HTTPS-Portal: Automated HTTPS server powered by Nginx, Let’s Encrypt and Docker
github.com
github.com
- If you use DNS for a blue-green deployment, traefik does not honor DNS ttls (because it uses the DNS of go and go might do some caching) so when you do the switch you might still end on the "old" environment
- An error on one of the cool feature: serving error page when your backend returns some HTTP code
- Some configuration options are not documented (but easily found using github search)
I still love this software and I will keep looking at it.
https://github.com/golang/go/blob/541f9c0345d4ec52d9f4be5913...
I do this exact thing with Traefik, Consul, and some various miscellaneous services that don't fall under the dynamically-discovered umbrella when they might run under k8s or nomad. I write a value to Consul with the desired Host: match, a backend server to route requests to, and Traefik will handle routing to any backend server it can reach without restarts or interrupting service.
Compose files can be; however they're used in conjunction with Docker Swarm - and when this is done, certain features are made available while others are not. Networks would be used in this case rather than the `link` directive.
Honestly though, I would probably use Heroku for deploying little apps like this. The Compose CLI’s sweet spot is development environments.
Edit: There are even official docs for this https://docs.docker.com/compose/production/
docker swarm init
docker stack deploy -c docker-compose.yml
As another commenter mentioned - there's often confusion on using Docker in development vs. production. I think this comes up a lot since people always talk about how "Use the same image everywhere!" when that's not always the case. In development you may be using bind-mounts and attaching your working directory into the container so you can actually edit your files, you may be running the application with nodemon (Or your langauge-equivalent) to monitor changes, or do whatever it is your application needs, maybe you have separate Dockerfile's as you want a more slimmed down Production image. But the idea is more that you bring the dev/production parity closer not necessarily identical. You can now ensure all your developing teams are using the same version of your language, and that things are configured exactly the same, and when you do go into Production - that when the image is built, it will run exactly the same on your CI server as it does in on your Production node. It allows for more consistency. But things aren't necessarily 100% the same between development and production.
The project has a very poor history of bad decisions.
your comment however paints a different picture... if you know other examples, please enlighten us.
My issues are:
- that problem was caused not by a 'bug' but by a deliberate decision that the author made, and defended. I wouldn't use the term 'back peddled' so much though: Even after relenting and changing the allowed expiry window, the behaviour was essentially the same, albeit with a smaller failure window. AFAIK Caddy to this day won't start with a valid certificate if it can't renew it, if the expiry is within 7 days.
- before the TLS-SNI-01 challenge was disabled on the LE side, Caddy's behaviour was to randomly select a challenge to use. When I questioned the author about this his response was "oh well that would be too much load for LE". The problem there is that the ACME protocol handles this exact scenario - you query the ACME server to find out which of the challenges you want to use, it will allow you to continue with. As I pointed out at the time, I personally wasn't aware of this before the TLS-SNI issue, but as demonstrated by his response, neither was he. If his project's entire reason for being is registering certs via ACME, wouldn't you expect him to know the basic information/control flow when requesting a cert?
- the author has no apparent concept or understanding of 'separation of concerns' - apparently anything that isn't a single file go binary is all too much for the world to bare, regardless of the disastrous results his approach has given the world. I'm all for competing approaches to solving a problem, but when someone essentially ignores any competing approach that doesn't fit their existing narrative of "I have the sole solution to this problem", it's not a sign of someone who is really interested in solving the problem, it's someone interested in pushing their solution. That's fine for a salesman, I guess. Not so much for an 'engineer'.
Edit:
- the 'ads via headers' stunt was just plain weird and creepy, and shows that the author and his partners have no real sense for business. This is demonstrated in their 'Basic' paid support, which states: "We usually respond within 1-2 business days.". USUALLY!? You're paying $25 a month per instance, so you.. I dunno, don't have to install certbot once, and your support response timeframe includes the term "usually". Sweet fucking Jesus.
But recently though, I grew tired of handling 2 or more docker images, then I discovered https://github.com/Valian/docker-nginx-auto-ssl. One image, sets up in a single command without volume sharing complexity of jwilder/nginx-proxy. One caveat though is the larger cpu overhead (from lua) when handling high volume or high reqs/sec.
If you want to serve Microservices from a common host name as if they were a single application, e.g. for public users of an API, you need some sort of mapping between internal and external URLs.
Service discovery is another approach but that's probably only applicable to internal service usage.
