From 51c219d651de134ba352b081d60fd33d155d9cd7 Mon Sep 17 00:00:00 2001 From: pabra Date: Tue, 22 Dec 2015 21:20:44 +0100 Subject: [PATCH 01/17] connect to uWSGI backends --- README.md | 7 ++++++- nginx.tmpl | 10 ++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 9d4bb40..7116775 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,12 @@ You can also use wildcards at the beginning and the end of host name, like `*.ba If you would like to connect to your backend using HTTPS instead of HTTP, set `VIRTUAL_PROTO=https` on the backend container. +### uWSGI Backends + +If you would like to connect to uWSGI backend, set `VIRTUAL_PROTO=uwsgi` on the +backend container. Your backend container should than listen on a port rather +than a socket and expose that port. + ### Default Host To set the default host for nginx use the env var `DEFAULT_HOST=foo.bar.com` for example @@ -227,4 +233,3 @@ Before submitting pull requests or issues, please check github to make sure an e To run tests, you'll need to install [bats 0.4.0](https://github.com/sstephenson/bats). make test - diff --git a/nginx.tmpl b/nginx.tmpl index 255cc35..71ccc31 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -144,7 +144,12 @@ server { {{ end }} location / { + {{ if eq $proto "uwsgi" }} + include uwsgi_params; + uwsgi_pass {{ trim $proto }}://{{ trim $host }}; + {{ else }} proxy_pass {{ trim $proto }}://{{ trim $host }}; + {{ end }} {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }} auth_basic "Restricted {{ $host }}"; auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }}; @@ -170,7 +175,12 @@ server { {{ end }} location / { + {{ if eq $proto "uwsgi" }} + include uwsgi_params; + uwsgi_pass {{ trim $proto }}://{{ trim $host }}; + {{ else }} proxy_pass {{ trim $proto }}://{{ trim $host }}; + {{ end }} {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }} auth_basic "Restricted {{ $host }}"; auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }}; From 5f684d4fc5b5466f351492e94fc0c4279c9b6750 Mon Sep 17 00:00:00 2001 From: ryneeverett Date: Mon, 27 Jun 2016 01:26:39 -0400 Subject: [PATCH 02/17] Add docker-compose file for separate containers. Demonstrate that this pattern works. This is based on the example at . --- README.md | 10 +++++++- docker-compose-separate-containers.yml | 33 ++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 docker-compose-separate-containers.yml diff --git a/README.md b/README.md index b12c9c2..0a9fe79 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ services: ```shell $ docker-compose up $ curl -H "Host: whoami.local" localhost -I''m 5b129ab83266 +I'm 5b129ab83266 ``` ### Multiple Ports @@ -92,6 +92,14 @@ image and the official [nginx](https://registry.hub.docker.com/_/nginx/) image. You may want to do this to prevent having the docker socket bound to a publicly exposed container service. +You can demo this pattern with docker-compose: + +```console +$ docker-compose --file docker-compose-separate-containers.yml up +$ curl -H "Host: whoami.local" localhost +I'm 5b129ab83266 +``` + To run nginx proxy as a separate container you'll need to have [nginx.tmpl](https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl) on your host system. First start nginx with a volume: diff --git a/docker-compose-separate-containers.yml b/docker-compose-separate-containers.yml new file mode 100644 index 0000000..dc41c01 --- /dev/null +++ b/docker-compose-separate-containers.yml @@ -0,0 +1,33 @@ +version: '2' +services: + nginx: + image: nginx + container_name: nginx + ports: + - "80:80" + volumes: + - /etc/nginx/conf.d + networks: + - proxy-tier + + dockergen: + image: jwilder/docker-gen + command: -notify-sighup nginx -watch /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf + volumes_from: + - nginx + volumes: + - /var/run/docker.sock:/tmp/docker.sock:ro + - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl + networks: + - proxy-tier + + whoami: + image: jwilder/whoami + environment: + - VIRTUAL_HOST=whoami.local + networks: + - proxy-tier + +networks: + proxy-tier: + driver: bridge From 2e29168d923d424d656c17fa4568e169bdf65d76 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Thu, 21 Jul 2016 11:23:35 -0400 Subject: [PATCH 03/17] Added X-Forwarded-Port --- README.md | 1 + nginx.tmpl | 1 + 2 files changed, 2 insertions(+) diff --git a/README.md b/README.md index 53e8d5d..dddea56 100644 --- a/README.md +++ b/README.md @@ -205,6 +205,7 @@ proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; +proxy_set_header X-Forwarded-Port $server_port; # Mitigate httpoxy attack (see README for details) proxy_set_header Proxy ""; diff --git a/nginx.tmpl b/nginx.tmpl index 0969564..b168bc5 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -51,6 +51,7 @@ proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; +proxy_set_header X-Forwarded-Port $server_port; # Mitigate httpoxy attack (see README for details) proxy_set_header Proxy ""; From 478ad17adb59808fecdaf1b7076d938460ba0108 Mon Sep 17 00:00:00 2001 From: ryneeverett Date: Fri, 29 Jul 2016 17:23:10 -0400 Subject: [PATCH 04/17] Remove proxy-tier network in favor of the default. As @huiwang pointed out, using a custom network is unnecessary since the default bridge network works just as well. --- docker-compose-separate-containers.yml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/docker-compose-separate-containers.yml b/docker-compose-separate-containers.yml index dc41c01..a4edb94 100644 --- a/docker-compose-separate-containers.yml +++ b/docker-compose-separate-containers.yml @@ -7,8 +7,6 @@ services: - "80:80" volumes: - /etc/nginx/conf.d - networks: - - proxy-tier dockergen: image: jwilder/docker-gen @@ -18,16 +16,8 @@ services: volumes: - /var/run/docker.sock:/tmp/docker.sock:ro - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl - networks: - - proxy-tier whoami: image: jwilder/whoami environment: - VIRTUAL_HOST=whoami.local - networks: - - proxy-tier - -networks: - proxy-tier: - driver: bridge From 37323320c87a392e94f3c8e8e242afd314636fa1 Mon Sep 17 00:00:00 2001 From: mplx Date: Mon, 12 Sep 2016 09:46:59 +0200 Subject: [PATCH 05/17] do not enable HSTS for subdomains --- nginx.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nginx.tmpl b/nginx.tmpl index 980eace..1528b43 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -158,7 +158,7 @@ server { {{ end }} {{ if (ne $https_method "noredirect") }} - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header Strict-Transport-Security "max-age=31536000"; {{ end }} {{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }} From fe9a538ec8eb1a78f828d287fdc103cd32171b58 Mon Sep 17 00:00:00 2001 From: pvlg Date: Sat, 17 Sep 2016 16:53:01 +0300 Subject: [PATCH 06/17] Replace "replace" to "trimSuffix" I have a domain key-mydomain.com. When I add domain www.key-mydomain.com with ssl cert I did not get the desired result. Function replace cut name ssl cert "www.key-mydomain.com.key" to "www-mydomain.com". --- nginx.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nginx.tmpl b/nginx.tmpl index 1528b43..d2caf82 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -118,8 +118,8 @@ upstream {{ $host }} { {{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}} {{/* vhostCert is actually a filename so remove any suffixes since they are added later */}} -{{ $vhostCert := replace $vhostCert ".crt" "" -1 }} -{{ $vhostCert := replace $vhostCert ".key" "" -1 }} +{{ $vhostCert := trimSuffix ".crt" $vhostCert }} +{{ $vhostCert := trimSuffix ".key" $vhostCert }} {{/* Use the cert specified on the container or fallback to the best vhost match */}} {{ $cert := (coalesce $certName $vhostCert) }} From 4661bf4dd9160932f8d42c22f7619dc66949362f Mon Sep 17 00:00:00 2001 From: Chulki Lee Date: Fri, 23 Sep 2016 21:58:06 -0700 Subject: [PATCH 07/17] add ssl_session_tickets to default site Fixes #580 --- nginx.tmpl | 1 + 1 file changed, 1 insertion(+) diff --git a/nginx.tmpl b/nginx.tmpl index d2caf82..9eb9520 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -70,6 +70,7 @@ server { access_log /var/log/nginx/access.log vhost; return 503; + ssl_session_tickets off; ssl_certificate /etc/nginx/certs/default.crt; ssl_certificate_key /etc/nginx/certs/default.key; } From 124b8cd757c7d99c83048ea08b96722403c887b4 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Thu, 29 Sep 2016 11:33:21 -0400 Subject: [PATCH 08/17] Honor upstream forwarded port if available --- nginx.tmpl | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/nginx.tmpl