feat: set up nginx reverse proxy

docker-compose.prod.yaml

@@ -1,4 +1,27 @@
 services:
+  nginx:
+    build:
+      context: ./nginx-docker
+    ports:
+      - "80:8080"
+    environment:
+      - NEXTJS_CONTAINER_IP=frontend
+      - ACTIX_CONTAINER_IP=backend
+      - CONF_FILE=prod-nginx.conf
+    command: [ 'sh', '/etc/nginx/convert-nginx.sh'] 
+    volumes:
+      - ./data/certbot/conf:/etc/letsencrypt
+      - ./data/certbot/www:/var/www/certbot
+    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
+
+
+  certbot:
+    image: certbot/certbot
+    volumes:
+      - ./data/certbot/conf:/etc/letsencrypt
+      - ./data/certbot/www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
   backend:
     container_name: zyenyo-backend
     build:

docker-compose.yaml

@@ -1,12 +1,21 @@
 services:
+  nginx:
+    build:
+      context: ./nginx-docker
+    ports:
+      - "8080:8080"
+    environment:
+      - NEXTJS_CONTAINER_IP=frontend
+      - ACTIX_CONTAINER_IP=backend
+      - CONF_FILE=dev-nginx.conf
+    command: [ 'sh', '/etc/nginx/convert-nginx.sh'] 
+
   backend:
     container_name: zyenyo-backend
     build:
       context: zyenyo-backend
       target: development
     env_file: .env
-    ports:
-      - "8000:8000"
 
   frontend:
     build:
@@ -19,8 +28,6 @@ services:
       - ./zyenyo-frontend:/app
       - /app/node_modules
       - /app/.next
-    ports:
-      - "8080:8080"
 
   discord:
     build:

init-letsencrypt.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+
+if ! [ -x "$(command -v docker-compose)" ]; then
+  echo 'Error: docker-compose is not installed.' >&2
+  exit 1
+fi
+
+domains=(zyenyobot.com)
+rsa_key_size=4096
+data_path="./data/certbot"
+email="ashwinr2k2@gmail.com" # Adding a valid address is strongly recommended
+staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
+
+if [ -d "$data_path" ]; then
+  read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
+  if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
+    exit
+  fi
+fi
+
+
+if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
+  echo "### Downloading recommended TLS parameters ..."
+  mkdir -p "$data_path/conf"
+  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
+  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
+  echo
+fi
+
+echo "### Creating dummy certificate for $domains ..."
+path="/etc/letsencrypt/live/$domains"
+mkdir -p "$data_path/conf/live/$domains"
+docker-compose run --rm --entrypoint "\
+  openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\
+    -keyout '$path/privkey.pem' \
+    -out '$path/fullchain.pem' \
+    -subj '/CN=localhost'" certbot
+echo
+
+
+echo "### Starting nginx ..."
+docker-compose up --force-recreate -d nginx
+echo
+
+echo "### Deleting dummy certificate for $domains ..."
+docker-compose run --rm --entrypoint "\
+  rm -Rf /etc/letsencrypt/live/$domains && \
+  rm -Rf /etc/letsencrypt/archive/$domains && \
+  rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
+echo
+
+
+echo "### Requesting Let's Encrypt certificate for $domains ..."
+#Join $domains to -d args
+domain_args=""
+for domain in "${domains[@]}"; do
+  domain_args="$domain_args -d $domain"
+done
+
+# Select appropriate email arg
+case "$email" in
+  "") email_arg="--register-unsafely-without-email" ;;
+  *) email_arg="--email $email" ;;
+esac
+
+# Enable staging mode if needed
+if [ $staging != "0" ]; then staging_arg="--staging"; fi
+
+docker-compose run --rm --entrypoint "\
+  certbot certonly --webroot -w /var/www/certbot \
+    $staging_arg \
+    $email_arg \
+    $domain_args \
+    --rsa-key-size $rsa_key_size \
+    --agree-tos \
+    --force-renewal" certbot
+echo
+
+echo "### Reloading nginx ..."
+docker-compose exec nginx nginx -s reload

nginx-docker/Dockerfile

@@ -0,0 +1,25 @@
+FROM nginx:1.15-alpine
+# alpine is light weight, doesnot have any executable shells like bash
+# FROM nginx:latest is recommended. But 1.15-alpine has executable shell.
+
+# Remove any existing config files
+# is it the reason why, we have to set the root /app/public
+RUN rm /etc/nginx/conf.d/* 
+
+# Copy config files
+# *.conf files in "conf.d/" dir get included in main config
+COPY ./dev-nginx.conf /etc/nginx/conf.d/
+COPY ./prod-nginx.conf /etc/nginx/conf.d/
+# COPY ./default.conf /etc/nginx/conf.d/
+COPY ./nginx.conf /etc/nginx/
+COPY ./mime.types /etc/nginx/
+COPY ./convert-nginx.sh /etc/nginx/
+
+RUN chmod +x /etc/nginx/convert-nginx.sh
+
+# Expose the listening port
+EXPOSE 8080
+
+# Commented this because, we want COMMAND full control in docker-compose and deployment.yml files only.
+# CMD [ "/bin/sh","-c","/etc/nginx/convert-nginx.sh"]  
+

nginx-docker/convert-nginx.sh

@@ -0,0 +1,6 @@
+# !/usr/bin/env bash
+
+envsubst '$${NEXTJS_CONTAINER_IP} $${ACTIX_CONTAINER_IP}'  < /etc/nginx/conf.d/${CONF_FILE} > /etc/nginx/conf.d/default.conf 
+rm -rf /etc/nginx/conf.d/dev-nginx.conf
+rm -rf /etc/nginx/conf.d/prod-nginx.conf
+nginx -g "daemon off;"

