From 1948a41949f64c11fac0e8673dbc2f1d33ec744f Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:03:44 -0400 Subject: [PATCH 01/12] Add a note on how ssl and multiple domains interact Refs #2086 --- docs/deployment/ssl-configuration.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/deployment/ssl-configuration.md b/docs/deployment/ssl-configuration.md index 0837b9a57..7fbfafdfe 100644 --- a/docs/deployment/ssl-configuration.md +++ b/docs/deployment/ssl-configuration.md @@ -35,6 +35,12 @@ dokku certs:add < cert-key.tar cat yourdomain_com.crt yourdomain_com.ca-bundle > server.crt ``` +#### SSL and Multiple Domains + +When an SSL certificate is associated to an application, the certificate will be associated with *all* domains currently associated with said application. Your certificate _should_ be associated with all of those domains, otherwise accessing the application will result in SSL errors. If you wish to remove one of the domains from the application, refer to the [domain plugin documentation](/dokku/nginx/#domains-plugin). + +Note that with the default nginx template, requests will be redirected to the `https` version of the domain. If this is not the desired state of request resolution, you may customize the nginx template in use. For more details, see the [nginx documentation](/dokku/nginx/#domains-plugin). + ### Certificate generation > Note: Using this method will create a self-signed certificate, which is only recommended for development or staging use, not production environments. From 0ea44cfafb6909f946b73e1676f185544efd66c5 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:07:21 -0400 Subject: [PATCH 02/12] Create domains.md --- docs/deployment/domains.md | 72 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 docs/deployment/domains.md diff --git a/docs/deployment/domains.md b/docs/deployment/domains.md new file mode 100644 index 000000000..c6a6c51c6 --- /dev/null +++ b/docs/deployment/domains.md @@ -0,0 +1,72 @@ +# Domains configuration + +> New as of 0.3.10 + +```shell +domains:add DOMAIN Add a domain to app +domains [] List domains +domains:clear Clear all domains for app +domains:disable Disable VHOST support +domains:enable Enable VHOST support +domains:remove DOMAIN Remove a domain from app +domains:set-global Set global domain name +``` + +## Disabling VHOSTS + +If desired, it is possible to disable vhosts with the domains plugin. + +```shell +dokku domains:disable myapp +``` + +On subsequent deploys, the nginx virtualhost will be discarded. This is useful when deploying internal-facing services that should not be publicly routeable. As of 0.4.0, nginx will still be configured to proxy your app on some random high port. This allows internal services to maintain the same port between deployments. You may change this port by setting `DOKKU_NGINX_PORT` and/or `DOKKU_NGINX_SSL_PORT` (for services configured to use SSL.) + + +The domains plugin allows you to specify custom domains for applications. This plugin is aware of any ssl certificates that are imported via `certs:add`. Be aware that disabling domains (with `domains:disable`) will override any custom domains. + +```shell +# where `myapp` is the name of your app + +# add a domain to an app +dokku domains:add myapp example.com + +# list custom domains for app +dokku domains myapp + +# clear all custom domains for app +dokku domains:clear myapp + +# remove a custom domain from app +dokku domains:remove myapp example.com +``` + +## Default site + +By default, dokku will route any received request with an unknown HOST header value to the lexicographically first site in the nginx config stack. If this is not the desired behavior, you may want to add the following configuration to the global nginx configuration. This will catch all unknown HOST header values and return a `410 Gone` response. You can replace the `return 410;` with `return 444;` which will cause nginx to not respond to requests that do not match known domains (connection refused). + +``` +server { + listen 80 default_server; + listen [::]:80 default_server; + + server_name _; + return 410; + log_not_found off; +} +``` + +You may also wish to use a separate vhost in your `/etc/nginx/sites-enabled` directory. To