Deployment Overview of Nginx Certbot on Server¶

This document provides the technical specifications and deployment details for the Nginx Certbot service, which manages SSL/TLS certificates via Let's Encrypt and serves as a reverse proxy.

Prerequisites and Basic Requirements¶

The following requirements must be met for a successful deployment:

Operating System: Linux (compatible with Docker installation).
Privileges: Root or sudo access is required to manage system packages, directories, and Docker containers.
Domain Configuration: A valid domain pointing to the server IP is required for SSL certificate issuance.
Ports: The following ports must be open in the firewall:
80/TCP (HTTP)
443/TCP (HTTPS)

FQDN of the final panel on the hostkey.in domain¶

The service uses a dynamic Fully Qualified Domain Name (FQDN) based on a specific template.

Parameter	Value
Prefix	`nginx-certbot`
Domain	`hostkey.in`
Full template	`nginx-certbot{Server_ID}.hostkey.in`

File and Directory Structure¶

The application data and configuration files are stored in the following locations:

/data/nginx/: Main application directory.
/data/nginx/docker-compose.yml: Docker Compose orchestration file.
/data/nginx/user_conf.d/: Directory containing custom Nginx server configurations.
/data/nginx/nginx-certbot.env: Environment variables for the container.
/data/nginx/user_conf.d/{prefix}{Server_ID}.{zone}.conf: Specific configuration file for the domain.

Application installation process¶

The application is deployed using a combination of system package management and Docker Compose:

System Preparation: The server undergoes a Docker engine installation to support containerized services.
Directory Creation: A directory structure is established at /data/nginx/ with specific permissions (0640) for security.
Configuration Generation:
A docker-compose.yml file is generated in /data/nginx/.
An Nginx configuration file is created within the user_conf.d directory to handle SSL termination and domain routing.
An environment file (nginx-certbot.env) is placed in the application directory.
Docker Volume Initialization: A Docker volume named nginx_secrets is created to persist Let's Encrypt certificates.
Service Deployment: The service is started using Docker Compose in detached mode from the /data/nginx/ directory.

Access Rights and Security¶

File Permissions: Configuration files and data directories are owned by root:root with restricted access (0640 or 0644).
Network Security: The service is configured to listen on both IPv4 and IPv6 for port 443.
SSL/TLS: Secure communication is enforced using Let's Encrypt certificates, including the use of a Diffie-Hellman (DH) parameter file located in /etc/letsencrypt/dhparams/.

Docker Containers and Their Deployment¶

The deployment utilizes one primary container to manage web traffic and SSL:

Container Name	Image	Ports	Volumes	Environment Variables	Restart Policy
`nginx`	`jonasal/nginx-certbot:latest`	`80:80`, `443:443`	- `nginx_secrets:/etc/letsencrypt` - `./user_conf.d:/etc/nginx/user_conf.d`	`[email protected]` (plus variables from `nginx-certbot.env`)	`unless-stopped`

Application Update Instructions¶

To update the Nginx Certbot application, perform the following steps:

Navigate to the application directory:
```
cd /data/nginx/
```

Pull the latest image and restart the container:

docker compose pull && docker compose up -d

Location of configuration files and data¶

Nginx Configuration: /data/nginx/user_conf.d/
Docker Compose File: /data/nginx/docker-compose.yml
Environment Variables: /data/nginx/nginx-certbot.env
SSL Certificates (Persistent Volume): nginx_secrets (Managed by Docker)

Available ports for connection¶

HTTP: 80
HTTPS: 443