NGINX and HTTPs with Let’s Encrypt, Certbot, and Cron dockerization in production

Docker is a popular open source containerization platform and it frees your hands to build your applications in development and production. In this post, I'm going to walk you through how to build a production grade HTTPs secured Nginx server with Docker, Docker Compose, Let’s Encrypt(its client certbot). Let’s Encrypt certificates last 90 days and will need to be renewed after the certificate expires. So I will also provide details to script the renewal in crontab in Docker container.

1. Basic Example

In development, we need a basic Nginx container without HTTPs to fast setup our local test environment. I use Nginx official docker image and wrap up all the stuff with docker-compose.

YAML

1

version: '3.4'

2

3

services:

4

  nginx:

5

    container_name: nginx

6

    image: nginx:stable

7

    restart: always

8

    volumes:

9

      - ./nginx/config/nginx.conf:/etc/nginx/nginx.conf

10

      - ./nginx/config/conf.d/local:/etc/nginx/conf.d

11

      - /tmp/logs/nginx:/var/log/nginx

12

      - ./nginx/html:/var/www/public/content

13

    ports:

14

      - "80:80"

I choose to use nginx.conf along with conf.d folder to manage all the configurations. So nginx.conf is for generic configuration while conf.d folder is for site specific configurations like below.

Java

1

server {

2

  listen 80;

3

  server_name localhost;

4

5

  gzip              on;

6

  gzip_comp_level   2;

7

  gzip_min_length   1024;

8

  gzip_vary         on;

9

  gzip_proxied      expired no-cache no-store private auth;

10

  gzip_types        application/x-javascript application/javascript application/xml application/json text/xml text/css text$

11

12

  client_body_timeout 12;

13

  client_header_timeout 12;

14

  reset_timedout_connection on;

15

  proxy_connect_timeout       600;

16

  proxy_send_timeout          600;

17

  proxy_read_timeout          600;

18

  send_timeout                600;

19

  server_tokens off;

20

  client_max_body_size 50m;

21

22

  expires 1y;

23

  access_log off;

24

  log_not_found off;

25

  root /var/www/public/content;

26

27

28

  location / {

29

    proxy_pass       http://ui:3000;

30

    proxy_http_version 1.1;

31

    proxy_set_header X-Forwarded-Host $host;

32

    proxy_set_header X-Forwarded-Server $host;

33

    proxy_set_header X-Real-IP $remote_addr;

34

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

35

    proxy_set_header X-Forwarded-Proto $scheme;

36

    proxy_set_header Host $http_host;

37

    proxy_set_header Upgrade $http_upgrade;

38

    proxy_set_header Connection "Upgrade";

39

    proxy_pass_request_headers on;

40

  }

41

42

}

2. Configure HTTPs

2.1 Let’s Encrypt

To enable HTTPS on your website, you need to get a certificate from a Certificate Authority (CA). Let’s Encrypt is a free, automated, and open certificate authority (CA). In order to get a certificate for your website’s domain from Let’s Encrypt, you have to demonstrate control over the domain. With Let’s Encrypt, you do this using software that uses the ACME protocol which typically runs on your web host.

2.1 Certbot

we recommend using certbot-auto, which automates the process of installing Certbot on your system.The certbot-auto wrapper script installs Certbot, obtaining some dependencies from your web server OS and putting others in a python virtual environment. You can download and run it as follows. In addition, Certbot needs port 80 to be enabled, so the host firewall should allow incoming traffic on port 80 (HTTP) from anywhere. I'm using Oracle cloud, I need to open up port 80 on the security list, and also the VM firewall(as below):

Shell

1

sudo firewall-cmd --permanent --zone=public --add-port=80/tcp

2

sudo firewall-cmd --reload

2.3 Setup NGINX

We need configure ports, domain names, certificates as well as reverse proxy mappings for the servers. Here is a quick example grabbed from my project which contains two servers: one is for HTTPs and another is for HTTP that will redirect to HTTPs.

