This directory contains a Dockerfile that builds nginx with the OQS OpenSSL 1.1.1 fork, which allows nginx to negotiate quantum-safe keys and use quantum-safe authentication in TLS 1.3.
Install Docker and run the following commands in this directory:
docker build --build-arg SIG_ALG=<SIG> -t oqs-nginx-img .(<SIG>can be any of the authentication algorithms listed here). An alternative, simplified build instruction isdocker build -t oqs-nginx-img .: This will generate the image with a default QSC algorithm (dilithium2 -- see Dockerfile to change this).docker run --detach --rm --name oqs-nginx -p 4433:4433 oqs-nginx-imgwill start up the resulting container with QSC-enabled nginx running and listening for TLS 1.3 connections on port 4433.
Complete information how to use the image is available in the separate file USAGE.md.
The Dockerfile provided allows for significant customization of the image built:
This permits changing the build options for the underlying library with the quantum safe algorithms. All possible options are documented here.
By default, the image is built such as to have maximum portability regardless of CPU type and optimizations available, i.e. to run on the widest possible range of cloud machines.
This defines the quantum-safe cryptographic signature algorithm for the internally generated (demonstration) CA and server certificates.
The default value is 'dilithium3' but can be set to any value documented here.
This defines the resultant location of the nginx installatiion.
By default this is '/opt/nginx'. It is recommended to not change this. Also, all usage documentation assumes this path.
This defines the nginx software version to be build into the image.
The default version set is known to work OK but one could try any value available for download.
Allow setting parameters to make operation, e.g., '-j nnn' where nnn defines the number of jobs run in parallel during build.
The default is conservative and known not to overload normal machines. If one has a very powerful (many cores, >64GB RAM) machine, passing larger numbers (or only '-j' for maximum parallelism) speeds up building considerably.