chore: Remove SSL cert handling - use external reverse proxy
- Nginx now listens on HTTP only (port 80) - Remove SSL cert volume mounts from docker-compose - Remove SSL troubleshooting sections - Update docs to indicate SSL handled by Caddy/reverse proxy - Simplify nginx.conf to remove HTTPS server block
This commit is contained in:
+7
-24
@@ -13,13 +13,13 @@
|
||||
│ CoopCredits Server │
|
||||
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
|
||||
│ │ Nginx │ │ Frontend │ │ Backend │ │ PostgreSQL │ │
|
||||
│ │ (80/443) │──│ (Next.js) │──│ (Express) │──│ (5432) │ │
|
||||
│ │ (80) │──│ (Next.js) │──│ (Express) │──│ (5432) │ │
|
||||
│ └──────────────┘ └──────────────┘ └──────┬───────┘ └──────────────┘ │
|
||||
│ │ │
|
||||
│ ┌──────────────┐ ┌──────────────┐ │ ┌──────────────┐ │
|
||||
│ │ Certbot │ │ Redis │◀────────┘ │ Anchor CLI │ │
|
||||
│ │ (SSL) │ │ (6379) │ │ (Optional) │ │
|
||||
│ └──────────────┘ └──────────────┘ └──────────────┘ │
|
||||
│ ┌──────────────┐ │ ┌──────────────┐ │
|
||||
│ │ Redis │◀────────┘ │ Anchor CLI │ │
|
||||
│ │ (6379) │ │ (Optional) │ │
|
||||
│ └──────────────┘ └──────────────┘ │
|
||||
└──────────────────────────────────┬──────────────────────────────────────┘
|
||||
│
|
||||
│ Local Network (172.20.1.0/24)
|
||||
@@ -132,26 +132,9 @@ sudo ufw deny 6379/tcp # Redis
|
||||
- Subnet: 172.20.2.0/24
|
||||
- Used for: backend → Tautulli/Overseer/Plex
|
||||
|
||||
## SSL/TLS Setup
|
||||
## SSL/TLS
|
||||
|
||||
### Let's Encrypt (Recommended)
|
||||
```bash
|
||||
# Initial certificate
|
||||
docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
|
||||
--webroot -w /var/www/certbot \
|
||||
-d coop.hobokenchicken.com \
|
||||
--agree-tos --no-eff-email
|
||||
|
||||
# Auto-renewal (configured in docker-compose)
|
||||
```
|
||||
|
||||
### Self-Signed (Testing only)
|
||||
```bash
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
-keyout docker/nginx/ssl/key.pem \
|
||||
-out docker/nginx/ssl/cert.pem \
|
||||
-subj '/CN=coop.hobokenchicken.com'
|
||||
```
|
||||
SSL/TLS is handled by an external reverse proxy (e.g., Caddy). The application stack runs HTTP only on port 80 internally.
|
||||
|
||||
## Monitoring and Logging
|
||||
|
||||
|
||||
@@ -47,9 +47,10 @@ cd coop-credits
|
||||
This script will:
|
||||
- Test connectivity to your services (Plex, Tautulli, Overseer)
|
||||
- Generate a secure `.env` file
|
||||
- Check SSL certificate status
|
||||
- Output configuration instructions
|
||||
|
||||
**Note:** SSL/TLS is handled by your external reverse proxy (Caddy). The application runs HTTP on port 80 internally.
|
||||
|
||||
### 3. Configure Environment
|
||||
|
||||
Edit the generated `.env` file:
|
||||
@@ -96,40 +97,7 @@ anchor deploy
|
||||
|
||||
Update `SOLANA_PROGRAM_ID` in `.env` with the deployed program ID.
