nginx.tmpl

Author

Owner

@ShockwaveNN commented on GitHub (Feb 21, 2020):

Could you look out for any errors in /var/log/onlyoffice

@ShockwaveNN commented on GitHub (Feb 21, 2020): Could you look out for any errors in `/var/log/onlyoffice`

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 21, 2020):

Here is one thing I found:
tail -100 /var/log/onlyoffice/documentserver/converter/out.log

[2020-02-21T10:11:06.825] [ERROR] nodeJS - stdout (id=3877597986_4630):
[2020-02-21T10:11:06.825] [ERROR] nodeJS - stderr (id=3877597986_4630):Couldn't automatically recognize conversion direction from extensions

[2020-02-21T10:11:06.825] [ERROR] nodeJS - ExitCode (code=88;signal=null;error:-80;id=3877597986_4630)

tail -f /var/log/onlyoffice/documentserver/docservice/out.log

[2020-02-21T10:13:35.988] [ERROR] nodeJS - sendServerRequest error: docId = 3877597986;url = https://nextcloud.x.com/apps/onlyoffice/track?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJuYXRoYW4ucGllcmNlIiwiZmlsZUlkIjoyMDIyLCJmaWxlUGF0aCI6IlwvdGVzdGluZy5kb2N4Iiwic2hhcmVUb2tlbiI6bnVsbCwiYWN0aW9uIjoidHJhY2sifQ.qksqyLUvxVxD1eUQutKSxba4t-iOsznG_Js19IPzVLo;data = {"key":"3877597986","status":3,"users":["ochmr3mbs1sy_nathan.pierce"],"actions":[{"type":0,"userid":"ochmr3mbs1sy_nathan.pierce"}],"lastsave":"2020-02-21T10:13:35.741Z","notmodified":false}
Error: Error response: statusCode:400 ;body:
{"message":"Url not found"}
    at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:301:23)
    at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
    at emitTwo (events.js:126:13)
    at Request.emit (events.js:214:7)
    at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
    at emitOne (events.js:116:13)
    at Request.emit (events.js:211:7)
    at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
    at Object.onceWrapper (events.js:313:30)
    at emitNone (events.js:111:20)
    at IncomingMessage.emit (events.js:208:7)
    at endReadableNT (_stream_readable.js:1064:12)
    at _combinedTickCallback (internal/process/next_tick.js:139:11)
    at process._tickCallback (internal/process/next_tick.js:181:9)

@NorseGaud commented on GitHub (Feb 21, 2020): Here is one thing I found: `tail -100 /var/log/onlyoffice/documentserver/converter/out.log` ``` [2020-02-21T10:11:06.825] [ERROR] nodeJS - stdout (id=3877597986_4630): [2020-02-21T10:11:06.825] [ERROR] nodeJS - stderr (id=3877597986_4630):Couldn't automatically recognize conversion direction from extensions [2020-02-21T10:11:06.825] [ERROR] nodeJS - ExitCode (code=88;signal=null;error:-80;id=3877597986_4630) ``` `tail -f /var/log/onlyoffice/documentserver/docservice/out.log` ``` [2020-02-21T10:13:35.988] [ERROR] nodeJS - sendServerRequest error: docId = 3877597986;url = https://nextcloud.x.com/apps/onlyoffice/track?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJuYXRoYW4ucGllcmNlIiwiZmlsZUlkIjoyMDIyLCJmaWxlUGF0aCI6IlwvdGVzdGluZy5kb2N4Iiwic2hhcmVUb2tlbiI6bnVsbCwiYWN0aW9uIjoidHJhY2sifQ.qksqyLUvxVxD1eUQutKSxba4t-iOsznG_Js19IPzVLo;data = {"key":"3877597986","status":3,"users":["ochmr3mbs1sy_nathan.pierce"],"actions":[{"type":0,"userid":"ochmr3mbs1sy_nathan.pierce"}],"lastsave":"2020-02-21T10:13:35.741Z","notmodified":false} Error: Error response: statusCode:400 ;body: {"message":"Url not found"} at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:301:23) at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22) at emitTwo (events.js:126:13) at Request.emit (events.js:214:7) at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10) at emitOne (events.js:116:13) at Request.emit (events.js:211:7) at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12) at Object.onceWrapper (events.js:313:30) at emitNone (events.js:111:20) at IncomingMessage.emit (events.js:208:7) at endReadableNT (_stream_readable.js:1064:12) at _combinedTickCallback (internal/process/next_tick.js:139:11) at process._tickCallback (internal/process/next_tick.js:181:9) ```

