Skip to content

Commit bf04010

Browse files
bfrenbfren
authored
v6.0.0 (#145)
Major updates * Using rebuilt Nginx base image * Using variable in proxy_pass in case upstream host is not available - so Nginx will always start Minor updates * Generate proxy configuration and helper to allow refresh override Documentation updates * Adding various missing environment variables to README.md * Adding nginx-adduser to README.md * Various improvements and fixes to comments
1 parent ddcb1b0 commit bf04010

File tree

10 files changed

+67
-32
lines changed

10 files changed

+67
-32
lines changed

‎Dockerfile‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM bfren/nginx:nginx1.22-4.0.33
1+
FROM bfren/nginx:nginx1.22-alpine3.17-5.0.0
22

33
LABEL org.opencontainers.image.source="https://github.com/bfren/docker-nginx-proxy"
44

@@ -35,7 +35,11 @@ ENV \
3535
# optional - add aliases to the auto-generated conf.json on first startup
3636
PROXY_AUTO_ALIASES= \
3737
# optional - mark the Nginx config as custom so it isn't regenerated on future startups
38-
PROXY_AUTO_CUSTOM=0
38+
PROXY_AUTO_CUSTOM=0 \
39+
# upstream DNS resolver, set to Docker's internal resolver by default
40+
PROXY_UPSTREAM_DNS_RESOLVER=127.0.0.11 \
41+
# the number of seconds before the maintenance page will auto-refresh
42+
PROXY_MAINTENANCE_REFRESH_SECONDS=6
3943

4044
COPY ./overlay /
4145

‎README.md‎

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -34,28 +34,35 @@ For SSL certificate requests to work correctly, ports 80 and 443 need mapping fr
3434

3535
## Environment Variables
3636

37-
| Variable | Values | Description | Default |
38-
| ------------------------------------ | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
39-
| `PROXY_URI` | URI | The base URI of the proxy server - will be used to handle unbound requests. | *None* - **required** |
40-
| `PROXY_CLEAN_INSTALL` | 0 or 1 | If 1, all Nginx and SSL configuration and certificates will be deleted and regenerated. | 0 |
41-
| `PROXY_HARDEN` | 0 or 1 | If 1, only modern SSL ciphers and protocols will be enabled (some older devices may not be able to access it). | 0 |
42-
| `PROXY_LETS_ENCRYPT_EMAIL` | A valid email address | Used by Lets Encrypt for notification emails. | *None* - **required** |
43-
| `PROXY_LETS_ENCRYPT_LIVE` | 0 or 1 | Only set to 1 (to request live certificates) when your config is correct - Lets Encrypt rate limit certificate requests. | 0 |
44-
| `PROXY_SSL_DHPARAM_BITS` | A valid integer | The size of your DHPARAM variables - adjust down only if you have limited processing resources. | 4096 |
45-
| `PROXY_SSL_REDIRECT_TO_CANONICAL` | 0 or 1 | If 1, all requests will be redirected to the primary domain (defined in `conf.json`). | 0 |
46-
| `PROXY_GETSSL_SKIP_HTTP_TOKEN_CHECK` | true or false | Set to true to enable `getssl`'s [skip HTTP token check](https://github.com/srvrco/getssl/wiki/Config-variables#skip_http_token_checkfalse). | false |
37+
| Variable | Values | Description | Default |
38+
| ------------------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
39+
| `PROXY_URI` | URI | The base URI of the proxy server - will be used to handle unbound requests. | *None* - **required** |
40+
| `PROXY_CLEAN_INSTALL` | 0 or 1 | If 1, all Nginx and SSL configuration and certificates will be deleted and regenerated. | 0 |
41+
| `PROXY_HARDEN` | 0 or 1 | If 1, only modern SSL ciphers and protocols will be enabled (some older devices may not be able to access it). | 0 |
42+
| `PROXY_LETS_ENCRYPT_EMAIL` | A valid email address | Used by Lets Encrypt for notification emails. | *None* - **required** |
43+
| `PROXY_LETS_ENCRYPT_LIVE` | 0 or 1 | Only set to 1 (to request live certificates) when your config is correct - Lets Encrypt rate limit certificate requests. | 0 |
44+
| `PROXY_SSL_DHPARAM_BITS` | A valid integer | The size of your DHPARAM variables - adjust down only if you have limited processing resources. | 4096 |
45+
| `PROXY_SSL_REDIRECT_TO_CANONICAL` | 0 or 1 | If 1, all requests will be redirected to the primary domain (defined in `conf.json`). | 0 |
46+
| `PROXY_GETSSL_SKIP_HTTP_TOKEN_CHECK` | true or false | Set to true to enable `getssl`'s [skip HTTP token check](https://github.com/srvrco/getssl/wiki/Config-variables#skip_http_token_checkfalse). | false |
47+
| `PROXY_AUTO_PRIMARY` | URI | If set (along with PROXY_AUTO_UPSTREAM) SSL config will be generated on first startup. | *None* |
48+
| `PROXY_AUTO_UPSTREAM` | URI | If set (along with PROXY_AUTO_PRIMARY) SSL config will be generated on first startup. | *None* |
49+
| `PROXY_AUTO_ALIASES` | string of URIs | Add aliases to the auto-generated conf.json on first startup. | *None* |
50+
| `PROXY_AUTO_CUSTOM` | 0 or 1 | Mark the auto-generated SSL config to 'custom' so the Nginx configuration is not regenerated on startup. | 0 |
51+
| `PROXY_UPSTREAM_DNS_RESOLVER` | IP address | Upstream DNS resolver - set to Docker's by default. | 127.0.0.11 |
52+
| `PROXY_MAINTENANCE_REFRESH_SECONDS` | A valid integer | The number of seconds to count down before the maintenance page auto-refreshes. | 6 |
4753