|
||||
|
||||
### 6. Setup SSL Certificates
|
||||
|
||||
#### Option A: Let's Encrypt (Recommended)
|
||||
|
||||
```bash
|
||||
# Obtain certificate
|
||||
docker-compose -f docker-compose.prod.yml run --rm certbot certonly \
|
||||
--webroot -w /var/www/certbot \
|
||||
-d coop.hobokenchicken.com \
|
||||
--agree-tos --no-eff-email
|
||||
|
||||
# Update nginx config to use Let's Encrypt paths
|
||||
# Edit docker/nginx/nginx.prod.conf:
|
||||
# ssl_certificate /etc/letsencrypt/live/coop.hobokenchicken.com/fullchain.pem;
|
||||
# ssl_certificate_key /etc/letsencrypt/live/coop.hobokenchicken.com/privkey.pem;
|
||||
```
|
||||
|
||||
#### Option B: Existing Certificates
|
||||
|
||||
```bash
|
||||
cp /path/to/your/cert.pem docker/nginx/ssl/cert.pem
|
||||
cp /path/to/your/key.pem docker/nginx/ssl/key.pem
|
||||
```
|
||||
|
||||
#### Option C: Self-Signed (Testing only)
|
||||
|
||||
```bash
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
-keyout docker/nginx/ssl/key.pem \
|
||||
-out docker/nginx/ssl/cert.pem \
|
||||
-subj '/CN=coop.hobokenchicken.com'
|
||||
```
|
||||
|
||||
### 7. Deploy
|
||||
### 6. Deploy
|
||||
|
||||
```bash
|
||||
./deployment/deploy-production.sh
|
||||
@@ -304,20 +272,6 @@ sudo ufw enable
|
||||
docker-compose -f docker-compose.prod.yml exec postgres pg_isready -U coop
|
||||
```
|
||||
|
||||
### SSL certificate issues
|
||||
|
||||
1. Check certificate:
|
||||
```bash
|
||||
openssl s_client -connect coop.hobokenchicken.com:443 -servername coop.hobokenchicken.com
|
||||
```
|
||||
|
||||
2. Verify certificate paths in nginx config
|
||||
|
||||
3. Check certificate expiry:
|
||||
```bash
|
||||
openssl x509 -in docker/nginx/ssl/cert.pem -noout -dates
|
||||
```
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Update Application
|
||||
@@ -354,7 +308,7 @@ docker-compose -f docker-compose.prod.yml restart backend
|
||||
## Security Checklist
|
||||
|
||||
- [ ] Changed all default passwords in `.env`
|
||||
- [ ] SSL certificates installed and valid
|
||||
- [ ] External reverse proxy (Caddy) configured for SSL
|
||||
- [ ] Firewall rules configured
|
||||
- [ ] Tautulli webhook secret set
|
||||
- [ ] Overseer webhook secret set
|
||||
|
||||
@@ -123,25 +123,6 @@ solana balance
|
||||
solana airdrop 2
|
||||
```
|
||||
|
||||
### SSL Certificate Errors
|
||||
|
||||
**Error:** Browser shows certificate warnings
|
||||
|
||||
**Solution:**
|
||||
```bash
|
||||
# Check certificate
|
||||
openssl s_client -connect coop.hobokenchicken.com:443
|
||||
|
||||
# Renew Let's Encrypt
|
||||
docker-compose -f docker-compose.prod.yml run --rm certbot renew
|
||||
|
||||
# Or use self-signed for testing:
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
-keyout docker/nginx/ssl/key.pem \
|
||||
-out docker/nginx/ssl/cert.pem \
|
||||
-subj '/CN=coop.hobokenchicken.com'
|
||||
```
|
||||
|
||||
### CORS Errors in Browser
|
||||
|
||||
**Error:** `Access-Control-Allow-Origin` errors
|
||||
@@ -219,19 +200,6 @@ cd frontend
|
||||
npm install next-themes
|
||||
```
|
||||
|
||||
### Nginx: SSL Certificate Error
|
||||
|
||||
**Error:** `cannot load certificate "/etc/nginx/ssl/cert.pem"`
|
||||
|
||||
**Solution:**
|
||||
```bash
|
||||
mkdir -p docker/nginx/ssl
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
-keyout docker/nginx/ssl/key.pem \
|
||||
-out docker/nginx/ssl/cert.pem \
|
||||
-subj "/CN=coop.hobokenchicken.com"
|
||||
```
|
||||
|
||||
### Docker Compose: Public Directory Not Found
|
||||
|
||||
**Error:** `failed to calculate checksum: "/app/frontend/public": not found`
|
||||
|
||||
Reference in New Issue
Block a user