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Feb 21, 2020):

Seems this is a reason

[2020-02-21T10:13:35.988] [ERROR] nodeJS - sendServerRequest error: docId = 3877597986;url = https://nextcloud.x.com/apps/onlyoffice/track?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJuYXRoYW4ucGllcmNlIiwiZmlsZUlkIjoyMDIyLCJmaWxlUGF0aCI6IlwvdGVzdGluZy5kb2N4Iiwic2hhcmVUb2tlbiI6bnVsbCwiYWN0aW9uIjoidHJhY2sifQ.qksqyLUvxVxD1eUQutKSxba4t-iOsznG_Js19IPzVLo;data = {"key":"3877597986","status":3,"users":["ochmr3mbs1sy_nathan.pierce"],"actions":[{"type":0,"userid":"ochmr3mbs1sy_nathan.pierce"}],"lastsave":"2020-02-21T10:13:35.741Z","notmodified":false}
Error: Error response: statusCode:400 ;body:

DocumentServer couldn't connect to nextcloud
Could you check that DocumentServer can open files from integrated test example (but for test purposes you should replace onlyoffice-documentserver container to onlyoffice-documentserver-de)

@ShockwaveNN commented on GitHub (Feb 21, 2020): Seems this is a reason ``` [2020-02-21T10:13:35.988] [ERROR] nodeJS - sendServerRequest error: docId = 3877597986;url = https://nextcloud.x.com/apps/onlyoffice/track?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJuYXRoYW4ucGllcmNlIiwiZmlsZUlkIjoyMDIyLCJmaWxlUGF0aCI6IlwvdGVzdGluZy5kb2N4Iiwic2hhcmVUb2tlbiI6bnVsbCwiYWN0aW9uIjoidHJhY2sifQ.qksqyLUvxVxD1eUQutKSxba4t-iOsznG_Js19IPzVLo;data = {"key":"3877597986","status":3,"users":["ochmr3mbs1sy_nathan.pierce"],"actions":[{"type":0,"userid":"ochmr3mbs1sy_nathan.pierce"}],"lastsave":"2020-02-21T10:13:35.741Z","notmodified":false} Error: Error response: statusCode:400 ;body: ``` DocumentServer couldn't connect to nextcloud Could you check that DocumentServer can open files from integrated test example (but for test purposes you should replace `onlyoffice-documentserver` container to `onlyoffice-documentserver-de`)

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 21, 2020):

Thanks for the help!
Sorry, what do you mean by an integrated test example? Where/what is that?
Also, what is the reason for the container name change?

Here is my nextcloud docker file if it helps:

version: '3'
services:

  nextcloud-app:
    image: nextcloud:latest
    container_name: nextcloud-app
    environment:
      - VIRTUAL_HOST=nextcloud.x.com
      - VIRTUAL_NETWORK=nextcloud-nginx-proxy
      - LETSENCRYPT_HOST=nextcloud.x.com
      - LETSENCRYPT_EMAIL=blah@blah.com
      - MYSQL_HOST=nextcloud-db
    volumes:
      - /root/nextcloud_apps:/var/www/html/apps
      - /root/nextcloud_custom_apps:/var/www/html/custom_apps
      - /root/nextcloud_config:/var/www/html/config
      - /root/nextcloud_data:/var/www/html/data
    expose:
      - "80"
      - "443"
    stdin_open: true
    tty: true
    networks:
      - default
      - nextcloud
    restart: always
    env_file:
      - db.env
    depends_on:
      - nextcloud-db

  nextcloud-db:
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    container_name: nextcloud-db
    volumes:
      - /root/nextcloud_db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=XXXXXXXXXXXXXXXXXXX
    networks:
      - nextcloud
    restart: always
    env_file:
      - db.env

networks:
  default:
    external:
      name: webproxy
  nextcloud:
    driver: 'bridge'