4854
## Helper Functions
4955

50-
| Function | Arguments | Description |
51-
| --------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------- |
52-
| `nginx-regenerate` | -f: force | Removes non-custom Nginx configuration files (in `/sites`) and regenerates based on `conf.json` (with force, removes all). |
53-
| `ssl-cleanup` | -m: mode | Removes SSL and Nginx configuration files and directories not defined in `conf.json` (mode 0 = dry run, 1 = live). |
54-
| `ssl-init` | *None* | Initialises SSL configuration based on `conf.json`. |
55-
| `ssl-regenerate` | *None* | Removes SSL configuration files (in `/ssl/certs`) and regenerates based on `conf.json`. |
56-
| `ssl-regenerate-full` | *None* | Removes SSL configuration files (in `/ssl/certs`), as well as DH parameters, and regenerates based on `conf.json`. |
57-
| `ssl-request` | *None* | Requests SSL certificates from Lets Encrypt. |
58-
| `ssl-update` | *None* | Attempts to update SSL certificates manually. |
56+
| Function | Arguments | Description |
57+
| --------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
58+
| `nginx-adduser` | 0: username, 1: password | Add a user to enable basic HTTP auth. |
59+
| `nginx-regenerate` | -f: force | Removes non-custom Nginx configuration files (in `/sites`) and regenerates based on `conf.json` (with force, removes all). |
60+
| `ssl-cleanup` | -m: mode | Removes SSL and Nginx configuration files and directories not defined in `conf.json` (mode 0 = dry run, 1 = live). |
61+
| `ssl-init` | *None* | Initialises SSL configuration based on `conf.json`. |
62+
| `ssl-regenerate` | *None* | Removes SSL configuration files (in `/ssl/certs`) and regenerates based on `conf.json`. |
63+
| `ssl-regenerate-full` | *None* | Removes SSL configuration files (in `/ssl/certs`), as well as DH parameters, and regenerates based on `conf.json`. |
64+
| `ssl-request` | *None* | Requests SSL certificates from Lets Encrypt. |
65+
| `ssl-update` | *None* | Attempts to update SSL certificates manually. |
5966

