6
Im heavily investigating this, and like many people, im discovering that in 2020 there doesn't seem to be so much logic in separating tightly coupled webserver + PHP + app process/code from each other:
Two main arguments for separation are scalability and separation of concerns (one process per container).
Logically the webserver should only act as webserver ...
5
docker-compose is just a glorified wrapper around docker which gives you a nice textual representation of all the options you would regularly give to docker build or docker run. Plus, of course, it bundles several docker images/containers together. That said, it has no provisions to run anything else than you would get by calling docker.
I don't see how you ...
5
As per Martin Flowers' definition of Blue-Green deployment
The blue-green deployment approach does this by ensuring you have two production environments, as identical as possible. At any time one of them, let's say blue for the example, is live. As you prepare a new release of your software you do your final stage of testing in the green environment. Once ...
4
Unless you are using the AWS API Gateway, you'll still need some way of "serving" your Flask API. You will also need to provision an EC2 instance and run something to serve your API. Instead of running a windows EC2 instance with IIS you can save about 50% operating cost and use Nginx on a linux EC2 instance. Additionally, Nginx can be used as a reverse ...
4
The "official" nginx image has a specific path where it looks for files. You can either copy a file into the image by creating a new image from it or mount your files into this path as a volume.
To copy files, have a folder with your index.html and a Dockerfile that looks like this:
FROM nginx
COPY index.html /usr/share/nginx/html
Then build a new ...
2
I have done this in the past using https://github.com/hashicorp/consul-template.
What consul-template does it generate a configuration file (for nginx) based on a certain template you provide. And the values that it fills into this template are coming from the configuration stored in consul.
Each time your micro-services register themselves in consul and ...
2
I was able to combine your two example files by first converting them to JSON.
foo.json
{
"apiVersion": "extensions/v1beta1",
"kind": "Ingress",
"metadata": {
"name": "nginx-ingress"
},
"spec": {
"tls": [
{
"hosts": [
"foo.bar.com"
],
"secretName": "tls-secret"
}
],
"rules": [
{
...
2
As per this docker documentation the copy instruction may have multiple sources but only one destination.
Your first copy is coping two file /etc/passwd and /etc/group to /etc.
2
You will find people from both camps (terminating TLS as soon as possible vs terminating TLS in the application code) but it's not as serious as for example tabs vs spaces.
The benefit of terminating TLS by reverse proxy is that application developer does not have to implement TLS in the application itself - possibly introducing bugs. Another benefit ...
2
I would suggest at least one for production and one for npe. The nginx-ingress helm chart appears to only support setting a scope to all namespaces or just one namespace (a frustrating limitation not in other ingress controller options):
https://github.com/helm/charts/tree/master/stable/nginx-ingress
controller.scope.namespace
2
It just works
Your configuration is correct.
Provided YAML file generates nginx config like this:
...
server {
listen 80;
server_name example.com;
...
location ~* "^/service/test" {
root /var/www/example.com/htdocs;
}
}
Testing this config via this cool tester shows that location filter works:
http://example.com/service/test1 -> ...
2
According to your screen dump you have your port 80 mapped to the Traefik container
58cd5b59579c traefik:v2.2 "/entrypoint.sh --lo…" 16 minutes ago Up 15 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp frappe_docker_traefik_1
The listen address of this mapping is 0.0.0.0 on both port 80 HTTP, and 443 ...
2
Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network).
A wider answer would primarily depend on whether you trust your Docker host and services on ...
2
You can't configure your Ingress to serve static data (from your host files for example) alone because the Ingress resource is just a way to configure a way of understanding for Kubernetes on how to access a specific internal resource from outside the cluster.
An API object that manages external access to the services in a cluster, typically HTTP.
Ingress ...
1
Nginx will help you in performing the below items if you need some of them, Then I would say it make sense to add it to the stack
Optimize the caching (you can also cache dynamic content.
Restrict access to the services (based on ips).
Implement basic auth for some services.
Load balancing traffic between different posds or services.
Rewrite URLS.
Pass ...
1
Issue ended up being that I was creating a self signed cert because I was using the wrong issuer. I had an issue before with the dev.yaml file but never updated for this new ENV.
1
Answered my own question, documented my steps on my Github repo.
Recap:
Add Nginx config to desired domains:
location ~ /.well-known/acme-challenge {
allow all;
try_files $uri $uri/ /index.php;
}
Use certbot staging to try out test certificates before running the real deal.
sudo docker run -it --rm -v /some/place/to/save/letsencrypt:/...
1
While this is possible it is not a best practice. Whenever possible, containers should contain a single process. The reasoning for this is:
It fosters a modular design where you can more easily plug and play components. What if you decide not to use nginx and use asp.net core in the future? If everything is tightly coupled in one container then the ...
1
There are lots of good tutorials for NGINX and it is an easy server to setup with the Angular router. You can still accomplish this with an Apache server, but you may need more steps in your Dockerfile. As a starting place check out the answer on Stack Overflow Deploy Angular 2 to Apache Server. These types of server modifications will need to be baked ...
1
This question doesn't really make sense - WSGI is the mechanism that a web server such as Apache would use to invoke an application or script, such as something written in Python. If you have no web server, then what would be using WSGI in the first place?
Is the question really, how do I take a pre-existing WSGI application and turn it into a standalone? ...
1
All cookies and headers are a construct of the HTTP protocol. Kubernetes Services operate on TCP/UDP packets therefore it will pass the payload as-is.
It is not that there isn't an nginx.conf file but rather the configuration is managed via annotations. See this link
https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/...
1
I suggest you mount your conf file as a volume:
docker run -v nginx.conf:/etc/nginx/nginx.conf ....
This way you can easily change the file outside the container and then just restart the container. If you change your config file inside the container and then you should have to restart nginx to pick-up the changes. At that point your container will stop ...
1
You will notice in this upstream block:
upstream api {
server server:5000;
}
I called it api but then I say server server:5000;. That was the problem because I originally had it as:
upstream server {
server server:5000;
}
but then thought that server might be a reserved operator in the Nginx world so I changed it to api but did not change it ...
1
I would suggest to use Ubuntu form docker hub and try Ubuntu alpine image.
there should be also problem form database if your database is outside the K8s cluster so may possible latency problem should be there
1
Here is nginx and php done as an s2i builder image. You can basically have plain old php in a git repo and run s2i to make a runtime image that runs it with nginx and php. You simply docker build that dockerfile and pass the resultant image as the builder image to s2i along with your source code.
You will notice I have archived that project. That is because ...
1
Oops, turns out I just have to remove the line
listen [::]:443 ssl ipv6only=on;
and it works.
it's leftover from running NGINX certbot, I thought that was important
1
Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not.
One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer ...
1
Production configurations often involve multiple levels of proxies. Each should provide a place for gathering stats. Proxies can also hide backend failures if you have a pool of nodes behind the proxy, which doesn't seem to be what you're going for here.
Your comment that you wouldn't be able to renew certificates with extra proxies is not correct. You ...
1
Sure, you put in as many proxies as you need. You don't want to over-complicate things, but it seems you have a good reason for your architecture.
Only top voted, non community-wiki answers of a minimum length are eligible