Skip to content

create Apache SSL self signed certificates with environment variable - #644

Closed
marceljd wants to merge 31 commits into
nextcloud:masterfrom
marceljd:apache-ssl
Closed

create Apache SSL self signed certificates with environment variable#644
marceljd wants to merge 31 commits into
nextcloud:masterfrom
marceljd:apache-ssl

Conversation

@marceljd

@marceljdmarceljd commented Feb 8, 2019•
edited
Loading

Copy link
Copy Markdown
Contributor

PR to enable SSL encryption with self-signed certificates on Apache. Multiple SSL related errors will disappear (.well.know autodiscovery, apps not working). For use behind a proxy or in private environments. For Traefik you need to set insecureSkipVerify: true in the traefik.yaml file so the self signed certificates are not rejected. The SSL encryption is activated by an environment variable to prevent existing installations to break. The certificates will be renewed every time the entrypoint script runs.

Please help with testing on different environments (behind Nginx proxy).

To do: the README and examples have to be rewritten.

@marceljd
On branch apache-ssl
76ca17d
 Changes to be committed:
modified: docker-entrypoint.sh
Untracked files:
.config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
5f5274d
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
Untracked files:
.config/000-default.conf
13.0/apache/config/000-default.conf
13.0/fpm-alpine/config/000-default.conf
13.0/fpm/config/000-default.conf
14.0/apache/config/000-default.conf
14.0/fpm-alpine/config/000-default.conf
14.0/fpm/config/000-default.conf
15.0/apache/config/000-default.conf
15.0/fpm-alpine/config/000-default.conf
15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
7d85a64
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Untracked files:
.config/000-default.conf
13.0/apache/config/000-default.conf
13.0/fpm-alpine/config/000-default.conf
13.0/fpm/config/000-default.conf
14.0/apache/config/000-default.conf
14.0/fpm-alpine/config/000-default.conf
14.0/fpm/config/000-default.conf
15.0/apache/config/000-default.conf
15.0/fpm-alpine/config/000-default.conf
15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
fb9aa32
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Untracked files:
.config/000-default.conf
13.0/apache/config/000-default.conf
13.0/fpm-alpine/config/000-default.conf
13.0/fpm/config/000-default.conf
14.0/apache/config/000-default.conf
14.0/fpm-alpine/config/000-default.conf
14.0/fpm/config/000-default.conf
15.0/apache/config/000-default.conf
15.0/fpm-alpine/config/000-default.conf
15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
7594ff3
 Changes to be committed:
modified: 13.0/apache/Dockerfile
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/Dockerfile
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/Dockerfile
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/Dockerfile
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/Dockerfile
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/Dockerfile
modified: 15.0/fpm/entrypoint.sh
modified: Dockerfile-debian.template
modified: docker-entrypoint.sh
Untracked files:
.config/000-default.conf
13.0/apache/config/000-default.conf
13.0/fpm-alpine/config/000-default.conf
13.0/fpm/config/000-default.conf
14.0/apache/config/000-default.conf
14.0/fpm-alpine/config/000-default.conf
14.0/fpm/config/000-default.conf
15.0/apache/config/000-default.conf
15.0/fpm-alpine/config/000-default.conf
15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
9d6413f
 Changes to be committed:
modified: 13.0/apache/Dockerfile
modified: 13.0/fpm/Dockerfile
modified: 14.0/apache/Dockerfile
modified: 14.0/fpm/Dockerfile
modified: 15.0/apache/Dockerfile
modified: 15.0/fpm/Dockerfile
modified: Dockerfile-debian.template
Untracked files:
.config/000-default.conf
13.0/apache/config/000-default.conf
13.0/fpm-alpine/config/000-default.conf
13.0/fpm/config/000-default.conf
14.0/apache/config/000-default.conf
14.0/fpm-alpine/config/000-default.conf
14.0/fpm/config/000-default.conf
15.0/apache/config/000-default.conf
15.0/fpm-alpine/config/000-default.conf
15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
6b0618e
 Changes to be committed:
modified: 13.0/apache/Dockerfile
modified: 13.0/fpm/Dockerfile
modified: 14.0/apache/Dockerfile
modified: 14.0/fpm/Dockerfile
modified: 15.0/apache/Dockerfile
modified: 15.0/fpm/Dockerfile
modified: Dockerfile-debian.template
Untracked files:
.config/000-default.conf
13.0/apache/config/000-default.conf
13.0/fpm-alpine/config/000-default.conf
13.0/fpm/config/000-default.conf
14.0/apache/config/000-default.conf
14.0/fpm-alpine/config/000-default.conf
14.0/fpm/config/000-default.conf
15.0/apache/config/000-default.conf
15.0/fpm-alpine/config/000-default.conf
15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
c451b0b
 Changes to be committed:
new file: .config/000-default.conf
new file: 13.0/apache/config/000-default.conf
new file: 13.0/fpm-alpine/config/000-default.conf
new file: 13.0/fpm/config/000-default.conf
new file: 14.0/apache/config/000-default.conf
new file: 14.0/fpm-alpine/config/000-default.conf
new file: 14.0/fpm/config/000-default.conf
new file: 15.0/apache/config/000-default.conf
new file: 15.0/fpm-alpine/config/000-default.conf
new file: 15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
4b84231
 Changes to be committed:
modified: .config/000-default.conf
modified: 13.0/apache/config/000-default.conf
modified: 13.0/fpm-alpine/config/000-default.conf
modified: 13.0/fpm/config/000-default.conf
modified: 14.0/apache/config/000-default.conf
modified: 14.0/fpm-alpine/config/000-default.conf
modified: 14.0/fpm/config/000-default.conf
modified: 15.0/apache/config/000-default.conf
modified: 15.0/fpm-alpine/config/000-default.conf
modified: 15.0/fpm/config/000-default.conf
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
47fb5c3
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
dce4d20
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
61dee27
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
00b8fd7
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
eaaf485
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
3bee4c0
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
7ee8194
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
c84311c
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
8b4dc27
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
e97df42
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
77d44c5
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
21e5421
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
0924211
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
d74de27
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
a2515d4
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
b9e5b19
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
aeff968
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
b13c578
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
65f2427
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
f3565b1
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
7ba7ccd
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd
On branch apache-ssl
442656c
 Changes to be committed:
modified: 13.0/apache/entrypoint.sh
modified: 13.0/fpm-alpine/entrypoint.sh
modified: 13.0/fpm/entrypoint.sh
modified: 14.0/apache/entrypoint.sh
modified: 14.0/fpm-alpine/entrypoint.sh
modified: 14.0/fpm/entrypoint.sh
modified: 15.0/apache/entrypoint.sh
modified: 15.0/fpm-alpine/entrypoint.sh
modified: 15.0/fpm/entrypoint.sh
modified: docker-entrypoint.sh
Signed-off-by: marceljd <support@dihosting.ch>
@marceljd

