diff --git a/reverse-proxy/Dockerfile b/reverse-proxy/Dockerfile deleted file mode 100644 index e6cca433..00000000 --- a/reverse-proxy/Dockerfile +++ /dev/null @@ -1,23 +0,0 @@ -## -## REVERSE PROXY IMAGE -## - -FROM nginx:1.23.1 - -RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y certbot python3-certbot-nginx - -COPY ./docker/nginx.conf.template /nginx.conf.template -COPY ./docker/nginx-ssl.conf.template /nginx-ssl.conf.template -COPY ./docker/entrypoint.sh /var/entrypoint.sh - -RUN chmod +x /var/entrypoint.sh - -# Default nginx configuration has only one worker process running. "Auto" is a better setting for scalability. -# Commenting out any existing setting, and adding the desired one is more robust against new docker image versions. -RUN sed -i "s/worker_processes/#worker_processes/" /etc/nginx/nginx.conf && \ - echo "worker_processes auto;" >> /etc/nginx/nginx.conf && \ - echo "worker_rlimit_nofile 16384;" >> /etc/nginx/nginx.conf - -# Override the default command of the base image: -# See: https://github.com/nginxinc/docker-nginx/blob/1.15.7/mainline/stretch/Dockerfile#L99 -CMD ["/var/entrypoint.sh"] diff --git a/reverse-proxy/docker/entrypoint.sh b/reverse-proxy/docker/entrypoint.sh deleted file mode 100644 index 6479ab58..00000000 --- a/reverse-proxy/docker/entrypoint.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/usr/bin/env bash - -echo; echo -echo "reverse-proxy: Starting up!" -echo " - HTTPS: ${HTTPS}" -echo " - FRONTEND_DOMAIN_NAME: ${FRONTEND_DOMAIN_NAME}" -echo " - BACKEND_DOMAIN_NAME: ${BACKEND_DOMAIN_NAME}" - -set -e - -# Directory used by certbot to serve certificate requests challenges: -mkdir -p /var/www/certbot - -if [ $HTTPS = "true" ]; then - echo "Starting in SSL mode" - - rm /etc/nginx/conf.d/default.conf - - echo - echo "Obtaining SSL certificate for frontend domain name: ${FRONTEND_DOMAIN_NAME}" - certbot certonly --noninteractive --agree-tos --register-unsafely-without-email --nginx -d ${FRONTEND_DOMAIN_NAME} - - echo - echo "Obtaining SSL certificate for backend domain name: ${BACKEND_DOMAIN_NAME}" - certbot certonly --noninteractive --agree-tos --register-unsafely-without-email --nginx -d ${BACKEND_DOMAIN_NAME} - - # The above certbot command will start the nginx service in the background as a service. - # However, we need the `nginx -g "daemon off;"` to be the main nginx process running on the container, and - # we need it to be able to start listening on ports 80/443. If we don't stop the nginx process here, we'll - # encounter the following error: `nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)`. - service nginx stop - - envsubst '$FRONTEND_DOMAIN_NAME $BACKEND_DOMAIN_NAME $DOMAIN_VALIDATION_KEY' < /nginx-ssl.conf.template > /etc/nginx/conf.d/default.conf -else - echo "Starting in http mode" - envsubst '$FRONTEND_DOMAIN_NAME $BACKEND_DOMAIN_NAME $DOMAIN_VALIDATION_KEY' < /nginx.conf.template > /etc/nginx/conf.d/default.conf -fi - -# Call the command that the base image was initally supposed to run -# See: XXX -nginx -g "daemon off;" diff --git a/reverse-proxy/docker/nginx-ssl.conf.template b/reverse-proxy/docker/nginx-ssl.conf.template deleted file mode 100644 index 2e8b784c..00000000 --- a/reverse-proxy/docker/nginx-ssl.conf.template +++ /dev/null @@ -1,86 +0,0 @@ -# -# Frontend config: -# -server { - # Use Docker's built-in DNS resolver to enable resolving container hostnames used in the proxy_pass - # directives below. - # https://stackoverflow.com/questions/35744650/docker-network-nginx-resolver - resolver 127.0.0.11 ipv6=off; - - # Enable nginx to start even when upstream hosts are unreachable (i.e containers not started yet) - # https://sandro-keil.de/blog/let-nginx-start-if-upstream-host-is-unavailable-or-down/ - set $frontend_upstream http://frontend; - - server_name ${FRONTEND_DOMAIN_NAME}; - listen 443 ssl; - - ssl_certificate /etc/letsencrypt/live/${FRONTEND_DOMAIN_NAME}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/${FRONTEND_DOMAIN_NAME}/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location /validation-key.txt { - return 200 '${DOMAIN_VALIDATION_KEY}'; - } - - location / { - proxy_pass $frontend_upstream; - } -} - -server { - listen 80; - server_name ${FRONTEND_DOMAIN_NAME}; - - if ($host = ${FRONTEND_DOMAIN_NAME}) { - return 302 https://$host$request_uri; - } - - return 404; -} - - -# -# Backend config: -# -server { - # Use Docker's built-in DNS resolver to enable resolving container hostnames used in the proxy_pass - # directives below. - # https://stackoverflow.com/questions/35744650/docker-network-nginx-resolver - resolver 127.0.0.11 ipv6=off; - - # Enable nginx to start even when upstream hosts are unreachable (i.e containers not started yet) - # https://sandro-keil.de/blog/let-nginx-start-if-upstream-host-is-unavailable-or-down/ - set $backend_upstream http://backend:8000; - - server_name ${BACKEND_DOMAIN_NAME}; - listen 443 ssl; - - ssl_certificate /etc/letsencrypt/live/${BACKEND_DOMAIN_NAME}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/${BACKEND_DOMAIN_NAME}/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - proxy_pass $backend_upstream; - } -} - -server { - listen 80; - server_name ${BACKEND_DOMAIN_NAME}; - - if ($host = ${BACKEND_DOMAIN_NAME}) { - return 302 https://$host$request_uri; - } - - return 404; -} diff --git a/reverse-proxy/docker/nginx.conf.template b/reverse-proxy/docker/nginx.conf.template deleted file mode 100644 index 07cbfa47..00000000 --- a/reverse-proxy/docker/nginx.conf.template +++ /dev/null @@ -1,52 +0,0 @@ -# -# Frontend config: -# -server { - # Use Docker's built-in DNS resolver to enable resolving container hostnames used in the proxy_pass - # directives below. - # https://stackoverflow.com/questions/35744650/docker-network-nginx-resolver - resolver 127.0.0.11 ipv6=off; - - # Enable nginx to start even when upstream hosts are unreachable (i.e containers not started yet) - # https://sandro-keil.de/blog/let-nginx-start-if-upstream-host-is-unavailable-or-down/ - set $frontend_upstream http://frontend; - - server_name ${FRONTEND_DOMAIN_NAME}; - listen 80; - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - proxy_pass $frontend_upstream; - } -} - -# -# Backend config: -# -server { - # Use Docker's built-in DNS resolver to enable resolving container hostnames used in the proxy_pass - # directives below. - # https://stackoverflow.com/questions/35744650/docker-network-nginx-resolver - resolver 127.0.0.11 ipv6=off; - - # Enable nginx to start even when upstream hosts are unreachable (i.e containers not started yet) - # https://sandro-keil.de/blog/let-nginx-start-if-upstream-host-is-unavailable-or-down/ - set $backend_upstream http://backend:8000; - - server_name ${BACKEND_DOMAIN_NAME}; - listen 80; - - # Enable nginx to start even when upstream hosts are unreachable (i.e containers not started yet) - # https://sandro-keil.de/blog/let-nginx-start-if-upstream-host-is-unavailable-or-down/ - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - proxy_pass $backend_upstream; - } -}