@NorseGaud commented on GitHub (Feb 21, 2020): Thanks for the help! Sorry, what do you mean by an integrated test example? Where/what is that? Also, what is the reason for the container name change? Here is my nextcloud docker file if it helps: ``` version: '3' services: nextcloud-app: image: nextcloud:latest container_name: nextcloud-app environment: - VIRTUAL_HOST=nextcloud.x.com - VIRTUAL_NETWORK=nextcloud-nginx-proxy - LETSENCRYPT_HOST=nextcloud.x.com - LETSENCRYPT_EMAIL=blah@blah.com - MYSQL_HOST=nextcloud-db volumes: - /root/nextcloud_apps:/var/www/html/apps - /root/nextcloud_custom_apps:/var/www/html/custom_apps - /root/nextcloud_config:/var/www/html/config - /root/nextcloud_data:/var/www/html/data expose: - "80" - "443" stdin_open: true tty: true networks: - default - nextcloud restart: always env_file: - db.env depends_on: - nextcloud-db nextcloud-db: image: mariadb command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW container_name: nextcloud-db volumes: - /root/nextcloud_db:/var/lib/mysql environment: - MYSQL_ROOT_PASSWORD=XXXXXXXXXXXXXXXXXXX networks: - nextcloud restart: always env_file: - db.env networks: default: external: name: webproxy nextcloud: driver: 'bridge' ```

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 21, 2020):

I wanted to also mention that I'm doing the docker exec <CONTAINER> documentserver-prepare4shutdown.sh before shutting it down.

@NorseGaud commented on GitHub (Feb 21, 2020): I wanted to also mention that I'm doing the `docker exec <CONTAINER> documentserver-prepare4shutdown.sh` before shutting it down.

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Feb 21, 2020):

an integrated test example? Where/what is that?

This one:

Opening files in this example can detect if something wrong with DocumentServer itself if test example cause same error
It available via running instruction on http://documentserver-url/welcome/

Also, what is the reason for the container name change?

Because test example is not available by default with onlyoffice-documentserver image, only with onlyoffice-documentserver-ie or onlyoffice-documentserver-de

@ShockwaveNN commented on GitHub (Feb 21, 2020): > an integrated test example? Where/what is that? This one: ![image](https://user-images.githubusercontent.com/668524/75035665-1078e080-54c1-11ea-966d-2a463e1b57ae.png) Opening files in this example can detect if something wrong with DocumentServer itself if test example cause same error It available via running instruction on `http://documentserver-url/welcome/` > Also, what is the reason for the container name change? Because test example is not available by default with `onlyoffice-documentserver` image, only with `onlyoffice-documentserver-ie` or `onlyoffice-documentserver-de`

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 21, 2020):

Odd, I'm using image: onlyoffice/documentserver-de:latest and also -ie and the welcome page doesn't show anything about a test. :(
All I see is
Screen Shot 2020-02-21 at 8 11 21 AM

@NorseGaud commented on GitHub (Feb 21, 2020): Odd, I'm using `image: onlyoffice/documentserver-de:latest` and also -ie and the welcome page doesn't show anything about a test. :( All I see is <img width="649" alt="Screen Shot 2020-02-21 at 8 11 21 AM" src="https://user-images.githubusercontent.com/5896030/75037284-cd4b4d00-5481-11ea-8021-0a5221486ec4.png">

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 21, 2020):

Does the actual container name need to change too? Or just the image being used?

@NorseGaud commented on GitHub (Feb 21, 2020): Does the actual container name need to change too? Or just the image being used?

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Feb 21, 2020):

Odd, I'm using image: onlyoffice/documentserver-de:latest and also -ie and the welcome page doesn't show anything about a test. :(

Try to clear browser cache, this is not right

Does the actual container name need to change too? Or just the image being used?

No, only image name

@ShockwaveNN commented on GitHub (Feb 21, 2020): > Odd, I'm using image: onlyoffice/documentserver-de:latest and also -ie and the welcome page doesn't show anything about a test. :( Try to clear browser cache, this is not right > Does the actual container name need to change too? Or just the image being used? No, only image name

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 22, 2020):

Hmm... No difference. Is there documentation on these tags/images somewhere? Maybe I'm missing an ENV

@NorseGaud commented on GitHub (Feb 22, 2020): Hmm... No difference. Is there documentation on these tags/images somewhere? Maybe I'm missing an ENV

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Feb 22, 2020):

Hmm... No difference.

To be sure - are you getting same "An error has occurred" while using integrated test example?

@ShockwaveNN commented on GitHub (Feb 22, 2020): > Hmm... No difference. To be sure - are you getting same "An error has occurred" while using integrated test example?

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 22, 2020):

I meant that clearing the cache doesn't show the page that will allow me to do the integrated test.

@NorseGaud commented on GitHub (Feb 22, 2020): I meant that clearing the cache doesn't show the page that will allow me to do the integrated test.