marceljd commented Feb 9, 2019•
edited
Loading

Copy link
Copy Markdown
ContributorAuthor

The environment variable you have to add to the docker-compose.yml is:
APACHE_SSL_SELFSIGNED=true

I will change the README and examples as soon as I have some time. Please test this on different environments, I already tested this behind a Traefik proxy and directly on a private host. Sorry for the pile of commits, I know how to prevent it now...

This was referenced Feb 9, 2019
Closed
Closed
Closed
Closed
Closed
@J0WIJ0WI mentioned this pull request Feb 10, 2019
Closed
@J0WI

J0WI commented Feb 10, 2019

Copy link
Copy Markdown
Contributor

This is IMHO to much overhead to work around the problem. We should work with the configuration parameters provided by NextCloud. I hope we can make some progress in nextcloud/server#13713

@kesselb

kesselb commented Apr 2, 2019

Copy link
Copy Markdown
Contributor

  1. Documentation about service discovery: Add service discovery to reverse proxy doc documentation#1297 (IMHO redirects like this should be done by your reverse proxy)

  2. A setup warning if you run nextcloud behind a reverse proxy without trusted_proxies: Warning if x-forwarded-host present but trusted_proxies empty server#14261

  3. To be done: A warning if some required parameters not present (e.g. apache2 does not forward x-forwarded-proto while nginx and traefik does => overwriteproto is required for apache2).

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@marceljd@J0WI@kesselb