mirror of
https://github.com/thib8956/nginx-proxy
synced 2024-11-22 11:56:31 +00:00
Merge branch 'master' into feature_x_forwarded_port
This commit is contained in:
Steve Kamerman
commit
6ebbdb10c7
@ -4,7 +4,7 @@ services:
|
||||
|
||||
env:
|
||||
global:
|
||||
- DOCKER_VERSION=1.10.1-0~trusty
|
||||
- DOCKER_VERSION=1.12.1-0~trusty
|
||||
|
||||
before_install:
|
||||
# list docker-engine versions
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
FROM nginx:1.9.15
|
||||
FROM nginx:1.11.3
|
||||
MAINTAINER Jason Wilder mail@jasonwilder.com
|
||||
|
||||
# Install wget and install/updates certificates
|
||||
|
||||
2
Makefile
2
Makefile
@ -3,7 +3,7 @@
|
||||
|
||||
update-dependencies:
|
||||
docker pull jwilder/docker-gen:0.7.3
|
||||
docker pull nginx:1.9.12
|
||||
docker pull nginx:1.11.3
|
||||
docker pull python:3
|
||||
docker pull rancher/socat-docker:latest
|
||||
docker pull appropriate/curl:latest
|
||||
|
||||
18
README.md
18
README.md
@ -1,4 +1,4 @@
|
||||
  [](https://travis-ci.org/jwilder/nginx-proxy) [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub')
|
||||
  [](https://travis-ci.org/jwilder/nginx-proxy) [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub')
|
||||
|
||||
|
||||
nginx-proxy sets up a container running nginx and [docker-gen][1]. docker-gen generates reverse proxy configs for nginx and reloads nginx when containers are started and stopped.
|
||||
@ -42,7 +42,7 @@ services:
|
||||
```shell
|
||||
$ docker-compose up
|
||||
$ curl -H "Host: whoami.local" localhost
|
||||
I''m 5b129ab83266
|
||||
I'm 5b129ab83266
|
||||
```
|
||||
|
||||
### Multiple Ports
|
||||
@ -78,6 +78,12 @@ In this example, the `my-nginx-proxy` container will be connected to `my-network
|
||||
|
||||
If you would like to connect to your backend using HTTPS instead of HTTP, set `VIRTUAL_PROTO=https` on the backend container.
|
||||
|
||||
### uWSGI Backends
|
||||
|
||||
If you would like to connect to uWSGI backend, set `VIRTUAL_PROTO=uwsgi` on the
|
||||
backend container. Your backend container should than listen on a port rather
|
||||
than a socket and expose that port.
|
||||
|
||||
### Default Host
|
||||
|
||||
To set the default host for nginx use the env var `DEFAULT_HOST=foo.bar.com` for example
|
||||
@ -92,6 +98,14 @@ image and the official [nginx](https://registry.hub.docker.com/_/nginx/) image.
|
||||
|
||||
You may want to do this to prevent having the docker socket bound to a publicly exposed container service.
|
||||
|
||||
You can demo this pattern with docker-compose:
|
||||
|
||||
```console
|
||||
$ docker-compose --file docker-compose-separate-containers.yml up
|
||||
$ curl -H "Host: whoami.local" localhost
|
||||
I'm 5b129ab83266
|
||||
```
|
||||
|
||||
To run nginx proxy as a separate container you'll need to have [nginx.tmpl](https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl) on your host system.
|
||||
|
||||
First start nginx with a volume:
|
||||
|
||||
23
docker-compose-separate-containers.yml
Normal file
23
docker-compose-separate-containers.yml
Normal file
@ -0,0 +1,23 @@
|
||||
version: '2'
|
||||
services:
|
||||
nginx:
|
||||
image: nginx
|
||||
container_name: nginx
|
||||
ports:
|
||||
- "80:80"
|
||||
volumes:
|
||||
- /etc/nginx/conf.d
|
||||
|
||||
dockergen:
|
||||
image: jwilder/docker-gen
|
||||
command: -notify-sighup nginx -watch /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
|
||||
volumes_from:
|
||||
- nginx
|
||||
volumes:
|
||||
- /var/run/docker.sock:/tmp/docker.sock:ro
|
||||
- ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl
|
||||
|
||||
whoami:
|
||||
image: jwilder/whoami
|
||||
environment:
|
||||
- VIRTUAL_HOST=whoami.local
|
||||
18
nginx.tmpl
18
nginx.tmpl
@ -71,6 +71,7 @@ server {
|
||||
access_log /var/log/nginx/access.log vhost;
|
||||
return 503;
|
||||
|
||||
ssl_session_tickets off;
|
||||
ssl_certificate /etc/nginx/certs/default.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/default.key;
|
||||
}
|
||||
@ -119,8 +120,8 @@ upstream {{ $host }} {
|
||||
{{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}}
|
||||
|
||||
{{/* vhostCert is actually a filename so remove any suffixes since they are added later */}}
|
||||
{{ $vhostCert := replace $vhostCert ".crt" "" -1 }}
|
||||
{{ $vhostCert := replace $vhostCert ".key" "" -1 }}
|
||||
{{ $vhostCert := trimSuffix ".crt" $vhostCert }}
|
||||
{{ $vhostCert := trimSuffix ".key" $vhostCert }}
|
||||
|
||||
{{/* Use the cert specified on the container or fallback to the best vhost match */}}
|
||||
{{ $cert := (coalesce $certName $vhostCert) }}
|
||||
@ -144,11 +145,12 @@ server {
|
||||
access_log /var/log/nginx/access.log vhost;
|
||||
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
|
||||
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_timeout 5m;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
|
||||
ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};
|
||||
@ -168,7 +170,12 @@ server {
|
||||
{{ end }}
|
||||
|
||||
location / {
|
||||
{{ if eq $proto "uwsgi" }}
|
||||
include uwsgi_params;
|
||||
uwsgi_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ else }}
|
||||
proxy_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ end }}
|
||||
{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
|
||||
auth_basic "Restricted {{ $host }}";
|
||||
auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }};
|
||||
@ -197,7 +204,12 @@ server {
|
||||
{{ end }}
|
||||
|
||||
location / {
|
||||
{{ if eq $proto "uwsgi" }}
|
||||
include uwsgi_params;
|
||||
uwsgi_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ else }}
|
||||
proxy_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ end }}
|
||||
{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
|
||||
auth_basic "Restricted {{ $host }}";
|
||||
auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }};
|
||||
|
||||
Loading…
Reference in New Issue
Block a user