LobotomyLabs/coop
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: Remove SSL cert handling - use external reverse proxy

Browse Source 
- Nginx now listens on HTTP only (port 80)
- Remove SSL cert volume mounts from docker-compose
- Remove SSL troubleshooting sections
- Update docs to indicate SSL handled by Caddy/reverse proxy
- Simplify nginx.conf to remove HTTPS server block
This commit is contained in:
Dustin Newkirk
2026-04-15 14:25:35 -04:00
parent 9516f5d570
commit 67701d10ad
7 changed files with 17 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -8
View File
@@ -37,16 +37,9 @@ cp .env.example .env
# Edit .env with your values (see docs/SETUP-INFRASTRUCTURE.md)
# 3. Create required directories
mkdir -p docker/nginx/ssl
mkdir -p frontend/public
# 4. Generate SSL certificates (self-signed for local dev)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout docker/nginx/ssl/key.pem \
-out docker/nginx/ssl/cert.pem \
-subj "/CN=localhost"
# 5. Start with Docker Compose
# 4. Start with Docker Compose
docker-compose up -d --build
# 6. Initialize database (first time only)
SETUP.md
+3 -8
View File
@@ -104,20 +104,15 @@ npm run dev:frontend # Next.js on port 3000
### 8. Production Deployment
```bash
# Setup SSL certificates (self-signed for local dev, or use real certs)
mkdir -p docker/nginx/ssl
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout docker/nginx/ssl/key.pem \
-out docker/nginx/ssl/cert.pem \
-subj "/CN=coop.hobokenchicken.com"
# Create public directory (required for build)
mkdir -p frontend/public
# Deploy
# Deploy (Caddy handles SSL termination)
docker-compose up -d --build
```
**Note:** This setup runs HTTP only on port 80. Place behind Caddy or another reverse proxy for SSL termination.
## Architecture Overview
```
docker-compose.yml
-2
View File
@@ -96,10 +96,8 @@ services:
container_name: coop-nginx
ports:
- "80:80"
- "443:443"
volumes:
- ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./docker/nginx/ssl:/etc/nginx/ssl:ro
depends_on:
frontend:
condition: service_started
docker/nginx/nginx.conf
+2 -27
View File
@@ -33,35 +33,10 @@ http {
server backend:3001;
}
# HTTP server - redirect to HTTPS
# HTTP server (Caddy handles SSL termination)
server {
listen 80;
server_name coop.hobokenchicken.com;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location / {
return 301 https://$server_name$request_uri;
}
}
# HTTPS server
server {
listen 443 ssl http2;
server_name coop.hobokenchicken.com;
# SSL certificates (replace with your actual certificates)
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/key.pem;
# SSL settings
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
server_name _;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
docs/INFRASTRUCTURE.md
+7 -24
View File
@@ -13,13 +13,13 @@
│ CoopCredits Server │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Nginx │ │ Frontend │ │ Backend │ │ PostgreSQL │ │
│ │ (80/443) │──│ (Next.js) │──│ (Express) │──│ (5432) │ │
│ │ (80) │──│ (Next.js) │──│ (Express) │──│ (5432) │ │
│ └──────────────┘ └──────────────┘ └──────┬───────┘ └──────────────┘ │
│ │ │
│ ┌──────────────┐ ┌──────────────┐ │ ┌──────────────┐ │
│ │ Certbot │ │ Redis │◀────────┘ │ Anchor CLI │ │
│ │ (SSL) │ │ (6379) │ │ (Optional) │ │
│ └──────────────┘ └──────────────┘ └──────────────┘ │
│ ┌──────────────┐ │ ┌──────────────┐ │
│ │ Redis │◀────────┘ │ Anchor CLI │ │
│ │ (6379) │ │ (Optional) │ │
│ └──────────────┘ └──────────────┘ │
└──────────────────────────────────┬──────────────────────────────────────┘
│
│ Local Network (172.20.1.0/24)
@@ -132,26 +132,9 @@ sudo ufw deny 6379/tcp # Redis
- Subnet: 172.20.2.0/24
- Used for: backend → Tautulli/Overseer/Plex
## SSL/TLS Setup
## SSL/TLS
### Let's Encrypt (Recommended)
```bash
# Initial certificate
docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
--webroot -w /var/www/certbot \
-d coop.hobokenchicken.com \
--agree-tos --no-eff-email
# Auto-renewal (configured in docker-compose)
```
### Self-Signed (Testing only)
```bash
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout docker/nginx/ssl/key.pem \
-out docker/nginx/ssl/cert.pem \
-subj '/CN=coop.hobokenchicken.com'
```
SSL/TLS is handled by an external reverse proxy (e.g., Caddy). The application stack runs HTTP only on port 80 internally.
