From a93d6e22d93f2e7dcf1b8cc8bb50c84b8fdaa81c Mon Sep 17 00:00:00 2001 From: ChengWei Date: Wed, 2 Sep 2026 21:30:26 +0800 Subject: [PATCH] refactor: rename nginx ssl directory to certs --- README.md | 4 ++-- docker-compose-prod.yaml | 8 ++++---- docker-compose.yaml | 2 +- nginx/.gitignore | 4 ++-- nginx/README.md | 6 +++--- nginx/{ssl => certs}/.gitkeep | 0 nginx/templates/backend.conf | 8 ++++---- nginx/templates/frontend.conf | 14 +++++++------- nginx/templates/grafana.conf | 8 ++++---- nginx/templates/phpmyadmin.conf | 8 ++++---- nginx/templates/redis.conf | 10 +++++----- 11 files changed, 36 insertions(+), 36 deletions(-) rename nginx/{ssl => certs}/.gitkeep (100%) diff --git a/README.md b/README.md index 084ff4c..4e5f79c 100755 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ docker compose down On first start, `nginx/whitelist.conf` is auto-created from `whitelist.conf.example`. Edit that file if you need to restrict allowed IP addresses. -To enable SSL (HTTPS), configure SSL settings in `.env` and place certificates in `nginx/ssl`: +To enable SSL (HTTPS), configure SSL settings in `.env` and place certificates in `nginx/certs`: ```bash SSL_ENABLE=true @@ -73,7 +73,7 @@ SSL_KEY_FILE=privkey.pem ``` ```bash -nginx/ssl/ +nginx/certs/ ├── cert.pem # Your SSL certificate └── privkey.pem # Your private key ``` diff --git a/docker-compose-prod.yaml b/docker-compose-prod.yaml index dc43348..ab63138 100755 --- a/docker-compose-prod.yaml +++ b/docker-compose-prod.yaml @@ -6,7 +6,7 @@ services: - ./nginx/nginx.conf:/etc/nginx/nginx.conf - ./nginx/templates:/etc/nginx/templates - ./nginx/custom.d:/etc/nginx/custom.d - - ./nginx/ssl:/etc/nginx/ssl + - ./nginx/certs:/etc/nginx/certs - ./nginx/logs:/var/log/nginx - ./nginx:/etc/nginx/host:rw - ./nginx/logrotate/nginx:/etc/logrotate.d/nginx @@ -146,7 +146,7 @@ services: condition: service_started networks: - backend-network - restart: always + restart: always healthcheck: test: ["CMD-SHELL", "curl --silent --fail localhost:5000/healthz || exit 1"] interval: 10s @@ -180,7 +180,7 @@ services: interval: 30s timeout: 5s retries: 5 - + phpmyadmin: image: phpmyadmin/phpmyadmin:5.2.3 environment: @@ -383,4 +383,4 @@ networks: frontend-network: driver: bridge backend-network: - driver: bridge \ No newline at end of file + driver: bridge diff --git a/docker-compose.yaml b/docker-compose.yaml index 8bdafff..638c450 100755 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -6,7 +6,7 @@ services: - ./nginx/nginx.conf:/etc/nginx/nginx.conf - ./nginx/templates:/etc/nginx/templates - ./nginx/custom.d:/etc/nginx/custom.d - - ./nginx/ssl:/etc/nginx/ssl + - ./nginx/certs:/etc/nginx/certs - ./nginx/logs:/var/log/nginx - ./nginx:/etc/nginx/host:rw - ./nginx/logrotate/nginx:/etc/logrotate.d/nginx diff --git a/nginx/.gitignore b/nginx/.gitignore index e48b7e3..4258dc4 100644 --- a/nginx/.gitignore +++ b/nginx/.gitignore @@ -1,4 +1,4 @@ -# SSL +# Certificates *.pem *.key *.crt @@ -6,4 +6,4 @@ # Custom Configurations custom.d/*.conf -whitelist.conf \ No newline at end of file +whitelist.conf diff --git a/nginx/README.md b/nginx/README.md index 608ac97..3c469e5 100755 --- a/nginx/README.md +++ b/nginx/README.md @@ -48,9 +48,9 @@ SSL_CERT_FILE=cert.pem SSL_KEY_FILE=privkey.pem ``` -Place your certificates in the `nginx/ssl` directory: +Place your certificates in the `nginx/certs` directory: ```bash -nginx/ssl/ +nginx/certs/ ├── cert.pem # Your SSL certificate └── privkey.pem # Your private key -``` \ No newline at end of file +``` diff --git a/nginx/ssl/.gitkeep b/nginx/certs/.gitkeep similarity index 100% rename from nginx/ssl/.gitkeep rename to nginx/certs/.gitkeep diff --git a/nginx/templates/backend.conf b/nginx/templates/backend.conf index a9c7e84..144a2bc 100755 --- a/nginx/templates/backend.conf +++ b/nginx/templates/backend.conf @@ -9,13 +9,13 @@ server { listen {{ .Env.BACKEND_PORT }}; {{ end }} server_name {{ .Env.HOSTNAME }}; - + {{ if eq .Env.SSL_ENABLE "true" }} # Redirect HTTP to HTTPS when accessing HTTPS port error_page 497 =301 https://$host:$server_port$request_uri; - ssl_certificate /etc/nginx/ssl/{{ .Env.SSL_CERT_FILE }}; - ssl_certificate_key /etc/nginx/ssl/{{ .Env.SSL_KEY_FILE }}; + ssl_certificate /etc/nginx/certs/{{ .Env.SSL_CERT_FILE }}; + ssl_certificate_key /etc/nginx/certs/{{ .Env.SSL_KEY_FILE }}; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; @@ -58,4 +58,4 @@ server { proxy_pass_request_headers on; proxy_pass_request_body on; } -} \ No newline at end of file +} diff --git a/nginx/templates/frontend.conf b/nginx/templates/frontend.conf index ba3d728..3b76fa5 100755 --- a/nginx/templates/frontend.conf +++ b/nginx/templates/frontend.conf @@ -9,23 +9,23 @@ server { listen {{ .Env.FRONTEND_PORT }}; {{ end }} server_name {{ .Env.HOSTNAME }}; - + {{ if eq .Env.SSL_ENABLE "true" }} # Redirect HTTP to HTTPS when accessing HTTPS port error_page 497 =301 https://$host:$server_port$request_uri; - ssl_certificate /etc/nginx/ssl/{{ .Env.SSL_CERT_FILE }}; - ssl_certificate_key /etc/nginx/ssl/{{ .Env.SSL_KEY_FILE }}; + ssl_certificate /etc/nginx/certs/{{ .Env.SSL_CERT_FILE }}; + ssl_certificate_key /etc/nginx/certs/{{ .Env.SSL_KEY_FILE }}; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; - ssl_prefer_server_ciphers off; + ssl_prefer_server_ciphers off; # HSTS - Only enable when SSL is enabled - add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; {{ end }} # Increase WebSocket timeout settings @@ -40,7 +40,7 @@ server { {{ if eq .Env.NODE_ENV "production" }} # Production configuration root /usr/share/nginx/html; - + # Handle static assets location /assets/ { alias /usr/share/nginx/html/assets/; @@ -78,4 +78,4 @@ server { proxy_pass_request_body on; } {{ end }} -} \ No newline at end of file +} diff --git a/nginx/templates/grafana.conf b/nginx/templates/grafana.conf index d545379..68ea88d 100644 --- a/nginx/templates/grafana.conf +++ b/nginx/templates/grafana.conf @@ -9,13 +9,13 @@ server { listen {{ .Env.GRAFANA_PORT }}; {{ end }} server_name {{ .Env.HOSTNAME }}; - + {{ if eq .Env.SSL_ENABLE "true" }} # Redirect HTTP to HTTPS when accessing HTTPS port error_page 497 =301 https://$host:$server_port$request_uri; - ssl_certificate /etc/nginx/ssl/{{ .Env.SSL_CERT_FILE }}; - ssl_certificate_key /etc/nginx/ssl/{{ .Env.SSL_KEY_FILE }}; + ssl_certificate /etc/nginx/certs/{{ .Env.SSL_CERT_FILE }}; + ssl_certificate_key /etc/nginx/certs/{{ .Env.SSL_KEY_FILE }}; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; @@ -58,4 +58,4 @@ server { proxy_pass_request_headers on; proxy_pass_request_body on; } -} \ No newline at end of file +} diff --git a/nginx/templates/phpmyadmin.conf b/nginx/templates/phpmyadmin.conf index 46af2e4..cb3c5af 100755 --- a/nginx/templates/phpmyadmin.conf +++ b/nginx/templates/phpmyadmin.conf @@ -9,13 +9,13 @@ server { listen {{ .Env.PMA_PORT }}; {{ end }} server_name {{ .Env.HOSTNAME }}; - + {{ if eq .Env.SSL_ENABLE "true" }} # Redirect HTTP to HTTPS when accessing HTTPS port error_page 497 =301 https://$host:$server_port$request_uri; - ssl_certificate /etc/nginx/ssl/{{ .Env.SSL_CERT_FILE }}; - ssl_certificate_key /etc/nginx/ssl/{{ .Env.SSL_KEY_FILE }}; + ssl_certificate /etc/nginx/certs/{{ .Env.SSL_CERT_FILE }}; + ssl_certificate_key /etc/nginx/certs/{{ .Env.SSL_KEY_FILE }}; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; @@ -57,4 +57,4 @@ server { proxy_pass_request_headers on; proxy_pass_request_body on; } -} \ No newline at end of file +} diff --git a/nginx/templates/redis.conf b/nginx/templates/redis.conf index 72d6c8f..da9f905 100644 --- a/nginx/templates/redis.conf +++ b/nginx/templates/redis.conf @@ -9,13 +9,13 @@ server { listen {{ .Env.REDIS_INSIGHT_PORT }}; {{ end }} server_name {{ .Env.HOSTNAME }}; - + {{ if eq .Env.SSL_ENABLE "true" }} # Redirect HTTP to HTTPS when accessing HTTPS port error_page 497 =301 https://$host:$server_port$request_uri; - ssl_certificate /etc/nginx/ssl/{{ .Env.SSL_CERT_FILE }}; - ssl_certificate_key /etc/nginx/ssl/{{ .Env.SSL_KEY_FILE }}; + ssl_certificate /etc/nginx/certs/{{ .Env.SSL_CERT_FILE }}; + ssl_certificate_key /etc/nginx/certs/{{ .Env.SSL_KEY_FILE }}; ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; @@ -32,7 +32,7 @@ server { {{ if and .Env.REDIS_INSIGHT_USER .Env.REDIS_INSIGHT_PASSWORD }} auth_basic "Redis Insight Access"; auth_basic_user_file /etc/nginx/.htpasswd; - + # Additional security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; @@ -56,4 +56,4 @@ server { proxy_pass_request_headers on; proxy_pass_request_body on; } -} \ No newline at end of file +}