11 ms·
HTTPS-Portal: Automated HTTPS server powered by Nginx, Let’s Encrypt and Docker
- deleted 8y ago[deleted]
- rapnie 8y agoThis is a great project, and exactly what I was looking for. Now doing manual cert renewal and looked into using jwilder's docker-gen to automate, but that was an involved process. This brings it all together. Thank you!
- twovarsishard 8y agoSetting a few labels on a docker container is hard? Good god we set the bar low these days.
- SquareWheel 8y agoI've flagged this comment. Creating a throwaawy just to mock somebody is not appropriate.
- nothrabannosir 8y agoAgreed, and thanks for mentioning it. This type of comment gives everyone a bad name.
- dvfjsdhgfv 8y agoWhile I don't appreciate the form and agree there is no place for it on HN, there is some merit in that that comment.
- thecatspaw 8y agoit could be written in a non-inflamatory tone however
- Sohcahtoa82 8y agoI'd call it cowardly.
- bovermyer 8y agoIt should also be punishable by more than just flagging a comment. Is there a way to ban IPs?
- dspillett 8y agoIP blocking is ineffective[1] and can have noticeable collateral damage[2]. As has been discussed at length in discussions about tracking people for copyright protection/enforcement reasons, IP addresses are not a suitable method of identifying/locating/tracking people. [1] they could just connect from somewhere else next time: mobile instead of home network, coffee shop wireless, day-job guest wireless, train/bus wireless, friend's wireless, tethered to friends' mobile connection, ... - in fact the poster may have used an alternate location this time just-in-case[3]. [2] if a public address/range is blocked, or a range used by a large employer or educational establishment, that could affect many innocent users while not affecting the problem user. [3] people determined enough to be dicks that they take time to sign up for a throwaway account, are likely determined enough to post from another location and dickish enough not care if other people using that location get blocked because of their action.
- throwaway8879 8y agoThey didn't say it was hard, they said "involved process", which I agree with.
- rapnie 8y agoThank you. My case involves more than the few labels. But you may enlighten others with your solution and help raise the bar again.
- dvfjsdhgfv 8y agoI'm sorry, I really don't get it. What do you need Docker for? Let's Encrypt and Nginx give you practically full cert automation. Maybe there's some crucial bit of information I'm missing here?
- rapnie 8y agoI am running RancherOS and Rancher where I have everything as docker images. Easily manageable and updateable. Using docker-compose automation, but in my setup with nginx as reverse proxy I have a lot of configuration options, and am a programmer at heart, not a DevOps guy. Don't know yet if I can use this out-of-the-box, but it will certainly save me a lot of time having it all together.
- sureaboutthis 8y agoI don't get it either even if one uses Docker. I use jails on FreeBSD but, otherwise, I have the same set up that does the same thing by just configuring what comes with all that so I don't understand the point of this.
- aaaaaaaaaab 8y agoCan you have a self-contained pre-built FreeBSD jail that you can fire up without doing additional setup? Like a prebuilt Docker container with all the necessary stuff already installed.
- sureaboutthis 8y agoI'm a professional. I don't need someone else to configure my system tools for me.
- rawoke083600 8y agoI don't get docker... I get it for things of scale... but the everyday stuff ? Maybe i'm still old !
- nothrabannosir 8y agoExample : this company had part of their site built by some abstruse static site generator with a million dependencies written in a language that no one at the company had installed by default, nor knew (I think it was Ruby). We put it all in Docker, and the README changed from 10 lines of install x, y, z version foo to /random, to just “run docker build, then docker run.” Most of the people working on those docs didn’t need to know about ruby or gems or lock files or any of that. A year later I overheard someone say thank god that thing was dockerized because I was absolutely not looking forward to installing all those dependencies just for a typo fix. That’s one of the areas where docker shines: app delivery.
- simongr3dal 8y agoI get that docker makes this simpler but it’s not really a feat only docker could accomplish, a makefile or bash script could have accomplished the same thing.
- johnchristopher 8y agoYou could also move bits with a magnet over the circuits but it's more error prone /s.
- louiskottmann 8y agoA bash script would be nowhere near as practical. First of all it would be much more complicated to deal with various environments, and in practice, docker run/docker stop is much easier to upgrade.
- jarfil 8y agoA bash script would have to automatically install all the dependencies. Over time, there is a growing chance that some of the versions required will conflict with whatever is already installed on the machine, and someone will have to go in and fix them... then fix them in a way that it works on everybody's machines. With docker, you can just ignore all that. As long as there is a single person capable of updating the dependencies on a single machine with docker, it'll work the same everywhere, always.
- ssijak 8y agoOr use Caddy https://caddyserver.com/docs/automatic-https https://caddyserver.com/docs/automatic-https
- graup 8y agoLooks cool, but it's not free for commercial use. Instead of paying $25/instance/mo I can set it up myself with the https-portal docker config.
- mortond 8y agoOr just build Caddy from source?
- cabraca 8y agotheir github source is still apache 2.0 licensed. just compile it yourself and you're good to go.
- bpizzi 8y agoIt's not free if you use the binaries builded/downloaded from caddyserver.com. It's still free if you build the binaries yourself from source [0]. [0] https://caddyserver.com/products/licenses https://caddyserver.com/products/licenses
- andmarios 8y agoBinaries from github should also be free, though they do not have external plugins compiled in.
- edwinyzh 8y agoGreat! I didn't know about that.
