计算机知识分享网

【nginx】利用docker-compose和certbot部署Let's Encrypt ssl证书

新建文件夹映射目录
mkdir -p ~/nginx-ssl/{html,certbot/conf,certbot/www}
cd ~/nginx-ssl
目录结构如下
nginx-ssl/
├── docker-compose.yml
├── nginx/
│   ├── nginx.conf          # 基础 Nginx 配置
│   └── conf.d/
│       └── default.conf    # 虚拟主机配置
├── html/                   # 网站根目录
└── certbot/
    ├── conf/               # Certbot 配置目录
    └── www/                # ACME 验证文件目录
创建 docker-compose.yml

version: '3'
services:
  nginx:
    image: registry.cn-shenzhen.aliyuncs.com/davidzheng/nginx:1.18.0
    container_name: nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./html:/usr/share/nginx/html
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    networks:
      - web
    restart: unless-stopped

  certbot:
    image: docker.1ms.run/certbot/certbot:v4.0.0
    container_name: certbot
    volumes:
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    networks:
      - web
    command: certonly --webroot --webroot-path=/var/www/certbot --email 986945193@qq.com --agree-tos --no-eff-email -d jiaochengziyuan.cn -d www.jiaochengziyuan.cn --dry-run  # 测试时用 --dry-run，正式运行去掉

networks:
  web:
    driver: bridge
配置nginx/nginx.conf
user  nginx;
worker_processes  auto;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;
}

配置虚拟主机nginx/conf.d/default.conf

server {
    listen 80;
    server_name jiaochengziyuan.cn www.jiaochengziyuan.cn;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

测试 Certbot 证书申请（带--dry-run 模式）

docker-compose run --rm certbot

成功后，配置nginx监听ssl 443端口

配置虚拟主机`nginx/conf.d/default.conf`

server {
    listen 80;
    server_name jiaochengziyuan.cn www.jiaochengziyuan.cn;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name jiaochengziyuan.cn www.jiaochengziyuan.cn;

    ssl_certificate /etc/letsencrypt/live/jiaochengziyuan.cn/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/jiaochengziyuan.cn/privkey.pem;

    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}

正式申请证书

# 正式申请证书（去掉 --dry-run）
sed -i 's/--dry-run //' docker-compose.yml
docker-compose run --rm certbot

# 重启 Nginx 启用 HTTPS
docker-compose restart nginx

配置自动续期，创建自动续期脚本 auto_apply_letsssl_cert.sh,脚本要放在~/nginx-ssl目录下

#!/bin/bash
docker-compose run --rm certbot renew
docker-compose exec nginx nginx -s reload

添加可执行权限

chmod +x auto_apply_letsssl_cert.sh

增加定时任务

(crontab -l ; echo "0 3 * * * ~/nginx-ssl/auto_apply_letsssl_cert.sh >> /var/log/certbot-renew.log 2>&1") | crontab -

通过日志即可看到执行结果

#Nginx