nginx ssl hardening using self signed ssl certs - part2

harden nginx reverse proxy using self signed ssl certificates

00:00 Intro
00:59 File setup
01:16 Nginx docker-compose file
02:28 Nginx ssl enabled configuration file redirecting http to https
04:12 Generate self signed ssl certificate files for nginx
06:24 Test the end result
07:55 Outro

#nginx
#docker
#ssl
#certificate
#proxy
#hardening
#self
#tls
#shell
#container
#authentication
#explanation
#database
#storage
#linux
#command
#terminal
#build
#application
#backend
#devops

USEFUL********

part2 replication (high availibility):

link for redis docker hub page:

PLAYLISTS*******

let's talk a bit :-*
LINKS********

[viniciusandrade]

Thanks for the content. Its possible in the future explain how to create the same solution using lets encrypt service? Great job.

[davidbayliss]

Thanks - helped me to quickly add nginx ssl for the web frontend of roundcube (webmail) on my Portainer compose-style "stack" along with my container for roundcube itself. (Running Docker MailServer). (nb. there's other stuff you have to change in roundcube to get imap working with SSL/TLS imap port on Docker MailServer - I'm using my own certs on that too so roundcube has to be able to access the CA for them ... and I've still gotta get SMTP StartTLS working between the containers ... I guess I need to add the CA to the roundcube container OS too, maybe).

But for the webmail to be SSL protected - this nginx proxy was the easy way to go.
(Further context: I wanted a purely internal email server just as a log-sink I guess for some apps that insist on email e.g. self-hosted bitwarden ... I'm blocking SMTP relaying for this one ... I have two actually - a pair ... Docker in LCX Containers on Proxmox ... not in HA, (as Proxmox though I have pfsense in HA and use VMs for Docker-swarm/Kubenetes {eventually} that can {will} access the outside world) ... but just for internal admin on a separate VLAN only accessible by direct ethernet to that VLAN or via various VPN solutions, I wanted a purely internal light-email solution - and I guess I'm a bit excessive when I come to encryption lol [on same docker network] ... but I'm old and forgetful and I just try to set things up so that future mistakes might be caught by earlier over-zealousness).

I did notice the use of container IPs ... I'm using container names.
I'm using an "external" network set in Portainer for my collection of email containers.

EXTRACT FROM PORTAINER STACK:

roundcubenginx:
image: nginx:latest
container_name: roundcubenginx
restart: unless-stopped
ports:
- redacted:443
volumes:
- # where nginx config is
- # where my certificates are
networks:
-


MY NGINX CONFIG
... I don't use the IP addresses


upstream roundcube {
server roundcubemail;
}

server{
listen 443 ssl;
server_name roundcubemail;
client_max_body_size 10240M;

ssl_certificate /etc/certs/cert.crt;
ssl_certificate_key /etc/certs/cert.key;

location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
}

I never quite know what I'm doing lol or if things are "right" - I just fumble my way, but just sharing in case useful to anyone else.

nb: I use XCA on Windows to create/manage my internal certificates - I personally have found that to be the easiest/most-convenient for me.