Merge pull request #110 from Pet-projects-CodePET/feature/ssl

new try
Pet-projects-CodePET · Mar 12, 2024 · 6cbb35b · 6cbb35b
2 parents 2842ef5 + 53e5c1d
commit 6cbb35b
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 7 deletions.
diff --git a/infra/docker-compose-prod.yaml b/infra/docker-compose-prod.yaml
@@ -53,21 +53,21 @@ services:
     volumes:
       - static_volume:/staticfiles/
       - media_value:/var/html/media/
-      - ./nginx/conf/:/etc/nginx/conf.d/:ro
-      - ./certbot/www/:/var/www/certbot/:ro
+      - ./data/certbot/www:/var/www/certbot/:ro
+      - ./data/nginx/conf/:/etc/nginx/conf.d/:ro
+      - ./data/certbot/conf/:/etc/nginx/ssl/:ro
+      - /etc/letsencrypt:/etc/letsencrypt
     restart: unless-stopped
-    command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
     depends_on:
       - backend
       - frontend
 
   certbot:
     image: certbot/certbot
     volumes:
-      - ./certbot/www/:/var/www/certbot/:rw
-      - ./certbot/conf/:/etc/letsencrypt/:rw
+      - ./data/certbot/www/:/var/www/certbot/:rw
+      - ./data/certbot/conf/:/etc/letsencrypt/:rw
     restart: unless-stopped
-    entrypoint:  "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
     depends_on:
       - backend
       - frontend
diff --git a/infra/nginx/nginx.conf b/infra/nginx/nginx.conf
@@ -17,7 +17,7 @@ server {
     }
 
     location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
+        root /var/www/certbot/;
     }
 
     location / {
@@ -33,8 +33,11 @@ server {
     listen 443 default_server ssl http2;
     listen [::]:443 ssl http2;
     server_name 89.23.117.80 devcodepet.tw1.ru;
+
     ssl_certificate /etc/nginx/ssl/live/devcodepet.tw1.ru/fullchain.pem;
     ssl_certificate_key /etc/nginx/ssl/live/devcodepet.tw1.ru/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
     root /staticfiles;
 
@@ -61,8 +64,11 @@ server {
     listen 443 default_server ssl http2;
     listen [::]:443 ssl http2;
     server_name 89.23.117.168 testcodepet.tw1.ru;
+
     ssl_certificate /etc/nginx/ssl/live/testcodepet.tw1.ru/fullchain.pem;
     ssl_certificate_key /etc/nginx/ssl/live/testcodepet.tw1.ru/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
     root /staticfiles;