diff options
| author | Arseney300 <Arseney300@gmail.com> | 2026-02-20 01:34:23 +0700 |
|---|---|---|
| committer | Arseney300 <Arseney300@gmail.com> | 2026-02-20 01:34:23 +0700 |
| commit | d8b4a8e4b54e7bec9a955639c8f9dd2ce1daf5ee (patch) | |
| tree | 4cd5a07a654dcbb400f308902a7043ace92182f1 /nginx | |
Initial commit: bastion server project
Add Docker configurations for Ghost, Git server, and Nginx services
with documentation and architecture diagrams.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Diffstat (limited to 'nginx')
| -rw-r--r-- | nginx/docker-compose.yaml | 25 | ||||
| -rw-r--r-- | nginx/letsencrypt/index.html | 11 | ||||
| -rw-r--r-- | nginx/nginx.conf | 52 | ||||
| -rw-r--r-- | nginx/run_certbot.sh | 21 |
4 files changed, 109 insertions, 0 deletions
diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml new file mode 100644 index 0000000..8aa8c4e --- /dev/null +++ b/nginx/docker-compose.yaml @@ -0,0 +1,25 @@ +version: '3' + +services: + webserver: + image: nginx:latest + ports: + - 80:80 + #- 8000:8000 + - 443:443 + restart: always + volumes: + - /var/nginx/conf/:/etc/nginx/conf.d:ro + - /var/letsencrypt/etc:/var/letsencrypt/etc:ro #letsencrypt SSL certs + - /var/letsencrypt/lts_site:/var/letsencrypt/lts_site:ro #letsencrypt plug site + - /var/dh_param/dhparam-2048.pem:/etc/ssl/certs/dhparam-2048.pem #dhparam cert + networks: + git-network: + ipv4_address: 172.22.0.254 + +networks: + #write each stack network (or connect it manually later) + git-network: + name: git-network + external: true + diff --git a/nginx/letsencrypt/index.html b/nginx/letsencrypt/index.html new file mode 100644 index 0000000..bd4cee4 --- /dev/null +++ b/nginx/letsencrypt/index.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8" /> + <title>LetsEncrypt Certs setup</title> +</head> +<body> + + <p>LetsEncrypt Certs setup</p> +</body> +</html> diff --git a/nginx/nginx.conf b/nginx/nginx.conf new file mode 100644 index 0000000..9e49ae7 --- /dev/null +++ b/nginx/nginx.conf @@ -0,0 +1,52 @@ +error_log /var/log/nginx/error.log warn; + +server { + listen 80; + listen [::]:80; + + server_name swave.lol; + + location / { + rewrite ^ https://$host$request_uri? permanent; + } + + #for certbot challenges (renewal process) + location ~ /.well-known/acme-challenge { + allow all; + root /var/letsencrypt/lts_site; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name swave.com; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/letsencrypt/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/letsencrypt/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.1 TLSv1; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + + # Define the specified charset to the “Content-Type” response header field + charset utf-8; +} + diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh new file mode 100644 index 0000000..27e9127 --- /dev/null +++ b/nginx/run_certbot.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +email=arseney300@gmail.com +domain=swave.lol +dir=/var/ +lts_dir=$dir/letsencrypt + +#create dir for lts etc +mkdir $lts_dir/etc +mkdir $lts_dir/lts_site +cp letsencrypt/index.html $lts_dir/lts_site + +docker run -it --rm \ + -v $lts_dir/etc:/etc/letsencrypt \ + -v $lts_dir/lts_site:/data/letsencrypt \ + certbot/certbot \ + certonly --webroot \ + --email $email \ + --agree-tos --no-eff-email \ + --webroot-path=/data/letsencrypt \ + -d $domain |