b/nginx.tmpl index c0936d7..7262968 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -24,6 +24,13 @@ map $http_x_forwarded_proto $proxy_x_forwarded_proto { '' $scheme; } +# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the +# server port the client connect to +map $http_x_forwarded_port $proxy_x_forwarded_port { + default $http_x_forwarded_port; + '' $server_port; +} + # If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any # Connection header that may have been passed to this server map $http_upgrade $proxy_connection { @@ -51,7 +58,7 @@ proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; -proxy_set_header X-Forwarded-Port $server_port; +proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; # Mitigate httpoxy attack (see README for details) proxy_set_header Proxy ""; From 112aad39b6654cec497672fec0d7682ddf59e5db Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Thu, 29 Sep 2016 15:36:01 -0400 Subject: [PATCH 09/17] Implemented more advanced webserver with routing and request header echoing, added header tests --- test/docker.bats | 6 +- test/headers.bats | 128 ++++++++++++++++++++++++++++++++++ test/multiple-hosts.bats | 6 +- test/multiple-ports.bats | 2 +- test/test_helpers.bash | 8 +-- test/web_helpers/webserver.py | 27 +++++++ 6 files changed, 165 insertions(+), 12 deletions(-) create mode 100644 test/headers.bats create mode 100755 test/web_helpers/webserver.py diff --git a/test/docker.bats b/test/docker.bats index fc10226..0569dcb 100644 --- a/test/docker.bats +++ b/test/docker.bats @@ -111,13 +111,13 @@ function assert_nginxproxy_behaves { assert_output -l 0 $'HTTP/1.1 503 Service Temporarily Unavailable\r' # Querying the proxy with Host header → 200 - run curl_container $container /data --header "Host: web1.bats" + run curl_container $container /port --header "Host: web1.bats" assert_output "answer from port 81" - run curl_container $container /data --header "Host: web2.bats" + run curl_container $container /port --header "Host: web2.bats" assert_output "answer from port 82" # Querying the proxy with unknown Host header → 503 - run curl_container $container /data --header "Host: webFOO.bats" --head + run curl_container $container /port --header "Host: webFOO.bats" --head assert_output -l 0 $'HTTP/1.1 503 Service Temporarily Unavailable\r' } diff --git a/test/headers.bats b/test/headers.bats new file mode 100644 index 0000000..6bcd4ed --- /dev/null +++ b/test/headers.bats @@ -0,0 +1,128 @@ +#!/usr/bin/env bats +load test_helpers +SUT_CONTAINER=bats-nginx-proxy-${TEST_FILE} + +function setup { + # make sure to stop any web container before each test so we don't + # have any unexpected container running with VIRTUAL_HOST or VIRUTAL_PORT set + stop_bats_containers web +} + + +@test "[$TEST_FILE] start a nginx-proxy container" { + # GIVEN + run nginxproxy $SUT_CONTAINER -v /var/run/docker.sock:/tmp/docker.sock:ro + assert_success + docker_wait_for_log $SUT_CONTAINER 9 "Watching docker events" +} + +@test "[$TEST_FILE] nginx-proxy passes arbitrary header" { + # WHEN + prepare_web_container bats-host-1 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-1 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Foo: Bar" -H "Host: web.bats" + assert_output -l 'Foo: Bar' +} + +##### Testing the handling of X-Forwarded-For ##### + +@test "[$TEST_FILE] nginx-proxy generates X-Forwarded-For" { + # WHEN + prepare_web_container bats-host-2 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-2 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Host: web.bats" + assert_output -p 'X-Forwarded-For:' +} + +@test "[$TEST_FILE] nginx-proxy passes X-Forwarded-For" { + # WHEN + prepare_web_container bats-host-3 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-3 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "X-Forwarded-For: 1.2.3.4" -H "Host: web.bats" + assert_output -p 'X-Forwarded-For: 1.2.3.4, ' +} + +##### Testing the handling of X-Forwarded-Proto ##### + +@test "[$TEST_FILE] nginx-proxy generates X-Forwarded-Proto" { + # WHEN + prepare_web_container bats-host-4 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-4 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Host: web.bats" + assert_output -l 'X-Forwarded-Proto: