oui

srcs/requirements/nginx/.dockerignore

@@ -0,0 +1,2 @@
+*.pem
+*.crt

srcs/requirements/nginx/Dockerfile

@@ -1,12 +1,13 @@
-FROM alpine:3.19
+FROM alpine:3.20
 
-RUN apk add --no-cache nginx openssl
+RUN apk update && apk add --no-cache nginx openssl bash
 
+# Copie des fichiers de configuration
+COPY conf/nginx.conf /etc/nginx/nginx.conf
 COPY conf/default.conf /etc/nginx/http.d/default.conf
-COPY tools/generate_ssl.sh /tmp/generate_ssl.sh
-
-RUN chmod +x /tmp/generate_ssl.sh && /tmp/generate_ssl.sh
+COPY tools/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
 EXPOSE 443
 
-CMD ["nginx", "-g", "daemon off;"]
+ENTRYPOINT ["/entrypoint.sh"]

srcs/requirements/nginx/conf/default.conf

@@ -1,11 +1,11 @@
 server {
-    listen 443 ssl;
-    server_name yantoine.42.fr;
+    listen 443 ssl http2;
+    server_name __DOMAIN_NAME__;
 
-    ssl_certificate /etc/ssl/private/yantoine.42.fr.crt;
-    ssl_certificate_key /etc/ssl/private/yantoine.42.fr.key;
-
-    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_certificate     /etc/ssl/certs/server.crt;
+    ssl_certificate_key /etc/ssl/private/server.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
 
     root /var/www/html;
     index index.php index.html;
@@ -15,8 +15,9 @@ server {
     }
 
     location ~ \.php$ {
-        fastcgi_pass wordpress:9000;
         include fastcgi_params;
+        fastcgi_pass wordpress:9000;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
     }
 }

srcs/requirements/nginx/conf/nginx.conf

@@ -0,0 +1,21 @@
+user nginx;
+worker_processes auto;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    include /etc/nginx/http.d/*.conf;
+}

srcs/requirements/nginx/tools/entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+# Copie des secrets TLS vers leurs emplacements
+cp /run/secrets/tls_crt /etc/ssl/certs/server.crt
+cp /run/secrets/tls_key /etc/ssl/private/server.key
+chmod 600 /etc/ssl/private/server.key
+
+# Remplacement du nom de domaine dans la conf
+sed -i "s/__DOMAIN_NAME__/${DOMAIN_NAME}/g" /etc/nginx/http.d/default.conf
+
+exec nginx -g 'daemon off;'

srcs/requirements/nginx/tools/generate_ssl.sh

@@ -1,7 +0,0 @@
-#!/bin/sh
-mkdir -p /etc/ssl/private
-openssl req -x509 -nodes -days 365 \
-  -subj "/C=FR/ST=Paris/L=Paris/O=42/OU=Login/CN=yantoine.42.fr" \
-  -newkey rsa:2048 \
-  -keyout /etc/ssl/private/yantoine.42.fr.key \
-  -out /etc/ssl/private/yantoine.42.fr.crt