ZeroSSL-域名SSL配置说明 · 淡水鱼的蔚蓝之海

待完善，先记录下，好不容易理清楚我干了什么

起因

收到了ZeroSSL证书即将过期的通知

于是不得不回顾下当时搞了啥

流水线配置

先看下流水线干了啥

variables:
  VITE_API_URL: "https://49.235.142.226:8701/api"

stages: # List of stages for jobs, and their order of execution
  - build
  - test
  - deploy

docker-build-job:
  stage: build
  tags: [ nancy ]
  script:
    - docker build --build-arg VITE_API_URL="$VITE_API_URL" -t front:latest -f INeedGithub/Dockerfile INeedGithub
    - docker save -o front.tar front:latest
  artifacts:
    untracked: true


unit-test-job-data-center:
  stage: test
  script:
    - echo "Running unit tests for data-center... This will take about 10 seconds."

lint-test-job: # This job also runs in the test stage.
  tags: [ nancy ]
  stage: test # It can run at the same time as unit-test-job (in parallel).
  script:
    - echo "Linting code... This will take about 10 seconds."
    - sleep 1
    - echo "No lint issues found."

deploy-job:
  tags: [ nancy ]
  stage: deploy
  environment:
    name: production
  script:
    - sshpass -p "$APP_SERVER_PWD" scp -o StrictHostKeyChecking=no front.tar ubuntu@"$APP_SERVER_IP":~
    - sshpass -p "$APP_SERVER_PWD" ssh -o StrictHostKeyChecking=no ubuntu@"$APP_SERVER_IP" 'docker container rm -f front-v2; docker load -i front.tar; docker run -d --name front-v2 -p 8700:80 -p 8701:443 -v /usr/share/mynginxconf/certificate.crt:/etc/nginx/ssl/your_domain.crt -v /usr/share/mynginxconf/private.key:/etc/nginx/ssl/your_domain.key front:latest /bin/bash -c "nginx; tail -f /dev/null"'

主要是

deploy-job:
  tags: [ nancy ]
  stage: deploy
  environment:
    name: production
  script:
    - sshpass -p "$APP_SERVER_PWD" scp -o StrictHostKeyChecking=no front.tar ubuntu@"$APP_SERVER_IP":~
    - sshpass -p "$APP_SERVER_PWD" ssh -o StrictHostKeyChecking=no ubuntu@"$APP_SERVER_IP" 'docker container rm -f front-v2; docker load -i front.tar; docker run -d --name front-v2 -p 8700:80 -p 8701:443 -v /usr/share/mynginxconf/certificate.crt:/etc/nginx/ssl/your_domain.crt -v /usr/share/mynginxconf/private.key:/etc/nginx/ssl/your_domain.key front:latest /bin/bash -c "nginx; tail -f /dev/null"'

这部分涉及我当时docker都搞了些啥，OK

1. 将docker内的80和443分别映射到了服务器的8700和8701
2. 配置文件从本机/usr/share/mynginxconf/certificate.crt和/usr/share/mynginxconf/private.key映射过去

前端容器内的nginx.conf

user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    keepalive_timeout 65;
    client_max_body_size 100m;

    server {
        listen 80;

        location / {
            root /app;
            try_files $uri $uri/ /index.html;
        }

        location /api/ {
            proxy_pass http://<后端服务器ip>:8080/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }

    server {
        listen 443 ssl;

        ssl_certificate /etc/nginx/ssl/your_domain.crt;
        ssl_certificate_key /etc/nginx/ssl/your_domain.key;

        location / {
            root /app;
            try_files $uri $uri/ /index.html;
        }

        location /api/ {
            proxy_pass http://<后端服务器ip>:8080/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }

}

renew过程

To Be Co