12 ms·
Host Your Blog on DigitalOcean with Docker, Nginx and Let’s Encrypt
- pbreit 8y agoWould this work OK in 512mb at, say, Vultr?
- xxdesmus 8y agoAs long as you have some swap configured you’ll probably be fine.
- peterwwillis 8y agoAlternately, generate static HTML, run a bare web server and use about 16MB of RAM.
- biggio 8y agoSpot on! I pity the resources we waste. It seems people have forgotten to respect the fundamentals of computing.
- comtn 8y agoOpenBSD with HTTPD or Hiawatha is SMALL.
- tathougies 8y agoWhy even bother running a web server? Just use S3 with cloudfront.
- peterwwillis 8y agoIt looks like this would work, but you would have to use www.myblog.com instead of myblog.com since you have to use a CNAME to use cloudfront. Maybe using cloudflare's CNAME flattening?
- krallja 8y agoUnless you host your domain servers on Route53, in which case you can configure an alias record at the apex.
- jetrink 8y agoDO requests that you don't use swap as it degrades their SSDs. https://www.digitalocean.com/community/tutorials/how-to-add-swap-space-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-add-...
- abraham_lincoln 8y agoIs this the proper way to share file sockets? Also, why Docker and not just an Ansible script? update: Found this... https://github.com/jkap/ansible-ghost-letsencrypt https://github.com/jkap/ansible-ghost-letsencrypt
- oweiler 8y agoBecause the docker-compose is perfectly fine here?
- peterwwillis 8y agoWhy not Terraform? Why not Puppet? Why not X? Pick your poison. But it does seem simpler to not have to learn Ansible if you're already using Docker. The example you give has 6 config files.... the linked article uses 1 config file. shrug
- abraham_lincoln 8y agoSo if you know Docker, you shouldn't know how to do things without a container?
- manigandham 8y agoNobody said that. But yea, when using Docker already, why not? It's quick and easy compared to all the alternatives.
- toomuchtodo 8y agoIt's not easier than pushing a static site up to a CDN. Let someone else do the work until you're using actual compute. EDIT: Others are already expressing my point, that this is overkill for a blog.
- manigandham 8y agoThat's entirely different than what this thread is about. Many different ways to build and host a site, although many would find it simpler to just run Ghost or Wordpress and have the GUI for their posts. You can still use a CDN in front of a very tiny VM. Some new blog engines even support running on serverless/FaaS platforms for every easier deployments, and once FaaS evolves into just running Docker containers then the circle will complete and we'll have the best of everything.
- biggio 8y agoI want FTP back!
- comtn 8y agoSFTP?
- juanuys 8y agoIt'd be nice to see a follow-up post on how to keep this setup up-to-date with the latest security fixes without service disruption.
- peterwwillis 8y ago~$ docker-compose pull ~$ docker-compose up -d --build The compose files are already using latest, so this pulls the latest images, rebuilds images with any new code, and restarts the services.
- subway 8y agoassuming jwilder publishes updated images..
- bhurlow 8y agoshots fired lol
- peterwwillis 8y agoOh, for upstream/base? If a Docker Hub image was set up with automated builds, it would automatically rebuild the image once its base was rebuilt. It looks like nginx was set up this way, but nginx-proxy was not. So you have to rebuild nginx-proxy manually. ~$ git clone https://github.com/jwilder/nginx-proxy ~$ cd nginx-proxy ~$ docker build -f Dockerfile.alpine -t my-own-tag-name/nginx-proxy:alpine . ~$ cd .. ~$ sed -i -e 's/image: jwilder\/nginx-proxy.*/image: my-own-tag-name\/nginx-proxy:alpine/' docker-compose.yaml Alternately, you could fork the nginx-proxy repo, build it, push it to your own Docker Hub account, and add the Repository Links[1] back to nginx. Then you could use TravisCI to automatically pull in and rebuild changes from the parent nginx-proxy. This way you get automated builds when base is updated, and when nginx-proxy is updated. [1] https://docs.docker.com/docker-hub/builds/#repository-links https://docs.docker.com/docker-hub/builds/#repository-links
- subway 8y ago
- instaheat 8y agoI'm just curious - why? Forgive me if I am missing the obvious advantage over a blogging platform like medium.
- Kpourdeilami 8y agoMedium's reading experience is pretty bad with all the annoying popups showing up all over the place. Also with Ghost you can easily export your data and move it across different ghost installations, you can customize the look and feel of the blog, you can use your own custom domain without paying medium extra for that, etc.
