codekitchen / dinghy-http-proxy

the http proxy container that dinghy uses
MIT License
125 stars 43 forks source link

Fix default `ssl_dhparam` #41

Closed jiahaog closed 7 years ago

jiahaog commented 7 years ago

Hi, as mentioned by @paradite in #40, it seems like the default parameter specified by the jwilder/nginx-proxy is

DHPARAM_FILE="/etc/nginx/dhparam/dhparam.pem"

https://github.com/jwilder/nginx-proxy/blob/02121df3b914061040df128e8266ccad81ce3046/generate-dhparam.sh#L9

We should have a additional /dhparam as a directory path. I could be missing something here with what is defined as "default" in this case, please let me know otherwise!

jiahaog commented 7 years ago

In any case, even though the nginx.tmpl allows us to override the "default" ssl_dhparam defined at the top with the following snippet:

    {{ if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }}
    ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
    {{ end }}

https://github.com/jiahaog/dinghy-http-proxy/blob/master/nginx.tmpl#L118-L120

This code cannot be executed because I think nginx will first try to read from the top level ssl_dhparam, and fail with a file not found.

BIO_new_file("/etc/nginx/dhparam.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/nginx/dhparam.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
codekitchen commented 7 years ago

Ah I was about to make the same change myself after researching #40, perfect thank you. It looks like the path was changed a while back in the jwilder project here: https://github.com/jwilder/nginx-proxy/commit/dfdd67f5a4606d8c9269d71b14d37f04cde947dd

I'll push out a new version right away. You can force an update with docker pull codekitchen/dinghy-http-proxy:2.5 and then dinghy restart.

jiahaog commented 7 years ago

Cool, thanks a lot for the quick response!