Java

1

server {

2

          listen 443 ssl default_server;

3

          server_name yourcompany.com;

4

5

          gzip              on;

6

          gzip_comp_level   2;

7

          gzip_min_length   1024;

8

          gzip_vary         on;

9

          gzip_proxied      expired no-cache no-store private auth;

10

          gzip_types        application/x-javascript application/javascript application/xml application/json text/xml text/css text$

11

12

          client_body_timeout 12;

13

          client_header_timeout 12;

14

          reset_timedout_connection on;

15

          proxy_connect_timeout       600;

16

          proxy_send_timeout          600;

17

          proxy_read_timeout          600;

18

          send_timeout                600;

19

          server_tokens off;

20

          client_max_body_size 50m;

21

22

          expires 1y;

23

          access_log off;

24

          log_not_found off;

25

          root /var/www/public/content/default;

26

          ssl_certificate    /etc/letsencrypt/live/yourcompany.com/fullchain.pem;

27

          ssl_certificate_key    /etc/letsencrypt/live/yourcompany.com/privkey.pem;

28

29

          location / {

30

            proxy_pass       http://ui:3000;

31

            proxy_http_version 1.1;

32

            proxy_set_header X-Forwarded-Host $host;

33

            proxy_set_header X-Forwarded-Server $host;

34

            proxy_set_header X-Real-IP $remote_addr;

35

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

36

            proxy_set_header X-Forwarded-Proto $scheme;

37

            proxy_set_header Host $http_host;

38

            proxy_set_header Upgrade $http_upgrade;

39

            proxy_set_header Connection "Upgrade";

40

            proxy_pass_request_headers on;

41

          }

42

}

43

server {

44

    listen 80;

45

46

    server_name yourcompany.com;

47

48

    return 301 https://$host$request_uri;

49

}

2.4 Automatically Renew Certificates

We just need to add the following script to crontab, which will run monthly to check and renew the certificate.

Shell

1

@monthly /usr/local/bin/certbot-auto renew --nginx >> /var/log/cron.log 2>&1

2.5 Wrap all in Docker

We will need a Dockerfile and docker-compose.yml. 

Dockerfile

Dockerfile

1

FROM nginx:stable

2

3

ARG CERTBOT_EMAIL=info@domain.com

4

ARG DOMAIN_LIST

5

6

RUN  apt-get update \

7

      && apt-get install -y cron certbot python-certbot-nginx bash wget \

8

      && certbot certonly --standalone --agree-tos -m "${CERTBOT_EMAIL}" -n -d ${DOMAIN_LIST} \

9

      && rm -rf /var/lib/apt/lists/* \

      && echo "PATH=$PATH" > /etc/cron.d/certbot-renew  \

      && echo "@monthly certbot renew --nginx >> /var/log/cron.log 2>&1" >>/etc/cron.d/certbot-renew \

11

      && crontab /etc/cron.d/certbot-renew

12

13

14

15

VOLUME /etc/letsencrypt

16

17

18

CMD [ "sh", "-c", "cron && nginx -g 'daemon off;'" ]

19

docker-compose.yml

We use network mode - host at the time of docker build so that it can share host network, which is quite tricky because the port mapping(80,443) are not ready at building phrase. Otherwise, running certbot-auto will fail due to HTTP port 80 is not reachable.

YAML

1

version: '3.4'

2

3

services:

4

  nginx:

5

    container_name: nginx

6

    build:

7

      context: ./nginx

8

      network: host

9

      args:

10

        - CERTBOT_EMAIL=hello@yourcompany.com #replace with your own email

11

        - DOMAIN_LIST=yourcompany.com,api.yourcompany.com,www.yourcompany.com #replace with your own domains

12

    restart: always

13

    volumes:

14

      - ./nginx/config/conf.d/prod:/etc/nginx/conf.d

15

      - letsencrypt:/etc/letsencrypt

16

    ports:

17

      - "80:80"

18

      - "443:443"

That's it. You're good to go. Contact me if you need whole source code.