
4850
environment:
49-
- MYSQL_ROOT_PASSWORD=pointofsale
50-
- MYSQL_DATABASE=ospos
51-
- MYSQL_USER=admin
52-
- MYSQL_PASSWORD=pointofsale
51+
- MYSQL_ROOT_PASSWORD=${OSPOS_MYSQL_ROOT_PASSWORD}
52+
- MYSQL_DATABASE=ospos
53+
- MYSQL_USER=${OSPOS_MYSQL_USERNAME}
54+
- MYSQL_PASSWORD=${OSPOS_MYSQL_PASSWORD}
5355

54-
# phpmyadmin:
55-
# image: phpmyadmin/phpmyadmin
56-
# container_name: phpmyadmin
57-
# restart: always
58-
# depends_on:
59-
# - mysql
60-
# ports:
61-
# - "8000:80"
62-
# networks:
63-
# - ospos_net
64-
# environment:
65-
# - MYSQL_USERNAME=admin
66-
# - MYSQL_ROOT_PASSWORD=pointofsale
67-
# - PMA_HOST=mysql
56+
phpmyadmin:
57+
image: phpmyadmin/phpmyadmin
58+
container_name: phpmyadmin
59+
restart: always
60+
depends_on:
61+
- mysql
62+
expose:
63+
- "80"
64+
networks:
65+
- app_net
66+
- db_net
67+
environment:
68+
- MYSQL_USERNAME=${OSPOS_MYSQL_USERNAME}
69+
- MYSQL_ROOT_PASSWORD=${OSPOS_MYSQL_ROOT_PASSWORD}
70+
- PMA_HOST=mysql
71+
72+
nginx:
73+
image: nginx:1.15-alpine
74+
container_name: nginx
75+
restart: always
76+
depends_on:
77+
- ospos
78+
- phpmyadmin
79+
- certbot
80+
volumes:
81+
- ./docker/data/nginx/nginx.tmpl:/etc/nginx/nginx.tmpl:ro
82+
- ./docker/data/nginx/error_log.log:/etc/nginx/error_log.log
83+
- ./docker/data/certbot/conf:/etc/letsencrypt:ro
84+
- ./docker/data/certbot/www:/var/www/certbot:ro
85+
ports:
86+
- "80:80"
87+
- "443:443"
88+
- "8000:8000"
89+
networks:
90+
- app_net
91+
environment:
92+
- WEB_DOMAIN=${OSPOS_DOMAIN_NAME}
93+
- ESC=$$
94+
command: "/bin/sh -c 'envsubst < /etc/nginx/nginx.tmpl > /etc/nginx/nginx.conf & while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
95+
96+
certbot:
97+
image: certbot/certbot
98+
container_name: certbot
99+
restart: always
100+
volumes:
101+
- ./docker/data/certbot/conf:/etc/letsencrypt
102+
- ./docker/data/certbot/www:/var/www/certbot
103+
networks:
104+
- app_net
105+
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

‎docker/.env

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
OSPOS_MYSQL_USERNAME=admin
2+
OSPOS_MYSQL_PASSWORD=pointofsale
3+
OSPOS_MYSQL_ROOT_PASSWORD=ospos_mysql
4+
# Set a valid domain name if you use Letsencrypt
5+
OSPOS_DOMAIN_NAME=ospos.ospos
6+
# Set a valid email address if you use Letsencrypt
7+
OSPOS_CONTACT_EMAIL=[email protected]
8+
# Set to 1 if you're testing your setup with Letsencrypt
9+
# to avoid hitting request limits, otherwise set 0
10+
OSPOS_STAGING=1

‎docker/data/nginx/nginx.tmpl

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
worker_processes auto;
2+
3+
events {
4+
worker_connections 1024;
5+
}
6+
7+
http {
8+
9+
error_log /etc/nginx/error_log.log warn;
10+
11+
server {
12+
listen 80;
13+
server_name ${WEB_DOMAIN};
14+
server_tokens off;
15+
16+
location /.well-known/acme-challenge/ {
17+
root /var/www/certbot;
18+
}
19+
20+
location / {
21+
return 301 https://${ESC}host${ESC}request_uri;
22+
}
23+
}
24+
25+
server {
26+
listen 443 ssl;
27+
server_name ${WEB_DOMAIN};
28+
server_tokens off;
29+
30+
client_max_body_size 10M;
31+
32+
ssl_certificate /etc/letsencrypt/live/ospos.ospos/fullchain.pem;
33+
ssl_certificate_key /etc/letsencrypt/live/ospos.ospos/privkey.pem;
34+
include /etc/letsencrypt/options-ssl-nginx.conf;
35+
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
36+
37+
location / {
38+
proxy_pass http://ospos:80;
39+
proxy_redirect off;
40+
proxy_set_header Host ${ESC}host;
41+
proxy_set_header X-Real-IP ${ESC}remote_addr;
42+
proxy_set_header X-Forwarded-For ${ESC}proxy_add_x_forwarded_for;
43+
proxy_set_header X-Forwarded-Host ${ESC}server_name;
44+
proxy_set_header X-Forwarded-Proto ${ESC}scheme;
45+
}
46+
}
47+
48+
server {
49+
listen 8000 ssl;
50+
server_name ${WEB_DOMAIN};
51+
server_tokens off;
52+
53+
ssl_certificate /etc/letsencrypt/live/ospos.ospos/fullchain.pem;
54+
ssl_certificate_key /etc/letsencrypt/live/ospos.ospos/privkey.pem;
55+
include /etc/letsencrypt/options-ssl-nginx.conf;
56+
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
57+
58+
location / {
59+
proxy_pass http://phpmyadmin:80;
60+
proxy_redirect off;
61+
proxy_set_header Host ${ESC}host;
62+
proxy_set_header X-Real-IP ${ESC}remote_addr;
63+
proxy_set_header X-Forwarded-For ${ESC}proxy_add_x_forwarded_for;
64+
proxy_set_header X-Forwarded-Host ${ESC}server_name;
65+
proxy_set_header X-Forwarded-Proto ${ESC}scheme;
66+
}
67+
}
68+
69+
}