http' +} + +@test "[$TEST_FILE] nginx-proxy passes X-Forwarded-Proto" { + # WHEN + prepare_web_container bats-host-5 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-5 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "X-Forwarded-Proto: https" -H "Host: web.bats" + assert_output -l 'X-Forwarded-Proto: https' +} + +##### Testing the handling of X-Forwarded-Port ##### + +@test "[$TEST_FILE] nginx-proxy generates X-Forwarded-Port" { + # WHEN + prepare_web_container bats-host-6 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-6 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Host: web.bats" + assert_output -l 'X-Forwarded-Port: 80' +} + +@test "[$TEST_FILE] nginx-proxy passes X-Forwarded-Port" { + # WHEN + prepare_web_container bats-host-7 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-7 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "X-Forwarded-Port: 1234" -H "Host: web.bats" + assert_output -l 'X-Forwarded-Port: 1234' +} + +##### Other headers + +@test "[$TEST_FILE] nginx-proxy generates X-Real-IP" { + # WHEN + prepare_web_container bats-host-8 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-8 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Host: web.bats" + assert_output -p 'X-Real-IP: ' +} + +@test "[$TEST_FILE] nginx-proxy passes Host" { + # WHEN + prepare_web_container bats-host-9 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-9 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Host: web.bats" + assert_output -l 'Host: web.bats' +} + +@test "[$TEST_FILE] stop all bats containers" { + stop_bats_containers +} diff --git a/test/multiple-hosts.bats b/test/multiple-hosts.bats index 10487ae..8e14c11 100644 --- a/test/multiple-hosts.bats +++ b/test/multiple-hosts.bats @@ -26,15 +26,15 @@ function setup { assert_output -l 0 $'HTTP/1.1 503 Service Temporarily Unavailable\r' # THEN querying the proxy with unknown Host header → 503 - run curl_container $SUT_CONTAINER /data --header "Host: webFOO.bats" --head + run curl_container $SUT_CONTAINER /port --header "Host: webFOO.bats" --head assert_output -l 0 $'HTTP/1.1 503 Service Temporarily Unavailable\r' # THEN - run curl_container $SUT_CONTAINER /data --header 'Host: multiple-hosts-1-A.bats' + run curl_container $SUT_CONTAINER /port --header 'Host: multiple-hosts-1-A.bats' assert_output "answer from port 80" # THEN - run curl_container $SUT_CONTAINER /data --header 'Host: multiple-hosts-1-B.bats' + run curl_container $SUT_CONTAINER /port --header 'Host: multiple-hosts-1-B.bats' assert_output "answer from port 80" } diff --git a/test/multiple-ports.bats b/test/multiple-ports.bats index a3c6fd0..f3e670b 100644 --- a/test/multiple-ports.bats +++ b/test/multiple-ports.bats @@ -58,7 +58,7 @@ function setup { # $1 port we are expecting an response from function assert_response_is_from_port { local -r port=$1 - run curl_container $SUT_CONTAINER /data --header "Host: web.bats" + run curl_container $SUT_CONTAINER /port --header "Host: web.bats" assert_output "answer from port $port" } diff --git a/test/test_helpers.bash b/test/test_helpers.bash index 9b35b3c..0fd9532 100644 --- a/test/test_helpers.bash +++ b/test/test_helpers.bash @@ -124,6 +124,7 @@ function prepare_web_container { --name $container_name \ $expose_option \ -w /var/www/ \ + -v $DIR/web_helpers:/var/www:ro \ $options \ -e PYTHON_PORTS="$ports" \ python:3 bash -c " @@ -131,10 +132,7 @@ function prepare_web_container { declare -a PIDS for port in \$PYTHON_PORTS; do echo starting a web server listening on port \$port; - mkdir /var/www/\$port - cd /var/www/\$port - echo \"answer from port \$port\" > data - python -m http.server \$port & + ./webserver.py \$port & PIDS+=(\$!) done wait \${PIDS[@]} @@ -146,7 +144,7 @@ function prepare_web_container { # THEN querying directly port works IFS=$' \t\n' # See https://github.com/sstephenson/bats/issues/89 for port in $ports; do - run retry 5 1s docker run --label bats-type="curl" appropriate/curl --silent --fail http://$(docker_ip $container_name):$port/data + run retry 5 1s docker run --label bats-type="curl" appropriate/curl --silent --fail http://$(docker_ip $container_name):$port/port assert_output "answer from port $port" done } diff --git a/test/web_helpers/webserver.py b/test/web_helpers/webserver.py new file mode 100755 index 0000000..d94ed89 --- /dev/null +++ b/test/web_helpers/webserver.py @@ -0,0 +1,27 @@ +#!