Merge pull request #1797 from polarathene/feat/prefer-rfc-7919-dhparams

feat: Use RFC 7919 DH groups + Remove DH generation

test/lib/ssl/dhparam.pem

@@ -1,8 +0,0 @@
------BEGIN DH PARAMETERS-----
-MIIBCAKCAQEA1cae6HqPSgicEuAuSCf6Ii3d6qMX9Ta8lnwoX0JQ0CWK7mzaiiIi
-dY7oHmc4cq0S3SH+g0tdLP9yqygFS9hdUGINwS2VV6poj2/vdL/dUshegyxpEH58
-nofCPnFDeKkcPDMYAlGS8zjp60TsBkRJKcrxxwnjod1Q5mWuMN5KH3sxs842udKH
-0nHFE9kKW/NfXb+EGsjpocGpf786cGuCO2d00THsoItOEcM9/aI8DX1QcyxAHR6D
-HaYTFJnyyx8Q44u27M15idI4pbNoKORlotiuOwCTGYCfbN14aOV+Ict7aSF8FWpP
-48j9SMNuIu2DlF9pNLo6fsrOjYY3c9X12wIBAg==
------END DH PARAMETERS-----

test/pytest.sh

@@ -8,17 +8,18 @@
 #                                                                             #
 ###############################################################################
 
+# Returns the absolute directory path to this script
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-ARGS="$@"
+ARGS=("$@")
 
 # check requirements
 echo "> Building nginx-proxy-tester image..."
-docker build -t nginx-proxy-tester -f $DIR/requirements/Dockerfile-nginx-proxy-tester $DIR/requirements
+docker build -t nginx-proxy-tester -f "${DIR}/requirements/Dockerfile-nginx-proxy-tester" "${DIR}/requirements"
 
 # run the nginx-proxy-tester container setting the correct value for the working dir in order for 
 # docker-compose to work properly when run from within that container.
 exec docker run --rm -it \
-	-v ${DIR}:/${DIR} \
-	-w ${DIR} \
-	-v /var/run/docker.sock:/var/run/docker.sock \
-	nginx-proxy-tester ${ARGS}
+--volume /var/run/docker.sock:/var/run/docker.sock \
+--volume "${DIR}:${DIR}" \
+--workdir "${DIR}" \
+nginx-proxy-tester "${ARGS[@]}"

test/test_DOCKER_HOST_unix_socket.yml

@@ -19,6 +19,5 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/f00.sock:ro
-    - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
   environment:
     DOCKER_HOST: unix:///f00.sock

test/test_composev2.yml

@@ -4,7 +4,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
 
   web:
     image: web

test/test_custom/test_defaults-location.yml

@@ -2,7 +2,6 @@ nginx-proxy:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     - ./my_custom_proxy_settings.conf:/etc/nginx/vhost.d/default_location:ro
     - ./my_custom_proxy_settings_bar.conf:/etc/nginx/vhost.d/web3.nginx-proxy.local_location:ro
 

test/test_custom/test_defaults.yml

@@ -4,7 +4,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
       - ./my_custom_proxy_settings.conf:/etc/nginx/proxy.conf:ro
 
   web1:

test/test_custom/test_location-per-vhost.yml

@@ -4,7 +4,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
       - ./my_custom_proxy_settings.conf:/etc/nginx/vhost.d/web1.nginx-proxy.local_location:ro
 
   web1:

test/test_custom/test_per-vhost.yml

@@ -4,7 +4,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
       - ./my_custom_proxy_settings.conf:/etc/nginx/vhost.d/web1.nginx-proxy.local:ro
 
   web1:

test/test_custom/test_proxy-wide.yml

@@ -4,7 +4,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
       - ./my_custom_proxy_settings.conf:/etc/nginx/conf.d/my_custom_proxy_settings.conf:ro
 
   web1:

test/test_debug/test_proxy-debug-flag.yml

@@ -22,6 +22,5 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
   environment:
     DEBUG: "true"

test/test_debug/test_server-debug-flag.yml

@@ -23,4 +23,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_default-host.yml