‎docker/init-letsencrypt.sh

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#!/bin/bash
2+
3+
domains=(${OSPOS_DOMAIN_NAME})
4+
rsa_key_size=4096
5+
data_path="./data/certbot"
6+
email="${OSPOS_CONTACT_EMAIL}"
7+
staging=${OSPOS_STAGING}
8+
9+
if [ -d "$data_path" ]; then
10+
read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
11+
if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
12+
exit
13+
fi
14+
fi
15+
16+
17+
if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
18+
echo "### Downloading recommended TLS parameters ..."
19+
mkdir -p "$data_path/conf"
20+
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
21+
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
22+
echo
23+
fi
24+
25+
echo "### Creating dummy certificate for $domains ..."
26+
path="/etc/letsencrypt/live/$domains"
27+
mkdir -p "$data_path/conf/live/$domains"
28+
docker-compose run --rm --entrypoint "\
29+
openssl req -x509 -nodes -newkey rsa:1024 -days 1\
30+
-keyout '$path/privkey.pem' \
31+
-out '$path/fullchain.pem' \
32+
-subj '/CN=localhost'" certbot
33+
echo
34+
35+
36+
echo "### Starting nginx ..."
37+
docker-compose up --force-recreate -d nginx
38+
echo
39+
40+
echo "### Deleting dummy certificate for $domains ..."
41+
docker-compose run --rm --entrypoint "\
42+
rm -Rf /etc/letsencrypt/live/$domains && \
43+
rm -Rf /etc/letsencrypt/archive/$domains && \
44+
rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
45+
echo
46+
47+
48+
echo "### Requesting Let's Encrypt certificate for $domains ..."
49+
#Join $domains to -d args
50+
domain_args=""
51+
for domain in "${domains[@]}"; do
52+
domain_args="$domain_args -d $domain"
53+
done
54+
55+
# Select appropriate email arg
56+
case "$email" in
57+
"") email_arg="--register-unsafely-without-email" ;;
58+
*) email_arg="--email $email" ;;
59+
esac
60+
61+
# Enable staging mode if needed
62+
if [ $staging != "0" ]; then staging_arg="--staging"; fi
63+
64+
docker-compose run --rm --entrypoint "\
65+
certbot certonly --webroot -w /var/www/certbot \
66+
$staging_arg \
67+
$email_arg \
68+
$domain_args \
69+
--rsa-key-size $rsa_key_size \
70+
--agree-tos \
71+
--force-renewal" certbot
72+
echo
73+
74+
echo "### Reloading nginx ..."
75+
docker-compose exec nginx nginx -s reload

‎docker/init-selfcert.sh

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/bash
2+
3+
domains=(${OSPOS_DOMAIN_NAME})
4+
rsa_key_size=4096
5+
data_path="./data/certbot"
6+
7+
if [ -d "$data_path" ]; then
8+
read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
9+
if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
10+
exit
11+
fi
12+
fi
13+
14+
15+
if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
16+
echo "### Downloading recommended TLS parameters ..."
17+
mkdir -p "$data_path/conf"
18+
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
19+
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
20+
echo
21+
fi
22+
23+
24+
echo "### Creating dummy certificate for $domains ..."
25+
path="/etc/letsencrypt/live/$domains"
26+
mkdir -p "$data_path/conf/live/$domains"
27+
docker-compose run --rm --entrypoint "\
28+
openssl req -x509 -nodes -newkey rsa:1024 -days 1\
29+
-keyout '$path/privkey.pem' \
30+
-out '$path/fullchain.pem' \
31+
-subj '/CN=localhost'" certbot
32+
echo
33+
34+
35+
echo "### Starting nginx ..."
36+
docker-compose up --force-recreate -d nginx
37+
echo
38+
39+
40+
#echo "### Reloading nginx ..."
41+
#docker-compose exec nginx nginx -s reload

‎docker/install-local.sh

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
cd docker
4+
5+
# load local environment variables
6+
if [ ! -e ".env" ]; then
7+
echo "The .env (environment variables) file is missing"
8+
exit 1
9+
fi
10+
11+
. ./.env
12+
13+
docker-compose build
14+
15+
/bin/bash ./init-selfcert.sh

0 commit comments

Comments
 (0)