{"action":"created","issue":{"url":"https://api.github.com/repos/dokku/dokku-letsencrypt/issues/69","repository_url":"https://api.github.com/repos/dokku/dokku-letsencrypt","labels_url":"https://api.github.com/repos/dokku/dokku-letsencrypt/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/dokku/dokku-letsencrypt/issues/69/comments","events_url":"https://api.github.com/repos/dokku/dokku-letsencrypt/issues/69/events","html_url":"https://github.com/dokku/dokku-letsencrypt/issues/69","id":164585785,"number":69,"title":"nginx.conf has no ssl section","user":{"login":"MichaelSp","id":448282,"avatar_url":"https://avatars.githubusercontent.com/u/448282?v=3","gravatar_id":"","url":"https://api.github.com/users/MichaelSp","html_url":"https://github.com/MichaelSp","followers_url":"https://api.github.com/users/MichaelSp/followers","following_url":"https://api.github.com/users/MichaelSp/following{/other_user}","gists_url":"https://api.github.com/users/MichaelSp/gists{/gist_id}","starred_url":"https://api.github.com/users/MichaelSp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MichaelSp/subscriptions","organizations_url":"https://api.github.com/users/MichaelSp/orgs","repos_url":"https://api.github.com/users/MichaelSp/repos","events_url":"https://api.github.com/users/MichaelSp/events{/privacy}","received_events_url":"https://api.github.com/users/MichaelSp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dokku/dokku-letsencrypt/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-07-08T18:11:13Z","updated_at":"2016-07-12T12:56:06Z","closed_at":null,"body":"With current version (letsencrypt 0.8.3; dokku 0.6.5) The generated <app>/nginx.conf is missing the ssl section.\r\n\r\n```\r\n# dokku letsencrypt app\r\n=====> Let's Encrypt app\r\n-----> Updating letsencrypt docker image...\r\nlatest: Pulling from dokkupaas/letsencrypt-simp_le\r\n420890c9e918: Already exists \r\ne4a2ae244258: Already exists \r\n5c6ac6d1c950: Already exists \r\nDigest: sha256:18a19b34beceba79dd5be458abe7e132fc7486da1da19cc4d0395ad4578031ef\r\nStatus: Image is up to date for dokkupaas/letsencrypt-simp_le:latest\r\n       done updating\r\n-----> Enabling ACME proxy for app...\r\n-----> Getting letsencrypt certificate for app...\r\n        - Domain 'app.example.com'\r\ndarkhttpd/1.11, copyright (c) 2003-2015 Emil Mikulic.\r\nlistening on: http://0.0.0.0:80/\r\n2016-07-08 18:08:14,629:INFO:__main__:1211: Generating new account key\r\n2016-07-08 18:08:15,214:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:15,463:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:15,714:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:16,323:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): letsencrypt.org\r\n2016-07-08 18:08:16,945:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:17,207:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:17,465:INFO:requests.packages.urllib3.connectionpool:207: Starting new HTTP connection (1): app.example.com\r\n2016-07-08 18:08:17,516:INFO:__main__:1305: app.example.com was successfully self-verified\r\n2016-07-08 18:08:17,529:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:17,772:INFO:__main__:1313: Generating new certificate private key\r\n2016-07-08 18:08:18,997:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:19,250:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:19,545:INFO:requests.packages.urllib3.connectionpool:758: Starting new HTTPS connection (1): acme-staging.api.letsencrypt.org\r\n2016-07-08 18:08:19,789:INFO:__main__:391: Saving account_key.json\r\n2016-07-08 18:08:19,790:INFO:__main__:391: Saving fullchain.pem\r\n2016-07-08 18:08:19,790:INFO:__main__:391: Saving chain.pem\r\n2016-07-08 18:08:19,790:INFO:__main__:391: Saving cert.pem\r\n2016-07-08 18:08:19,790:INFO:__main__:391: Saving key.pem\r\n-----> Certificate retrieved successfully.\r\n-----> Symlinking let's encrypt certificates\r\n-----> Unsetting app\r\n-----> Unsetting DOKKU_PROXY_PORT_MAP\r\n-----> Setting config vars\r\n       DOKKU_PROXY_PORT_MAP: http:80:80\r\n-----> Configuring app.example.com...(using built-in template)\r\n-----> Creating https nginx.conf\r\n-----> Running nginx-pre-reload\r\n       Reloading nginx\r\n-----> Configuring app.example.com...