@@ -13,6 +13,5 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
   environment:
     DEFAULT_HOST: web1.tld

test/test_dockergen/test_dockergen_v2.yml

@@ -6,7 +6,6 @@ services:
     container_name: nginx
     volumes:
       - /etc/nginx/conf.d
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
 
   dockergen:
     image: jwilder/docker-gen

test/test_dockergen/test_dockergen_v3.yml

@@ -5,7 +5,6 @@ services:
     container_name: nginx
     volumes:
       - nginx_conf:/etc/nginx/conf.d
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
 
   dockergen:
     image: jwilder/docker-gen

test/test_events.yml

@@ -2,4 +2,3 @@ nginxproxy:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_headers/test_http.yml

@@ -20,4 +20,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_headers/test_https.yml

@@ -26,4 +26,3 @@ sut:
     - ./certs/web.nginx-proxy.tld.key:/etc/nginx/certs/web.nginx-proxy.tld.key:ro
     - ./certs/web-server-tokens-off.nginx-proxy.tld.crt:/etc/nginx/certs/web-server-tokens-off.nginx-proxy.tld.crt:ro
     - ./certs/web-server-tokens-off.nginx-proxy.tld.key:/etc/nginx/certs/web-server-tokens-off.nginx-proxy.tld.key:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_http_port.yml

@@ -10,6 +10,5 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
   environment:
     HTTP_PORT: 8080

test/test_ipv6.yml

@@ -33,7 +33,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     environment:
       ENABLE_IPV6: "true"
     networks:

test/test_multiple-hosts.yml

@@ -11,4 +11,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_multiple-networks.yml

@@ -9,7 +9,6 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     networks:
       - net1
       - net2

test/test_multiple-ports/test_VIRTUAL_PORT-single-different-from-single-port.yml

@@ -12,4 +12,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_multiple-ports/test_VIRTUAL_PORT.yml

@@ -12,4 +12,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_multiple-ports/test_default-80.yml

@@ -11,4 +11,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_multiple-ports/test_single-port-not-80.yml

@@ -11,4 +11,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_nominal.yml

@@ -33,6 +33,5 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     networks:
       - net1

test/test_raw-ip-vhost.yml

@@ -41,7 +41,6 @@ services:
       ENABLE_IPV6: "true"
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     networks:
       net1:
         ipv4_address: 172.20.0.4

test/test_server-down/test_load-balancing.yml

@@ -27,4 +27,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_server-down/test_no-server-down.yml

@@ -10,4 +10,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_server-down/test_server-down.yml

@@ -11,4 +11,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_ssl/test_dhparam.py

@@ -15,7 +15,7 @@ docker_client = docker.from_env()
 ###############################################################################
 
 @backoff.on_exception(backoff.constant, AssertionError, interval=2, max_tries=15, jitter=None)
-def assert_log_contains(expected_log_line):
+def assert_log_contains(expected_log_line, container_name="nginxproxy"):
     """
     Check that the nginx-proxy container log contains a given string.
     The backoff decorator will retry the check 15 times with a 2 seconds delay.
@@ -24,7 +24,7 @@ def assert_log_contains(expected_log_line):
     :return: None
     :raises: AssertError if the expected string is not found in the log
     """
-    sut_container = docker_client.containers.get("nginxproxy")
+    sut_container = docker_client.containers.get(container_name)
     docker_logs = sut_container.logs(stdout=True, stderr=True, stream=False, follow=False)
     assert bytes(expected_log_line, encoding="utf8") in docker_logs
 
@@ -58,36 +58,149 @@ def require_openssl(required_version):
             reason=f"openssl v{openssl_version} is less than required version {required_version}")
 