do so, create the vhost in that directory as `/etc/nginx/sites-enabled/00-default.conf`. You will also need to change two lines in the main `nginx.conf`: + +``` +# Swap both conf.d include line and the sites-enabled include line. From: +include /etc/nginx/conf.d/*.conf; +include /etc/nginx/sites-enabled/*; + +# to the following + +include /etc/nginx/sites-enabled/*; +include /etc/nginx/conf.d/*.conf; +``` + +Alternatively, you may push an app to your dokku host with a name like "00-default". As long as it lists first in `ls /home/dokku/*/nginx.conf | head`, it will be used as the default nginx vhost. From 344a63b95686c1d1fd6ad3729c6abc41e0c7b8e6 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:07:47 -0400 Subject: [PATCH 03/12] Move the domains documentation to its own page --- docs/nginx.md | 70 +++------------------------------------------------ 1 file changed, 4 insertions(+), 66 deletions(-) diff --git a/docs/nginx.md b/docs/nginx.md index 3fc30fc92..355160b5e 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -161,77 +161,15 @@ You can also use the built-in `domains` plugin to handle: ### Domains plugin -> New as of 0.3.10 +See the [domains documentation](/dokku/deployment/domains/). -```shell -domains:add DOMAIN Add a domain to app -domains [] List domains -domains:clear Clear all domains for app -domains:disable Disable VHOST support -domains:enable Enable VHOST support -domains:remove DOMAIN Remove a domain from app -domains:set-global Set global domain name -``` - -### Disabling VHOSTS - -If desired, it is possible to disable vhosts with the domains plugin. - -```shell -dokku domains:disable myapp -``` - -On subsequent deploys, the nginx virtualhost will be discarded. This is useful when deploying internal-facing services that should not be publicly routeable. As of 0.4.0, nginx will still be configured to proxy your app on some random high port. This allows internal services to maintain the same port between deployments. You may change this port by setting `DOKKU_NGINX_PORT` and/or `DOKKU_NGINX_SSL_PORT` (for services configured to use SSL.) - - -The domains plugin allows you to specify custom domains for applications. This plugin is aware of any ssl certificates that are imported via `certs:add`. Be aware that disabling domains (with `domains:disable`) will override any custom domains. - -```shell -# where `myapp` is the name of your app - -# add a domain to an app -dokku domains:add myapp example.com - -# list custom domains for app -dokku domains myapp - -# clear all custom domains for app -dokku domains:clear myapp - -# remove a custom domain from app -dokku domains:remove myapp example.com -``` +## Disabling VHOSTS +See the [disabling vhosts documentation](/dokku/deployment/domains/#disabling-vhosts). ## Default site -By default, dokku will route any received request with an unknown HOST header value to the lexicographically first site in the nginx config stack. If this is not the desired behavior, you may want to add the following configuration to the global nginx configuration. This will catch all unknown HOST header values and return a `410 Gone` response. You can replace the `return 410;` with `return 444;` which will cause nginx to not respond to requests that do not match known domains (connection refused). - -``` -server { - listen 80 default_server; - listen [::]:80 default_server; - - server_name _; - return 410; - log_not_found off; -} -``` - -You may also wish to use a separate vhost in your `/etc/nginx/sites-enabled` directory. To do so, create the vhost in that directory as `/etc/nginx/sites-enabled/00-default.conf`. You will also need to change two lines in the main `nginx.conf`: - -``` -# Swap both conf.d include line and the sites-enabled include line. From: -include /etc/nginx/conf.d/*.conf; -include /etc/nginx/sites-enabled/*; - -# to the following - -include /etc/nginx/sites-enabled/*; -include /etc/nginx/conf.d/*.conf; -``` - -Alternatively, you may push an app to your dokku host with a name like "00-default". As long as it lists first in `ls /home/dokku/*/nginx.conf | head`, it will be used as the default nginx vhost. +See the [default site documentation](/dokku/deployment/domains/#default-site). ## Running behind a load balancer From a62bae8c7c8a544230b8a085eb64b258cddf85de Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:08:59 -0400 Subject: [PATCH 04/12] Fix link to the domains plugin --- docs/deployment/ssl-configuration.