(using built-in template)\r\n-----> Creating https nginx.conf\r\n-----> Running nginx-pre-reload\r\n       Reloading nginx\r\n-----> Disabling ACME proxy for app...\r\n       done\r\n```\r\n```\r\n# cat nginx.conf\r\nserver {\r\n  listen      [::]:80;\r\n  listen      80;\r\n  server_name app.example.com; \r\n  access_log  /var/log/nginx/app-access.log;\r\n  error_log   /var/log/nginx/app-error.log;\r\n\r\n  return 301 https://$host:$request_uri;\r\n\r\n}\r\n\r\nupstream app-80 {\r\n\r\n  server 172.17.0.10:80;\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/dokku/dokku-letsencrypt/issues/comments/232038638","html_url":"https://github.com/dokku/dokku-letsencrypt/issues/69#issuecomment-232038638","issue_url":"https://api.github.com/repos/dokku/dokku-letsencrypt/issues/69","id":232038638,"user":{"login":"sseemayer","id":736556,"avatar_url":"https://avatars.githubusercontent.com/u/736556?v=3","gravatar_id":"","url":"https://api.github.com/users/sseemayer","html_url":"https://github.com/sseemayer","followers_url":"https://api.github.com/users/sseemayer/followers","following_url":"https://api.github.com/users/sseemayer/following{/other_user}","gists_url":"https://api.github.com/users/sseemayer/gists{/gist_id}","starred_url":"https://api.github.com/users/sseemayer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sseemayer/subscriptions","organizations_url":"https://api.github.com/users/sseemayer/orgs","repos_url":"https://api.github.com/users/sseemayer/repos","events_url":"https://api.github.com/users/sseemayer/events{/privacy}","received_events_url":"https://api.github.com/users/sseemayer/received_events","type":"User","site_admin":false},"created_at":"2016-07-12T12:56:06Z","updated_at":"2016-07-12T12:56:06Z","body":"It seems like [the way that dokku handles proxying of Dockerfile deploys](http://dokku.viewdocs.io/dokku/advanced-usage/proxy-management/#proxy-port-mapping) since 0.6 and how this relates to dokku-letsencrypt is not clear so I should clarify:\r\n\r\nThe dokku-letsencrypt plugin only handles certificate installation and leaves nginx configuration to the underlying dokku mechanisms. In the case of the Dockerfile deploy, this means that the reverse proxy will have to be configured correctly by the user using the `dokku proxy:ports-*` commands since by default, only `EXPOSE` directives in the Dockerfile will be parsed to forward exposed ports in the Docker containre to the same port numbers on the host. This means that both the forwards for HTTP port 80 and HTTPS port 443 to the app's container needs to be manually configured for certificate validation and browsing to the app via HTTPS to work.\r\n\r\nA full workflow for deploying a new Dockerfile deployment with dokku-letsencrypt would be:\r\n\r\n1. Create a new app `myapp` in dokku and push to the `dokku@myhost.com` remote. I assume that the Docker container will be listening for connections on port 5555.\r\n2. On the dokku host, use `dokku proxy:ports-add myapp http:80:5555` to proxy http port 80 to port 5555 on the Docker image\r\n3. On the dokku host, use `dokku letsencrypt myapp` to retrieve HTTPS certificates.\r\n4. On the dokku host, use `dokku proxy:ports-add myapp https:443:5555` to proxy https port 443 to port 5555 on the Docker image\r\n5. (optional) On the dokku host, use `dokku proxy:ports-remove myapp http:5555:5555` to remove a potential leftover port forward that was automatically configured on first deploy.\r\n\r\nAfter this, the output of `dokku proxy:ports myapp` should look like this:\r\n```\r\n-----> Port mappings for myapp\r\n-----> scheme             host port                 container port                                     \r\nhttp                      80                        5000                                               \r\nhttps                     443                       5000  \r\n```\r\n\r\nAs @chrisnew mentioned, it is possible to change `DOKKU_PROXY_PORT_MAP` manually but I'd recommend the official proxy plugin API.\r\n\r\nStep 2 and step 4 cannot be joined together since a configured HTTPS proxy will automatically create a HTTP 301 redirect to the HTTPS address that will fail because no valid HTTPS certificate is available until step 3 completed."}}
{"actor":{"display_login":"sseemayer"}}