HTTPS certifcates in Docker image

[awatkins1966]

Hi,
I am looking at depolying the docker image to use for students.
I would prefer to use the Docker image for easy of admin use, but failing to get the URL working with HTTPS.
Is there a way of using the docker image with HTTPS certifcates?

I have tried to altering the wait-for-backend.sh as a quick and dirty fix but that did not work.
i.e.
exec gunicorn --worker-tmp-dir $worker_tmp_dir --workers $workers --threads $threads --worker-class $worker_class --access-logfile /usr/src/app/logs/access_gunicorn.log --log-level $log_level --bind 0.0.0.0:5000 --certfile /usr/src/app/data/server.crt --keyfile /usr/src/app/data/server.key --ssl-version 3 webtool:app

Any ideas? Thanks
Andrew

[dale-wahl]

The best way would be to run Nginx or Apache and have it serve 4CAT. You can run it on your host server and point it to the exposed frontend container port. It also would be possible to run either in a separate container and connect that container to 4CAT (but I have not personally done that). Gunicorn itself recommends Nginx.

[stijn-uva]

Once you set this up, note that you can further configure 4CAT to take various proxy headers into account via Control Panel -> Settings -> Flask settings -> Use proxy headers for URL.

[awatkins1966]

Thanks,

Got there in the end.

1. You need to install nginx server
2. Change the TELEGRAM_PORT in docker-compose.yml & .env

worker_processes 1;
#
events { worker_connections 1024; }
#
http {
    sendfile on;
    large_client_header_buffers 4 32k;
    #
    upstream web-api {
        server 4cat:8888;
    }
 #
    server {
        listen 80;
        server_name site;
        #
        location / {
            return 301 https://$host$request_uri;
        }
    }
    server {
        listen 443 ssl;
        server_name 4cat.dcs.bbk.ac.uk;
        #
        ssl_certificate /etc/nginx/ssl/4cat.crt;
        ssl_certificate_key /etc/nginx/ssl/4cat.key;
        location / {
            proxy_pass         http://web-api;
            proxy_redirect     off;
            proxy_http_version 1.1;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection keep-alive;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   X-Forwarded-Host $server_name;
            proxy_buffer_size           128k;
            proxy_buffers               4 256k;
            proxy_busy_buffers_size     256k;
        }
    }
}

#grep TEL docker-compose.yml .env
docker-compose.yml:      - ${TELEGRAM_PORT}:444
.env:TELEGRAM_PORT=444

The above is important since if you leave the TELEGRAM_PORT as the default it will fail with:
May 07 17:23:51 4cat nginx[2286336]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Unknown error)
May 07 17:23:51 4cat nginx[2286336]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Unknown error)
May 07 17:23:52 4cat nginx[2286336]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Unknown error)
May 07 17:23:52 4cat nginx[2286336]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Unknown error)

I was thought the Docker way would be the best way of doing it, but having second thoughts now.

Thanks,
Andrew

[dale-wahl]

Thank you for sharing the nginx configuration. That may help someone in the future. We recommend using Nginx (or Apache) regardless of using Docker for both performance and security if you plan on serving it to multiple users and/or at a public domain.

All Docker exposed ports are set in the .env file and you should only need to edit that file to make changes on what is exposed on the host machine. The docker-compose.yml file is mapping the external port (set in .env and inserted at ${TELEGRAM_PORT}) on the host server to the internal port used in the 4CAT local network. I am not sure that the Telegram datasource will work now having changed the port in the docker-compose.yml, but the telethon library is the only thing that would be effected by that change.