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Feb 22, 2020):

Ok, try to drop docker-compose and only use clear onlyoffice/documentserver container and connect it to your nextcloud and see if it works
If will not work at least reason not in compose part

@ShockwaveNN commented on GitHub (Feb 22, 2020): Ok, try to drop `docker-compose` and only use clear `onlyoffice/documentserver` container and connect it to your nextcloud and see if it works If will not work at least reason not in compose part

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 23, 2020):

Playing a little more with my docker-compose setup, I see a new error now:

==> /var/log/onlyoffice/documentserver/docservice/out.log <==
==> /var/log/onlyoffice/documentserver/docservice/out.log <==
[2020-02-23T01:32:58.183] [ERROR] nodeJS - sendServerRequest error: docId = 2091389658;url = https://nextcloud.x.com/apps/onlyoffice/track?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJuYXRoYW4ucGllcmNlIiwiZmlsZUlkIjoyMDQ4LCJmaWxlUGF0aCI6IlwvMTIzLmRvY3giLCJzaGFyZVRva2VuIjpudWxsLCJhY3Rpb24iOiJ0cmFjayJ9.qjw-Opr47l6CAhsJMPIgC6hWKF9QAgLjeySg4HyVVOo;data = {"key":"2091389658","status":2,"url":"https://onlyoffice-ds.x.com/cache/files/2091389658_7103/output.docx/output.docx?md5=ITa1oNBMBUUIYedajB0agg&expires=1582422479&disposition=attachment&ooname=output.docx","changesurl":"https://onlyoffice-ds.x.com/cache/files/2091389658_7103/changes.zip/changes.zip?md5=91Hq0pftW8G4QDijCVOI7g&expires=1582422479&disposition=attachment&ooname=output.zip","history":{"serverVersion":"5.4.2","changes":[{"created":"2020-02-23 00:37:49","user":{"id":"ochmr3mbs1sy_nathan.pierce","name":"Nathan Pierce"}}]},"users":["ochmr3mbs1sy_nathan.pierce"],"actions":[{"type":0,"userid":"ochmr3mbs1sy_nathan.pierce"}],"lastsave":"2020-02-23T00:37:49.649Z","notmodified":false}
Error: socket hang up
    at createHangUpError (_http_client.js:342:15)
    at TLSSocket.socketOnEnd (_http_client.js:437:23)
    at emitNone (events.js:111:20)
    at TLSSocket.emit (events.js:208:7)
    at endReadableNT (_stream_readable.js:1064:12)
    at _combinedTickCallback (internal/process/next_tick.js:139:11)
    at process._tickCallback (internal/process/next_tick.js:181:9)

@NorseGaud commented on GitHub (Feb 23, 2020): Playing a little more with my docker-compose setup, I see a new error now: ``` ==> /var/log/onlyoffice/documentserver/docservice/out.log <== ==> /var/log/onlyoffice/documentserver/docservice/out.log <== [2020-02-23T01:32:58.183] [ERROR] nodeJS - sendServerRequest error: docId = 2091389658;url = https://nextcloud.x.com/apps/onlyoffice/track?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJuYXRoYW4ucGllcmNlIiwiZmlsZUlkIjoyMDQ4LCJmaWxlUGF0aCI6IlwvMTIzLmRvY3giLCJzaGFyZVRva2VuIjpudWxsLCJhY3Rpb24iOiJ0cmFjayJ9.qjw-Opr47l6CAhsJMPIgC6hWKF9QAgLjeySg4HyVVOo;data = {"key":"2091389658","status":2,"url":"https://onlyoffice-ds.x.com/cache/files/2091389658_7103/output.docx/output.docx?md5=ITa1oNBMBUUIYedajB0agg&expires=1582422479&disposition=attachment&ooname=output.docx","changesurl":"https://onlyoffice-ds.x.com/cache/files/2091389658_7103/changes.zip/changes.zip?md5=91Hq0pftW8G4QDijCVOI7g&expires=1582422479&disposition=attachment&ooname=output.zip","history":{"serverVersion":"5.4.2","changes":[{"created":"2020-02-23 00:37:49","user":{"id":"ochmr3mbs1sy_nathan.pierce","name":"Nathan Pierce"}}]},"users":["ochmr3mbs1sy_nathan.pierce"],"actions":[{"type":0,"userid":"ochmr3mbs1sy_nathan.pierce"}],"lastsave":"2020-02-23T00:37:49.649Z","notmodified":false} Error: socket hang up at createHangUpError (_http_client.js:342:15) at TLSSocket.socketOnEnd (_http_client.js:437:23) at emitNone (events.js:111:20) at TLSSocket.emit (events.js:208:7) at endReadableNT (_stream_readable.js:1064:12) at _combinedTickCallback (internal/process/next_tick.js:139:11) at process._tickCallback (internal/process/next_tick.js:181:9) ```

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Feb 23, 2020):

Thanks @ShockwaveNN
There are a lot of options I have to pass in to get it running with docker run. I'll try it out, but I'm sort of out of steam right now so I'm going to take a break.

