Support HTTPS

[evanp]

It's not clear how to support HTTPS with this image.

Ideally one could provide something like PORT for the Apache server to listen on, plus a KEY and CERT environment variables with the contents of the key and cert files.

I can try and make this work.

[evanp]

Also: I love this image. Thanks for making it so easy to use. I wrote a blog post about it here:

http://blog.fuzzy.io/2015/01/19/installing-wordpress-with-docker-and-fig/

[md5]

@evanp this image doesn't configure its Apache to support HTTPS, so there would have to be a PR or a derived image that adds the appropriate Apache config and EXPOSE setting for 443.

If you're willing to do your HTTPS in another container, jwilder/nginx-proxy is a nice option that supports SSL configuration.

[evanp]

That's what I thought!

Do you think the PR should be for this repo or for docker-library/php?

[md5]

I think it makes sense to do this in the php:*apache images myself, but @tianon and @yosifkit may think otherwise.

Looks like those images already have a Listen 443, but they don't a2enmod ssl or configure certificate or key paths.

In terms of implementation, it probably makes sense to follow the example set by the httpd image (cf. https://github.com/docker-library/docs/blob/master/httpd/content.md#sslhttps).

[tianon]

I'm actually personally pretty strongly -1 on SSL by default, and would
rather recommend people use a lightweight container in front of this one to
add that, but I run all my containers behind a single nginx.

SSL support in these one-off containers creates a configuration nightmare
though, IMO.

[md5]

@tianon Are you using something like nginx-proxy or your own custom config?

[tianon]

I just use the official "nginx" image with a custom config that hooks to my
other containers via https://github.com/tianon/rawdns

[pierreozoux]

IMHO, we should keep these images as simple as possible.

I see the purpose of these images to create the process as described in 12factor app.

As a consequence, the SSL part should be handled at another level.

You could base your image on this on and add an nginx or apache server in front that would consume this php (I don't recommend as you break the one process per container rule).

Or you could use a reverse proxy in front that would consume this container. this reverse proxy could be nginx or HAproxy (I personnaly use HAproxy). This reverse-proxy would handle the SSL offloading part.

Let me know if you need more details. If not, please consider closing the issue for the sake of keeping this number as low as possible.

Thanks

[chriscoyier]

I think it would be nice to have some kind of mention/documentation/resource on how to go about using HTTPS. This seems like a pretty good lead, but I'm not having much luck so far.

[redbullpeter]

I managed to get HTTPS to work on the most basic of configs for the latest WordPress Docker image (4.5.7). I've documented it here:

https://peter.pudaite.net/2017/05/29/enabling-https-on-the-standard-wordpress-docker-image/

[AlexanderOMara]

For future visitors, here's a Dockerfile showing what I did to enable HTTPS support using the ssl-cert package to install the self-signed certificates that Apache is configures to use by default.

FROM wordpress:4.8.0-php7.1-apache

RUN apt-get update && \
	apt-get install -y  --no-install-recommends ssl-cert && \
	rm -r /var/lib/apt/lists/* && \
	a2enmod ssl && \
	a2ensite default-ssl

EXPOSE 80
EXPOSE 443

[ajdruff]

@AlexanderOMara Brilliant - thank you!

Since I was already running a container using docker-compose, and didn't want to create a builder file, I did this :

1. expose port 443 by adding the following to your compose file:

     ports:
       - "443:443"       
   

2. restart your container (be sure your db and web files are on persistent storage!)

    docker-compose down
    docker-compose up -d
   

3. attach to the running container

      docker exec -t -i CONTAINER_ID /bin/bash
   

4. install ssl-cert ( automatically installs self-signed cert)

    apt-get update && \
        apt-get install -y  --no-install-recommends ssl-cert && \
        rm -r /var/lib/apt/lists/* && \
        a2enmod ssl && \
        a2ensite default-ssl
   

You may get a prompt about restarting apache before the new settings take effect.

  service apache2 reload

1. exit the container (won't kill your container)

    CTRL-P-Q
   

2. Access your https://example.com , adding an exception to your browser to ignore the prompt about untrusted CA