Configure SSL and CA Certificates

In today's digital landscape, securing web applications is paramount. One of the fundamental aspects of web security is implementing SSL/TLS encryption to protect data transmitted between clients and servers. In this guide, we'll delve into configuring SSL and CA certificates for Docker-based installations, ensuring your web applications are safeguarded against potential threats.

Setting up Domain:

1. Begin by configuring your domain name in the Nginx configuration file. Copy the default nginx.conf file and replace occurrences of %domainname% with your actual domain name.

   cp init/nginx.conf nginx.conf
   # Make changes in nginx.conf replacing `%domainname%` with `domain_actual`

2. Update the builder_url in the dronahq.env file to reflect your assigned domain.

   nano dronahq.env
   # Update builder_url to https://domain_name

3. Restart the web server to apply the changes.

   sudo docker compose stop webapp webserver
   sudo docker compose rm webapp webserver
   sudo docker compose up -d webapp webserver

Configuring SSL for Docker-Based Installation

Configure Self-Signed Certificates:

To configure SSL for your Docker-based installation, follow these steps to generate and implement a self-signed certificate:

1. Copy the default configuration file nginx.conf located in the init directory to the root directory and make necessary changes to accommodate your domain.

   cp init/nginx.conf nginx.conf

   Update occurrences of %domainname% with your actual domain name in the nginx.conf file.

2. Restart the web server to apply the updated configuration.

   sudo docker compose restart webserver

3. Generate the SSL certificate using Certbot with the provided Docker Compose configuration. Replace <your_email_id> with your email address and <your_custom_domain> with your custom domain.

   sudo docker compose -f certbot-docker-compose.yml run --rm certbot certonly --webroot --webroot-path /var/www/certbot/ --force-renewal --email <your_email_id> -d <your_custom_domain> --agree-tos --non-interactive

4. Copy the default configuration file nginx-ssl-default.conf from the init directory to the root directory, then replace occurrences of %domainname% with your actual domain name.

   cp init/nginx-ssl-default.conf nginx.conf

   Update all occurrences of %domainname% with your real domain in the nginx.conf file.

5. Modify the builder_url in the dronahq.env file to use HTTPS with your domain name.

   nano dronahq.env
   # Replace builder_url with https://domain_name

6. Restart Services: Stop and remove the web application and web server containers, then bring them back up to apply the SSL configuration.

   sudo docker compose stop webapp webserver
   sudo docker compose rm webapp webserver
   sudo docker compose up -d webapp webserver

Configuring Custom Certificates:

1. If you have custom SSL certificates, copy them to a designated folder on your machine. Let's denote this folder as XYZ.
2. Update the docker-compose.yml file to include the volume mapping for the certificate files. Replace /xyz/ with the path to your custom certificate folder and ensure it's appropriately mounted to /certificates/ within the container.

   services:
     webserver:
       volumes:
         - /path/to/XYZ/:/certificates/:ro
   Ensure that XYZ can be replaced with the actual folder name where your certificates are stored.
3. Modify the nginx.conf file to point to the custom certificate locations.

   cp init/nginx-ssl-default.conf nginx.conf
   # Replace all occurrences of `%domainname%` with your actual domain name
   Replace:
     ssl_certificate /etc/nginx/ssl/live/%domainname%/fullchain.pem;
     ssl_certificate_key /etc/nginx/ssl/live/%domainname%/privkey.pem;
   With:
     ssl_certificate /certificates/fullchain.pem;
     ssl_certificate_key /certificates/privkey.pem;
4. Restart the web server to apply the custom certificate configuration.

   sudo docker compose stop webapp webserver
   sudo docker compose rm webapp webserver
   sudo docker compose up -d webapp webserver