nginx-docker/dev-nginx.conf

@@ -0,0 +1,39 @@
+server {
+
+    listen 8080;
+    listen [::]:8080;
+    server_name _;
+
+    proxy_cache off;
+    proxy_set_header Host $http_host;
+    proxy_http_version 1.1;     
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_cache_bypass $http_upgrade;
+
+    location / {
+        proxy_pass http://${NEXTJS_CONTAINER_IP}:3000;
+        add_header X-Custom-HeaderNextServer "Value for Custom Header @nextserver";
+    }
+
+    location /api {
+        proxy_pass http://${ACTIX_CONTAINER_IP}:8000;
+    }
+
+    location /test {
+        return 200 "ROUTE HIT REGISTERED";
+    }
+
+    location ~ /testhtml {
+        alias /app;
+        try_files $uri /index.html =404;
+    }
+
+    error_page 404 /404.html;
+        location = /40x.html {
+    }
+
+    error_page 500 502 503 504 /50x.html;
+        location = /50x.html {
+    }
+}

nginx-docker/mime.types

@@ -0,0 +1,93 @@
+types {
+    text/html                             html htm shtml;
+    text/css                              css;
+    text/xml                              xml;
+    image/gif                             gif;
+    image/jpeg                            jpeg jpg;
+    application/javascript                js mjs;
+    application/atom+xml                  atom;
+    application/rss+xml                   rss;
+
+    text/mathml                           mml;
+    text/plain                            txt;
+    text/vnd.sun.j2me.app-descriptor      jad;
+    text/vnd.wap.wml                      wml;
+    text/x-component                      htc;
+
+    image/png                             png;
+    image/tiff                            tif tiff;
+    image/vnd.wap.wbmp                    wbmp;
+    image/x-icon                          ico;
+    image/x-jng                           jng;
+    image/x-ms-bmp                        bmp;
+    image/svg+xml                         svg svgz;
+    image/webp                            webp;
+
+    application/font-woff                 woff;
+    font/woff2    			  woff2;
+    font/ttf                              ttf;
+    font/opentype                         otf;
+
+
+    application/java-archive              jar war ear;
+    application/json                      json;
+    application/mac-binhex40              hqx;
+    application/msword                    doc;
+    application/pdf                       pdf;
+    application/postscript                ps eps ai;
+    application/rtf                       rtf;
+    application/vnd.apple.mpegurl         m3u8;
+    application/vnd.ms-excel              xls;
+    application/vnd.ms-fontobject         eot;
+    application/vnd.ms-powerpoint         ppt;
+    application/vnd.wap.wmlc              wmlc;
+    application/vnd.google-earth.kml+xml  kml;
+    application/vnd.google-earth.kmz      kmz;
+    application/x-7z-compressed           7z;
+    application/x-cocoa                   cco;
+    application/x-java-archive-diff       jardiff;
+    application/x-java-jnlp-file          jnlp;
+    application/x-makeself                run;
+    application/x-perl                    pl pm;
+    application/x-pilot                   prc pdb;
+    application/x-rar-compressed          rar;
+    application/x-redhat-package-manager  rpm;
+    application/x-sea                     sea;
+    application/x-shockwave-flash         swf;
+    application/x-stuffit                 sit;
+    application/x-tcl                     tcl tk;
+    application/x-x509-ca-cert            der pem crt;
+    application/x-xpinstall               xpi;
+    application/xhtml+xml                 xhtml;
+    application/xspf+xml                  xspf;
+    application/zip                       zip;
+
+    application/octet-stream              bin exe dll;
+    application/octet-stream              deb;
+    application/octet-stream              dmg;
+    application/octet-stream              iso img;
+    application/octet-stream              msi msp msm;
+
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet          xlsx;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation  pptx;
+
+    audio/midi                            mid midi kar;
+    audio/mpeg                            mp3;
+    audio/ogg                             ogg;
+    audio/x-m4a                           m4a;
+    audio/x-realaudio                     ra;
+
+    video/3gpp                            3gpp 3gp;
+    video/mp2t                            ts;
+    video/mp4                             mp4;
+    video/mpeg                            mpeg mpg;
+    video/quicktime                       mov;
+    video/webm                            webm;
+    video/x-flv                           flv;
+    video/x-m4v                           m4v;
+    video/x-mng                           mng;
+    video/x-ms-asf                        asx asf;
+    video/x-ms-wmv                        wmv;
+    video/x-msvideo                       avi;
+}

nginx-docker/nginx.conf

@@ -0,0 +1,49 @@
+# For more information on configuration, see:
+#   * Official English Documentation: http://nginx.org/en/docs/
+#   * Official Russian Documentation: http://nginx.org/ru/docs/
+
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log;
+pid /var/run/nginx.pid;
+
+# Load dynamic modules. See /usr/share/nginx/README.dynamic.
+include /usr/share/nginx/modules/*.conf;
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    gzip  on;
+    gzip_http_version 1.1;
+    gzip_vary on;
+    gzip_comp_level 6;
+    gzip_proxied any;
+    gzip_types image/png image/svg+xml image/x-icon text/plain text/html text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript text/x-js font/ttf font/opentype font/woff2 application/font;
+    gzip_buffers 16 8k;
+    gzip_disable "MSIE [1-6]\.(?!.*SV1)";
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile            on;
+    tcp_nopush          on;
+    tcp_nodelay         on;
+    keepalive_timeout   65;
+    keepalive_requests 1000;
+    keepalive_disable none;
+    types_hash_max_size 2048;
+
+    include             /etc/nginx/mime.types;
+    default_type        application/octet-stream;
+
+    # Load modular configuration files from the /etc/nginx/conf.d directory.
+    # See http://nginx.org/en/docs/ngx_core_module.html#include
+    # for more information.
+    include /etc/nginx/conf.d/*.conf;
+}