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/deployment/ssl-configuration.md b/docs/deployment/ssl-configuration.md index 7fbfafdfe..c4acc56f3 100644 --- a/docs/deployment/ssl-configuration.md +++ b/docs/deployment/ssl-configuration.md @@ -37,9 +37,9 @@ cat yourdomain_com.crt yourdomain_com.ca-bundle > server.crt #### SSL and Multiple Domains -When an SSL certificate is associated to an application, the certificate will be associated with *all* domains currently associated with said application. Your certificate _should_ be associated with all of those domains, otherwise accessing the application will result in SSL errors. If you wish to remove one of the domains from the application, refer to the [domain plugin documentation](/dokku/nginx/#domains-plugin). +When an SSL certificate is associated to an application, the certificate will be associated with *all* domains currently associated with said application. Your certificate _should_ be associated with all of those domains, otherwise accessing the application will result in SSL errors. If you wish to remove one of the domains from the application, refer to the [domains documentation](/dokku/deployment/domains/). -Note that with the default nginx template, requests will be redirected to the `https` version of the domain. If this is not the desired state of request resolution, you may customize the nginx template in use. For more details, see the [nginx documentation](/dokku/nginx/#domains-plugin). +Note that with the default nginx template, requests will be redirected to the `https` version of the domain. If this is not the desired state of request resolution, you may customize the nginx template in use. For more details, see the [nginx documentation](/dokku/nginx/). ### Certificate generation From cb9d98a819b50e1c3a471b9499b08854e0f6b4b6 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:12:18 -0400 Subject: [PATCH 05/12] Add domain configuration link [ci skip] --- docs/template.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/template.html b/docs/template.html index 4cae8aff4..a4312d554 100644 --- a/docs/template.html +++ b/docs/template.html @@ -107,7 +107,8 @@ Configuration Environment Variables - DNS Configuration + DNS Configuration + Domain Configuration Nginx Configuration SSL Configuration Dokku Event Logs From 841c8c22d75227e69294b498a770cfcc89012513 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:12:36 -0400 Subject: [PATCH 06/12] Fix casing [ci skip] --- docs/deployment/domains.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/deployment/domains.md b/docs/deployment/domains.md index c6a6c51c6..6d43debf5 100644 --- a/docs/deployment/domains.md +++ b/docs/deployment/domains.md @@ -1,4 +1,4 @@ -# Domains configuration +# Domains Configuration > New as of 0.3.10 From 89d1a9751c654e9aa41678a9153bb6a4af7cfb38 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:12:58 -0400 Subject: [PATCH 07/12] Update and rename domains.md to domain-configuration.md [ci skip] --- docs/deployment/{domains.md => domain-configuration.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename docs/deployment/{domains.md => domain-configuration.md} (99%) diff --git a/docs/deployment/domains.md b/docs/deployment/domain-configuration.md similarity index 99% rename from docs/deployment/domains.md rename to docs/deployment/domain-configuration.md index 6d43debf5..ea1f2c9ae 100644 --- a/docs/deployment/domains.md +++ b/docs/deployment/domain-configuration.md @@ -1,4 +1,4 @@ -# Domains Configuration +# Domain Configuration > New as of 0.3.10 From a36d35d7528126c326e1ee03a20ca5b389e47843 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:13:18 -0400 Subject: [PATCH 08/12] Update ssl-configuration.md [ci skip] --- docs/deployment/ssl-configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/deployment/ssl-configuration.md b/docs/deployment/ssl-configuration.md index c4acc56f3..8a31dfcf2 100644 --- a/docs/deployment/ssl-configuration.md +++ b/docs/deployment/ssl-configuration.md @@ -37,7 +37,7 @@ cat yourdomain_com.crt yourdomain_com.ca-bundle > server.crt #### SSL and Multiple Domains -When an SSL certificate is associated to an application, the certificate will be associated with *all* domains currently associated with said application. Your certificate _should_ be associated with all of those domains, otherwise accessing the application will result in SSL errors. If you wish to remove one of the domains from the application, refer to the [domains documentation](/dokku/deployment/domains/). +When an SSL certificate is associated to an application, the certificate will be associated with *all* domains currently associated with said application. Your certificate _should_ be associated with all of those domains, otherwise accessing the application will result in SSL errors. If you wish to remove one of the domains from the application, refer to the [domain configuration documentation](/dokku/deployment/domain-configuration/). Note that with the default nginx template, requests will be redirected to the `https` version of the domain. If this is not the desired state of request resolution, you may customize the nginx template in use. For more details, see the [nginx documentation](/dokku/nginx/). From 66ad41f814eb4a28392267e8083bbdf8a049449a Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:14:12 -0400 Subject: [PATCH 09/12] Fix links [ci skip] --- docs/nginx.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/nginx.md b/docs/nginx.md index 355160b5e..a173a6fdc 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -157,19 +157,17 @@ echo "$NEW_SUBDOMAIN.$VHOST" If the `nginx-hostname` has no output, the normal hostname algorithm will be executed. -You can also use the built-in `domains` plugin to handle: - ### Domains plugin -See the [domains documentation](/dokku/deployment/domains/). +See the [domain-configuration documentation](/dokku/deployment/domain-configuration/). ## Disabling VHOSTS -See the [disabling vhosts documentation](/dokku/deployment/domains/#disabling-vhosts). +See the [disabling vhosts documentation](/dokku/deployment/domain-configuration/#disabling-vhosts). ## Default site -See the [default site documentation](/dokku/deployment/domains/#default-site). +See the [default site documentation](/dokku/deployment/domain-configuration/#default-site). ## Running behind a load balancer From 6b48b250a7869342ecb7a45cf632afd3ac345626 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:14:56 -0400 Subject: [PATCH 10/12] Add documentation on customizing hostnames [ci skip] --- docs/deployment/domain-configuration.md | 26 +++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/docs/deployment/domain-configuration.md b/docs/deployment/domain-configuration.md index ea1f2c9ae..8669475bb 100644 --- a/docs/deployment/domain-configuration.md +++ b/docs/deployment/domain-configuration.md @@ -12,6 +12,32 @@ domains:remove DOMAIN domains:set-global Set global domain name ``` +## Customizing hostnames + +Applications typically have the following structure for their hostname: + +``` +scheme://subdomain.domain.tld +``` + +The `subdomain` is inferred from the pushed application name, while the `domain.tld` is set during initial configuration and stored in the `$DOKKU_ROOT/VHOST` file. It can then be modified with `dokku domains:set-global`. This value is used as a default TLD for all applications on a host. + +If a FQDN such as `other.tld` is used as the application name, the default `$DOKKU_ROOT/VHOST` will be ignored and the resulting vhost URL for that application will be `other.tld`. The exception to this rule being that if the FQDN has the same ending as the default vhost (such as `subdomain.domain.tld`), then the entire FQDN will be treated as a subdomain. The application will therefore be deployed at `subdomain.domain.tld.domain.tld`. + +You can optionally override this in a plugin by implementing the `nginx-hostname` plugin trigger. For example, you can reverse the subdomain with the following sample `nginx-hostname` plugin trigger: + +```shell +#!/usr/bin/env bash +set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x + +APP="$1"; SUBDOMAIN="$2"; VHOST="$3" + +NEW_SUBDOMAIN=`echo $SUBDOMAIN | rev` +echo "$NEW_SUBDOMAIN.