From ba55d1a0b6236e97218a1ed79dfa19a2633e56cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20Do=CC=88ring?= Date: Thu, 1 Sep 2016 17:29:25 +0200 Subject: [PATCH 01/15] Add alpine base image - Inspired by #408 - Possible solution for #543 --- Dockerfile.alpine | 31 +++++++++++++++++++++++++++++++ Makefile | 8 +++++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 Dockerfile.alpine diff --git a/Dockerfile.alpine b/Dockerfile.alpine new file mode 100644 index 0000000..5dfcdee --- /dev/null +++ b/Dockerfile.alpine @@ -0,0 +1,31 @@ +FROM nginx:1.11.3-alpine +MAINTAINER Jason Wilder mail@jasonwilder.com + +# Install wget and install/updates certificates +RUN apk add --no-cache --virtual .run-deps \ + ca-certificates bash wget \ + && update-ca-certificates + +# Configure Nginx and apply fix for very long server names +RUN echo "daemon off;" >> /etc/nginx/nginx.conf \ + && sed -i 's/^http {/&\n server_names_hash_bucket_size 128;/g' /etc/nginx/nginx.conf + +# Install Forego +ADD https://github.com/jwilder/forego/releases/download/v0.16.1/forego /usr/local/bin/forego +RUN chmod u+x /usr/local/bin/forego + +ENV DOCKER_GEN_VERSION 0.7.3 + +RUN wget --quiet https://github.com/jwilder/docker-gen/releases/download/$DOCKER_GEN_VERSION/docker-gen-alpine-linux-amd64-$DOCKER_GEN_VERSION.tar.gz \ + && tar -C /usr/local/bin -xvzf docker-gen-alpine-linux-amd64-$DOCKER_GEN_VERSION.tar.gz \ + && rm /docker-gen-alpine-linux-amd64-$DOCKER_GEN_VERSION.tar.gz + +COPY . /app/ +WORKDIR /app/ + +ENV DOCKER_HOST unix:///tmp/docker.sock + +VOLUME ["/etc/nginx/certs"] + +ENTRYPOINT ["/app/docker-entrypoint.sh"] +CMD ["forego", "start", "-r"] diff --git a/Makefile b/Makefile index 74ae6bf..1a50fbd 100644 --- a/Makefile +++ b/Makefile @@ -9,6 +9,12 @@ update-dependencies: docker pull appropriate/curl:latest docker pull docker:1.10 -test: +test-debian: docker build -t jwilder/nginx-proxy:bats . bats test + +test-alpine: + docker build -f Dockerfile.alpine -t jwilder/nginx-proxy:bats . + bats test + +test: test-debian test-alpine From 7d05f0d924ac8e59dadfaa0d4e99a08e7e2a4f20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20D=C3=B6ring?= Date: Sat, 3 Sep 2016 12:05:27 +0200 Subject: [PATCH 02/15] Add nginx alpine to update-dependencies task --- Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index 1a50fbd..0e802b3 100644 --- a/Makefile +++ b/Makefile @@ -4,6 +4,7 @@ update-dependencies: docker pull jwilder/docker-gen:0.7.3 docker pull nginx:1.11.3 + docker pull nginx:1.11.3-alpine docker pull python:3 docker pull rancher/socat-docker:latest docker pull appropriate/curl:latest From 1a608eaefbb3ad443a2f324b98271ce48ea84df9 Mon Sep 17 00:00:00 2001 From: Michael Date: Sat, 22 Oct 2016 14:31:57 +0200 Subject: [PATCH 03/15] add link to letsencrypt-nginx-proxy-companion --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 52ab6e4..355003e 100644 --- a/README.md +++ b/README.md @@ -125,6 +125,9 @@ $ docker run --volumes-from nginx \ Finally, start your containers with `VIRTUAL_HOST` environment variables. $ docker run -e VIRTUAL_HOST=foo.bar.com ... +### SSL Support using letsencrypt + +[letsencrypt-nginx-proxy-companion](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion)is a lightweight companion container for the nginx-proxy. It allow the creation/renewal of Let's Encrypt certificates automatically. ### SSL Support From dc910107cfc4cb5332ddaabd9d295e4c36e88c85 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Mon, 5 Dec 2016 09:21:39 -0500 Subject: [PATCH 04/15] Upgrade docker-engine and allow downgrades --- .travis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index e850f08..ea2de37 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,13 +4,13 @@ services: env: global: - - DOCKER_VERSION=1.12.1-0~trusty + - DOCKER_VERSION=1.12.3-0~trusty before_install: # list docker-engine versions - apt-cache madison docker-engine # upgrade docker-engine to specific version - - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y