Nginx Alpine + SSL Laradock
Tags: spanish, nginx, laravel, laradock
Published: 2021-09-01 06:54:00

Configuraciones realizadas dentro del contenedor de nginx

### Instalar Certbot dentro del contenedor de nginx

```bash
$ docker-compose exec nginx bash

#Instalar certbot
$ apk add certbot certbot-nginx
```

---

### Crear los certificados y siga las opciones

```bash
certbot certonly --email your-rafa.developers@gmail.com --no-eff-email -d ralphdev.tech -d www.ralphdev.tech
```

---

### Configuración .conf nginx

- default.conf

    ```php
    server {

        listen 80 default_server;
        #listen [::]:80 default_server ipv6only=on;

        # For https
        # listen 443 ssl default_server;
        # listen [::]:443 ssl default_server ipv6only=on;
        # ssl_certificate /etc/nginx/ssl/default.crt;
        # ssl_certificate_key /etc/nginx/ssl/default.key;

        server_name ralphdev.tech;
        root /var/www/ralphdev;
        index index.php index.html index.htm;

        location / {
             try_files $uri $uri/ /index.php$is_args$args;
        }

        location ~ \.php$ {
            try_files $uri /index.php =404;
            fastcgi_pass php-upstream;
            fastcgi_index index.php;
            fastcgi_buffers 16 16k;
            fastcgi_buffer_size 32k;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            #fixes timeouts
            fastcgi_read_timeout 600;
            include fastcgi_params;
        }

        location ~ /\.ht {
            deny all;
        }

        location /.well-known/acme-challenge/ {
            root /var/www/letsencrypt/;
            log_not_found off;
        }

        return 301 https://ralphdev.tech$request_uri;
    }
    ```

- ralphdev.tech.conf

    ```php
    server {

        #listen 80;
        #listen [::]:80;

        # For https
        listen 443 ssl http2;
        #listen [::]:443 ssl ipv6only=on;

        ssl_certificate /etc/letsencrypt/live/ralphdev.tech/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/ralphdev.tech/privkey.pem;

        server_name www.ralphdev.tech;
        root /var/www/ralphdev;
        index index.php index.html index.htm;

        # Additional Nginx options
        include /etc/letsencrypt/options-ssl-nginx.conf;

        # Diffie-Hellman parameter for DHE ciphersuites
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        # Security headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

        location / {
             try_files $uri $uri/ /index.php$is_args$args;
        }

        location ~ \.php$ {
            try_files $uri /index.php =404;
            fastcgi_pass php-upstream;
            fastcgi_index index.php;
            fastcgi_buffers 16 16k;
            fastcgi_buffer_size 32k;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            #fixes timeouts
            fastcgi_read_timeout 600;
            include fastcgi_params;
        }

        location ~ /\.ht {
            deny all;
        }

        # SEO files
        location = /robots.txt { log_not_found off; }
        location = /sitemap.xml { log_not_found off; }
        location = /favicon.ico { log_not_found off; }

        # Assets, media
        location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
            expires 7d;
        }

        # SVG, fonts
        location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
            add_header Access-Control-Allow-Origin "*";
            expires 7d;
        }

        location /.well-known/acme-challenge/ {
            root /var/www/letsencrypt/;
            log_not_found off;
        }

        error_log /var/log/nginx/ralphdev_error.log;
        access_log /var/log/nginx/ralphdev_access.log;

    }
    ```

- Rutas del cronjob
    - etc/periodic/
    - chmod a+x /etc/periodic/[path/scriptname]
    - echo '#!/bin/sh' >> scriptname
    - rc-service crond start && rc-update add crond

    ```bash
    #!/bin/sh
    # min   hour    day     month   weekday command
    *       12       *       *       *       /usr/bin/certbot renew --quiet
    ```

---

### Adicional

```bash
// Install vim 
$ apk add vim
$ vi --version
```