feat: add optional letsencrypt tls

nginx/40-configure-tls.sh

@@ -0,0 +1,106 @@
+#!/bin/sh
+set -eu
+
+enabled="${LETSENCRYPT_ENABLED:-0}"
+domain="${LETSENCRYPT_DOMAIN:-azionelab.org}"
+interval="${TLS_RELOAD_INTERVAL_SECONDS:-30}"
+certificate="/etc/letsencrypt/live/${domain}/fullchain.pem"
+private_key="/etc/letsencrypt/live/${domain}/privkey.pem"
+http_config="/etc/nginx/http-enabled/site.conf"
+tls_config="/etc/nginx/tls-enabled/site.conf"
+tls_template="/etc/nginx/templates/tls.conf.template.source"
+base_template="/etc/nginx/templates/default.conf.template.source"
+base_config="/etc/nginx/conf.d/default.conf"
+proxy_routes="/etc/nginx/snippets/proxy-routes.conf"
+
+case "$domain" in
+    "" | *[!A-Za-z0-9.-]* | .* | *. | *..* | -* | *- | *.-* | *-.*)
+        echo "Invalid LETSENCRYPT_DOMAIN: $domain" >&2
+        exit 1
+        ;;
+esac
+
+case "$domain" in
+    *.*) ;;
+    *)
+        echo "LETSENCRYPT_DOMAIN must be a fully qualified domain name." >&2
+        exit 1
+        ;;
+esac
+
+case "$enabled" in
+    0 | 1) ;;
+    *)
+        echo "LETSENCRYPT_ENABLED must be 0 or 1." >&2
+        exit 1
+        ;;
+esac
+
+case "$interval" in
+    "" | *[!0-9]*)
+        echo "TLS_RELOAD_INTERVAL_SECONDS must be a positive integer." >&2
+        exit 1
+        ;;
+esac
+
+if [ "$interval" -eq 0 ]; then
+    echo "TLS_RELOAD_INTERVAL_SECONDS must be a positive integer." >&2
+    exit 1
+fi
+
+certificate_state() {
+    if [ ! -s "$certificate" ] || [ ! -s "$private_key" ]; then
+        echo "missing"
+        return
+    fi
+
+    cksum "$certificate" "$private_key" | cksum | awk '{print $1 ":" $2}'
+}
+
+render_http_only() {
+    printf 'include %s;\n' "$proxy_routes" > "$http_config"
+    rm -f "$tls_config"
+}
+
+render_https() {
+    sed "s|__DOMAIN__|${domain}|g" "$tls_template" > "${tls_config}.tmp"
+    mv "${tls_config}.tmp" "$tls_config"
+    printf 'location ^~ / { return 301 https://$host$request_uri; }\n' > "$http_config"
+}
+
+sed "s|__DOMAIN__|${domain}|g" "$base_template" > "${base_config}.tmp"
+mv "${base_config}.tmp" "$base_config"
+
+if [ "$enabled" != "1" ]; then
+    render_http_only
+    exit 0
+fi
+
+state="$(certificate_state)"
+if [ "$state" = "missing" ]; then
+    render_http_only
+else
+    render_https
+fi
+
+(
+    while sleep "$interval"; do
+        next_state="$(certificate_state)"
+        if [ "$next_state" = "$state" ]; then
+            continue
+        fi
+
+        if [ "$next_state" = "missing" ]; then
+            render_http_only
+        else
+            render_https
+        fi
+
+        if nginx -t; then
+            nginx -s reload
+            state="$next_state"
+        else
+            echo "TLS configuration reload failed; retrying after ${interval}s." >&2
+        fi
+    done
+) &

nginx/Dockerfile

@@ -0,0 +1,10 @@
+FROM nginx:1.30.0-alpine
+
+COPY default.conf /etc/nginx/templates/default.conf.template.source
+COPY proxy-routes.conf /etc/nginx/snippets/proxy-routes.conf
+COPY tls.conf.template /etc/nginx/templates/tls.conf.template.source
+COPY 40-configure-tls.sh /docker-entrypoint.d/40-configure-tls.sh
+
+RUN chmod 755 /docker-entrypoint.d/40-configure-tls.sh \
+    && rm -f /etc/nginx/conf.d/default.conf \
+    && mkdir -p /etc/nginx/http-enabled /etc/nginx/tls-enabled /var/www/certbot

nginx/default.conf

@@ -3,6 +3,11 @@ map $http_upgrade $connection_upgrade {
     "" close;
 }
 
+map $http_x_forwarded_proto $effective_forwarded_proto {
+    default $scheme;
+    https https;
+}
+
 server_tokens off;
 
 upstream wagtail_backend {
@@ -19,31 +24,27 @@ server {
     listen 80 default_server;
     server_name _;
 
-    return 404;
+    location = /nginx-health {
+        access_log off;
+        return 200 "ok\n";
+    }
+
+    location / {
+        return 404;
+    }
 }
 
 server {
     listen 80;
-    server_name azionelab.org;
+    server_name __DOMAIN__;
 
-    client_max_body_size 10m;
-
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection $connection_upgrade;
-
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-
-    location ~ ^/(admin|api|documents|health|media|static)(/|$) {
-        proxy_pass http://wagtail_backend;
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+        default_type text/plain;
+        try_files $uri =404;
     }
 
-    location / {
-        proxy_pass http://astro_frontend;
-    }
+    include /etc/nginx/http-enabled/site.conf;
 }
+
+include /etc/nginx/tls-enabled/*.conf;

nginx/proxy-routes.conf

@@ -0,0 +1,20 @@
+client_max_body_size 10m;
+
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $effective_forwarded_proto;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $connection_upgrade;
+
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+location ~ ^/(admin|api|documents|health|media|static)(/|$) {
+    proxy_pass http://wagtail_backend;
+}
+
+location / {
+    proxy_pass http://astro_frontend;
+}

nginx/tls.conf.template

@@ -0,0 +1,26 @@
+server {
+    listen 443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate /etc/letsencrypt/live/__DOMAIN__/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/__DOMAIN__/privkey.pem;
+    ssl_reject_handshake on;
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name __DOMAIN__;
+
+    ssl_certificate /etc/letsencrypt/live/__DOMAIN__/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/__DOMAIN__/privkey.pem;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    add_header Strict-Transport-Security "max-age=15552000" always;
+
+    include /etc/nginx/snippets/proxy-routes.conf;
+}