docker-engine=${DOCKER_VERSION} + - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y --allow-downgrades docker-engine=${DOCKER_VERSION} - docker version - docker info - sudo add-apt-repository ppa:duggan/bats --yes From 271729aaaa201209f8a10395fcb7a7b9715d3f34 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Mon, 5 Dec 2016 09:29:08 -0500 Subject: [PATCH 05/15] Put --allow-downgrades in the right place --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index ea2de37..18ac9d9 100644 --- a/.travis.yml +++ b/.travis.yml @@ -10,7 +10,7 @@ before_install: # list docker-engine versions - apt-cache madison docker-engine # upgrade docker-engine to specific version - - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y --allow-downgrades docker-engine=${DOCKER_VERSION} + - sudo apt-get -o Dpkg::Options::="--force-confnew" --allow-downgrades install -y docker-engine=${DOCKER_VERSION} - docker version - docker info - sudo add-apt-repository ppa:duggan/bats --yes From 59b88068596a40f5eb42a339c9a53064dbb6733d Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Mon, 5 Dec 2016 09:33:44 -0500 Subject: [PATCH 06/15] Travis-CI's apt-get doesn't have --allow-downgrades yet, which is annoying because --force-yes is deprecated --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 18ac9d9..5386261 100644 --- a/.travis.yml +++ b/.travis.yml @@ -10,7 +10,7 @@ before_install: # list docker-engine versions - apt-cache madison docker-engine # upgrade docker-engine to specific version - - sudo apt-get -o Dpkg::Options::="--force-confnew" --allow-downgrades install -y docker-engine=${DOCKER_VERSION} + - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y --force-yes docker-engine=${DOCKER_VERSION} - docker version - docker info - sudo add-apt-repository ppa:duggan/bats --yes From b66398d1bfd0b88caa00d7439cc2adee723642ff Mon Sep 17 00:00:00 2001 From: Cody Ramaker Date: Thu, 8 Dec 2016 13:24:49 -0600 Subject: [PATCH 07/15] Updated nginx to 1.11.6 --- Dockerfile | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6d5ce9b..afa564c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.11.3 +FROM nginx:1.11.6 MAINTAINER Jason Wilder mail@jasonwilder.com # Install wget and install/updates certificates diff --git a/README.md b/README.md index dc09923..1ff2ef2 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -![nginx 1.11.3](https://img.shields.io/badge/nginx-1.11.3-brightgreen.svg) ![License MIT](https://img.shields.io/badge/license-MIT-blue.svg) [![Build Status](https://travis-ci.org/jwilder/nginx-proxy.svg?branch=master)](https://travis-ci.org/jwilder/nginx-proxy) [![](https://img.shields.io/docker/stars/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [![](https://img.shields.io/docker/pulls/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') +![nginx 1.11.6](https://img.shields.io/badge/nginx-1.11.6-brightgreen.svg) ![License MIT](https://img.shields.io/badge/license-MIT-blue.svg) [![Build Status](https://travis-ci.org/jwilder/nginx-proxy.svg?branch=master)](https://travis-ci.org/jwilder/nginx-proxy) [![](https://img.shields.io/docker/stars/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [![](https://img.shields.io/docker/pulls/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') nginx-proxy sets up a container running nginx and [docker-gen][1]. docker-gen generates reverse proxy configs for nginx and reloads nginx when containers are started and stopped. From 004cc3cb8c421cbb2715ae1565725e4617131392 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20D=C3=B6ring?