At least you'd have to send an additional request, e.g. instead of just calling
https://someserviceprovider.com/serviceA
you'd first have to call
https://someserviceprovider.com/serviceA
which for example would return
{ "url": "https://someserviceprovider.com:8081", "auth_token": "..." }
and only then could you call the actual service under https://someserviceprovider.com:8081
> By using it, you can run any existing web application over HTTPS, with only one extra line of configuration.
You can do authentication, ssl, authorization etc. all in one place.
Downsides:
- difficult to scale
- no deep defense
- CSRF exposure because applications are not separated by domain
I’m having good experiences with this approach
From the point of view of SSL, they make it easy to bolt SSL support onto existing infrastructure with minimal changes to everything else.
In some cases the separation of duties is useful too: if I change the back-end of one of my applications from Apache+PHP on one server to a new implementation in node.js elsewhere, I don't have to worry about implementing SSL (and caching if the proxy is also used for that purpose) in the new implementation or even needing to change DNS and other service pointers, I can just direct the proxy to the new end-point(s).
For larger organisations (or individual projects) this separation of responsibility might also be beneficial for human resource deployment and access control: keeping the proxy within the security/infrastructure team for the most part and the app deployment/development with specific teams.
> They are unnecessary in most cases
I agree. But that doesn't necessarily mean they are not beneficial in a number of cases.
> and bring more conplexity
Though also spread out that complexity, which can help in the management of scaling up and the maintenance of larger scale once there.
Obviously the utility of this very much depends on the project/team/organisation - it is very much a "your mileage will vary" situation.
It would be nice to have one in Go or Rust if it had all of nginx' features, performance and documentation/community support.
- SSL: You can put a bunch of things behind a reverse proxy and you can put all your SSL stuff in one place, which makes it a lot easier to deal with, secure and manage.
- Load balancing: If your application needs more than one host, you need some way of distributing requests to multiple hosts. A reverse proxy is one of the easiest ways of achieving this (and comes with above SSL handling as well)
- Caching: They can be very good for caching dynamic but rarely changing resources like news articles. They can also take care of requests for static assets so that your application servers don't have to.
- Multiple apps on a single IP: At the other end of the spectrum, if you have for example a home server, only one application can listen on a given port and you might want to run multiple applications responding to different hostnames. A reverse proxy lets you do this.
I trust nginx to do the right thing, more than some other application.
# setcap cap_net_bind_service=+ep /usr/sbin/httpd
You should never run servers with privileges, period.
For httpd this may not matter as much because it's only used as a serve. But if you use node, giving all node scripts the ability to bind to a low port is uncomfortable.
Can do (improvements here) with little to no change to (existing app) is the recurring pattern.
I've authored a similar Docker image with less features: https://github.com/DanielDent/docker-nginx-ssl-proxy
(Although lately I've been finding my cookie-or-IP-or-HTTP-basic auth feature extremely useful in development, which this doesn't seem to have from the README)
It hasn't been updated in a while, but I've also got an automatic service discovered based version of this for Rancher 1.6:
A year later I overheard someone say thank god that thing was dockerized because I was absolutely not looking forward to installing all those dependencies just for a typo fix.
That’s one of the areas where docker shines: app delivery.
With docker, you can just ignore all that. As long as there is a single person capable of updating the dependencies on a single machine with docker, it'll work the same everywhere, always.
Every member of team will need to run same version of Fedora directly or in Vagrant or in (ta-da) docker container.
From my experience, it turned out that for small Dockerfile's, RPM packages are unnecessary burden, so usually I just start with just docker. But later, when Dockerfile growths, it much harder to track dependencies and installation instructions, when they are interleaved, so it much easier to return to individually packaged programs and replace almost whole content of Dockerfile with single "dnf install meta-package" command.
Hm, I'm pretty sure I can take any Go project out there and build it in a matter of minutes on my current OS (depending on the build time of course). Just a matter of setting the environment on the right compiler binary and retrieving dependencies (which just came better 2 weeks ago with 1.11's modules).
I'm pretty sure too I'll very quickly run into dependencies hell by picking randoms ruby/python programs. Just take a look at that SO question: https://stackoverflow.com/questions/2812471/is-there-a-pytho....
Interpreted languages have their uses, of course, but there's a clear difference in both ease of deployment and development between the realms of interpreted languages (Ruby/Python/PHP/etc.), VM/IL/JIT based languages (JVM/.NET/etc.) and 'plain old' compiler based languages (C/C++/Rust/Go/etc.).