- ageitgey 8y agoFor anyone that wants to move from Medium to Ghost easily, I made this thing to do that: https://github.com/ageitgey/medium_to_ghost https://github.com/ageitgey/medium_to_ghost
- jazzyjackson 8y agoGhost uses markdown, right? So does this tool export my medium blogs as markdown files, with links to the image files already embedded? If so, I will be forever indebted xD
- icebraining 8y agoApparently it uses a format called Mobiledoc¹, not Markdown. ¹ https://github.com/bustle/mobiledoc-kit/blob/master/MOBILEDOC.md https://github.com/bustle/mobiledoc-kit/blob/master/MOBILEDO...
- ageitgey 8y agoGhost 2.0 uses Mobiledoc format now. But you could get Markdown + Images out of this with a little hacking and passing the output to https://github.com/yuloh/mobiledoc-markdown-renderer https://github.com/yuloh/mobiledoc-markdown-renderer
- 8y ago
- StavrosK 8y agoHaving been down that path, don't do this to yourself. Just use a static site generator and Netlify, and save yourself countless hours of work and headache.
- akuji1993 8y agoYeah there really isn't any reason to do this other than wanting to specifically use these technologies.. Way easier with generators. Also you can save a lot of money by hosting it cheap instead of DigitalOcean.
- AndrewStephens 8y agoI I’m not going to tell people not to do this, but in my opinion this is massive overkill for a simple blog. Why use docker when you can just run nginx on the host with certbot for LetsEncrypt. I guess docker gives you some flexibility for rollover and load balancing, but a single droplet will handle huge amounts of traffic for static sites.
- deleted 8y ago[deleted]
- finaliteration 8y agoIt might be a good simple project for those not familiar with Docker and web server/nginx configuration. But other than that, I agree with you. Seems like a lot of overhead.
- mamon 8y agoWhy I use Docker for everything? saves me from dependency hell, chasing down the required libraries. Plus, some more complex stacks, which normally would take like half day to install now take just one "docker run" command (or "docker-compose up"). That's how I installed Nextcloud, Gitlab, etc. I think that Docker is a great time saver for those who want just to play with a new piece of software, and don't have the time to learn all the details of some arcane install procedure.
- twblalock 8y ago> I think that Docker is a great time saver for those who want just to play with a new piece of software, and don't have the time to learn all the details of some arcane install procedure. That's true, but if you do that in production you're running untrusted code that could do pretty much anything. If you don't have your own Docker registry full of containers you either made yourself or have audited yourself, you might as well let anyone in the world run their code on your servers. And if you do have your own registry, it's a lot of work and it involves chasing down libraries and working with arcane install procedures. You can't really trust the public base images unless you fork them and audit them yourself, or just create your own. At some point you need to take responsibility for your own stack. Docker fine for messing around on your laptop but the real work starts when you need to get past that.
- hidiegomariani 8y agouse medium
- Sohcahtoa82 8y agoThis was already proposed and shot down for various reasons: https://news.ycombinator.com/item?id=17983366 https://news.ycombinator.com/item?id=17983366
- coleifer 8y agoPremature optimization something something...and honestly this isn't even optimization, just some extra complexity. Dockers cool for doing dev stuff on your laptop, or for scaling out with something like kubernetes. This is just silly!
- opmac 8y agoGitHub pages with HTTPS support is easier :P
- cyphar 8y ago> volumes: - /var/run/docker.sock:/var/run/docker.sock:ro Please for the love of all that is holy, do not ever do this! Giving access to the host's Docker socket is equivalent to giving a container unrestricted root access to your host. Mounting the socket read-only doesn't protect you in any way either, because you can still connect to and write to the socket! Seriously, try it: % touch /tmp/docker.sock % mount --bind -o ro /var/run/docker.sock /tmp/docker.sock # this is -v /var/run/docker.sock:/foo:ro % docker -H unix:///tmp/docker.sock run --privileged -v /:/host -it ubuntu bash # # I couldn't write to it, but I can connect and write to the connection... # cat /host/etc/shadow # whoops! (The full container escape is left as an exercise for the reader. It's pretty trivial though.) To be fair, there are unix-like DAC controls that do restrict this somewhat but given that most people run containers as root or they don't use user namespaces this is still an issue. Please stop doing this, please stop telling people to do this, and please stop making images that access docker.sock. I understand that this is something that a lot of people do, so it's obviously not exclusively the fault of the author for doing what the majority of people appear to be doing, but I think that this deserves to be said much stronger than it was in the past (people still expose Docker over the internet -- which is literally a free root-level RCE for anyone who figures out you're hosting it). And yes, AuthZ plugins exist but nobody really uses them as far as I'm aware -- and personally (as someone who maintains container runtimes and other low-level container tools) I would not feel confident in depending on any AuthZ plugin's profile to protect against a container escape where you give unprivileged users access to /var/run/docker.sock. Even if I were to write one.