= Date: Wed, 28 Dec 2016 23:38:47 +0100 Subject: [PATCH 08/15] Upgrade to nginx 1.11.8 --- Dockerfile | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index afa564c..bf604e6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.11.6 +FROM nginx:1.11.8 MAINTAINER Jason Wilder mail@jasonwilder.com # Install wget and install/updates certificates diff --git a/README.md b/README.md index 1ff2ef2..12c36f6 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -![nginx 1.11.6](https://img.shields.io/badge/nginx-1.11.6-brightgreen.svg) ![License MIT](https://img.shields.io/badge/license-MIT-blue.svg) [![Build Status](https://travis-ci.org/jwilder/nginx-proxy.svg?branch=master)](https://travis-ci.org/jwilder/nginx-proxy) [![](https://img.shields.io/docker/stars/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [![](https://img.shields.io/docker/pulls/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') +![nginx 1.11.8](https://img.shields.io/badge/nginx-1.11.8-brightgreen.svg) ![License MIT](https://img.shields.io/badge/license-MIT-blue.svg) [![Build Status](https://travis-ci.org/jwilder/nginx-proxy.svg?branch=master)](https://travis-ci.org/jwilder/nginx-proxy) [![](https://img.shields.io/docker/stars/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [![](https://img.shields.io/docker/pulls/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') nginx-proxy sets up a container running nginx and [docker-gen][1]. docker-gen generates reverse proxy configs for nginx and reloads nginx when containers are started and stopped. From c1d93d112a7720fd3c13e3087e199ad056aa2ef4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20D=C3=B6ring?= Date: Thu, 29 Dec 2016 00:18:06 +0100 Subject: [PATCH 09/15] Upgrade nginx-alpine to 1.11.8 --- Dockerfile.alpine | 2 +- Makefile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile.alpine b/Dockerfile.alpine index 5dfcdee..4ce9561 100644 --- a/Dockerfile.alpine +++ b/Dockerfile.alpine @@ -1,4 +1,4 @@ -FROM nginx:1.11.3-alpine +FROM nginx:1.11.8-alpine MAINTAINER Jason Wilder mail@jasonwilder.com # Install wget and install/updates certificates diff --git a/Makefile b/Makefile index 0e802b3..acb3386 100644 --- a/Makefile +++ b/Makefile @@ -3,8 +3,8 @@ update-dependencies: docker pull jwilder/docker-gen:0.7.3 - docker pull nginx:1.11.3 - docker pull nginx:1.11.3-alpine + docker pull nginx:1.11.6 + docker pull nginx:1.11.8-alpine docker pull python:3 docker pull rancher/socat-docker:latest docker pull appropriate/curl:latest From 8d017504c012db70d6179b97ec3473d7a6f30e38 Mon Sep 17 00:00:00 2001 From: Thomas LEVEIL Date: Sat, 7 Jan 2017 20:57:19 +0100 Subject: [PATCH 10/15] TRAVIS: run debian and alpine tests in parallel --- .travis.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 5386261..6bc9cd6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,3 +1,4 @@ +dist: trusty sudo: required services: - docker @@ -18,5 +19,10 @@ before_install: - sudo apt-get install -qq bats - make update-dependencies +matrix: + include: + - env: TEST_ID=test-debian + - env: TEST_ID=test-alpine + script: - - make test + - make $TEST_ID From a3c6a272f1df482f530ec3d778c8315903e77897 Mon Sep 17 00:00:00 2001 From: Thomas LEVEIL Date: Sat, 7 Jan 2017 23:33:54 +0100 Subject: [PATCH 11/15] TEST: wildcards-hosts.bats - showcase http://foo.bar.why.not.bats-to-infinity-and-beyond/ --- test/wildcard-hosts.bats | 1 + 1 file changed, 1 insertion(+) diff --git a/test/wildcard-hosts.bats b/test/wildcard-hosts.bats index 8491e4b..ce9e3aa 100644 --- a/test/wildcard-hosts.bats +++ b/test/wildcard-hosts.bats @@ -50,6 +50,7 @@ function setup { # THEN assert_200 foo.bar.whatever.bats assert_200 foo.bar.why.not.bats + assert_200 foo.bar.why.not.bats-to-infinity-and-beyond assert_503 unexpected.host.bats } From d8658bd8d9825e7f9dc0c183b76e8b85610b07c8 Mon Sep 17 00:00:00 2001 From: Thomas LEVEIL Date: Sat, 7 Jan 2017 23:50:54 +0100 Subject: [PATCH 12/15] TEST: wildcards-hosts.bats - add a test which uses regexp end-of-string --- test/wildcard-hosts.bats | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/test/wildcard-hosts.bats b/test/wildcard-hosts.bats index ce9e3aa..826009e 100644 --- a/test/wildcard-hosts.bats +++ b/test/wildcard-hosts.bats @@ -43,8 +43,8 @@ function setup { @test "[$TEST_FILE] VIRTUAL_HOST=~^foo\.bar\..*\.bats" { # WHEN - prepare_web_container bats-wildcard-hosts-2 80 -e VIRTUAL_HOST=~^foo\.bar\..*\.bats - dockergen_wait_for_event $SUT_CONTAINER start bats-wildcard-hosts-2 + prepare_web_container bats-wildcard-hosts-3 80 -e VIRTUAL_HOST=~^foo\.bar\..