Skip to content

Commit 3d8f04a

Browse files
author
Luca
committed
feat : create an exemple of use of docker image with SSL certificate
1 parent f2eb89d commit 3d8f04a

File tree

5 files changed

+202
-3
lines changed

5 files changed

+202
-3
lines changed

‎example/docker-compose-prod-certificate/README.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Deploy in production!
2+
3+
## :dvd: Software requirements
4+
5+
- [Docker](https://www.docker.com/) : packages `docker` and `docker-compose`
6+
7+
## :desktop_computer: Network Requirements
8+
9+
You will need a DNS domain name pointing to your server with a [wildcard DNS record](https://en.wikipedia.org/wiki/Wildcard_DNS_record)
10+
> **Note**
11+
> For free DNS names you can use [Dynu DNS](https://www.dynu.com/)
12+
13+
You will need the used port to be opened on your router and forwarded to your server :
14+
- Port 80 for HTTP
15+
- Port 443 for HTTPS
16+
- Port 9000 for PeerJs
17+
18+
## :globe_with_meridians: Setup reverse proxy
19+
20+
You need to set up a reverse proxy in a docker container to :
21+
- Redirect `${YOUR_DOMAIN_NAME}` to `app.${YOUR_DOMAIN_NAME}`
22+
- Redirect HTTP to HTTPS
23+
- Forward `app.${YOUR_DOMIN_NAME}` to the docker container adding certificates
24+
- Forward `peer.${YOUR_DOMIN_NAME}` to the docker container adding certificates
25+
26+
you can use (NGINX)[https://www.nginx.com/] and the exemple inside `exemple/docker-compose-prod-certificate/reverse-proxy`, replacing all occurrences of `${YOUR_DOMAIN_NAME}`
27+
28+
## :page_with_curl: Set-up certificates
29+
30+
You will need a SSL certifcate for each subdomain :
31+
- `${YOUR_DOMAIN_NAME}`
32+
- `app.${YOUR_DOMAIN_NAME}`
33+
- `peer.${YOUR_DOMAIN_NAME}`
34+
> **Note**
35+
> You can manage your cerificates with [Certbot](https://certbot.eff.org/), which uses [Let's Encrypt](https://letsencrypt.org/fr/getting-started/)
36+
37+
Once you have created you certificates and have a path for them you need to :
38+
- Mount a volume containing the certificates to the reverse-proxy : update `docker-compose.yml` (change only if your path differs from the exemple)
39+
- Point to the certificates in the reverse-proxy configuration: update : `nginx.comf` (change only if your path differs from the exemple)
40+
41+
42+
## :runner: Run lemverse in production
43+
44+
export your settings.json in the environment variable METEOR_SETTINGS
45+
46+
`export METEOR_SETTINGS="$(cat path/to/settings.json)"`
47+
48+
then execute docker-compose from this folder :
49+
50+
`docker-compose up -d`
51+

‎example/docker-compose-prod-certificate/docker-compose.yml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
version: "3.8"
2+
services:
3+
reverseproxy:
4+
build:
5+
context: .
6+
dockerfile: reverse-proxy/nginx.Dockerfile
7+
ports:
8+
- "443:443"
9+
- "80:80"
10+
volumes:
11+
# update here with the the paths to your certificate folders if necessary
12+
- /etc/letsencrypt:/etc/letsencrypt:ro
13+
networks:
14+
- net_lemverse
15+
depends_on:
16+
- mongodb
17+
- lemverse
18+
restart: always
19+
mongodb:
20+
image: mongo:5.0.3
21+
environment:
22+
- PUID=1000
23+
- PGID=1000
24+
volumes:
25+
- db:/data/db # Volume to keep database data between restarts
26+
restart: unless-stopped
27+
networks:
28+
- net_lemverse
29+
lemverse:
30+
image: lempire/lemverse:latest
31+
container_name: lemverse
32+
restart: unless-stopped
33+
networks:
34+
- net_lemverse
35+
depends_on:
36+
- mongodb
37+
ports:
38+
- "3000:3000"
39+
volumes:
40+
- lemverse:/var/tmp/lemverse # Volume for upload tileset and keep them between restart
41+
environment:
42+
ROOT_URL: ${APP_ROOT_URL:-http://localhost}
43+
MONGO_URL: mongodb://mongodb:27017/meteor
44+
PORT: 3000
45+
METEOR_SETTINGS: ${METEOR_SETTINGS}
46+
peer:
47+
image: peerjs/peerjs-server:0.6.1
48+
container_name: peer
49+
restart: unless-stopped
50+
networks:
51+
- net_lemverse
52+
command: [ "--port", "9000", "--path", "/peer" ]
53+
volumes:
54+
lemverse:
55+
driver: local
56+
db:
57+
driver: local
58+
# Custom network so all services can communicate using a FQDN
59+
networks:
60+
net_lemverse:
61+
driver: bridge
62+
name: net_lemverse