@NorseGaud commented on GitHub (Feb 23, 2020): Thanks @ShockwaveNN There are a lot of options I have to pass in to get it running with `docker run`. I'll try it out, but I'm sort of out of steam right now so I'm going to take a break.

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Feb 23, 2020):

@NorseGaud

Error: socket hang up

I think this is some kind of network problem, maybe some firewall block, I'm not sure

@ShockwaveNN commented on GitHub (Feb 23, 2020): @NorseGaud > Error: socket hang up I think this is some kind of network problem, maybe some firewall block, I'm not sure

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Mar 4, 2020):

@ShockwaveNN do you have any other ideas around why the -de and -ie don't work?

@NorseGaud commented on GitHub (Mar 4, 2020): @ShockwaveNN do you have any other ideas around why the -de and -ie don't work?

kerem commented

Author

Owner

@ShockwaveNN commented on GitHub (Mar 4, 2020):

@NorseGaud No, no idea, I could take a look into your setup if you provide VM image or step-by-step instruction how did you setup all the services (DocumentServer and Nextcloud)

@ShockwaveNN commented on GitHub (Mar 4, 2020): @NorseGaud No, no idea, I could take a look into your setup if you provide VM image or step-by-step instruction how did you setup all the services (DocumentServer and Nextcloud)

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Mar 4, 2020):

Sure, so both docker-compose files are provided above. I just docker-compose up -d them.

@NorseGaud commented on GitHub (Mar 4, 2020): Sure, so both docker-compose files are provided above. I just `docker-compose up -d` them.

kerem commented

Author

Owner

@NorseGaud commented on GitHub (Mar 4, 2020):

You'll need the webproxy too:

version: '3'
services:

  webproxy-nginx:
    container_name: webproxy-nginx
    image: nginx
    labels:
        com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - conf.d:/etc/nginx/conf.d
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /root/webproxy_certs:/etc/nginx/certs:ro
      - htpasswd:/etc/nginx/htpasswd:ro
    logging:
      options:
        max-size: "4m"
        max-file: "10"

  webproxy-nginx-gen:
    image: jwilder/docker-gen
    command: -notify-sighup webproxy-nginx -watch -wait 5s:30s /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
    container_name: webproxy-nginx-gen
    restart: always
    volumes:
      - conf.d:/etc/nginx/conf.d
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /root/webproxy_certs:/etc/nginx/certs:ro
      - htpasswd:/etc/nginx/htpasswd:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro
    logging:
      options:
        max-size: "2m"
        max-file: "10"

  webproxy-letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: webproxy-letsencrypt
    restart: always
    volumes:
      - conf.d:/etc/nginx/conf.d
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /root/webproxy_certs:/etc/nginx/certs:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      NGINX_DOCKER_GEN_CONTAINER: webproxy-nginx-gen
      NGINX_PROXY_CONTAINER: webproxy-nginx
    logging:
      options:
        max-size: "2m"
        max-file: "10"

volumes:
  vhost.d:
  conf.d:
  html:
  htpasswd:

networks:
  default:
    external:
      name: webproxy

nginx.tmpl

{{ $CurrentContainer := where $ "ID" .Docker.CurrentContainerID | first }}

{{ define "upstream" }}
	{{ if .Address }}
		{{/* If we got the containers from swarm and this container's port is published to host, use host IP:PORT */}}
		{{ if and .Container.Node.ID .Address.HostPort }}
			# {{ .Container.Node.Name }}/{{ .Container.Name }}
			server {{ .Container.Node.Address.IP }}:{{ .Address.HostPort }};
		{{/* If there is no swarm node or the port is not published on host, use container's IP:PORT */}}
		{{ else if .Network }}
			# {{ .Container.Name }}
			server {{ .Network.IP }}:{{ .Address.Port }};
		{{ end }}
	{{ else if .Network }}
		# {{ .Container.Name }}
		{{ if .Network.IP }}
			server {{ .Network.IP }} down;
		{{ else }}
			server 127.0.0.1 down;
		{{ end }}
	{{ end }}

