Automated Container For Certs Renewal

[pwdel]

Basically we have a set up wherein we're using an nginx container as our frontend:

https://github.com/openpredictionmarkets/socialpredict/blob/bb5c86e3e351e077a881f26944b1bae61bd795ca/docker-compose.prod.yaml#L28

and so we're able to successfully host on HTTP, however we need to create a sustainable way so that anyone who uses this open source software can have access to automatically renewable SSL certs, perhaps via a certbot container which creates certs that gets mounted to the nginx container via a volume.

See how it's done here for ideas:

https://bitbucket.org/JoeHitchen/gatekeeper/src/master/docker-compose.yml

So essentially, there are two containers which tie into one another:

  nginx:
    image: nginx
    network_mode: host
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./config:/etc/nginx/conf.d
      - ./webroot:/var/www/gatekeeper
      - cert_data:/etc/letsencrypt
      - challenge:/var/www/challenge

  certbot:
    image: certbot/certbot
    volumes:
      - cert_data:/etc/letsencrypt
      - cert_logs:/var/lib/letsencrypt
      - challenge:/var/www/challenge
    command: renew
    depends_on:
      - nginx 

volumes:
  cert_data:
  cert_logs:
  challenge:

Another idea to look at:

https://github.com/SteveLTN/https-portal

[donghj2000]

Hello, Another solution is to use openresty, I have a lua script fulfilling this function, please refer to my rep https://github.com/donghj2000/lua-resty-auto-ssl-for-many-domains

I am familiar with nginx/openresty source code, and I have completed several projects, one is to integrate IOCP to nginx, and another is to migrate openresty to visual studio,please refer to my github.

[donghj2000]

1,I set up https-portal, it works well. 2,But, after I have build your frontend to product and upload to https-portal's static file dir ,it displays nothing,all the static files including html,js etc have been loaded. 3,I have a rough look at frontend code, mayby it has not been finished including api. The frontend is unnecessary to packaged to docker image, it is only to be build by npm to production and copy do nginx(https-portal) static file dir.

[donghj2000]

It‘s ok, my site is https://www.thespxaeettt.buzz, you can access it, and now the ssl cert is for test. Edit vite.config.mjs

build: {
  outDir: 'build',
  commonjsOptions: { transformMixedEsModules: true }
},

then npm run build copy the generated files to https-portal static files dir.

[pwdel]

@donghj2000 hey, thank you so much... I am sorry, I should have turned off hiring on UpWork ... we already got help from @ntoufoudis on this after I had met with him earlier this week.

I am not sure if you were still attempting to bid on this project, or just offering open source code help in general?

Anyway, thank you so much for the information and for letting me know.

OK so I am aware of the frontend issue...which is that, ideally we should be just serving static files with no backend dockerfile to host them. I am going to put together a separate issue about this. For now I'm just trying to slowly build out the site and get the SSL working, and change things so that we have both a well defined dev and prod mode.

Does that make sense? So basically the first step was to host everything with certbot / SSL and ensure we have the proper proof of ownership, then go back in and do optimizations so we are hosting it with static files rather than just merely docker container hosting node sites, which is really more something for development.

So all of that being said... I should ask... are you interested in the software overall? E.g., are you familiar with the concept of prediction markets and do you have another reason for contributing? Or were you mostly interested from trying to contribute and bid from UpWork?

We do have a discord if you are interested to join and talk more there.

https://discord.gg/7JaENX8U