$VHOST" +``` + +If the `nginx-hostname` has no output, the normal hostname algorithm will be executed. + ## Disabling VHOSTS If desired, it is possible to disable vhosts with the domains plugin. From 95993955c5193b12736778c1872fef8c0b10b18d Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 7 Apr 2016 21:15:59 -0400 Subject: [PATCH 11/12] Move customizing-hostnames documentation [ci skip] --- docs/nginx.md | 32 +++++--------------------------- 1 file changed, 5 insertions(+), 27 deletions(-) diff --git a/docs/nginx.md b/docs/nginx.md index a173a6fdc..6ab080814 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -131,36 +131,14 @@ chown dokku:dokku /home/dokku/myapp/nginx.conf.d/upload.conf service nginx reload ``` -## Customizing hostnames - -Applications typically have the following structure for their hostname: - -``` -scheme://subdomain.domain.tld -``` - -The `subdomain` is inferred from the pushed application name, while the `domain.tld` is set during initial configuration and stored in the `$DOKKU_ROOT/VHOST` file. It can then be modified with `dokku domains:set-global`. This value is used as a default TLD for all applications on a host. - -If a FQDN such as `other.tld` is used as the application name, the default `$DOKKU_ROOT/VHOST` will be ignored and the resulting vhost URL for that application will be `other.tld`. The exception to this rule being that if the FQDN has the same ending as the default vhost (such as `subdomain.domain.tld`), then the entire FQDN will be treated as a subdomain. The application will therefore be deployed at `subdomain.domain.tld.domain.tld`. - -You can optionally override this in a plugin by implementing the `nginx-hostname` plugin trigger. For example, you can reverse the subdomain with the following sample `nginx-hostname` plugin trigger: - -```shell -#!/usr/bin/env bash -set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x - -APP="$1"; SUBDOMAIN="$2"; VHOST="$3" - -NEW_SUBDOMAIN=`echo $SUBDOMAIN | rev` -echo "$NEW_SUBDOMAIN.$VHOST" -``` - -If the `nginx-hostname` has no output, the normal hostname algorithm will be executed. - -### Domains plugin +## Domains plugin See the [domain-configuration documentation](/dokku/deployment/domain-configuration/). +## Customizing hostnames + +See the [customizing hostnames documentation](/dokku/deployment/domain-configuration/#customizing-hostnames). + ## Disabling VHOSTS See the [disabling vhosts documentation](/dokku/deployment/domain-configuration/#disabling-vhosts). From db94fcb6b4809b2a0ac9c65ed4a85951f2800cbd Mon Sep 17 00:00:00 2001 From: Michael Hobbs Date: Fri, 8 Apr 2016 13:21:26 -0700 Subject: [PATCH 12/12] include non ssl server names in SSL server block. fixes #2086 --- plugins/nginx-vhosts/templates/ssl.server.config | 1 + tests/unit/40_nginx-vhosts_2.bats | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/plugins/nginx-vhosts/templates/ssl.server.config b/plugins/nginx-vhosts/templates/ssl.server.config index 490a13bb1..7c19885e3 100644 --- a/plugins/nginx-vhosts/templates/ssl.server.config +++ b/plugins/nginx-vhosts/templates/ssl.server.config @@ -2,6 +2,7 @@ server { listen [::]:{{ .NGINX_SSL_PORT }} ssl spdy; listen {{ .NGINX_SSL_PORT }} ssl spdy; {{ if .SSL_SERVER_NAME }}server_name {{ .SSL_SERVER_NAME }}; {{ end }} + {{ if .NOSSL_SERVER_NAME }}server_name {{ .NOSSL_SERVER_NAME }}; {{ end }} {{ include "log.config" . }} ssl_certificate {{ .APP_SSL_PATH }}/server.crt; ssl_certificate_key {{ .APP_SSL_PATH }}/server.key; diff --git a/tests/unit/40_nginx-vhosts_2.bats b/tests/unit/40_nginx-vhosts_2.bats index ad5e48948..902e253fa 100644 --- a/tests/unit/40_nginx-vhosts_2.bats +++ b/tests/unit/40_nginx-vhosts_2.bats @@ -41,6 +41,15 @@ assert_error_log() { assert_error_log ${TEST_APP} } +@test "(nginx-vhosts) nginx:build-config (with SSL & unrelated domain)" { + setup_test_tls + add_domain "node-js-app.dokku.me" + add_domain "test.dokku.me" + deploy_app + assert_ssl_domain "node-js-app.dokku.me" + assert_http_redirect "http://test.dokku.me" "https://test.dokku.me:443/" +} + @test "(nginx-vhosts) nginx:build-config (wildcard SSL)" { setup_test_tls wildcard add_domain "wildcard1.dokku.me"