- morpheuskafka 8y agoAnd there is a Docker Hub image freely licensed building from source: https://github.com/abiosoft/caddy-docker https://github.com/abiosoft/caddy-docker
- JoshuaAshton 8y agoOr just use traefik https://traefik.io/ https://traefik.io/
- tjbiddle 8y agodocker-compose is not meant to be used in Production. Compose files can be; however they're used in conjunction with Docker Swarm - and when this is done, certain features are made available while others are not. Networks would be used in this case rather than the `link` directive.
- ripdog 8y agoWhy shouldn't I? If I was just going to use this to host a single website, what's wrong with running docker-compose?
- gexla 8y agoI see Docker for production and Docker for development as two different worlds. I think containers can work well for everyone in development. Not everyone needs to use it in production. If you are using Docker Compose for production, then you might not need the advantages of Docker for production (even though it's still useful for development.) If you Google around for production setup of applications, you'll see what a typical flow looks like. I think key points are automation and spreading your resources. Docker compose doesn't address these points.
- bfirsh 8y agoNothing at all, as long as you don’t mind the unreliability of a single server. (I am the author of Compose.) Honestly though, I would probably use Heroku for deploying little apps like this. The Compose CLI’s sweet spot is development environments. Edit: There are even official docs for this https://docs.docker.com/compose/production/ https://docs.docker.com/compose/production/
- Already__Taken 8y agoI have always been confused by examples of things that are deployed with docker compose. And I'm sat here with babies first coreOs cluster wondering how to mesh the two.
- tjbiddle 8y ago
- snorremd 8y agoTræfik works pretty well as an automated https proxy as well: https://traefik.io/ https://traefik.io/ It is still missing a caching feature though, so it might not be a good fit for everyone. It has a Docker backend which works with Docker labels (much the same way the https-portal project uses environment vars).
- Rowern 8y agoTraefik is really cool for most usage, I tried to used it in production and here are some of the shortcoming I found (the 2 first issues are on github): - If you use DNS for a blue-green deployment, traefik does not honor DNS ttls (because it uses the DNS of go and go might do some caching) so when you do the switch you might still end on the "old" environment - An error on one of the cool feature: serving error page when your backend returns some HTTP code - Some configuration options are not documented (but easily found using github search) I still love this software and I will keep looking at it.
- dward 8y agoBy default, go compiles binaries linked to libc to use the system DNS resolver. It does re-implement a DNS resolver but it's only used if CGO is disabled at compilation time.
- axaxs 8y agoThat's only half right. It does link to libc, but the default behavior on linux is to use Go unless some conditions are met.
- dward 8y agoUse go for what? DNS resolution? The default behavior is to use the system DNS resolver. The Go resolver will be used if the system is resolver is not avaialble (e.g. if the binary is compiled as pure go) or if the net.Resolver has the PreferGo flag set (which is false by default). https://github.com/golang/go/blob/541f9c0345d4ec52d9f4be5913bf8097f687e819/src/net/lookup.go#L108-L111 https://github.com/golang/go/blob/541f9c0345d4ec52d9f4be5913...
- enriquto 8y agowhat is the difference between "automated", "fully automated", and nothing ? Aren't all algorithms automatic ?
- TheGrumpyBrit 8y agoI've been using https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy and https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... to achieve this for a year or two now. I prefer it because the domain configuration is set on the backend site, rather than the proxy image itself, which means you don't have to worry about cleaning anything up when you remove an image.
- dexterbt1 8y agoSame with me, they're my go-to dockerized automated https reverse proxy setup. Takes a few minutes to setup. But recently though, I grew tired of handling 2 or more docker images, then I discovered https://github.com/Valian/docker-nginx-auto-ssl https://github.com/Valian/docker-nginx-auto-ssl. One image, sets up in a single command without volume sharing complexity of jwilder/nginx-proxy. One caveat though is the larger cpu overhead (from lua) when handling high volume or high reqs/sec.
- fulafel 8y agoWhy are reverse proxies (in memory unsafe languages, no less) so popular? They are unnecessary in most cases, and bring more conplexity and hinder transparency more than the alternatives.
- a012 8y agoCan you name a reverse proxy which written in safe language?
- BjoernKW 8y agoThey're popular because, for better or worse, Microservices are popular. If you want to serve Microservices from a common host name as if they were a single application, e.g. for public users of an API, you need some sort of mapping between internal and external URLs. Service discovery is another approach but that's probably only applicable to internal service usage.
- aequitas 8y agoThey where popular way before microservices, only less dynamic. Mostly from an operational perspective they give a single entry point which can be better secured and monitored. It also allows to easily decouple unstable backends from your user so even though functionality is broken (404), the user experience doesn't have to suffer (serve stale cache, respond with a proper branded error page which helps the user forward (instead of a cryptic app specific error page).
- tvaughan 8y agohttps://gitlab.com/tvaughan/docker-flask-starterkit https://gitlab.com/tvaughan/docker-flask-starterkit
- DanielDent 8y agoThis seems like it might be a new "hello world" for devops-inclined people. I've authored a similar Docker image with less features: https://github.com/DanielDent/docker-nginx-ssl-proxy https://github.com/DanielDent/docker-nginx-ssl-proxy (Although lately I've been finding my cookie-or-IP-or-HTTP-basic auth feature extremely useful in development, which this doesn't seem to have from the README) It hasn't been updated in a while, but I've also got an automatic service discovered based version of this for Rancher 1.6: https://github.com/DanielDent/rancher-nginx-active-lb https://github.com/DanielDent/rancher-nginx-active-lb