configure https on prod-one

(I need to wait 12 - 24 hours from now, with testing this. Because when I was going to add a new DNS server CNAME, Gandi.net first required me to migrate to some new "LiveDNS" something.)

1. About containers and /etc/letsencrypt: If you loook in the docker-compose.yml file: (this is from a test server)

root@ty-test-1cpu-1d7ram-ub1804:/opt/talkyard# cat docker-compose.yml  
...
services:
  web:
    image: $DOCKER_REPOSITORY/talkyard-web:$VERSION_TAG
    # dockerfile: https://github.com/debiki/talkyard/blob/master/docker/web/Dockerfile
    restart: always
    volumes:
      - ./conf/web/server-listen-http.conf:/etc/nginx/server-listen.conf:ro
      - ./conf/web/sites-enabled-manual/:/etc/nginx/sites-enabled-manual/:ro
      - ./data/sites-enabled-auto-gen/:/etc/nginx/sites-enabled-auto-gen/:ro
 ———> - ./data/certbot/:/etc/certbot/:ro                                   <————— look
      - ./data/certbot-challenges/.well-known/:/opt/nginx/html/.well-known/:ro
      - ./data/uploads/:/opt/talkyard/uploads/:ro
      # Mount here so standard monitoring tools looking for Nginx logs will work.
      - /var/log/nginx/:/var/log/nginx/

There you can see that the certs are placed in ./data/certbot/ on the host, which is /opt/talkyard/data/certbot/ (since the current directory ./ is /opt/talkyard/). That's where the certs are to be placed, on the host — and that's why the certbot command above has this flag: --config-dir /opt/talkyard/data/certbot/.

That directory is, via docker-compose.yml, mounted at /etc/certbot/ inside the Nginx container. Therefore it's accessible to Nginx, at the standard /etc/certbot location. (Not /etc/letsencrypt — they renamed the client from Letsencrypt to Certbot and moved to /etc/certbot/)

2. About server-listen.conf — oh seems I forgot one thing. You need to change http to https in docker-compose.yml, look here:

    volumes:
      ...
      - ./conf/web/server-listen-http.conf:/etc/nginx/server-listen.conf:ro

That maps the server-listen-http.conf file, to the server-listen.conf file inside Nginx. And that -listen-http file listens on HTTP port 80:

root@ty-test-1cpu-1d7ram-ub1804:/opt/talkyard# cat ./conf/web/server-listen-http.conf

# The backlog should be the same as net.core.somaxconn in /etc/sysctl.conf,
# set in ../../scripts/configure-ubuntu.sh.

listen 80 backlog=8192;
listen [::]:80 backlog=8192;

You need to edit docker-compose.yml and add a s so becomes: - ./conf/web/server-listen-https.conf:/etc/nginx/server-listen.conf:ro

That file, server-listen-https.conf, listens on HTTPS port 443:

root@ty-test-1cpu-1d7ram-ub1804:/opt/talkyard# cat ./conf/web/server-listen-https.conf

# The backlog should be the same as net.core.somaxconn in /etc/sysctl.conf,
# set in ../../scripts/configure-ubuntu.sh.

listen 443 ssl backlog=8192;
listen [::]:443 ssl backlog=8192;

3. About: "Should I add references about the newly created file forum.yoursite.com.conf somewhere" — when you do this:

nano /opt/talkyard/data/sites-enabled/forum.yoursite.com.conf
nano ./conf/web/sites-enabled-manual/forum.yoursite.com.conf

it gets created in a directory that's mounted inside the Docker Nginx container already, at .... oops now I see I typed the wrong file path, fixed. Then it'll get included automatically, because in the container, it appears here: /etc/nginx/sites-enabled-manual/ and I've configured Nginx to auto-enable all sites in that directory . So you don't need to add it to anywhere else.

4. You also want to redirect HTTP port 80 to HTTPS. Do that (when HTTPS works already) by editing: /opt/talkyard/conf/web/sites-enabled-manual/default-server.conf and comment in this line:

#include /etc/nginx/http-redirect-to-https.conf

(That file is already included in the Docker image, and creates a server at port 80 that redirects everything to 443.)

B.t.w. the plan is that all this be done automatically, in the future. I've created a container, certgen, that later on will generate HTTPS certs as required, and create Nginx config files that loads the certs. (Probably will not happen the nearest 6 months.)