> In fact build awkwardness is orthogonal to static vs dynamic typing.
I said "interpreted languages' ecosystems", not "dynamically typed languages". I think you're mixing concepts here (or just maybe you're adding info not directly related to my comment).
You said at first "Dev builds are just as annoying with Golang as Ruby or Python" and now you're saying "I can build any python [...] I can't do that with [...] Ruby"?
It seems like you think there's a "build process" with Go because you're accustomed to python/pyenv (or whatever is your env manager of choice), in which cas you need to known that there's no such thing with Go.
The two following course of actions are the same: - "apt-get docker; docker pull {project-url}; docker start {project-url}" - "apt-get golang; git pull {project-url}; go run .go" (the last Go 1.11 will take care of dependencies at build time)
You can't as easily do "apt-get python; git pull {url}; python .py", unless the program is really simple, because there's such questions as "python2 or 3?" or "pyenv, virtualenv or anaconda?", obligatory XKCD here: https://xkcd.com/1987.
But it's totally ok not to bother learning the compilation command of a given project's language and rely on Docker, really I'm ok with that, doing it myself from time to time. My initial point was on app delivery to final users.
"apt install python3 python3-pipenv; git pull {url}; pipenv sync; python3 .py"
pipenv sync sets up a virtual env and pulls all the dependencies.
Which is exactly how it works in Python.
I'm pretty sure too I'll very quickly run into dependencies hell by picking randoms ruby/python programs. Just take a look at that SO question:
That SO question is about a tool for "setting the environment on the right compiler binary and retrieving dependencies". But you can also do it manually just fine; that's how I usually did it, in fact. Just retrieve the dependencies to a directory and call Python with PYTHONPATH set to it.
Pyenv is essentially the same as Go's new modules tool, it's just not called through the same binary as the interpreter/compiler.
Interpreted languages have their uses, of course, but there's a clear difference in both ease of deployment and development between the realms of interpreted languages (Ruby/Python/PHP/etc.), VM/IL/JIT based languages (JVM/.NET/etc.) and 'plain old' compiler based languages (C/C++/Rust/Go/etc.).
Yes; with Python, you can both run directly from source without wasting time compiling after each change, or you can produce a standalone binary (dependent only on libc) for distribution, using a tool like PyInstaller. Plain old compiled based languages are much more limited.
As I said, interpreted languages have their uses, of course. My initial point was about delivery to end users.
What makes us successful as software engineers, in the end (and IMHO), is the efficiency level at which we reach our goals. To my eyes, when deliverability is the goal, then a language where native (cross)compilation is first class citizen is the most efficient path. But don't get me wrong, Python is really great and still a good choice for that scenario (I'm thinking of dropbox, for ex).
From this description it seems to solve the same issue.
I could imagine something like environment variables, but on the other hand that's something I've learned not to keep in version control, and putting it in docker would be exactly that, no?
It's not, it solves a different issue. If you only have Python as dependency, requirements.txt are fine (well, user needs to install correct version of Python, pip and virtualenv / pipenv, but that's doable). But as soon as your app is actually composed of nginx / apache, python, some background process in Rust, bash scripts for cron jobs,... then you have a problem with app delivery, which Docker solves nicely. Just package eveything in a Dockerfile and distribute the image. Bonus point: you can now test it locally, with the same installation.
I jumped on Docker wagon very early for this exact reason. I don't care about hype, but it does solve these kinds of problems.
You can't put postgres, memcached, imagemagick in requirement.txt, can you?
> Why is docker better than virtualenv with a requirements.txt file
One of issues that `docker-compose build` solves better is that venv is superconfusing to your non-python users. I've had people:
- skip it and do `python setup.py install` instead - skip it and install requirements globally `pip install -r requirements.txt` because thats how it worked for them last time they used python - version control their `venv` directory - backup and upload their `venv` directory on new server when moving
Now they just do `./appctl setup` that asks them for few things, writes `setup.env` file for docker-compose, and then runs `docker-compose build`
But this is only beginning. Thanks to `docker-compose` that `build` step also installs:
- PostgreSQL database - Redis for caching and message queue - UWSGI - Celery - Nginx proxy
https://nickjanetakis.com/blog/setting-up-a-python-developme...
The TL;DR is a typical web app is often a lot more than just running Python, and there's a huge amount of value in being able to run the same code across different operating systems without any installation changes.
