Merge pull request #774 from progrium/254-nginx-hostname-hook

Add the ability to customize an app's hostname using nginx-hostname pluginhook
This commit is contained in:
Jose Diaz-Gonzalez
2014-11-22 17:19:38 -05:00
3 changed files with 43 additions and 12 deletions

View File

@@ -12,7 +12,7 @@ Docker powered mini-Heroku. The smallest PaaS implementation you've ever seen.
- [Remote commands](http://progrium.viewdocs.io/dokku/remote-commands)
- [Plugins](http://progrium.viewdocs.io/dokku/plugins)
- [Configuration management](http://progrium.viewdocs.io/dokku/configuration-management)
- [TLS/SPDY support](http://progrium.viewdocs.io/dokku/tls-spdy-support)
- [Nginx Configuration](http://progrium.viewdocs.io/dokku/nginx)
- [DNS](http://progrium.viewdocs.io/dokku/dns)
## Things this project won't do

View File

@@ -1,14 +1,18 @@
# TLS/SPDY support
# Nginx
Dokku uses nginx as it's server for routing requests to specific applications.
## TLS/SPDY support
Dokku provides easy TLS/SPDY support out of the box. This can be done app-by-app or for all subdomains at once. Note that whenever TLS support is enabled SPDY is also enabled.
## Per App
### Per App
To enable TLS connection to to one of your applications, copy or symlink the `.crt`/`.pem` and `.key` files into the application's `/home/dokku/:app/tls` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively.
Redeployment of the application will be needed to apply TLS configuration. Once it is redeployed, the application will be accessible by `https://` (redirection from `http://` is applied as well).
## All Subdomains
### All Subdomains
To enable TLS connections for all your applications at once you will need a wildcard TLS certificate.
@@ -23,13 +27,13 @@ The nginx configuration will need to be reloaded in order for the updated TLS co
**Note**: TLS will not be enabled unless the application's VHOST matches the certificate's name. (i.e. if you have a cert for *.example.com TLS won't be enabled for something.example.org or example.net)
## HSTS Header
### HSTS Header
The [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is an HTTP header that can inform browsers that all requests to a given site should be made via HTTPS. dokku does not, by default, enable this header. It is thus left up to you, the user, to enable it for your site.
Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails.
## Importing ssl certificates
### Importing ssl certificates
You can import ssl certificates via tarball using the following command:
@@ -48,3 +52,27 @@ dokku config:set myapp NO_VHOST=1
```
On subsequent deploys, the nginx virtualhost will be discarded. This is useful when deploying internal-facing services that should not be publicly routeable.
## Customizing hostnames
Applications typically have the following structure for their hostname:
```
scheme://subdomain.domain.tld
```
The `subdomain` is inferred from the pushed application name, while the `domain` is set during initial configuration in the `$DOKKU_ROOT/VHOST` file.
You can optionally override this in a plugin by implementing the `nginx-hostname` pluginhook. For example, you can reverse the subdomain with the following sample `nginx-hostname` pluginhook:
```bash
#!/usr/bin/env bash
set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
APP="$1"; SUBDOMAIN="$2"; VHOST="$3"
NEW_SUBDOMAIN=`echo $SUBDOMAIN | rev`
echo "$NEW_SUBDOMAIN.$VHOST"
```
If the `nginx-hostname` has no output, the normal hostname algorithm will be executed.

View File

@@ -16,10 +16,13 @@ fi
if [[ -f "$DOKKU_ROOT/VHOST" && ! -z "$NO_VHOST" ]]; then
VHOST=$(< "$DOKKU_ROOT/VHOST")
SUBDOMAIN=${APP/%\.${VHOST}/}
if [[ "$APP" == *.* ]] && [[ "$SUBDOMAIN" == "$APP" ]]; then
hostname="${APP/\//-}"
else
hostname="${APP/\//-}.$VHOST"
hostname=$(: | pluginhook nginx-hostname $APP $SUBDOMAIN $VHOST)
if [[ ! -n $hostname ]]; then
if [[ "$APP" == *.* ]] && [[ "$SUBDOMAIN" == "$APP" ]]; then
hostname="${APP/\//-}"
else
hostname="${APP/\//-}.$VHOST"
fi
fi
if [[ -e "$SSL/server.crt" ]] && [[ -e "$SSL/server.key" ]]; then
@@ -35,7 +38,7 @@ EOF
fi
if [[ -n "$SSL_INUSE" ]]; then
echo "-----> creating ssl nginx.conf"
echo "-----> Creating ssl nginx.conf"
cat<<EOF > $DOKKU_ROOT/$APP/nginx.conf
upstream $APP { server 127.0.0.1:$PORT; }
server {
@@ -71,7 +74,7 @@ EOF
echo "https://$hostname" > "$DOKKU_ROOT/$APP/URL"
else
echo "-----> creating non-ssl nginx.conf"
echo "-----> Creating non-ssl nginx.conf"
cat<<EOF > $DOKKU_ROOT/$APP/nginx.conf
upstream $APP { server 127.0.0.1:$PORT; }
server {