如何將 Let encrypt 添加到在 Elastic Beanstalk 上運行的多容器中

Question

我正在嘗試使用 let encrypt on aws eb 將 https 添加到我的域中。 我的預算很緊，所以我負擔不起使用 AWS 證書和負載均衡器。 I have combed the web to find the best way to go about this but I seem to find only implementation using single containers hence the use of .ebextensions The only documentation I have found on stack overflow that came close was HTTPS on Elastic Beanstalk (Docker Multi -容器）

我還找到了有關如何在沒有負載均衡器的 AWS Elastic Beanstalk 上的免費 HTTPS 上使用 Dockerrun.aws.json 的文檔

但我似乎無法正確配置。 我已經有一個 nginx 服務器了。 如何配置 jwilder/nginx-proxy、jrcs/letsencrypt-nginx-proxy-companion 和 nginx

Dockerrun.aws.json
{
    "AWSEBDockerrunVersion": 2,
    "volumes": [{
            "name": "home-ec2-user-certs",
            "host": {
                "sourcePath": "/home/ec2-user/certs"
            }
        },
        {
            "name": "etc-nginx-vhost-d",
            "host": {
                "sourcePath": "/etc/nginx/vhost.d"
            }
        },
        {
            "name": "usr-share-nginx-html",
            "host": {
                "sourcePath": "/usr/share/nginx/html"
            }
        },
        {
            "name": "var-run-docker-sock",
            "host": {
                "sourcePath": "/var/run/docker.sock"
            }
        }
    ],
    "containerDefinitions": [{
            "name": "client",
            "image": "example/site-client",
            "hostname": "client",
            "essential": false,
            "memory": 128,
            "environment": [{
                    "name": "VIRTUAL_HOST",
                    "value": "www.example.com, example.com"
                },
                {
                    "name": "LETSENCRYPT_HOST",
                    "value": "www.example.com, example.com"
                }
            ]
        },
        {
            "name": "server",
            "image": "example/site-server",
            "hostname": "api",
            "essential": false,
            "memory": 128
        },
        {
            "name": "admin",
            "image": "example/site-admin",
            "hostname": "admin",
            "essential": false,
            "memory": 128,
            "environment": [{
                    "name": "VIRTUAL_HOST",
                    "value": "admin.example.com"
                },
                {
                    "name": "LETSENCRYPT_HOST",
                    "value": "admin.example.com"
                }
            ]
        },
        {
            "name": "worker",
            "image": "example/site-worker",
            "hostname": "worker",
            "essential": false,
            "memory": 128
        },
        {
            "name": "sales",
            "image": "example/site-payment",
            "hostname": "sales",
            "essential": false,
            "memory": 128
        },
        {
            "name": "nginx-proxy",
            "image": "jwilder/nginx-proxy",
            "essential": true,
            "memoryReservation": 128,
            "dockerLabels": {
                "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy": "true"
            },
            "portMappings": [{
                    "containerPort": 80,
                    "hostPort": 80
                },
                {
                    "containerPort": 443,
                    "hostPort": 443
                }
            ],
            "mountPoints": [{
                    "sourceVolume": "home-ec2-user-certs",
                    "containerPath": "/etc/nginx/certs",
                    "readOnly": true
                },
                {
                    "sourceVolume": "etc-nginx-vhost-d",
                    "containerPath": "/etc/nginx/vhost.d"
                },
                {
                    "sourceVolume": "usr-share-nginx-html",
                    "containerPath": "/usr/share/nginx/html"
                },
                {
                    "sourceVolume": "var-run-docker-sock",
                    "containerPath": "/tmp/docker.sock",
                    "readOnly": true
                }
            ]
        },
        {
            "name": "letsencrypt-nginx-proxy-companion",
            "image": "jrcs/letsencrypt-nginx-proxy-companion",
            "essential": true,
            "memoryReservation": 128,
            "volumesFrom": [{
                "sourceContainer": "nginx-proxy"
            }],
            "mountPoints": [{
                    "sourceVolume": "home-ec2-user-certs",
                    "containerPath": "/etc/nginx/certs"
                },
                {
                    "sourceVolume": "var-run-docker-sock",
                    "containerPath": "/var/run/docker.sock",
                    "readOnly": true
                }
            ]
        },
        {
            "name": "nginx",
            "image": "example/site-nginx",
            "hostname": "nginx",
            "essential": true,
            "portMappings": [{
                "hostPort": 80,
                "containerPort": 80
            }],
            "links": ["client", "server", "admin", "sales"],
            "memory": 128
        }
    ]
}

還有我的 nginx 文件

upstream client {
    server client:3000;
}

upstream admin {
    server admin:8000;
}

upstream sales {
    server sales:8626;
}


upstream api {
    server api:5000;
}

{
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_ur;
}

server {
#    listen 80;

    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem.;
    ssl_certificate_key /etc/letsencrypt/live/example.com/fullchain.pem.;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location / {
        proxy_pass http://client;
    }

    location /sales {
        rewrite /sales/(.*) /$1 break;
        proxy_pass http://sales;
    }

    location /api {
        rewrite /api/(.*) /$1 break;
        proxy_pass http://api;
    }
}

server {
    listen 80;
    server_name admin.example.com;

    location / {
        proxy_pass http://admin;
    }

}

Answer 1

可以“Dockerize” nginx 服務器並在設置時運行一些配置腳本。 所以是這樣的：

FROM nginx:1.16-alpine

RUN apk add --no-cache certbot

RUN mkdir /var/lib/certbot

COPY scripts/setup.sh /setup.sh
RUN chmod +x /setup.sh

COPY config/nginx.conf /etc/nginx/nginx.conf

ENTRYPOINT [ "../setup.sh" ]

劇本：

#!/bin/sh

certbot certonly -n -d DOMAINS \
    --standalone --preferred-challenges http --email EMAIL --agree-tos --expand


/usr/sbin/nginx -g "daemon off;"

然后像往常一樣將 ssl 證書和密鑰添加到 nginx 配置中。