 
+@require_openssl("1.0.2")
+def negotiate_cipher(sut_container, additional_params='', grep='Cipher is'):
+    host = f"{sut_container.attrs['NetworkSettings']['IPAddress']}:443"
+
+    try:
+        # Enforce TLS 1.2 as newer versions don't support custom dhparam or ciphersuite preference.
+        # The empty `echo` is to provide `openssl` user input, so that the process exits: https://stackoverflow.com/a/28567565
+        # `shell=True` enables using a single string to execute as a shell command.
+        # `text=True` prevents the need to compare against byte strings.
+        # `stderr=subprocess.PIPE` removes the output to stderr being interleaved with test case status (output during exceptions).
+        return subprocess.check_output(
+            f"echo '' | openssl s_client -connect {host} -tls1_2 {additional_params} | grep '{grep}'",
+            shell=True,
+            text=True,
+            stderr=subprocess.PIPE,
+        )
+    except subprocess.CalledProcessError as e:
+        # Output a more helpful error, the original exception in this case isn't that helpful.
+        # `from None` to ignore undesired output from exception chaining.
+        raise Exception("Failed to process CLI request:\n" + e.stderr) from None
+
+
+def can_negotiate_dhe_ciphersuite(sut_container):
+    r = negotiate_cipher(sut_container, "-cipher 'EDH'")
+    assert "New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384\n" == r
+
+    r2 = negotiate_cipher(sut_container, "-cipher 'EDH'", "Server Temp Key")
+    assert "DH" in r2
+
+
+def cannot_negotiate_dhe_ciphersuite(sut_container):
+    # Fail to negotiate a DHE cipher suite:
+    r = negotiate_cipher(sut_container, "-cipher 'EDH'")
+    assert "New, (NONE), Cipher is (NONE)\n" == r
+
+    # Correctly establish a connection (TLS 1.2):
+    r2 = negotiate_cipher(sut_container)
+    assert "New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384\n" == r2
+
+    r3 = negotiate_cipher(sut_container, grep="Server Temp Key")
+    assert "X25519" in r3
+
+
+# Parse array of container ENV, splitting at the `=` and returning the value, otherwise `None`
+def get_env(sut_container, var):
+  env = sut_container.attrs['Config']['Env']
+
+  for e in env:
+    if e.startswith(var):
+      return e.split('=')[1]
+  
+  return None
+
+
 ###############################################################################
 #
 # Tests
 #
 ###############################################################################
 
-def test_dhparam_is_not_generated_if_present(docker_compose):
-    sut_container = docker_client.containers.get("nginxproxy")
+def test_default_dhparam_is_ffdhe4096(docker_compose):
+    container_name="dh-default"
+    sut_container = docker_client.containers.get(container_name)
     assert sut_container.status == "running"
 
-    assert_log_contains("Custom dhparam.pem file found, generation skipped")
+    assert_log_contains("Setting up DH Parameters..", container_name)
 
-    # Make sure the dhparam in use is not the default, pre-generated one
-    default_checksum = sut_container.exec_run("md5sum /app/dhparam.pem.default").output.split()
+    # Make sure the dhparam file used is the default ffdhe4096.pem:
+    default_checksum = sut_container.exec_run("md5sum /app/dhparam/ffdhe4096.pem").output.split()
+    current_checksum = sut_container.exec_run("md5sum /etc/nginx/dhparam/dhparam.pem").output.split()
+    assert default_checksum[0] == current_checksum[0]
+
+    can_negotiate_dhe_ciphersuite(sut_container)
+
+
+def test_can_change_dhparam_group(docker_compose):
+    container_name="dh-env"
+    sut_container = docker_client.containers.get(container_name)
+    assert sut_container.status == "running"
+
+    assert_log_contains("Setting up DH Parameters..", container_name)
+
+    # Make sure the dhparam file used is ffdhe2048.pem, not the default (ffdhe4096.pem):
+    default_checksum = sut_container.exec_run("md5sum /app/dhparam/ffdhe2048.pem").output.split()
+    current_checksum = sut_container.exec_run("md5sum /etc/nginx/dhparam/dhparam.pem").output.split()
+    assert default_checksum[0] == current_checksum[0]
+
+    can_negotiate_dhe_ciphersuite(sut_container)
+
+
+def test_fail_if_dhparam_group_not_supported(docker_compose):
+    container_name="invalid-group-1024"
+    sut_container = docker_client.containers.get(container_name)
+    assert sut_container.status == "exited"
+
+    DHPARAM_BITS = get_env(sut_container, "DHPARAM_BITS")
+    assert DHPARAM_BITS == "1024"
+
+    assert_log_contains(
+        f"ERROR: Unsupported DHPARAM_BITS size: {DHPARAM_BITS}. Use: 2048, 3072, or 4096 (default).",
+        container_name
+    )
+
+
+def test_custom_dhparam_is_supported(docker_compose):
+    container_name="dh-file"
+    sut_container = docker_client.containers.get(container_name)
+    assert sut_container.status == "running"
+
+    assert_log_contains(
+        "Warning: A custom dhparam.pem file was provided. Best practice is to use standardized RFC7919 DHE groups instead.",
+        container_name
+    )
+
+    # Make sure the dhparam file used is not the default (ffdhe4096.pem):
+    default_checksum = sut_container.exec_run("md5sum /app/dhparam/ffdhe4096.pem").output.split()
     current_checksum = sut_container.exec_run("md5sum /etc/nginx/dhparam/dhparam.pem").output.split()
     assert default_checksum[0] != current_checksum[0]
 