{{ end }}

{{ define "ssl_policy" }}
	{{ if eq .ssl_policy "Mozilla-Modern" }}
		ssl_protocols TLSv1.3;
		{{/* nginx currently lacks ability to choose ciphers in TLS 1.3 in configuration, see https://trac.nginx.org/nginx/ticket/1529 /*}}
		{{/* a possible workaround can be modify /etc/ssl/openssl.cnf to change it globally (see https://trac.nginx.org/nginx/ticket/1529#comment:12 ) /*}}
		{{/* explicitly set ngnix default value in order to allow single servers to override the global http value */}}
		ssl_ciphers HIGH:!aNULL:!MD5;
		ssl_prefer_server_ciphers off;
	{{ else if eq .ssl_policy "Mozilla-Intermediate" }}
		ssl_protocols TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
		ssl_prefer_server_ciphers off;
	{{ else if eq .ssl_policy "Mozilla-Old" }}
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA';
		ssl_prefer_server_ciphers on;
	{{ else if eq .ssl_policy "AWS-TLS-1-2-2017-01" }}
		ssl_protocols TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES128-SHA256:AES256-GCM-SHA384:AES256-SHA256';
		ssl_prefer_server_ciphers on;
	{{ else if eq .ssl_policy "AWS-TLS-1-1-2017-01" }}
		ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
		ssl_prefer_server_ciphers on;
	{{ else if eq .ssl_policy "AWS-2016-08" }}
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
		ssl_prefer_server_ciphers on;
	{{ else if eq .ssl_policy "AWS-2015-05" }}
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DES-CBC3-SHA';
		ssl_prefer_server_ciphers on;
	{{ else if eq .ssl_policy "AWS-2015-03" }}
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA';
		ssl_prefer_server_ciphers on;
	{{ else if eq .ssl_policy "AWS-2015-02" }}
		ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA';
		ssl_prefer_server_ciphers on;
	{{ end }}
{{ end }}

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}

# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}

# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}

# Apply fix for very long server names
server_names_hash_bucket_size 128;

# Default dhparam
{{ if (exists "/etc/nginx/dhparam/dhparam.pem") }}
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
{{ end }}

# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}

gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';

access_log off;

{{/* Get the SSL_POLICY defined by this container, falling back to "Mozilla-Intermediate" */}}
{{ $ssl_policy := or ($.Env.SSL_POLICY) "Mozilla-Intermediate" }}
{{ template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}

{{ if $.Env.RESOLVERS }}
resolver {{ $.Env.RESOLVERS }};
{{ end }}

{{ if (exists "/etc/nginx/proxy.conf") }}
include /etc/nginx/proxy.conf;
{{ else }}
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;

# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
{{ end }}

{{ $enable_ipv6 := eq (or ($.Env.ENABLE_IPV6) "") "true" }}
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 80;
	{{ if $enable_ipv6 }}
	listen [::]:80;
	{{ end }}
	access_log /var/log/nginx/access.log vhost;
	return 503;
}

{{ if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 443 ssl http2;
	{{ if $enable_ipv6 }}
	listen [::]:443 ssl http2;
	{{ end }}
	access_log /var/log/nginx/access.log vhost;
	return 503;

	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/default.crt;
	ssl_certificate_key /etc/nginx/certs/default.key;
}
{{ end }}

{{ range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }}

{{ $host := trim $host }}
{{ $is_regexp := hasPrefix "~" $host }}
{{ $upstream_name := when $is_regexp (sha1 $host) $host }}

# {{ $host }}
upstream {{ $upstream_name }} {

{{ range $container := $containers }}
	{{ $addrLen := len $container.Addresses }}

	{{ range $knownNetwork := $CurrentContainer.Networks }}
		{{ range $containerNetwork := $container.Networks }}
			{{ if (and (ne $containerNetwork.Name "ingress") (or (eq $knownNetwork.Name $containerNetwork.Name) (eq $knownNetwork.Name "host"))) }}
				## Can be connected with "{{ $containerNetwork.Name }}" network

				{{/* If only 1 port exposed, use that */}}
				{{ if eq $addrLen 1 }}
					{{ $address := index $container.Addresses 0 }}
					{{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }}
				{{/* If more than one port exposed, use the one matching VIRTUAL_PORT env var, falling back to standard web port 80 */}}
				{{ else }}
					{{ $port := coalesce $container.Env.VIRTUAL_PORT "80" }}
					{{ $address := where $container.Addresses "Port" $port | first }}
					{{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }}
				{{ end }}
			{{ else }}
				# Cannot connect to network of this container
				server 127.0.0.1 down;
			{{ end }}
		{{ end }}
	{{ end }}
{{ end }}
}