*\.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-wildcard-hosts-3 sleep 1 # THEN @@ -55,6 +55,20 @@ function setup { } +@test "[$TEST_FILE] VIRTUAL_HOST=~^foo\.bar\..*\.bats$" { + # WHEN + prepare_web_container bats-wildcard-hosts-4 80 -e VIRTUAL_HOST=~^foo\.bar\..*\.bats$ + dockergen_wait_for_event $SUT_CONTAINER start bats-wildcard-hosts-4 + sleep 1 + + # THEN + assert_200 foo.bar.whatever.bats + assert_200 foo.bar.why.not.bats + assert_503 foo.bar.why.not.bats-to-infinity-and-beyond + assert_503 unexpected.host.bats + +} + @test "[$TEST_FILE] stop all bats containers" { stop_bats_containers } From 1bfc1c85ce26ef652616236561d6cbf61778e445 Mon Sep 17 00:00:00 2001 From: Thomas LEVEIL Date: Sun, 8 Jan 2017 01:49:05 +0100 Subject: [PATCH 13/15] fix regexp in VIRTUAL_HOST using end-of-string matching () --- nginx.tmpl | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/nginx.tmpl b/nginx.tmpl index 20688da..cab57e5 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -85,8 +85,8 @@ server { {{ end }} {{ range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }} - -upstream {{ $host }} { +{{ $upstream_name := sha1 $host }} +upstream {{ $upstream_name }} { {{ range $container := $containers }} {{ $addrLen := len $container.Addresses }} @@ -179,9 +179,9 @@ server { location / { {{ if eq $proto "uwsgi" }} include uwsgi_params; - uwsgi_pass {{ trim $proto }}://{{ trim $host }}; + uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ else }} - proxy_pass {{ trim $proto }}://{{ trim $host }}; + proxy_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ end }} {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }} auth_basic "Restricted {{ $host }}"; @@ -213,9 +213,9 @@ server { location / { {{ if eq $proto "uwsgi" }} include uwsgi_params; - uwsgi_pass {{ trim $proto }}://{{ trim $host }}; + uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ else }} - proxy_pass {{ trim $proto }}://{{ trim $host }}; + proxy_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ end }} {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }} auth_basic "Restricted {{ $host }}"; From 019fa89c536b16135b6cdc01298022e31dbbafae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20L=C3=89VEIL?= Date: Tue, 10 Jan 2017 10:10:46 +0100 Subject: [PATCH 14/15] add comment to ease debugging --- nginx.tmpl | 1 + 1 file changed, 1 insertion(+) diff --git a/nginx.tmpl b/nginx.tmpl index cab57e5..4a5e76b 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -86,6 +86,7 @@ server { {{ range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }} {{ $upstream_name := sha1 $host }} +# {{ $host }} upstream {{ $upstream_name }} { {{ range $container := $containers }} {{ $addrLen := len $container.Addresses }} From 16c9853dc22ce2d3ebe3a6d0afdb631620cac79e Mon Sep 17 00:00:00 2001 From: Konstantin L Date: Thu, 11 Feb 2016 23:54:32 +0300 Subject: [PATCH 15/15] Set appropriate X-Forwarded-Ssl header. --- README.md | 1 + nginx.tmpl | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/README.md b/README.md index 282010d..18e6fa3 100644 --- a/README.md +++ b/README.md @@ -226,6 +226,7 @@ proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; +proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl; proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; # Mitigate httpoxy attack (see README for details) diff --git a/nginx.tmpl b/nginx.tmpl index 20688da..3c6d4fc 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -38,6 +38,12 @@ map $http_upgrade $proxy_connection { '' close; } +# Set appropriate X-Forwarded-Ssl header +map $scheme $proxy_x_forwarded_ssl { + default off; + https on; +} + gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; log_format vhost '$host $remote_addr - $remote_user [$time_local] ' @@ -58,6 +64,7 @@ proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; +proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl; proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; # Mitigate httpoxy attack (see README for details)