{"id":116,"date":"2018-03-09T21:15:48","date_gmt":"2018-03-09T21:15:48","guid":{"rendered":"http:\/\/tonysbit.blog\/?p=116"},"modified":"2018-03-09T21:15:48","modified_gmt":"2018-03-09T21:15:48","slug":"deploying-a-ssl-protected-containerized-app-part-3","status":"publish","type":"post","link":"https:\/\/tonysbit.blog\/?p=116","title":{"rendered":"Deploying a SSL Protected Containerized App: Part 3"},"content":{"rendered":"<h1>Checklist<\/h1>\n<p>Let&#8217;s quickly do a checklist of what we have so far<\/p>\n<ol>\n<li>SSH Accessible Virtual Machine (Running Centos 7.4)<\/li>\n<li>Ports 22, 443, 80 are open on the virtual machine<\/li>\n<li>Domain pointed at the public IP of the Virtual machine<\/li>\n<li>SSL Certificate generated on the virtual machine<\/li>\n<li>Docker CE installed on the virtual machine<\/li>\n<\/ol>\n<p>If you have not completed the steps above, review <a href=\"http:\/\/vfy.mne.mybluehost.me\/tonysbit\/2018\/03\/09\/deploying-a-ssl-protected-containerized-app-using-nginx-reverse-proxy-part-1\/\">part 1<\/a> and <a href=\"http:\/\/vfy.mne.mybluehost.me\/tonysbit\/2018\/03\/09\/deploying-a-ssl-protected-containerized-app-part-2\/\">part 2<\/a>.<\/p>\n<h1>Deploying the Final Stack<\/h1>\n<p>SSH into the virtual machine and swap to the root user.<\/p>\n<p>Move to the root directory of the machine (Running <code>cd \/<\/code>)<\/p>\n<h2>Creating our directories<\/h2>\n<p>Create two directories (This is done for simplicity)<\/p>\n<ul>\n<li><b>certs<\/b> &#8211; This will be used to store the SSL certificates to be used in our NGINX container<\/li>\n<\/ul>\n<p style=\"text-align:center;\"><code>Mkdir \/certs<\/code><\/p>\n<ul>\n<li><strong>docker<\/strong> &#8211; This will be used to store our docker related files (docker-compose.yml<\/li>\n<\/ul>\n<p style=\"text-align:center;\"><code>Mkdir \/docker<\/code><\/p>\n<p>Swap to the docker directory<\/p>\n<p style=\"text-align:center;\"><code>cd \/docker<\/code><\/p>\n<p>Create a docker compose file with the following content (It is case and space sensitive, <a href=\"https:\/\/docs.docker.com\/compose\/overview\/\">read more<\/a> about docker compose).<\/p>\n<h2>Moving and renaming our SSL Certificates<\/h2>\n<p>Unfortunately, Nginx-Proxy must read the SSL certificates as &lt;domain name&gt;.crt and the key as &lt;domain name&gt;.key. as such we need to move and rename the original certificates generated for our domain.<\/p>\n<p>Run the following commands to copy the certificates to the relevant folders and rename:<\/p>\n<p style=\"text-align:center;\"><code>cp \/etc\/letsencrypt\/live\/<strong><span style=\"color:#ff0000;\">&lt;your domain&gt;<\/span><\/strong>\/fullchain.pem \/certs\/<span style=\"color:#ff0000;\"><strong>&lt;your domain&gt;<\/strong><\/span>.crt<\/code><\/p>\n<p style=\"text-align:center;\"><code>cp \/etc\/letsencrypt\/live\/<span style=\"color:#ff0000;\"><strong>&lt;your domain&gt;<\/strong><\/span>\/privkey.pem \/certs\/<span style=\"color:#ff0000;\"><strong>&lt;your domain&gt;<\/strong><\/span>.key<\/code><\/p>\n<h2>Creating a docker-compose.yml file<\/h2>\n<p>The <a href=\"https:\/\/docs.docker.com\/compose\/overview\/\">docker compose<\/a> file will dictate our stack.<\/p>\n<p>Run\u00a0 the following command to create the file at \/docker\/docker-compose.yml<\/p>\n<p style=\"text-align:center;\"><code>vi \/docker\/docker-compose.yml<\/code><\/p>\n<p>Populate the file with the following content<\/p>\n<p>Line by line:<\/p>\n<pre>version: \"3.3\"\nservices:\u00a0 \n  nginx-proxy:\n    image: jwilder\/nginx-proxy #nginx proxy image\n    ports:\n      - \"443:443\"\u00a0 #binding the host port 443 to container 443 port\n    volumes:\n      - \/var\/run\/docker.sock:\/tmp\/docker.sock:ro\u00a0\u00a0\u00a0\u00a0\u00a0 \n      - \/certs:\/etc\/nginx\/certs #Mounting the SSL certificates to the image \n    networks:\n     -\u00a0 webnet\u00a0 \n  visualizer:\n    image: dockersamples\/visualizer:stable\u00a0\n    volumes:\n      - \"\/var\/run\/docker.sock:\/var\/run\/docker.sock\" \u00a0\u00a0\n\u00a0\u00a0  environment:\n      - VIRTUAL_HOST=<strong><span style=\"color:#ff0000;\">&lt;Your DOMAIN ie. domain.com.au&gt;<\/span><\/strong>\nnetworks:\u00a0\u00a0\u00a0\u00a0\u00a0 \n  - webnet<\/pre>\n<p>environment:<\/p>\n<p>&#8211; VIRTUAL_HOST=&lt;your domain ie. Domain.com.au&gt;<\/p>\n<p>networks:<\/p>\n<p>webnet:<\/p>\n<p>Save the file by press esc than :wq<\/p>\n<h2>Starting the stack<\/h2>\n<p>Start docker<\/p>\n<p style=\"text-align:center;\"><code>systemctl start docker<\/code><\/p>\n<p>Pull the images<\/p>\n<p style=\"text-align:center;\"><code>docker pull jwilder\/nginx-proxy:latest<\/code><\/p>\n<p style=\"text-align:center;\"><code>docker pull dockersamples\/visualizer<\/code><\/p>\n<p>Start the swarm<\/p>\n<p style=\"text-align:center;\"><code>docker