- mistrial9 8y agogreat tip - but nothing to do with 'holy' .. thx
- cyphar 8y agoIt's a common idiom. https://idioms.thefreedictionary.com/for+the+love+of https://idioms.thefreedictionary.com/for+the+love+of
- benatkin 8y agoThis is where it comes from and that's probably why it isn't explained in the post: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... It seems like if the author(s) of docker-letsencrypt-nginx-proxy-companion had assumed something like docker compose or kubernetes that neatly handles sharing volumes between containers, they probably wouldn't have made the mistake of giving a docker container access to docker for such a trivial use. I disagree that there's never a good reason to do this though. A docker control panel, or a CI or FaaS that spawns docker containers, can be a good reason to do this. https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/ https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d... BTW there's no escaping the container when you're doing this intentionally.
- blairanderson 8y agoAbsolutely do not do this. host your blog on https://pages.github.com https://pages.github.com or https://www.netlify.com https://www.netlify.com
- ILikeConemowk 8y agoshout-out to gitlab pages, I use it and love it.
- dsumenkovic 8y agoAwesome, thank you for your kind support. We really appreciate that.
- mcny 8y agoI think gitlab pages is a great way to introduce people to the philosophy of gitlab. I could imagine a pipeline setup in the future (with the help of web IDE) that will allow authors to write and commit new articles, for editors to edit them and sign them off to the publisher, and the publisher to publish articles to a static site without leaving the browser. Thoughts?
- eclipsetheworld 8y agoMore people should know about Caddy. A webserver with built-in HTTPS. We've been using it in production and the experience has been great so far: https://caddyserver.com/ https://caddyserver.com/
- steve19 8y agoUsing caddy for anything that might be commercial,by compiling, seems like a huge pain: https://www.digitalocean.com/community/tutorials/how-to-host-a-website-with-caddy-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-host...
- eclipsetheworld 8y agoThe Caddy license page states that: "If your company uses official Caddy binaries internally, in production, or distributes Caddy, a commercial license is required." So if you are not using the official binaries (for example a community-provided Caddy Docker image) a commercial license is not required.
- Dowwie 8y agoHow about not using any of that and instead using one of the hundred static site generators on GitHub and github.io hosting?
- tokyodude 8y agoit's twice as expensive? $120 a year vs $60? (unless you make your content open source in which case github is free)
- deleted 8y ago[deleted]
- wheresvic1 8y agoGitlab also provides hosting and free private repos.
- zellux 8y agoI've been using Netlify for a while with Hugo as site generator. It's free with HTTPS and CDN support.
- tomcam 8y agoThis is NOT meant to be incendiary. I'm trying to learn. Why not use Netlify instead? It seems to have everything you need from a static site host and has a comprehensive, well-documented toolchain. Seriously, what am I missing? Would DO be better under peak loads or something?
- alphabettsy 8y agoHugo + Netlify is simpler and faster. Just saying.
- newscracker 8y agoFor blogs that are “small” and/or expect low traffic, if someone doesn’t want to use free services, my recommendation would be a static site generator that pushes content to a site on Nearly Free Speech (nearlyfreespeech.net). It has a very simple way to create (and continuously renew) a letsencrypt TLS certificate. The cost would be USD 1.5 a month (or a bit higher than that) for what’s classified as a “production site” there. One drawback with NFSN is that it requires people to be somewhat tech savvy and know how to manage sites, probably use ssh, etc. If you’re someone who can use S3 or this solution, then you’ll find NFSN easier and cheaper for this use case.
- exolymph 8y agoI love NFSN. I wrote a detailed review a while back: https://winningwp.com/nearlyfreespeech-web-hosting-review/ https://winningwp.com/nearlyfreespeech-web-hosting-review/ (Not much has changed since then, and I'm still a happy customer.)