‎example/docker-compose-prod-certificate/reverse-proxy/config/nginx.conf

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
upstream lemverse {
2+
server lemverse:3000;
3+
}
4+
5+
upstream peer {
6+
server peer:9000;
7+
}
8+
9+
# Redirect ${YOUR_DOMAIN_NAME} to app.${YOUR_DOMAIN_NAME}
10+
server {
11+
listen 80;
12+
listen [::]:80;
13+
listen 443 ssl;
14+
listen [::]:443 ssl http2;
15+
server_name ${YOUR_DOMAIN_NAME};
16+
ssl_certificate /etc/letsencrypt/live/${YOUR_DOMAIN_NAME}/fullchain.pem;
17+
ssl_certificate_key /etc/letsencrypt/live/${YOUR_DOMAIN_NAME}/privkey.pem;
18+
19+
location / {
20+
return 301 https://app.${YOUR_DOMAIN_NAME}$request_uri;
21+
}
22+
}
23+
24+
# Redirect any HTTP to HTTPS
25+
server {
26+
listen 80;
27+
listen [::]:80;
28+
server_name *.${YOUR_DOMAIN_NAME};
29+
30+
location / {
31+
return 301 https://$host$request_uri;
32+
}
33+
34+
location ~ /.well-known/acme-challenge {
35+
allow all;
36+
root /tmp/acme_challenge;
37+
}
38+
}
39+
40+
# Certificates and redirect to container on https://app.${YOUR_DOMAIN_NAME}
41+
server {
42+
listen 443 ssl;
43+
listen [::]:443 ssl http2;
44+
server_name app.${YOUR_DOMAIN_NAME};
45+
ssl_certificate /etc/letsencrypt/live/app.${YOUR_DOMAIN_NAME}/fullchain.pem;
46+
ssl_certificate_key /etc/letsencrypt/live/app.${YOUR_DOMAIN_NAME}/privkey.pem;
47+
48+
location / {
49+
proxy_pass http://lemverse;
50+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
51+
proxy_set_header Host $host;
52+
proxy_redirect off;
53+
}
54+
location /static/ {
55+
alias /static/;
56+
}
57+
}
58+
59+
# Certificates and redirect to container on https://peer.${YOUR_DOMAIN_NAME}
60+
server {
61+
listen 443 ssl;
62+
listen [::]:443 ssl http2;
63+
server_name peer.${YOUR_DOMAIN_NAME};
64+
ssl_certificate /etc/letsencrypt/live/peer.${YOUR_DOMAIN_NAME}/fullchain.pem;
65+
ssl_certificate_key /etc/letsencrypt/live/peer.${YOUR_DOMAIN_NAME}/privkey.pem;
66+
67+
location / {
68+
proxy_pass http://peer;
69+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
70+
proxy_set_header Host $host;
71+
proxy_redirect off;
72+
# WebSocket support
73+
proxy_http_version 1.1;
74+
proxy_set_header Upgrade $http_upgrade;
75+
proxy_set_header Connection "upgrade";
76+
}
77+
location /static/ {
78+
alias /static/;
79+
}
80+
81+
}

‎example/docker-compose-prod-certificate/reverse-proxy/nginx.Dockerfile

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM nginx:latest
2+
RUN rm /etc/nginx/conf.d/default.conf
3+
COPY reverse-proxy/config/nginx.conf /etc/nginx/conf.d/default.conf

‎example/docker-compose-prod/docker-compose.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ services:
3737
"production": true,
3838
"staging": false,
3939
"enableLogClient": false
40+
"logoURL": "https://assets.website-files.com/62b4ba92180b4210cc065959/62b4c09cbc28c2286fc87ed6_Logo.svg",
41+
"faviconURL": "https://assets.website-files.com/62b4ba92180b4210cc065959/62bdafd68a5ffb164edbdf51_Favicon%20(1).png"
4042
},
4143
"debug": false,
4244
"defaultReaction": "❤️",
@@ -197,7 +199,7 @@ services:
197199
restart: unless-stopped
198200
networks:
199201
- net_lemverse
200-
command: [ "--port", "9000", "--path", "/peer" ]
202+
command: ["--port", "9000", "--path", "/peer"]
201203
caddy:
202204
image: caddy/caddy:alpine
203205
restart: unless-stopped
@@ -220,12 +222,12 @@ services:
220222

221223
volumes:
222224
lemverse:
223-
driver: local
225+
driver: local
224226
caddy:
225227
driver: local
226228
db:
227229
driver: local
228-
230+
229231
# Custom network so all services can communicate using a FQDN
230232
networks:
231233
net_lemverse:

0 commit comments

Comments
 (0)