为 docker 中的 nginx 配置 https

就是一个提供免费 SSL/TLS 证书的网站，由于其证书期限只有三个月，所以需要我们用自动化的方式去更新证书。本文将介绍如何为通过 docker 运行的 nginx 中的站点添加 https 支持，并自动完成证书的更新。本文的演示环境为：运行在 Azure 上的 Ubuntu 16.04 主机(此图来自互联网)：

$ docker pull ljfpower/--d --restart=always --expose=--network=webnet --name=/nodedemo

$ -p nginx/ -p logs/{nginx,letsencrypt}

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
worker_connections 2048;
}

http {
include /etc/nginx/mime.types;
default_type application/octet-stream;

sendfile        on;
keepalive_timeout    </span><span style="color: #800080"&gt;65</span><span style="color: #000000"&gt;;
client_max_body_size 10M;

include </span>/etc/nginx/conf.d<span style="color: #008000"&gt;/*</span><span style="color: #008000"&gt;.conf;

}

location </span>^~ /.well-known/acme-challenge/<span style="color: #000000"&gt; {
    default_type </span><span style="color: #800000"&gt;"</span><span style="color: #800000"&gt;text/plain</span><span style="color: #800000"&gt;"</span><span style="color: #000000"&gt;;
    root </span>/usr/share/nginx/<span style="color: #000000"&gt;html;
}
location </span>= /.well-known/acme-challenge/<span style="color: #000000"&gt; {
    return </span><span style="color: #800080"&gt;404</span><span style="color: #000000"&gt;;
}
location </span>/<span style="color: #000000"&gt; {
    proxy_pass http:</span><span style="color: #008000"&gt;//</span><span style="color: #008000"&gt;web;</span>

}
}

Let's Encrypt First Time Cert Issue Site Hello HTTPS!

$ docker run --p :-v $()/nginx/conf.d:/etc/nginx/-v $()/nginx/nginx.conf:/etc/nginx/-v $()/logs/nginx:/var/log/-v $()/nginx/html:/usr/share/nginx/--restart=--name=--network=

是一个提供免费 SSL/TLS 证书的网站，它为用户提供了 certbot 工具用来生成 SSL/TLS 证书。方便起见，我们把 certbot 简单的封装到容器中。在用户的家目录下创建 certbot 目录，进入 certbot 目录并把下面的内容保存到 Dockerfile 文件中：

FROM alpine:--]

$ docker build -t certbot: .

#!/bin/==( ==/usr/share/nginx/ domain ${LIST[@]};---v ${WEBDIR}/nginx/conf.crt:/etc/-v ${WEBDIR}/logs/letsencrypt:/var/log/-v ${WEBDIR}/nginx/--verbose --noninteractive --quiet --agree---webroot ---email=-d =$? [ $CODE -ne ]; += output failed domains

if [ ${#FAILED_LIST[@]} -ne 0 ];then
echo 'failed domain:'
for (( i=0; i<${#FAILED_LIST[@]}; i++ ));
do
echo ${FAILED_LIST[$i]}
done
fi

server {
listen 80;
listen [::]:80;
server_name filterinto.com www.filterinto.com;

location </span>^~ /.well-known/acme-challenge/<span style="color: #000000"&gt; {
    default_type </span><span style="color: #800000"&gt;"</span><span style="color: #800000"&gt;text/plain</span><span style="color: #800000"&gt;"</span><span style="color: #000000"&gt;;
    root </span>/usr/share/nginx/<span style="color: #000000"&gt;html;
}
location </span>= /.well-known/acme-challenge/<span style="color: #000000"&gt; {
    return </span><span style="color: #800080"&gt;404</span><span style="color: #000000"&gt;;
}
return </span><span style="color: #800080"&gt;301</span> https:<span style="color: #008000"&gt;//</span><span style="color: #008000"&gt;$server_name$request_uri;</span>

}
server {
listen 443;
listen [::]:443;
server_name filterinto.com;

# enable ssl
ssl                       on;
ssl_protocols TLSv1 TLSv1.</span><span style="color: #800080"&gt;1</span> TLSv1.<span style="color: #800080"&gt;2</span><span style="color: #000000"&gt;;
ssl_prefer_server_ciphers on;
ssl_ciphers               </span><span style="color: #800000"&gt;"</span><span style="color: #800000"&gt;EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4</span><span style="color: #800000"&gt;"</span><span style="color: #000000"&gt;;

# config ssl certificate

ssl_certificate conf.crt/live/filterinto.com/fullchain.pem;
ssl_certificate_key conf.crt/live/filterinto.com/privkey.pem;

location </span>^~ /.well-known/acme-challenge/<span style="color: #000000"&gt; {
    default_type </span><span style="color: #800000"&gt;"</span><span style="color: #800000"&gt;text/plain</span><span style="color: #800000"&gt;"</span><span style="color: #000000"&gt;;
    root </span>/usr/share/nginx/<span style="color: #000000"&gt;html;
}
location </span>= /.well-known/acme-challenge/<span style="color: #000000"&gt; {
        return </span><span style="color: #800080"&gt;404</span><span style="color: #000000"&gt;;
}
location </span>/<span style="color: #000000"&gt; {
    proxy_pass http:</span><span style="color: #008000"&gt;//</span><span style="color: #008000"&gt;web;</span>

}
}
server {
listen 443;
listen [::]:443;
server_name www.filterinto.com;

# enable ssl
ssl                       on;
ssl_protocols TLSv1 TLSv1.</span><span style="color: #800080"&gt;1</span> TLSv1.<span style="color: #800080"&gt;2</span><span style="color: #000000"&gt;;
ssl_prefer_server_ciphers on;
ssl_ciphers               </span><span style="color: #800000"&gt;"</span><span style="color: #800000"&gt;EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4</span><span style="color: #800000"&gt;"</span><span style="color: #000000"&gt;;

# config ssl certificate

 ssl_certificate conf.crt/live/www.filterinto.com/fullchain.pem;
ssl_certificate_key conf.crt/live/www.filterinto.com/privkey.pem;

location </span>^~ /.well-known/acme-challenge/<span style="color: #000000"&gt; {
    default_type </span><span style="color: #800000"&gt;"</span><span style="color: #800000"&gt;text/plain</span><span style="color: #800000"&gt;"</span><span style="color: #000000"&gt;;
    root </span>/usr/share/nginx/<span style="color: #000000"&gt;html;
}
location </span>= /.well-known/acme-challenge/<span style="color: #000000"&gt; {
        return </span><span style="color: #800080"&gt;404</span><span style="color: #000000"&gt;;
}
location </span>/<span style="color: #000000"&gt; {
    proxy_pass http:</span><span style="color: #008000"&gt;//</span><span style="color: #008000"&gt;web;</span>

}
}

$ docker run --p :-p :-v $()/nginx/conf.d:/etc/nginx/-v $()/nginx/nginx.conf:/etc/nginx/-v $()/logs/nginx:/var/log/-v $()/nginx/html:/usr/share/nginx/--restart=--name=--network=

* * /home/nick/certbot/renew_cert. /home/nick >> /home/nick/logs/cert.log >> /home/nick/logs/ * * docker exec gateway nginx -s reload

为 docker 中的 nginx 配置 https

相关文章