- newscracker 8y agoNice writeup. Thanks for that!
- fapjacks 8y agoThis does not belong on HN at all. 1) It is not novel or interesting and 2) it is made worse through being self-promotion. Do not make posts like this. Edited to add: But to scratch the stupid itch I tried hard not to scratch and respond to the other people here, I do this with my own personal blog and it's totally fine. All of my self-hosted software is containerized behind an HTTP reverse proxy. I can do it any number of ways but "Rely on <external third-party service>" seems like a terrible idea to me. And there is no reason whatsoever for all the posts in this thread naysaying this particular way of doing it, any more than there's any particular reason to naysay the suggested alternatives. Do whatever you want. Learn something. Improve your skillset.
- benatkin 8y agoRead the HN rules. People are allowed to submit their own content. By the way, your username appears to promote a disgusting slang term. How is that any better?
- fapjacks 8y agoThere were two whole qualifiers in my statement, half of which you ignored. Self-promotion is obviously okay. However self-promotion of bland, boring posts that regurgitate nearly useless information which has been posted hundreds of times... Edit: Oh, I see that you have a long history of twisting the words of others and personally attacking those you disagree with, so we're done here. You have a nice evening.
- ducaale 8y agoor you can just use https://github.com/SteveLTN/https-portal https://github.com/SteveLTN/https-portal for ssl termination
- hardwaresofton 8y agoThe most efficient host-your-own-blog I've ever seen is just static blog generation & S3. I don't do it myself (ironically, I run tiny kubernetes cluster and in the past had a systemd-managed docker+ngin+LE setup before that) but it doesn't get much simpler than uploading a folder to S3 that's being served by amazon as a website.
- guu 8y agoTo everyone saying "use a static site", this deploys Ghost which is a blogging application that provides an admin interface to create and edit posts. Yes, you can use something like Netlify CMS or Contentful with a static site to get an admin interface, but those would require additional setup or payment beyond github pages or a netlify account.
- techaddict009 8y agoWhy do you guys love complexing so much? Why not use one click wp instance from DO images?
- hannasanarion 8y agoBecause it's fun
- apatters 8y agoLike, why? Am I being too cheeky if I point out that setting up a droplet with a WordPress blog on DigitalOcean takes three minutes? :) (They have a premade image for it)
- wheresvic1 8y agoWhile this is pretty cool, it's also not all that much of an effort to setup https using certbot and have it automatically configure nginx: https://smalldata.tech/blog/2015/12/29/nginx-nodejs-and-https-via-letsencrypt https://smalldata.tech/blog/2015/12/29/nginx-nodejs-and-http... Setting up the renew job is also a very simple cron job. Moreover, something that one forgets is that once you have your posts, comments and any sort of data, you need to have backups and other sysadminy stuff. Personally, I enjoyed learning about this while setting up my blog :)
- jypepin 8y agoOnce, I worked on a Rails app that was setup in a docker compose environment. I won't talk about prod, but was very surprised to see how much more complex it made developing locally, having to deal with docker instances and such, compared to just run `rails s` if we weren't using Docker. Was the app setup improperly, or is that expected that using Docker will make local development more complex?
- likeclockwork 8y agoIt's a mixed bag. Some of it was probably improper setup. With mounts and docker exec and such it's easy to go into the container and rails s or rails console and do what you need to do. But you have to deal with user permissions if your app creates files and some other things but you can just use a docker container as a very lightweight VM. On the other side you have to track down and figure out how to install or build whatever obscure old Ruby version they're using and dirty your machine installing and running services to support the app. All of which is also painful. I do client work and I'd rather not dirty my machine installing old or random software to work on a project. So having portable local environments works well for me. But they do take some thought to set up and people often don't take enough care in either case to document the procedure for getting things set up to work on it.
- catears 8y agoPerhaps a bit off-topic, but if you run a lighter blog and specifically want to do it on a machine you control the I can recommend using the nginx:alpine docker image to host your site. All you need to build it is a COPY command: COPY ./my_static_files /usr/share/nginx/html This alone wont get you HTTPS, but I wouldn't be surprised if you can get that working with little effort using docker volumes and certbot
- qrbLPHiKpiux 8y agoI really miss the days when plain text files were used on a simple apache server linked with simple html pages. We've gone from concentrating on content to concentrating on the visuals, first.