/usr/bin/env python3 + +import os, sys +import http.server +import socketserver + +class BatsHandler(http.server.SimpleHTTPRequestHandler): + def do_GET(self): + root = os.getcwd() + + self.send_response(200) + self.send_header("Content-Type", "text/plain") + self.end_headers() + + if self.path == "/headers": + self.wfile.write(self.headers.as_string().encode()) + elif self.path == "/port": + response = "answer from port %s\n" % PORT + self.wfile.write(response.encode()) + else: + self.wfile.write("No route for this path!\n".encode()) + +if __name__ == '__main__': + PORT = int(sys.argv[1]) + socketserver.TCPServer.allow_reuse_address = True + httpd = socketserver.TCPServer(('0.0.0.0', PORT), BatsHandler) + httpd.serve_forever() From 7422539f2063cfa3c0c7cf3c46b00d8f6bcbe316 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Thu, 29 Sep 2016 15:42:49 -0400 Subject: [PATCH 10/17] Updated README to reflect X-Forwarded-Port --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c9cd2a5..acda916 100644 --- a/README.md +++ b/README.md @@ -219,7 +219,7 @@ proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; -proxy_set_header X-Forwarded-Port $server_port; +proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; # Mitigate httpoxy attack (see README for details) proxy_set_header Proxy ""; From b9bf183df2866c69dafbb04399e8c089baf3697e Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Thu, 29 Sep 2016 15:43:07 -0400 Subject: [PATCH 11/17] Added httpoxy test --- test/headers.bats | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/test/headers.bats b/test/headers.bats index 6bcd4ed..bc401fd 100644 --- a/test/headers.bats +++ b/test/headers.bats @@ -123,6 +123,17 @@ function setup { assert_output -l 'Host: web.bats' } +@test "[$TEST_FILE] nginx-proxy supresses Proxy for httpoxy protection" { + # WHEN + prepare_web_container bats-host-10 80 -e VIRTUAL_HOST=web.bats + dockergen_wait_for_event $SUT_CONTAINER start bats-host-10 + sleep 1 + + # THEN + run curl_container $SUT_CONTAINER /headers -H "Proxy: tcp://foo.com" -H "Host: web.bats" + refute_output -l 'Proxy: tcp://foo.com' +} + @test "[$TEST_FILE] stop all bats containers" { stop_bats_containers } From 9ef0bb3356417f5632842a9951a690fea1b2c498 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Thu, 29 Sep 2016 16:06:53 -0400 Subject: [PATCH 12/17] Comment typo --- nginx.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nginx.tmpl b/nginx.tmpl index 7262968..20688da 100644 --- a/nginx.tmpl +++ b/nginx.tmpl @@ -25,7 +25,7 @@ map $http_x_forwarded_proto $proxy_x_forwarded_proto { } # If we receive X-Forwarded-Port, pass it through; otherwise, pass along the -# server port the client connect to +# server port the client connected to map $http_x_forwarded_port $proxy_x_forwarded_port { default $http_x_forwarded_port; '' $server_port; From fddae94ed89cce27d699896935fb9f044b654b4c Mon Sep 17 00:00:00 2001 From: Max Wilkinson Date: Fri, 28 Oct 2016 14:46:37 -0400 Subject: [PATCH 13/17] Clarified a couple parts in the README --- README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 52ab6e4..81ee351 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,7 @@ In this example, the `my-nginx-proxy` container will be connected to `my-network ### SSL Backends -If you would like to connect to your backend using HTTPS instead of HTTP, set `VIRTUAL_PROTO=https` on the backend container. +If you would like the reverse proxy to connect to your backend using HTTPS instead of HTTP, set `VIRTUAL_PROTO=https` on the backend container. ### uWSGI Backends @@ -140,6 +140,10 @@ hosts in use. The certificate and keys should be named after the virtual host w `.key` extension. For example, a container with `VIRTUAL_HOST=foo.bar.com` should have a `foo.bar.com.crt` and `foo.bar.com.key` file in the certs directory. +If you are running the container in a virtualized environment (Hyper-V, VirtualBox, etc...), +/path/to/certs must exist in that environment or be made accessible to that environment. +By default, Docker is not able to mount directories on the host machine to containers running in a virtual