{{ $default_host := or ($.Env.DEFAULT_HOST) "" }}
{{ $default_server := index (dict $host "" $default_host "default_server") $host }}

{{/* Get the VIRTUAL_PROTO defined by containers w/ the same vhost, falling back to "http" */}}
{{ $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }}

{{/* Get the NETWORK_ACCESS defined by containers w/ the same vhost, falling back to "external" */}}
{{ $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }}

{{/* Get the HTTPS_METHOD defined by containers w/ the same vhost, falling back to "redirect" */}}
{{ $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) "redirect" }}

{{/* Get the SSL_POLICY defined by containers w/ the same vhost, falling back to empty string (use default) */}}
{{ $ssl_policy := or (first (groupByKeys $containers "Env.SSL_POLICY")) "" }}

{{/* Get the HSTS defined by containers w/ the same vhost, falling back to "max-age=31536000" */}}
{{ $hsts := or (first (groupByKeys $containers "Env.HSTS")) "max-age=31536000" }}

{{/* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
{{ $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}


{{/* Get the first cert name defined by containers w/ the same vhost */}}
{{ $certName := (first (groupByKeys $containers "Env.CERT_NAME")) }}

{{/* Get the best matching cert  by name for the vhost. */}}
{{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}}

{{/* vhostCert is actually a filename so remove any suffixes since they are added later */}}
{{ $vhostCert := trimSuffix ".crt" $vhostCert }}
{{ $vhostCert := trimSuffix ".key" $vhostCert }}

{{/* Use the cert specified on the container or fallback to the best vhost match */}}
{{ $cert := (coalesce $certName $vhostCert) }}

{{ $is_https := (and (ne $https_method "nohttps") (ne $cert "") (exists (printf "/etc/nginx/certs/%s.crt" $cert)) (exists (printf "/etc/nginx/certs/%s.key" $cert))) }}

{{ if $is_https }}

{{ if eq $https_method "redirect" }}
server {
	server_name {{ $host }};
	listen 80 {{ $default_server }};
	{{ if $enable_ipv6 }}
	listen [::]:80 {{ $default_server }};
	{{ end }}
	access_log /var/log/nginx/access.log vhost;
	return 301 https://$host$request_uri;
}
{{ end }}

server {
	server_name {{ $host }};
	listen 443 ssl http2 {{ $default_server }};
	{{ if $enable_ipv6 }}
	listen [::]:443 ssl http2 {{ $default_server }};
	{{ end }}
	access_log /var/log/nginx/access.log vhost;

  # CUSTOM FOR NEXTCLOUD UPLOADS
  client_max_body_size 5G; # 0=unlimited - set max upload size
  client_body_buffer_size 0;

	{{ if eq $network_tag "internal" }}
	# Only allow traffic from internal clients
	include /etc/nginx/network_internal.conf;
	{{ end }}

	{{ template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}

	ssl_session_timeout 5m;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;

	ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
	ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};

	{{ if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }}
	ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
	{{ end }}

	{{ if (exists (printf "/etc/nginx/certs/%s.chain.pem" $cert)) }}
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.pem" $cert }};
	{{ end }}

	{{ if (not (or (eq $https_method "noredirect") (eq $hsts "off"))) }}
	add_header Strict-Transport-Security "{{ trim $hsts }}" always;
	{{ end }}

	{{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
	include {{ printf "/etc/nginx/vhost.d/%s" $host }};
	{{ else if (exists "/etc/nginx/vhost.d/default") }}
	include /etc/nginx/vhost.d/default;
	{{ end }}

	location / {
		{{ if eq $proto "uwsgi" }}
		include uwsgi_params;
		uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }};
		{{ else if eq $proto "fastcgi" }}
		root   {{ trim $vhost_root }};
		include fastcgi_params;
		fastcgi_pass {{ trim $upstream_name }};
		{{ else }}
		proxy_pass {{ trim $proto }}://{{ trim $upstream_name }};
		{{ end }}

		{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
		auth_basic	"Restricted {{ $host }}";
		auth_basic_user_file	{{ (printf "/etc/nginx/htpasswd/%s" $host) }};
		{{ end }}
		{{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }}
		include {{ printf "/etc/nginx/vhost.d/%s_location" $host}};
		{{ else if (exists "/etc/nginx/vhost.d/default_location") }}
		include /etc/nginx/vhost.d/default_location;
		{{ end }}
	}
}

