{"action":"created","issue":{"url":"https://api.github.com/repos/dokku/dokku/issues/1629","labels_url":"https://api.github.com/repos/dokku/dokku/issues/1629/labels{/name}","comments_url":"https://api.github.com/repos/dokku/dokku/issues/1629/comments","events_url":"https://api.github.com/repos/dokku/dokku/issues/1629/events","html_url":"https://github.com/dokku/dokku/issues/1629","id":114076556,"number":1629,"title":"nginx-vhosts expected behaviors","user":{"login":"michaelshobbs","id":4491438,"avatar_url":"https://avatars.githubusercontent.com/u/4491438?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelshobbs","html_url":"https://github.com/michaelshobbs","followers_url":"https://api.github.com/users/michaelshobbs/followers","following_url":"https://api.github.com/users/michaelshobbs/following{/other_user}","gists_url":"https://api.github.com/users/michaelshobbs/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelshobbs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelshobbs/subscriptions","organizations_url":"https://api.github.com/users/michaelshobbs/orgs","repos_url":"https://api.github.com/users/michaelshobbs/repos","events_url":"https://api.github.com/users/michaelshobbs/events{/privacy}","received_events_url":"https://api.github.com/users/michaelshobbs/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dokku/dokku/labels/rfc","name":"rfc","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":31,"created_at":"2015-10-29T15:34:19Z","updated_at":"2016-01-12T23:27:17Z","closed_at":null,"body":"Over the length of time I've been using and contributing to dokku, the nginx functionality and  implementation complexity of said functionality has increased significantly. It doesn't seem (to me at least) that we have documented fully what the plugin is meant to do, what cases are automated, and what cases are left to the reader to implement with a custom template.\r\n\r\nMy personal position on this (and with software development in general, I think) is we should do a handful of things very very well and document the edge cases to give users the ability to implement them in their own way. (read: batteries included but replaceable)\r\n\r\nThis issue is an attempt to document and clarify what this plugin does and subsequently clean up the implementation to this end. I will enumerate my current understanding of this and willfully open the conversation to the community in hopes to solidify the expectation of functionality, and subsequently help prevent the historic regression cycle we've seen in this plugin.\r\n\r\n## Current expected behaviors to be automated\r\n### baseline assumptions\r\n* nginx listener on port 80 \r\n  * no-ssl\r\n  * Loadbalancer (LB) with SSL termination. *not sure how this differs from no-ssl given our current templates*\r\n* nginx listener on port 443 (ssl hosted on box with 301 redirection from port 80)\r\n* some list of domains (`server_name` args) for which to answer\r\n* custom nginx template may override any of the aforementioned scenarios using documented template variables\r\n* dokku will validate (`nginx -t`) all nginx config before successfully deploying an app if VHOST support is enabled for said app\r\n\r\n### VHOST/domain support\r\n* local ssl configurations (i.e. non-ssl-terminated LBs) require nginx but **not** a domain (i.e. self-signed certs for development or internal services perhaps)\r\n* non-ssl configurations **do not** require a domain or nginx\r\n* `VHOST` support is on by default but can be disabled both explicitly or implicitly\r\n  * (explicit) `NO_VHOST` env variable\r\n    * nginx listens on random high port\r\n    * container listens on external interface\r\n  * (implicit) if either `$DOKKU_ROOT/VHOST` or `$DOKKU_ROOT/HOSTNAME` contain IPv4/IPv6 addresses, `NO_VHOST` is set for the deployed app\r\n* nginx can be disabled completely\r\n  * removes the app-specific nginx config and restart a container that listens on a random high port on the external interface of the host\r\n* app-specific domains/VHOST support (`$DOKKU_ROOT/VHOST`) works even without a global VHOST (`$DOKKU_ROOT/VHOST`)\r\n* all domains added with the domains plugin can be used to access the app\r\n* default domain is `<appname>.$(cat $DOKKU_ROOT/HOSTNAME)`, if...\r\n  * `$DOKKU_ROOT/$APP/VHOST` doesn't exist\r\n  * `$DOKKU_ROOT/VHOST` and `$DOKKU_ROOT/HOSTNAME` do not contain IPv4 or IPv6 addresses\r\n  * `$DOKKU_ROOT/VHOST` exists \r\n  * `nginx-hostname` plugin trigger returns nothing\r\n\r\n### ssl specifics\r\n* server-wide **AND** app-specific SSL certificates are supported\r\n  * app-specifc certs take precedence over server-wide certs\r\n* SSL certs with SANs are supported\r\n* nginx will proxy the same app on all SSL domains (as found in the defined cert) **and** any additional non-SSL domains added with the domains plugin (without redirection)\r\n\r\nI may have missed some cases but I think this illustrates how insane we've allowed our nginx support to become and I hope we can come to consensus on a more restrained scope of functionality or a more rational implementation. Now go ahead, talk amongst ya'selves.\r\n\r\n\r\nrefs: #1625 #1581 #1597 #1575 #674\r\nthose are just the open issues regarding nginx config. "},"comment":{"url":"https://api.github.com/repos/dokku/dokku/issues/comments/171098396","html_url":"https://github.com/dokku/dokku/issues/1629#issuecomment-171098396","issue_url":"https://api.github.com/repos/dokku/dokku/issues/1629","id":171098396,"user":{"login":"josegonzalez","id":65675,"avatar_url":"https://avatars.githubusercontent.com/u/65675?v=3","gravatar_id":"","url":"https://api.github.com/users/josegonzalez","html_url":"https://github.com/josegonzalez","followers_url":"https://api.github.com/users/josegonzalez/followers","following_url":"https://api.github.com/users/josegonzalez/following{/other_user}","gists_url":"https://api.github.com/users/josegonzalez/gists{/gist_id}","starred_url":"https://api.github.com/users/josegonzalez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josegonzalez/subscriptions","organizations_url":"https://api.github.com/users/josegonzalez/orgs","repos_url":"https://api.github.com/users/josegonzalez/repos","events_url":"https://api.github.com/users/josegonzalez/events{/privacy}","received_events_url":"https://api.github.com/users/josegonzalez/received_events","type":"User","site_admin":false},"created_at":"2016-01-12T23:27:16Z","updated_at":"2016-01-12T23:27:16Z","body":"Notes for my later review. They absolutely do not reflect what our proxy setup will look like in the future.\r\n\r\n---\r\n\r\nHere are things I want to support:\r\n\r\n- custom templates\r\n- a single file for custom templates (no guessing about which dokku will use depending upon ssl/non-ssl)\r\n- multiple proxied ports, defaulting to the 5000/80 port\r\n- setting a canonical domain name, and defaulting to redirecting to it (anything else == custom template)\r\n- disabling vhosts in ​*just*​ one way. anything that happens to otherwise disable (such as failing to have a global VHOSTS or HOSTNAME file) will result in a deploy error\r\n- dropping DOKKU_SSL_TERMINATED? Maybe that can just be a custom template for users\r\n- moving custom templates to be either the core global, a custom global, or one from within the container, and nothing else."}}