Admin
24f801cf2f
One nginx owns host ports 80/443 for every project (Gitea, Musify) and proxies by container name over infra-net and gitea_gitea; a certbot service renews the Let's Encrypt certificates.
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
# Shared public edge: the only thing that publishes host ports 80/443. One
|
|
# nginx terminates TLS for every project's domains (Gitea, Musify, ...) and
|
|
# proxies to their containers by name, over the networks below. Certificates
|
|
# come from Let's Encrypt (webroot), renewed by the certbot service.
|
|
#
|
|
# docker compose -f edge/compose.yml up -d
|
|
#
|
|
# Requires `infra-net` (created by ../compose.yml) and `gitea_gitea` (created
|
|
# by the Gitea stack) to already exist.
|
|
|
|
name: edge
|
|
|
|
networks:
|
|
infra-net:
|
|
name: infra-net
|
|
external: true
|
|
gitea:
|
|
name: gitea_gitea
|
|
external: true
|
|
|
|
services:
|
|
nginx:
|
|
image: nginx:1.27-alpine
|
|
container_name: edge-nginx
|
|
# The subshell reloads nginx every 6h so renewed certificates get picked up.
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "(while :; do sleep 6h; nginx -s reload; done) & exec nginx -g 'daemon off;'"
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./conf.d:/etc/nginx/conf.d:ro
|
|
- ./snippets:/etc/nginx/snippets:ro
|
|
- ./certbot/www:/var/www/certbot:ro
|
|
- ./certbot/conf:/etc/letsencrypt:ro
|
|
networks: [gitea, infra-net]
|
|
restart: unless-stopped
|
|
|
|
certbot:
|
|
image: certbot/certbot
|
|
container_name: edge-certbot
|
|
entrypoint:
|
|
- /bin/sh
|
|
- -c
|
|
- "trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done"
|
|
volumes:
|
|
- ./certbot/conf:/etc/letsencrypt
|
|
- ./certbot/www:/var/www/certbot
|
|
restart: unless-stopped
|