+    can_negotiate_dhe_ciphersuite(sut_container)
+
+
+def test_can_skip_dhparam(docker_compose):
+    container_name="dh-skip"
+    sut_container = docker_client.containers.get(container_name)
+    assert sut_container.status == "running"
+
+    assert_log_contains("Skipping Diffie-Hellman parameters setup.", container_name)
+
+    cannot_negotiate_dhe_ciphersuite(sut_container)
+
+def test_can_skip_dhparam_backward_compatibility(docker_compose):
+    container_name="dh-skip-backward"
+    sut_container = docker_client.containers.get(container_name)
+    assert sut_container.status == "running"
+    
+    assert_log_contains("Warning: The DHPARAM_GENERATION environment variable is deprecated, please consider using DHPARAM_SKIP set to true instead.", container_name)
+    assert_log_contains("Skipping Diffie-Hellman parameters setup.", container_name)
+
+    cannot_negotiate_dhe_ciphersuite(sut_container)
+
 
 def test_web5_https_works(docker_compose, nginxproxy):
     r = nginxproxy.get("https://web5.nginx-proxy.tld/port", allow_redirects=False)
     assert r.status_code == 200
     assert "answer from port 85\n" in r.text
-
-
-@require_openssl("1.0.2")
-def test_web5_dhparam_is_used(docker_compose):
-    sut_container = docker_client.containers.get("nginxproxy")
-    assert sut_container.status == "running"
-
-    host = f"{sut_container.attrs['NetworkSettings']['IPAddress']}:443"
-    r = subprocess.check_output(
-        f"echo '' | openssl s_client -connect {host} -cipher 'EDH' | grep 'Server Temp Key'", shell=True)
-    assert b"Server Temp Key: X25519, 253 bits\n" == r

test/test_ssl/test_dhparam.yml

@@ -6,11 +6,48 @@ web5:
     WEB_PORTS: "85"
     VIRTUAL_HOST: "web5.nginx-proxy.tld"
 
+# sut - System Under Test
+# `docker.sock` required for functionality
+# `certs` required to enable HTTPS via template
+with_default_group:
+  container_name: dh-default
+  image: &img-nginxproxy nginxproxy/nginx-proxy:test
+  volumes: &vols-common
+    - &docker-sock /var/run/docker.sock:/tmp/docker.sock:ro
+    - &nginx-certs ./certs:/etc/nginx/certs:ro
 