6067
## Nginx Configuration Helpers
6168

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5.1.25
1+
6.0.0

‎VERSION_MAJOR‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5
1+
6

‎VERSION_MINOR‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5.1
1+
6.0

‎overlay/etc/bf/init.d/23-maintenance‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/command/with-contenv bash
2+
3+
set -euo pipefail
4+
export BF_E=`basename ${0}`
5+
6+
7+
#======================================================================================================================
8+
# Generate maintenance configuration helper and page.
9+
#======================================================================================================================
10+
11+
bf-echo "Generating maintenance files."
12+
bf-esh ${BF_TEMPLATES}/proxy-maintenance.conf.esh /etc/nginx/helpers/proxy-maintenance.conf
13+
bf-esh ${BF_TEMPLATES}/maintenance.html.esh ${NGINX_ROOT}/maintenance.html
14+
bf-done

‎overlay/www/maintenance.html‎ renamed to ‎overlay/etc/bf/templates/maintenance.html.esh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@
1111
<body>
1212
<h1>Maintenance</h1>
1313
<p>The site you requested is temporarily down for maintenance. Please try again later.</p>
14-
<p class="muted">This page will auto-refresh in <span id="remaining">10</span>s.</p>
14+
<p class="muted">This page will auto-refresh in <span id="remaining"><%= "${PROXY_MAINTENANCE_REFRESH_SECONDS}" %></span>s.</p>
1515
<script type="text/javascript">
16-
let remaining = 7;
16+
let remaining = <%= "${PROXY_MAINTENANCE_REFRESH_SECONDS}" %>;
1717
let countdown = function () {
1818
// reload the page
1919
if (remaining == 0) {

‎overlay/etc/bf/templates/nginx-site.conf.esh‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
# WARNING: This file is generated. Do not make changes to this file.
2323
# Changes will be overwritten the next time the container is started.
2424
#
25-
# To add server names or aliases please use /ssl/conf.sh (see ssl-conf-sample.sh).
25+
# To add server names or aliases please use /ssl/conf.json (see ssl-conf-sample.json).
2626
#
2727
# If you need a fully custom configuration then add the following to /ssl/conf.json in the object where the primary
2828
# domain is "<%= "${DOMAIN_NAME}" %>":
@@ -78,18 +78,28 @@ server {
7878
listen [::]:443 ssl http2;
7979

8080
<% if [ "${PROXY_SSL_REDIRECT_TO_CANONICAL}" = "1" ] ; then -%>
81-
# redirect to primary domain name
81+
# redirect to primary (canonical) domain name
8282
if ($host != <%= "${DOMAIN_NAME}" %>) {
8383
return 301 <%= "https://${DOMAIN_NAME}" %>$request_uri;
8484
}
8585
<% fi -%>
8686

8787
# main site configuration block
8888
location / {
89-
proxy_pass <%= "${UPSTREAM}" %>;
89+
# set resolver to Docker's internal DNS resolver and use an upstream variable so Nginx will always start,
90+
# even if $upstream is not available - h/t https://stackoverflow.com/a/54719226/8199362
91+
resolver <%= "${PROXY_UPSTREAM_DNS_RESOLVER}" %> valid=30s;
92+
set $upstream <%= "${UPSTREAM}" %>;
93+
94+
# proxy to the upstream server, enabling best-practice proxy and security headers
95+
proxy_pass $upstream;
9096
include helpers/proxy-params.conf;
9197
include helpers/proxy-secure-headers.conf;
98+
99+
# use maintenance page (defined in helpers/proxy-maintenance.conf - see below) when there's an upstream error
92100
error_page 502 503 504 /maintenance.html;
101+
102+
# include custom configuration files
93103
include <%= "${CUSTOM_CONF}/*.conf" %>;
94104

95105
# because he was a legend

‎overlay/etc/bf/templates/proxy-maintenance.conf.esh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
location = /maintenance.html {
2+
root <%= "${NGINX_ROOT}" %>;
3+
}

‎overlay/etc/nginx/helpers/proxy-maintenance.conf‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)