C
C
cyberlain2021-09-08 11:45:15
Nginx
cyberlain, 2021-09-08 11:45:15

How to open a site on docker on the Internet through a specific port?

Hello! Situation: A docker site is running on a VPS. Here is the docker-compose.yml of the container:

version: '2.2'

services:
  postgres:
    image: postgres:12-alpine
    environment:
      - POSTGRES_USER=uzver
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=uzver
    volumes:
      - ./volumes/postgres:/var/lib/postgresql/data
    restart: always

  uzver:
    image: dessalines/uzver:0.12.0
    ports:
      - "127.0.0.1:8536:8536"
    restart: always
    environment:
      - RUST_LOG="warn,uzver_server=info,uzver_api=info,uzver_api_common=info,uzver_api_crud=info,uzver_apub=info,uzver_db_queries=info,uzver_db_schema=info,uzver_db_views=info,uzver_db_views_actor=info,uzver_db_views_moderator=info,uzver_routes=info,uzver_utils=info,uzver_websocket=info"
    volumes:
      - ./uzver.hjson:/config/config.hjson
    depends_on:
      - postgres
      - pictrs

  uzver-ui:
    image: dessalines/uzver-ui:0.12.0
    ports:
      - "127.0.0.1:1235:1234"
    restart: always
    environment:
      - uzver_INTERNAL_HOST=uzver:8536
      - uzver_EXTERNAL_HOST=mypage.tech:8536
      - uzver_HTTPS=false
    depends_on: 
      - uzver

  pictrs:
    image: asonix/pictrs:v0.2.6-r2
    ports: 
      - "127.0.0.1:8537:8080"
    user: 991:991
    volumes:
      - ./volumes/pictrs:/mnt
    restart: always


From within the vps, the site opens fine through port 1235,
then I began to configure firewall rules and opened ports 1235 and 8536

6138757bbfb5e393061338.png

, the site does not open. I checked both http and https and
looked into the project deployment tips and saw that I needed to configure nginx reverse proxy + attached a ready-made config which I used

/etc/nginx/sites-enabled/uszer.conf

limit_req_zone $binary_remote_addr zone=uzver_ratelimit:10m rate=1r/s;

server {
    listen 80;
    listen [::]:80;
    server_name mypage.tech;
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mypage.tech;

    ssl_certificate /etc/letsencrypt/live/mypage.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mypage.tech/privkey.pem;

    # Various TLS hardening settings
    # https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_session_timeout  10m;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;

    # Hide nginx version
    server_tokens off;

    # Enable compression for JS/CSS/HTML bundle, for improved client load times.
    # It might be nice to compress JSON, but leaving that out to protect against potential
    # compression+encryption information leak attacks like BREACH.
    gzip on;
    gzip_types text/css application/javascript image/svg+xml;
    gzip_vary on;

    # Only connect to this site via HTTPS for the two years
    add_header Strict-Transport-Security "max-age=63072000";

    # Various content security headers
    add_header Referrer-Policy "same-origin";
    add_header X-Content-Type-Options "nosniff";
    add_header X-Frame-Options "DENY";
    add_header X-XSS-Protection "1; mode=block";

    # Upload limit for pictrs
    client_max_body_size 20M;

    # frontend
    location / {
      # The default ports:
      # uzver_ui_port: 1235
      # uzver_port: 8536

      set $proxpass "http://0.0.0.0:1235";
      if ($http_accept = "application/activity+json") {
        set $proxpass "http://0.0.0.0:8536";
      }
      if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
        set $proxpass "http://0.0.0.0:8536";
      }
      if ($request_method = POST) {
        set $proxpass "http://0.0.0.0:8536";
      }
      proxy_pass $proxpass;

      rewrite ^(.+)/+$ $1 permanent;

      # Send actual client IP upstream
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # backend
    location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
      proxy_pass http://0.0.0.0:8536;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      # Rate limit
      limit_req zone=uzver_ratelimit burst=30 nodelay;

      # Add IP forwarding headers
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }


    # Redirect pictshare images to pictrs
    location ~ /pictshare/(.*)$ {
      return 301 /pictrs/image/$1;
    }

}

# Anonymize IP addresses
# https://www.supertechcrew.com/anonymizing-logs-nginx-apache/
map $remote_addr $remote_addr_anon {
  ~(?P<ip>\d+\.\d+\.\d+)\.    $ip.0;
  ~(?P<ip>[^:]+:[^:]+):       $ip::;
  127.0.0.1                   $remote_addr;
  ::1                         $remote_addr;
  default                     0.0.0.0;
}
log_format main '$remote_addr_anon - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;


The site is not visible on the Internet. What to do?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question