-sut:
-  image: nginxproxy/nginx-proxy:test
-  container_name: nginxproxy
-  volumes:
-    - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
-    - ./certs:/etc/nginx/certs:ro
+with_alternative_group:
+  container_name: dh-env
+  environment:
+    - DHPARAM_BITS=2048
+  image: *img-nginxproxy
+  volumes: *vols-common
+
+with_invalid_group:
+  container_name: invalid-group-1024
+  environment:
+    - DHPARAM_BITS=1024
+  image: *img-nginxproxy
+  volumes: *vols-common
+
+with_custom_file:
+  container_name: dh-file
+  image: *img-nginxproxy
+  volumes: 
+    - *docker-sock
+    - *nginx-certs
+    - ../../dhparam/ffdhe3072.pem:/etc/nginx/dhparam/dhparam.pem:ro
+
+with_skip:
+  container_name: dh-skip
+  environment:
+    - DHPARAM_SKIP=true
+  image: *img-nginxproxy
+  volumes: *vols-common
+
+with_skip_backward:
+  container_name: dh-skip-backward
+  environment:
+    - DHPARAM_GENERATION=false
+  image: *img-nginxproxy
+  volumes: *vols-common

test/test_ssl/test_dhparam_generation.py

@@ -1,44 +0,0 @@
-import backoff
-import docker
-
-docker_client = docker.from_env()
-
-
-###############################################################################
-#
-# Tests helpers
-#
-###############################################################################
-
-@backoff.on_exception(backoff.constant, AssertionError, interval=2, max_tries=15, jitter=None)
-def assert_log_contains(expected_log_line):
-    """
-    Check that the nginx-proxy container log contains a given string.
-    The backoff decorator will retry the check 15 times with a 2 seconds delay.
-
-    :param expected_log_line: string to search for
-    :return: None
-    :raises: AssertError if the expected string is not found in the log
-    """
-    sut_container = docker_client.containers.get("nginxproxy")
-    docker_logs = sut_container.logs(stdout=True, stderr=True, stream=False, follow=False)
-    assert bytes(expected_log_line, encoding="utf8") in docker_logs
-
-
-###############################################################################
-#
-# Tests
-#
-###############################################################################
-
-def test_dhparam_is_generated_if_missing(docker_compose):
-    sut_container = docker_client.containers.get("nginxproxy")
-    assert sut_container.status == "running"
-
-    assert_log_contains("Generating DSA parameters")
-    assert_log_contains("dhparam generation complete, reloading nginx")
-
-    # Make sure the dhparam in use is not the default, pre-generated one
-    default_checksum = sut_container.exec_run("md5sum /app/dhparam.pem.default").output.split()
-    generated_checksum = sut_container.exec_run("md5sum /etc/nginx/dhparam/dhparam.pem").output.split()
-    assert default_checksum[0] != generated_checksum[0]

test/test_ssl/test_dhparam_generation.yml

@@ -1,8 +0,0 @@
-sut:
-  image: nginxproxy/nginx-proxy:test
-  container_name: nginxproxy
-  volumes:
-    - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ./certs:/etc/nginx/certs:ro
-  environment:
-    - DHPARAM_BITS=256

test/test_ssl/test_hsts.yml

@@ -38,5 +38,4 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     - ./certs:/etc/nginx/certs:ro

test/test_ssl/test_https_port.yml

@@ -10,7 +10,6 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     - ./certs:/etc/nginx/certs:ro
   environment:
     HTTP_PORT: 8080

test/test_ssl/test_nohttp.yml

@@ -12,5 +12,4 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     - ./certs:/etc/nginx/certs:ro

test/test_ssl/test_nohttps.yml

@@ -12,4 +12,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_ssl/test_noredirect.yml

@@ -12,5 +12,4 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     - ./certs:/etc/nginx/certs:ro

test/test_ssl/test_wildcard.yml

@@ -10,5 +10,4 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     - ./certs:/etc/nginx/certs:ro

test/test_ssl/wildcard_cert_and_nohttps/docker-compose.yml

@@ -7,7 +7,6 @@ services:
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
       - ./certs:/etc/nginx/certs:ro
-      - ../../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
 
   web1:
     image: web

test/test_upstream-name/test_predictable-name.yml

@@ -13,4 +13,3 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro

test/test_upstream-name/test_sha1-name.yml

@@ -13,6 +13,5 @@ services:
     image: nginxproxy/nginx-proxy:test
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
     environment:
       SHA1_UPSTREAM_NAME: "true"

test/test_wildcard_host.yml

@@ -35,4 +35,3 @@ sut:
   image: nginxproxy/nginx-proxy:test
   volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
-    - ./lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro