On Wed, Aug 25, 2021 at 04:55:28PM +0800, Lu Weitao wrote:
[Why] Some clients(chrome|firefox bowser) can't access srv-http like: http://api.compass-ci.openeuler.org/pub because the url will be change as:(it's default behavior of bowser) https://api.compass-ci.openeuler.org/pub
so srv-http need support https access
[How] with start container/srv-http:
check current server exists?: /etc/ssl/certs/web-backend.crt /etc/ssl/certs/web-backend.key | | v v yes no config nginx.conf like: config /nginx.conf like: ... ... listen $port ssl: listen $port; ... | v start nginx in container
Signed-off-by: Lu Weitao luweitaobe@163.com
container/srv-http/docker_run.sh | 9 +++++++++ container/srv-http/root/sbin/entrypoint.sh | 13 ++++++++++++- container/srv-http/start-cci | 2 ++ container/srv-http/start-git | 2 ++ container/srv-http/start-initrd | 2 ++ container/srv-http/start-os | 2 ++ container/srv-http/start-pub | 2 ++ container/srv-http/start-result | 2 ++ container/srv-http/start-rpm | 2 ++ 9 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 container/srv-http/docker_run.sh
diff --git a/container/srv-http/docker_run.sh b/container/srv-http/docker_run.sh new file mode 100644 index 00000000..fcd9083d --- /dev/null +++ b/container/srv-http/docker_run.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# SPDX-License-Identifier: MulanPSL-2.0+ +# Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
+mount_ssl(){
- if [ -f "/etc/ssl/certs/web-backend.key" ] && [ -f "/etc/ssl/certs/web-backend.crt" ]; then
echo "-v /etc/ssl/certs:/opt/cert"- fi
defined var: ssl_path="/etc/ssl/certs/" , avoid long contents;
+} diff --git a/container/srv-http/root/sbin/entrypoint.sh b/container/srv-http/root/sbin/entrypoint.sh index ced6eda5..d0d354c2 100755 --- a/container/srv-http/root/sbin/entrypoint.sh +++ b/container/srv-http/root/sbin/entrypoint.sh @@ -1,6 +1,17 @@ #!/bin/sh
-sed -i "s/listen 11300;/listen $LISTEN_PORT;/g" /etc/nginx/conf.d/default.conf +ssl_conf="\ ssl_certificate /opt/cert/web-backend.crt;\n\
- ssl_certificate_key /opt/cert/web-backend.key;\n\
- ssl_session_timeout 5m;\n\
- ssl_ciphers BCDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;\n\
- ssl_prefer_server_ciphers on;\n"
+if [ -f "/opt/cert/web-backend.key" ] && [ -f "/opt/cert/web-backend.crt" ]; then
- sed -i "s/listen 11300;/listen $LISTEN_PORT ssl;/g" /etc/nginx/conf.d/default.conf
- sed -i "/server_name/a $ssl_conf" /etc/nginx/conf.d/default.conf
+else
- sed -i "s/listen 11300;/listen $LISTEN_PORT;/g" /etc/nginx/conf.d/default.conf
+fi
perhaps modify like this:
listen="$LISTEN_PORT"
if [ -f "/opt/cert/web-backend.key" ] && [ -f "/opt/cert/web-backend.crt" ]; then listen="$listen ssl" sed -i "/server_name/a $ssl_conf" /etc/nginx/conf.d/default.conf fi
sed -i "s/listen 11300;/listen $listen;/g" /etc/nginx/conf.d/default.conf
Thanks, Liushaofei
nginx /usr/sbin/php-fpm7 diff --git a/container/srv-http/start-cci b/container/srv-http/start-cci index aa539d20..1f160f44 100755 --- a/container/srv-http/start-cci +++ b/container/srv-http/start-cci @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-cci
cmd=( @@ -13,6 +14,7 @@ cmd=( -p 20011:20011 -v /srv/cci/libvirt-xml:/srv/cci/libvirt-xml:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
) diff --git a/container/srv-http/start-git b/container/srv-http/start-git index 0b0ff477..5851af6f 100755 --- a/container/srv-http/start-git +++ b/container/srv-http/start-git @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-git
cmd=( @@ -13,6 +14,7 @@ cmd=( -p 20010:20010 -v /srv/git/archlinux:/srv/git/archlinux:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
) diff --git a/container/srv-http/start-initrd b/container/srv-http/start-initrd index 41958da2..c8e7eded 100755 --- a/container/srv-http/start-initrd +++ b/container/srv-http/start-initrd @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-initrd
cmd=( @@ -17,6 +18,7 @@ cmd=( -v /srv/initrd/osimage:/srv/initrd/osimage:ro -v /srv/initrd/deps:/srv/initrd/deps:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
) diff --git a/container/srv-http/start-os b/container/srv-http/start-os index 5b63902e..c2012397 100755 --- a/container/srv-http/start-os +++ b/container/srv-http/start-os @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-os
cmd=( @@ -13,6 +14,7 @@ cmd=( -p 20009:20009 -v /srv/os:/srv/os:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
) diff --git a/container/srv-http/start-pub b/container/srv-http/start-pub index 6dfd5a44..2224737e 100755 --- a/container/srv-http/start-pub +++ b/container/srv-http/start-pub @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-pub
cmd=( @@ -13,6 +14,7 @@ cmd=( -p 20006:20006 -v /srv/pub:/srv/pub:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
) diff --git a/container/srv-http/start-result b/container/srv-http/start-result index 32bdf7df..c9e0eac2 100755 --- a/container/srv-http/start-result +++ b/container/srv-http/start-result @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-result
cmd=( @@ -13,6 +14,7 @@ cmd=( -p 20007:20007 -v /srv/result:/srv/result:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
) diff --git a/container/srv-http/start-rpm b/container/srv-http/start-rpm index 2d38298c..62fb1385 100755 --- a/container/srv-http/start-rpm +++ b/container/srv-http/start-rpm @@ -3,6 +3,7 @@ # Copyright (c) 2020 Huawei Technologies Co., Ltd. All rights reserved.
. $CCI_SRC/container/defconfig.sh +. ./docker_run.sh docker_rm srv-http-rpm
cmd=( @@ -13,6 +14,7 @@ cmd=( -p 20012:20012 -v /srv/rpm/pub:/srv/rpm/pub:ro -v /etc/localtime:/etc/localtime:ro
- $(mount_ssl) -d srv-http
)
2.23.0