## Monitoring and Logging
docs/SETUP-INFRASTRUCTURE.md
+4 -50
View File
@@ -47,9 +47,10 @@ cd coop-credits
This script will:
- Test connectivity to your services (Plex, Tautulli, Overseer)
- Generate a secure `.env` file
- Check SSL certificate status
- Output configuration instructions
**Note:** SSL/TLS is handled by your external reverse proxy (Caddy). The application runs HTTP on port 80 internally.
### 3. Configure Environment
Edit the generated `.env` file:
@@ -96,40 +97,7 @@ anchor deploy
Update `SOLANA_PROGRAM_ID` in `.env` with the deployed program ID.
### 6. Setup SSL Certificates
#### Option A: Let's Encrypt (Recommended)
```bash
# Obtain certificate
docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
--webroot -w /var/www/certbot \
-d coop.hobokenchicken.com \
--agree-tos --no-eff-email
# Update nginx config to use Let's Encrypt paths
# Edit docker/nginx/nginx.prod.conf:
# ssl_certificate /etc/letsencrypt/live/coop.hobokenchicken.com/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/coop.hobokenchicken.com/privkey.pem;
```
#### Option B: Existing Certificates
```bash
cp /path/to/your/cert.pem docker/nginx/ssl/cert.pem
cp /path/to/your/key.pem docker/nginx/ssl/key.pem
```
#### Option C: Self-Signed (Testing only)
```bash
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout docker/nginx/ssl/key.pem \
-out docker/nginx/ssl/cert.pem \
-subj '/CN=coop.hobokenchicken.com'
```
### 7. Deploy
### 6. Deploy
```bash
./deployment/deploy-production.sh
@@ -304,20 +272,6 @@ sudo ufw enable
docker-compose -f docker-compose.prod.yml exec postgres pg_isready -U coop
```
### SSL certificate issues
1. Check certificate:
```bash
openssl s_client -connect coop.hobokenchicken.com:443 -servername coop.hobokenchicken.com
```
2. Verify certificate paths in nginx config
3. Check certificate expiry:
```bash
openssl x509 -in docker/nginx/ssl/cert.pem -noout -dates
```
## Maintenance
### Update Application
@@ -354,7 +308,7 @@ docker-compose -f docker-compose.prod.yml restart backend
## Security Checklist
- [ ] Changed all default passwords in `.env`
- [ ] SSL certificates installed and valid
- [ ] External reverse proxy (Caddy) configured for SSL
- [ ] Firewall rules configured
- [ ] Tautulli webhook secret set
- [ ] Overseer webhook secret set
docs/TROUBLESHOOTING.md
-32
View File
@@ -123,25 +123,6 @@ solana balance
solana airdrop 2
```
### SSL Certificate Errors
**Error:** Browser shows certificate warnings
**Solution:**
```bash
# Check certificate
openssl s_client -connect coop.hobokenchicken.com:443
# Renew Let's Encrypt
docker-compose -f docker-compose.prod.yml run --rm certbot renew
# Or use self-signed for testing:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout docker/nginx/ssl/key.pem \
-out docker/nginx/ssl/cert.pem \
-subj '/CN=coop.hobokenchicken.com'
```
### CORS Errors in Browser
**Error:** `Access-Control-Allow-Origin` errors
@@ -219,19 +200,6 @@ cd frontend
npm install next-themes
```
### Nginx: SSL Certificate Error
**Error:** `cannot load certificate "/etc/nginx/ssl/cert.pem"`
**Solution:**
```bash
mkdir -p docker/nginx/ssl
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout docker/nginx/ssl/key.pem \
-out docker/nginx/ssl/cert.pem \
-subj "/CN=coop.hobokenchicken.com"
```
### Docker Compose: Public Directory Not Found
**Error:** `failed to calculate checksum: "/app/frontend/public": not found`