swarm init<\/code><\/p>\n<p>Deploy the swarm<\/p>\n<p style=\"text-align:center;\"><span style=\"font-family:Consolas;color:#24292e;\"><code>docker stack deploy -c \/docker\/docker-compose.yml test-stack<\/code><br \/>\n<\/span><\/p>\n<p><strong>Congratulations! If you have done everything right you should now have a SSL protected visualizer when you browse https:\/\/<span style=\"color:#ff0000;\">&lt;your domain&gt;<\/span><\/strong><\/p>\n<figure id=\"attachment_122\" aria-describedby=\"caption-attachment-122\" style=\"width: 566px\" class=\"wp-caption aligncenter\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-122 aligncenter\" src=\"https:\/\/tonysbit.files.wordpress.com\/2018\/03\/99018847-9a93-41d1-970f-0129bcfa487b.png?resize=566%2C636\" alt=\"99018847-9a93-41d1-970f-0129bcfa487b\" width=\"566\" height=\"636\" srcset=\"https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/99018847-9a93-41d1-970f-0129bcfa487b.png?w=566&amp;ssl=1 566w, https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/99018847-9a93-41d1-970f-0129bcfa487b.png?resize=267%2C300&amp;ssl=1 267w\" sizes=\"auto, (max-width: 566px) 100vw, 566px\" \/><figcaption id=\"caption-attachment-122\" class=\"wp-caption-text\">Figure 1: Final Stack Visualization<\/figcaption><\/figure>\n<h2><\/h2>\n<h2>Troubleshooting<\/h2>\n<p>To troubleshoot any problems check all services have a running container by running<\/p>\n<p style=\"text-align:center;\"><code>docker service ls<\/code><\/p>\n<figure id=\"attachment_124\" aria-describedby=\"caption-attachment-124\" style=\"width: 1104px\" class=\"wp-caption alignnone\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-124\" src=\"https:\/\/tonysbit.files.wordpress.com\/2018\/03\/2e212e5c-a1ef-45c5-bf22-0fc1cbda10e9.png?resize=640%2C53\" alt=\"2e212e5c-a1ef-45c5-bf22-0fc1cbda10e9\" width=\"640\" height=\"53\" srcset=\"https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/2e212e5c-a1ef-45c5-bf22-0fc1cbda10e9.png?w=1104&amp;ssl=1 1104w, https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/2e212e5c-a1ef-45c5-bf22-0fc1cbda10e9.png?resize=300%2C25&amp;ssl=1 300w, https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/2e212e5c-a1ef-45c5-bf22-0fc1cbda10e9.png?resize=1024%2C85&amp;ssl=1 1024w, https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/2e212e5c-a1ef-45c5-bf22-0fc1cbda10e9.png?resize=768%2C64&amp;ssl=1 768w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><figcaption id=\"caption-attachment-124\" class=\"wp-caption-text\">Figure 2: Example of troubleshooting output<\/figcaption><\/figure>\n<p>Check the replicas count. If the nginx image is not running, check that the mounted .certs path does exist.<\/p>\n<p>If the nginx container is running, you can run<\/p>\n<p style=\"text-align:center;\"><code>docker service &lt;service Id&gt; logs --follow<\/code><\/p>\n<p>then try access the https:\/\/&lt;your domain&gt; and see whether the connection is coming through.<\/p>\n<ul>\n<li>If it is than check the environment variable in your docker-compose<\/li>\n<li>If it is not than check that the port 443 is open and troubleshoot connectivity to the server<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Checklist Let&#8217;s quickly do a checklist of what we have so far SSH Accessible Virtual Machine (Running Centos 7.4) Ports 22, 443, 80 are open on the virtual machine Domain pointed at the public IP of the Virtual machine SSL Certificate generated on the virtual machine Docker CE installed on the virtual machine If you [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":122,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3,6,10,13],"tags":[],"class_list":["post-116","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-docker","category-linux","category-software-development"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/tonysbit.blog\/wp-content\/uploads\/2018\/03\/99018847-9a93-41d1-970f-0129bcfa487b.png?fit=566%2C636&ssl=1","_links":{"self":[{"href":"https:\/\/tonysbit.blog\/index.php?rest_route=\/wp\/v2\/posts\/116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tonysbit.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tonysbit.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tonysbit.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tonysbit.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=116"}],"version-history":[{"count":0,"href":"https:\/\/tonysbit.blog\/index.php?rest_route=\/wp\/v2\/posts\/116\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tonysbit.blog\/index.php?rest_route=\/wp\/v2\/media\/122"}],"wp:attachment":[{"href":"https:\/\/tonysbit.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tonysbit.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tonysbit.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}