Skip to content

Commit 2c7f0cf

Browse files
matifalimatifali
committed
docs: Add nginx reverse-proxy example
This PR adds nginx reverse-proxy example to provision coder with tls certificate using letsencrypt certbot. This will partially resolve #6086.
1 parent c0c83f1 commit 2c7f0cf

File tree

2 files changed

+102
-1
lines changed

2 files changed

+102
-1
lines changed

‎docs/admin/configure.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ subdomain that resolves to Coder (e.g. `*.coder.example.com`).
4646

4747
The Coder server can directly use TLS certificates with `CODER_TLS_ENABLE` and accompanying configuration flags. However, Coder can also run behind a reverse-proxy to terminate TLS certificates from LetsEncrypt, for example.
4848

49-
- Example: [Run Coder with Caddy and LetsEncrypt](https://github.com/coder/coder/tree/main/examples/web-server/caddy)
49+
- Caddy: [Run Coder with Caddy and LetsEncrypt](https://github.com/coder/coder/tree/main/examples/web-server/caddy)
50+
- Nginx: [Run Coder with Nginx and LetsEncrypt](https://../../../examples/web-server/nginx)
5051

5152
## PostgreSQL Database
5253

‎examples/web-server/nginx/README.md

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# How to use nginx as a reverse-proxy with letsencrypt
2+
3+
## Requirements
4+
5+
1. You'll need a subdomain and the a wildcard subdomain configured that resolves to server.
6+
2. Install **nginx** (assuming you're on debian/ubuntu):
7+
8+
- `sudo apt install nginx`
9+
10+
3. Stop **nginx** :
11+
12+
- `sudo service stop nginx`
13+
14+
## Adding Coder deployment subdomain
15+
16+
> this example assumes coder is running locally on `127.0.0.1:3000` for the subdomain `YOUR_SUBDOMAIN` e.g. `coder.example.com`.
17+
18+
- create a new file for this app : `sudo touch /etc/nginx/sites-available/YOUR_SUBDOMAIN`
19+
20+
- and activate this file : `sudo ln -s /etc/nginx/sites-available/YOUR_SUBDOMAIN /etc/nginx/sites-enabled/YOUR_SUBDOMAIN`
21+
22+
## Install and configure letsencrypt certbot
23+
24+
Install letsencrypt **certbot** : follow the instructions on [certbot website](https://certbot.eff.org/instructions?ws=other&os=pip&tab=wildcard)
25+
26+
## Create dns provider credentials
27+
28+
- Create an API token for the dns provider you're using : e.g cloudflare [here](https://dash.cloudflare.com/profile/api-tokens) with the following permissions :
29+
- Zone - DNS - Edit
30+
- Create a file in `.secrets/certbot/cloudflare.ini` with the following content :
31+
- `dns_cloudflare_api_token = YOUR_API_TOKEN`
32+
33+
## Create the certificate
34+
35+
- Create the wildcard certificate :
36+
37+
```console
38+
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini -d coder.example.com *.coder.example.com
39+
```
40+
41+
## Configure nginx
42+
43+
Edit the file with : `sudo nano /etc/nginx/sites-available/YOUR_SUBDOMAIN` and add the following content :
44+
45+
```nginx
46+
server {
47+
server_name YOUR_SUBDOMAIN;
48+
49+
# HTTP configuration
50+
listen 80;
51+
listen [::]:80;
52+
53+
# HTTP to HTTPS
54+
if ($scheme != "https") {
55+
return 301 https://$host$request_uri;
56+
} # managed by Certbot
57+
58+
# HTTPS configuration
59+
listen [::]:443 ssl ipv6only=on; # managed by Certbot
60+
listen 443 ssl; # managed by Certbot
61+
ssl_certificate /etc/letsencrypt/live/YOUR_SUBDOMAIN/fullchain.pem;
62+
ssl_certificate_key /etc/letsencrypt/live/YOUR_SUBDOMAIN/privkey.pem;
63+
include /etc/letsencrypt/options-ssl-nginx.conf;
64+
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
65+
66+
location / {
67+
proxy_pass http://127.0.0.1:3000;
68+
proxy_http_version 1.1;
69+
proxy_set_header Upgrade $http_upgrade;
70+
proxy_set_header Connection $connection_upgrade;
71+
proxy_set_header Host $server_name;
72+
proxy_set_header X-Real-IP $remote_addr;
73+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
74+
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
75+
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
76+
}
77+
}
78+
```
79+
80+
> Don't forget to change :
81+
>
82+
> - `YOUR_SUBDOMAIN` by your (sub)domain e.g. `coder.example.com`
83+
> - the port and ip in `proxy_pass` if applicable
84+
85+
## Automatic certificates refreshing
86+
87+
- Create a new file in `/etc/cron.weekly` : `sudo touch /etc/cron.weekly/certbot`
88+
- Make it executable : `sudo chmod +x /etc/cron.weekly/certbot`
89+
- And add this code :
90+
91+
```sh
92+
#!/bin/sh
93+
sudo certbot renew -q
94+
```
95+
96+
## Restart nginx
97+
98+
- `sudo service nginx restart`
99+
100+
And that's it, you should now be able to access coder via `https://YOUR_SUBDOMAIN` !

0 commit comments

Comments
 (0)