Anonymous volumes are discouraged for reliable persistence.
Users should use named volumes or bind mounts instead. Potentially breaking change, users can also use explicit anonymous volumes instead of relying on implicit anonymous volumes.
`nginx-proxy` really should not be creating implicit anonymous volumes as in most cases it is undesirable.
`git blame` reveals this was added in 2014 by jwilder, with a message that implies implicit anonymous volumes was never intended..
- While the anonymous VOLUME can be dropped from Dockerfile, the path needs to be valid at run-time, might as well ensure it's available by creating the dhparam folder at build.
- Generation logic no longer necessary, dropped.
- Standardized RFC 7919 groups added (2048, 3072, 4096), with 4096-bit remaining the default size. The DH logic can live in the entrypoint script as well.
- Third-party supplied pre-generated DH params removed as they're not considered trustworthy compared to RFC 7919 groups.
This commit updates both 'Dockerfile' and 'Dockerfile.alpine' to use
'nginx 1.19.3'. This change was implemented after feedback from @buchdag
to be able to use dependabot.
This commit updates both 'Dockerfile' and 'Dockerfile.alpine' to use
'go.15.10' when building the dependencies. This change was implemented
after feedback from @buchdag to be able to use dependabot.
Previously, the Dockerfile downloaded 'docker-gen' and 'forego' binaries
during build time. This caused a problem as it hard-coded the amd64
architecture for the images.
This commit updates both 'Dockerfile' and 'Dockerfile.alpine' to build
the `forego` and `docker-gen` executables from scratch instead of
downloading binaries directly.
This is achieved using multi-stage builds [1]. Two seperate stages first
build the binaries, and are then copied over to the final stage.
The advantage of this change is two-fold: First, it enables building
this image on architectures other than amd64. Secondly it adds trust by
not adding external binaries to the docker image.
This modified version passes the test both a linux desktop (amd64) as
well as a raspberry pi (armv7) with some caveats:
- On armv7, a modified version of the `jwilder/docker-gen` image is
required. See a seperate PR at [2].
- The 'test_dhparam_is_generated_if_missing' test fails. This also
doesn't currently pass on master.
[1] https://docs.docker.com/develop/develop-images/multistage-build/ [2]
https://github.com/jwilder/docker-gen/pull/327
Since [1] some timings seem to have changed. This caused the unit tests
to fail intermittently, from my testings especially on Ubuntu systems
(much less often on e.g. Arch).
This commit adds the `dockergen_wait_for_event` helper-function to try
and wait for the configuration to be generated by docker-gen before
continuing on with the actual tests themselves.
Additionally, at the end of every test file, all containers spun up by
the bats-tests will be stopped. This required adding the `bats-type`
label to every container started during the bats-tests.
The stopping of the containers reduces the amount of events docker-gen
has to process, thus resulting in lower wait times for the generation to
happen.
[1]: 50435652b1
current base image does not have commented configurations which means is impossible to use the previous configuration to set the server name max length
This changes the base-image to the official nginx image,
reducing the virtual size of the image by approx 50%.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This adds SSL support for containers. It supports single host
certificates, wildcards and SNI using naming conventions for
certificates or optionally specify a cert name (for SNI). The SSL
cipher configuration is based on mozilla intermediate profile which
should provide compatibility with clients back to Firefox 1, Chrome 1,
IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. The
configuration also enables OCSP stapling, HSTS, and ssl session caches.
To enable SSL, nginx-proxy should be started w/ -p 443:443 and -v
/path/to/certs:/etc/nginx/certs. Certificates must be named:
<virtualhost>.crt and <virtualhost>.key where <virtualhost> matches
the a value of VIRTUAL_HOST on a container.
For wildcard certificates, the certificate and private key should be
named after the wildcard domain with .crt and .key suffixes. For example,
*.example.com should be name example.com.crt and example.com.key.
For SNI where a certificate may be used for multiple domain names, the
container can specify a CERT_NAME env var that corresponds to the base
file name of the certificate and key. For example, if you have a cert
allowing *.example.com and *.bar.com, it can be name shared.crt and
shared.key. A container can use that cert by having CERT_NAME=shared and
VIRTUAL_HOST=foo.example.com. The name "shared" is arbitrary and can
be whatever makes sense.
The behavior for the proxy when port 80 and 443 is defined is as
follows:
* If a container has a usable cert, port 80 will redirect to
443 for that container to always prefer HTTPS when available.
* If the container does not have a usable cert 503 will be returned.
In the last case, a self-signed or generic cert can be defined as
"default.crt" and "default.key" which will allow a client browser to
at least make a SSL connection.
This optimizes the Dockerfile by;
- Combining RUN statements so that files are removed in the
same layer as they are added.
- Removing the downloaded .tar.gz of the docker-gen binary
after expanding
- Adding `--no-install-recommends` (but explicitly installing
ca-certificates)
- Replacing `ADD` with `COPY` (recommended if no unpacking is
required)
Also added a `.dockerignore` file to prevent the `.git` directory
and README.md being added to the image.
These changes reduce the size of the image with 34 MB (was 268.4 MB,
now 233.9 MB), and results in less layers being produced.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Should address #6.
The port selection now works as follows:
* If there is only 1 port exposed by the container, that port is used.
* If there is a VIRTUAL_PORT env variable defined, that port is used.
* Otherwise, default to port 80, if exposed.