machine. + #### Diffie-Hellman Groups If you have Diffie-Hellman groups enabled, the files should be named after the virtual host with a From dc910107cfc4cb5332ddaabd9d295e4c36e88c85 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Mon, 5 Dec 2016 09:21:39 -0500 Subject: [PATCH 14/17] Upgrade docker-engine and allow downgrades --- .travis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index e850f08..ea2de37 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,13 +4,13 @@ services: env: global: - - DOCKER_VERSION=1.12.1-0~trusty + - DOCKER_VERSION=1.12.3-0~trusty before_install: # list docker-engine versions - apt-cache madison docker-engine # upgrade docker-engine to specific version - - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y docker-engine=${DOCKER_VERSION} + - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y --allow-downgrades docker-engine=${DOCKER_VERSION} - docker version - docker info - sudo add-apt-repository ppa:duggan/bats --yes From 271729aaaa201209f8a10395fcb7a7b9715d3f34 Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Mon, 5 Dec 2016 09:29:08 -0500 Subject: [PATCH 15/17] Put --allow-downgrades in the right place --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index ea2de37..18ac9d9 100644 --- a/.travis.yml +++ b/.travis.yml @@ -10,7 +10,7 @@ before_install: # list docker-engine versions - apt-cache madison docker-engine # upgrade docker-engine to specific version - - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y --allow-downgrades docker-engine=${DOCKER_VERSION} + - sudo apt-get -o Dpkg::Options::="--force-confnew" --allow-downgrades install -y docker-engine=${DOCKER_VERSION} - docker version - docker info - sudo add-apt-repository ppa:duggan/bats --yes From 59b88068596a40f5eb42a339c9a53064dbb6733d Mon Sep 17 00:00:00 2001 From: Steve Kamerman Date: Mon, 5 Dec 2016 09:33:44 -0500 Subject: [PATCH 16/17] Travis-CI's apt-get doesn't have --allow-downgrades yet, which is annoying because --force-yes is deprecated --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 18ac9d9..5386261 100644 --- a/.travis.yml +++ b/.travis.yml @@ -10,7 +10,7 @@ before_install: # list docker-engine versions - apt-cache madison docker-engine # upgrade docker-engine to specific version - - sudo apt-get -o Dpkg::Options::="--force-confnew" --allow-downgrades install -y docker-engine=${DOCKER_VERSION} + - sudo apt-get -o Dpkg::Options::="--force-confnew" install -y --force-yes docker-engine=${DOCKER_VERSION} - docker version - docker info - sudo add-apt-repository ppa:duggan/bats --yes From b66398d1bfd0b88caa00d7439cc2adee723642ff Mon Sep 17 00:00:00 2001 From: Cody Ramaker Date: Thu, 8 Dec 2016 13:24:49 -0600 Subject: [PATCH 17/17] Updated nginx to 1.11.6 --- Dockerfile | 2 +- README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6d5ce9b..afa564c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM nginx:1.11.3 +FROM nginx:1.11.6 MAINTAINER Jason Wilder mail@jasonwilder.com # Install wget and install/updates certificates diff --git a/README.md b/README.md index dc09923..1ff2ef2 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -![nginx 1.11.3](https://img.shields.io/badge/nginx-1.11.3-brightgreen.svg) ![License MIT](https://img.shields.io/badge/license-MIT-blue.svg) [![Build Status](https://travis-ci.org/jwilder/nginx-proxy.svg?branch=master)](https://travis-ci.org/jwilder/nginx-proxy) [![](https://img.shields.io/docker/stars/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [![](https://img.shields.io/docker/pulls/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') +![nginx 1.11.6](https://img.shields.io/badge/nginx-1.11.6-brightgreen.svg) ![License MIT](https://img.shields.io/badge/license-MIT-blue.svg) [![Build Status](https://travis-ci.org/jwilder/nginx-proxy.svg?branch=master)](https://travis-ci.org/jwilder/nginx-proxy) [![](https://img.shields.io/docker/stars/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [![](https://img.shields.io/docker/pulls/jwilder/nginx-proxy.svg)](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') nginx-proxy sets up a container running nginx and [docker-gen][1]. docker-gen generates reverse proxy configs for nginx and reloads nginx when containers are started and stopped.