Use certbot container for letsencrypt certificates

- add certbot container to docker-compose - bind mount www path for certbot/nginx to use it in webroot mode - bind mount certboot cnf path to allow nginx find the certificates Fixes: - remove location /cloud-init as per review - remove NGINX_ARTIFACTS_SSL_PATH variable . Will use multiple domain names in PROD also. - adapt bb and ci NGINX conf files to handle the acme challenge on port 80 - fix generate-config to avoid exposing nginx env variables to other containers other than nginx
MariaDB · Oct 14, 2024 · c82491b · c82491b
1 parent 9f8f1bc
commit c82491b
Show file tree

Hide file tree

Showing 6 changed files with 42 additions and 62 deletions.
diff --git a/docker-compose/.env b/docker-compose/.env
@@ -7,7 +7,6 @@ MASTER_PACKAGES_DIR="/mnt/autofs/master_packages"
 GALERA_PACKAGES_DIR="/mnt/autofs/galera_packages"
 ARTIFACTS_URL="https://ci.mariadb.org"
 NGINX_ARTIFACTS_VHOST="ci.mariadb.org"
-NGINX_ARTIFACTS_SSL_PATH="ci.mariadb.org"
 NGINX_BUILDBOT_VHOST="buildbot.mariadb.org"
 ENVIRON="PROD"
 BRANCH="main"

diff --git a/docker-compose/.env.dev b/docker-compose/.env.dev
@@ -8,7 +8,6 @@ MASTER_PACKAGES_DIR="/mnt/autofs/master_dev_packages"
 GALERA_PACKAGES_DIR="/mnt/autofs/galera_dev_packages"
 ARTIFACTS_URL="https://ci.dev.mariadb.org"
 NGINX_ARTIFACTS_VHOST="ci.dev.mariadb.org"
-NGINX_ARTIFACTS_SSL_PATH="buildbot.dev.mariadb.org"
 NGINX_BUILDBOT_VHOST="buildbot.dev.mariadb.org"
 ENVIRON="DEV"
 BRANCH="dev"

diff --git a/docker-compose/docker-compose.yaml b/docker-compose/docker-compose.yaml
@@ -52,15 +52,15 @@ services:
       - /srv/buildbot/packages:/srv/buildbot/packages:ro
       - /srv/buildbot/galera_packages:/srv/buildbot/galera_packages:ro
       - /srv/buildbot/helper_files:/srv/buildbot/helper_files:ro
-      - /etc/letsencrypt/live:/etc/nginx/ssl:ro
       - ./logs/nginx:/var/log/nginx
+      - ./certbot/www/:/var/www/certbot/:ro
+      - ./certbot/conf/:/etc/nginx/ssl/:ro
     ports:
       - "443:443"
       - "80:80"
     environment:
       - NGINX_ARTIFACTS_VHOST
       - NGINX_BUILDBOT_VHOST
-      - NGINX_ARTIFACTS_SSL_PATH
     extra_hosts:
       - "hz-bbw5=127.0.0.1"
     networks:
@@ -71,6 +71,12 @@ services:
       options:
         tag: "bb-nginx"
 
+  certbot:
+    image: certbot/certbot:latest
+    volumes:
+      - ./certbot/www/:/var/www/certbot/:rw
+      - ./certbot/conf/:/etc/letsencrypt/:rw
+
   master-web:
     image: quay.io/mariadb-foundation/bb-master:master-web
     restart: unless-stopped
@@ -90,9 +96,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=8010
       - TITLE
       - TITLE_URL
@@ -127,9 +130,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=9996
       - TITLE
       - TITLE_URL
@@ -170,9 +170,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=9997
       - TITLE
       - TITLE_URL
@@ -212,9 +209,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=9998
       - TITLE
       - TITLE_URL
@@ -254,9 +248,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=9999
       - TITLE
       - TITLE_URL
@@ -296,9 +287,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10000
       - TITLE
       - TITLE_URL
@@ -338,9 +326,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10001
       - TITLE
       - TITLE_URL
@@ -380,9 +365,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10002
       - TITLE
       - TITLE_URL
@@ -422,9 +404,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10003
       - TITLE
       - TITLE_URL
@@ -464,9 +443,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10004
       - TITLE
       - TITLE_URL
@@ -506,9 +482,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10005
       - TITLE
       - TITLE_URL
@@ -548,9 +521,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10006
       - TITLE
       - TITLE_URL
@@ -590,9 +560,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10007
       - TITLE
       - TITLE_URL
@@ -632,9 +599,6 @@ services:
       - MASTER_NONLATENT_DOCKERLIBRARY_WORKER
       - MASTER_PACKAGES_DIR
       - MQ_ROUTER_URL
-      - NGINX_ARTIFACTS_SSL_PATH
-      - NGINX_ARTIFACTS_VHOST
-      - NGINX_BUILDBOT_VHOST
       - PORT=10008
       - TITLE
       - TITLE_URL

