diff --git a/docker-compose.yml b/docker-compose.yml index 2babca7..11d0646 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -39,7 +39,7 @@ services: - certbot-etc:/etc/letsencrypt - certbot-var:/var/lib/letsencrypt - webroot:/var/www/html - command: certonly --webroot --webroot-path=/var/www/html --email admin@itformhelp.ru --agree-tos --no-eff-email --force-renewal -d itformhelp.ru -d www.itformhelp.ru + command: certonly --webroot --webroot-path=/var/www/html --email admin@itformhelp.ru --agree-tos --no-eff-email --staging -d itformhelp.ru -d www.itformhelp.ru volumes: sqlite_data: diff --git a/docker/nginx/conf.d/default.conf b/docker/nginx/conf.d/default.conf index b2ab99a..0b8c3de 100644 --- a/docker/nginx/conf.d/default.conf +++ b/docker/nginx/conf.d/default.conf @@ -1,47 +1,44 @@ +# HTTP server for ACME challenge server { listen 80; listen [::]:80; server_name itformhelp.ru www.itformhelp.ru; - - root /var/www/html; - + + # Allow only ACME challenge and redirect everything else to HTTPS location ^~ /.well-known/acme-challenge/ { - allow all; default_type "text/plain"; - try_files $uri =404; + root /var/www/html; } location / { - return 301 https://$host$request_uri; + return 301 https://$server_name$request_uri; } } -server { - listen 443 ssl http2 default_server; - listen [::]:443 ssl http2 default_server; - server_name itformhelp.ru www.itformhelp.ru; - - ssl_certificate /etc/letsencrypt/live/itformhelp.ru/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/itformhelp.ru/privkey.pem; - - root /usr/share/nginx/html; - index index.html; - - location / { - try_files $uri $uri/ /index.html; - expires -1; - add_header Cache-Control "no-store, no-cache, must-revalidate"; - } - - location /api/ { - proxy_pass http://backend:8000/api/; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_connect_timeout 60s; - proxy_send_timeout 60s; - proxy_read_timeout 60s; - } -} +# HTTPS server (commented out until we have certificates) +#server { +# listen 443 ssl http2; +# listen [::]:443 ssl http2; +# server_name itformhelp.ru www.itformhelp.ru; +# +# ssl_certificate /etc/letsencrypt/live/itformhelp.ru/fullchain.pem; +# ssl_certificate_key /etc/letsencrypt/live/itformhelp.ru/privkey.pem; +# +# root /usr/share/nginx/html; +# index index.html; +# +# location / { +# try_files $uri $uri/ /index.html; +# expires -1; +# add_header Cache-Control "no-store, no-cache, must-revalidate"; +# } +# +# location /api/ { +# proxy_pass http://backend:8000/api/; +# proxy_http_version 1.1; +# proxy_set_header Host $host; +# proxy_set_header X-Real-IP $remote_addr; +# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +# proxy_set_header X-Forwarded-Proto $scheme; +# } +#} diff --git a/init-letsencrypt.sh b/init-letsencrypt.sh index 70d38d1..7dcd132 100644 --- a/init-letsencrypt.sh +++ b/init-letsencrypt.sh @@ -1,34 +1,27 @@ #!/bin/bash -domains=(itformhelp.ru www.itformhelp.ru) -email="admin@itformhelp.ru" -staging=0 # Set to 1 if you're testing your setup +# Остановить все контейнеры +docker compose down -# Create dummy certificates -path="/etc/letsencrypt/live/$domains" -docker compose run --rm --entrypoint "\ - openssl req -x509 -nodes -newkey rsa:4096 -days 1\ - -keyout '$path/privkey.pem' \ - -out '$path/fullchain.pem' \ - -subj '/CN=localhost'" certbot +# Создать временную директорию для webroot +mkdir -p ./docker/certbot/www -echo "### Starting nginx ..." -docker compose up --force-recreate -d frontend +# Запустить nginx +docker compose up -d frontend -echo "### Deleting dummy certificate ..." -docker compose run --rm --entrypoint "\ - rm -Rf /etc/letsencrypt/live/$domains && \ - rm -Rf /etc/letsencrypt/archive/$domains && \ - rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot +# Подождать, пока nginx запустится +echo "Waiting for nginx to start..." +sleep 5 -echo "### Requesting Let's Encrypt certificate ..." -docker compose run --rm --entrypoint "\ - certbot certonly --webroot -w /var/www/html \ - --email $email \ - --agree-tos \ - --no-eff-email \ - --force-renewal \ - ${staging:+--staging}" certbot +# Получить тестовый сертификат +docker compose run --rm certbot -echo "### Reloading nginx ..." -docker compose exec frontend nginx -s reload +# Если тестовый сертификат получен успешно, получить боевой сертификат +if [ $? -eq 0 ]; then + echo "Test certificate obtained successfully. Getting production certificate..." + docker compose run --rm certbot certonly --webroot --webroot-path=/var/www/html --email admin@itformhelp.ru --agree-tos --no-eff-email --force-renewal -d itformhelp.ru -d www.itformhelp.ru +fi + +# Перезапустить все сервисы +docker compose down +docker compose up -d