When thinking about it that way, it's the pre-docker world that seems unnecessarily dangerous -- Why would you just let some random process run on your system with all it's dependencies and possibly cause havoc without containerizing it?
Unfortunately it's a little bit annoying because the lxd docs don't make it easy to find what they define as a "system image" -- do you have some links to more more good layouts? I actually found a good talk from DebConf '17[1].
I still need VMs for some things, especially when the kernel of the host is too old or missing modules I need or when I need to mount things via FUSE (or similar ops).
For example, it lets you run software on your computer without worrying about installing stuff that might affect other software, and without even having any interactions with other software aside from what you allow it.
[-] Until it has an external dependency and then it breaks, which is where docker turns out to be rather fragile by comparison.
Docker solves this nicely. Apart from the kernel you take all dependencies with you.
In this case, it provides an easy installation of all the dependencies in a single command, while still allowing for customizations, and all in a standard way. Not to mention that certificates and similar are all solved.
Forget about hype and just try Docker. It's a tool like any other. It can be abused, sure, but it's useful too and it's here to stay.
EDIT: difference between Java and Docker is that containers depend on kernel capabilities, not on some 3rd party JAR maintainers. In my experience Docker simply works unless you are doing something really weird.
What has really sold me is more the orchestration side, with docker-compose allowing us to easily launch a whole fleet of independent services. I assume swarm and kubernetes etc., make this even better. It's really this that lets us decompose our software into finer grained independent components which has a number of other benefits. I don't think we could manage it otherwise.
If you want to protect yourself from breaking dependencies, mirror them locally, and use a network-isolated docker build to verify you've actually got everything you need.
I'm a front end dev, and at my latest contract I wanted to help out our back end developers with some .NET stuff. Can you imagine trying to setup a full .NET stack on a Macbook a few years ago? This time what I had to do was:
* install Docker * install Visual Studio Community and .NET Core * run docker-compose ... up
Then I had their entire .NET software stack up and running, including MSSQL, ElasticSearch, Kibana, redis, all with one command.
I don't like doing DevOps personally, but I definitely appreciate how Docker helps me in situations like this!
Differently people use Docker differently, I see Docker could be useful for several purposes:
1) scalability This is the main advertisement point for Docker I guess. Well it enables your stateless application to scale automatically.
2) being able to deploy without caring about dependencies There are times we want to deploy something into customers' servers. We have no control over their machines' environments. But with Docker, the only thing I need to make sure is that they have it installed.
3) Infrastructure as code All our source code is checked in git and version controlled nicely. When we need to run it again, just clone from git. How nice! But our infrastructure, meaning server formation and service relationship? Not so much. Before using Docker, we basically need to ssh into servers and install dependencies according to the documents. It was not only slow, but unreliable because we all know how documents can lie. With Docker and docker-compose, the infrastructure can be written in code and checked in git. Most importantly, code doesn't lie.
You can surely use other tools to achieve those. I'm not saying Docker is the only way. But I believe it's a good tool to consider when you have those needs.
There's an entire cottage industry of not-docker tools for that. Not to take anything from docker but the options aren't 'docker' and 'the pre-docker dark ages where you ssh'ed into servers one by one and carefully typed commands from a faded printout'.
Not the least of which are the distros own packaging systems (e.g. rpm/yum or dpkg/apt). Full investment in the complexity of the ecosystem isn't even necessary for basic dependency handling.
I never understood how creating the tight dependancy between the host and the docker image is not a problem.
But using docker has been an eye-opener. I can now get my front end developer to have a fully working database, queue, API server running with a simple `npm run docker`. They are free to develop the UI without having to worry about the underlying stack. I am free to change that stack without having to worry about telling them what commands to run on their laptop to get it up to date.
As we add more services, such as email sending, image processing, video compression, it wont require anything special to configure from the front end perspective.
We're now moving it into the cloud and are now seeing the benefits of Kubernetes with our docker containers to deploy, have a blue/green deployment, not worry so much about what the servers are doing but focusing on deployments. This is very clever stuff and will reduce our hosting cost without having to duplicate infrastructure.
So yeah, I didn't get docker for a long time. It does depend on the types of apps your building though. My use case fits it perfectly.
For local dev environments I still think Vagrant (and pick whatever underlying provider you want) is a better solution.
for me, docker actually solves the problem that lxc/openvz were trying to solve in a better way. we already had the data on separate volumes, and docker is a much nicer interface than bootstrapping and then updating a chroot for lxc