diff --git a/docker-compose/generate-config.py b/docker-compose/generate-config.py
@@ -78,15 +78,15 @@
       - /srv/buildbot/packages:/srv/buildbot/packages:ro
       - /srv/buildbot/galera_packages:/srv/buildbot/galera_packages:ro
       - /srv/buildbot/helper_files:/srv/buildbot/helper_files:ro
-      - /etc/letsencrypt/live:/etc/nginx/ssl:ro
       - ./logs/nginx:/var/log/nginx
+      - ./certbot/www/:/var/www/certbot/:ro
+      - ./certbot/conf/:/etc/nginx/ssl/:ro
     ports:
       - "443:443"
       - "80:80"
     environment:
       - NGINX_ARTIFACTS_VHOST
       - NGINX_BUILDBOT_VHOST
-      - NGINX_ARTIFACTS_SSL_PATH
     extra_hosts:
       - "{cr_host_wg_addr}"
     networks:
@@ -97,6 +97,12 @@
       options:
         tag: "bb-nginx"
 
+  certbot:
+    image: certbot/certbot:latest
+    volumes:
+      - ./certbot/www/:/var/www/certbot/:rw
+      - ./certbot/conf/:/etc/letsencrypt/:rw
+
   master-web:
     image: quay.io/mariadb-foundation/bb-master:master-web
     restart: unless-stopped
@@ -170,7 +176,9 @@ def generate_volumes(volumes, indent_level=2):
 def construct_env_section(env_vars):
     env_section = "    environment:\n"
     for key, value in sorted(env_vars.items()):
-        if key != "PORT":
+        if key.startswith("NGINX_"):
+            continue
+        elif key != "PORT":
             env_section += f"      - {key}\n"
         else:
             env_section += f"      - {key}={value}\n"

diff --git a/docker-compose/nginx/templates/bb.conf.template b/docker-compose/nginx/templates/bb.conf.template
@@ -1,8 +1,16 @@
 server {
 	listen      80;
 	listen      [::]:80;
-	server_name ${NGINX_BUILDBOT_VHOST};
-	return      301 https://$server_name$request_uri;
+
+	server_name ${NGINX_BUILDBOT_VHOST} www.${NGINX_BUILDBOT_VHOST};
+	server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$server_name$request_uri;
 }
 
 
@@ -22,8 +30,8 @@ server {
 
 	# SSL configuration
 	# ssl on; Deprecated in newer versions of NGINX (yields nginx: [emerg] unknown directive "ssl )
-	ssl_certificate /etc/nginx/ssl/${NGINX_BUILDBOT_VHOST}/fullchain.pem; # managed by Certbot
-	ssl_certificate_key /etc/nginx/ssl/${NGINX_BUILDBOT_VHOST}/privkey.pem; # managed by Certbot
+	ssl_certificate /etc/nginx/ssl/live/${NGINX_BUILDBOT_VHOST}/fullchain.pem; # managed by Certbot
+	ssl_certificate_key /etc/nginx/ssl/live/${NGINX_BUILDBOT_VHOST}/privkey.pem; # managed by Certbot
 	# put a one day session timeout for websockets to stay longer
 	ssl_session_cache   shared:SSL:10m;
 	ssl_session_timeout 1d;

diff --git a/docker-compose/nginx/templates/ci.conf.template b/docker-compose/nginx/templates/ci.conf.template
@@ -1,8 +1,15 @@
 server {
 	listen      80;
 	listen      [::]:80;
-	server_name ${NGINX_ARTIFACTS_VHOST};
-	return      301 https://$server_name$request_uri;
+	server_name ${NGINX_ARTIFACTS_VHOST} www.${NGINX_ARTIFACTS_VHOST};
+	server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$server_name$request_uri;
 }
 
 # Build artifacts location
@@ -19,11 +26,6 @@ server {
 	location /galera {
 		alias /srv/buildbot/galera_packages;
 	}
-  #FIX ME - Still needed? Not present in DEV.
-	# location /cloud-init {
-	# 	alias /srv/buildbot/cloud-init;
-	# 	autoindex off;
-	# }
 	location = /favicon.ico {
 		access_log off;
 	}
@@ -49,8 +51,8 @@ server {
 
 	# SSL configuration
 	# ssl on;
-	ssl_certificate /etc/nginx/ssl/${NGINX_ARTIFACTS_SSL_PATH}/fullchain.pem;
-	ssl_certificate_key /etc/nginx/ssl/${NGINX_ARTIFACTS_SSL_PATH}/privkey.pem;
+	ssl_certificate /etc/nginx/ssl/live/${NGINX_BUILDBOT_VHOST}/fullchain.pem;
+	ssl_certificate_key /etc/nginx/ssl/live/${NGINX_BUILDBOT_VHOST}/privkey.pem;
 	ssl_protocols TLSv1.1 TLSv1.2;
 
 	# Force https - Enable HSTS