{{ end }}

{{ if or (not $is_https) (eq $https_method "noredirect") }}

server {
	server_name {{ $host }};
	listen 80 {{ $default_server }};
	{{ if $enable_ipv6 }}
	listen [::]:80 {{ $default_server }};
	{{ end }}
	access_log /var/log/nginx/access.log vhost;

	{{ if eq $network_tag "internal" }}
	# Only allow traffic from internal clients
	include /etc/nginx/network_internal.conf;
	{{ end }}

	{{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
	include {{ printf "/etc/nginx/vhost.d/%s" $host }};
	{{ else if (exists "/etc/nginx/vhost.d/default") }}
	include /etc/nginx/vhost.d/default;
	{{ end }}

	location / {
		{{ if eq $proto "uwsgi" }}
		include uwsgi_params;
		uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }};
		{{ else if eq $proto "fastcgi" }}
		root   {{ trim $vhost_root }};
		include fastcgi_params;
		fastcgi_pass {{ trim $upstream_name }};
		{{ else }}
		proxy_pass {{ trim $proto }}://{{ trim $upstream_name }};
		{{ end }}
		{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
		auth_basic	"Restricted {{ $host }}";
		auth_basic_user_file	{{ (printf "/etc/nginx/htpasswd/%s" $host) }};
		{{ end }}
		{{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }}
		include {{ printf "/etc/nginx/vhost.d/%s_location" $host}};
		{{ else if (exists "/etc/nginx/vhost.d/default_location") }}
		include /etc/nginx/vhost.d/default_location;
		{{ end }}
	}
}

{{ if (and (not $is_https) (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
server {
	server_name {{ $host }};
	listen 443 ssl http2 {{ $default_server }};
	{{ if $enable_ipv6 }}
	listen [::]:443 ssl http2 {{ $default_server }};
	{{ end }}
	access_log /var/log/nginx/access.log vhost;
	return 500;

	ssl_certificate /etc/nginx/certs/default.crt;
	ssl_certificate_key /etc/nginx/certs/default.key;
}
{{ end }}

{{ end }}
{{ end }}

@NorseGaud commented on GitHub (Mar 4, 2020): You'll need the webproxy too: ``` version: '3' services: webproxy-nginx: container_name: webproxy-nginx image: nginx labels: com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true" restart: always ports: - "80:80" - "443:443" volumes: - conf.d:/etc/nginx/conf.d - vhost.d:/etc/nginx/vhost.d - html:/usr/share/nginx/html - /root/webproxy_certs:/etc/nginx/certs:ro - htpasswd:/etc/nginx/htpasswd:ro logging: options: max-size: "4m" max-file: "10" webproxy-nginx-gen: image: jwilder/docker-gen command: -notify-sighup webproxy-nginx -watch -wait 5s:30s /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf container_name: webproxy-nginx-gen restart: always volumes: - conf.d:/etc/nginx/conf.d - vhost.d:/etc/nginx/vhost.d - html:/usr/share/nginx/html - /root/webproxy_certs:/etc/nginx/certs:ro - htpasswd:/etc/nginx/htpasswd:ro - /var/run/docker.sock:/tmp/docker.sock:ro - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro logging: options: max-size: "2m" max-file: "10" webproxy-letsencrypt: image: jrcs/letsencrypt-nginx-proxy-companion container_name: webproxy-letsencrypt restart: always volumes: - conf.d:/etc/nginx/conf.d - vhost.d:/etc/nginx/vhost.d - html:/usr/share/nginx/html - /root/webproxy_certs:/etc/nginx/certs:rw - /var/run/docker.sock:/var/run/docker.sock:ro environment: NGINX_DOCKER_GEN_CONTAINER: webproxy-nginx-gen NGINX_PROXY_CONTAINER: webproxy-nginx logging: options: max-size: "2m" max-file: "10" volumes: vhost.d: conf.d: html: htpasswd: networks: default: external: name: webproxy ``` # nginx.tmpl ``` {{ $CurrentContainer := where $ "ID" .Docker.CurrentContainerID | first }} {{ define "upstream" }} {{ if .Address }} {{/* If we got the containers from swarm and this container's port is published to host, use host IP:PORT */}} {{ if and .Container.Node.ID .Address.HostPort }} # {{ .Container.Node.Name }}/{{ .Container.Name }} server {{ .Container.Node.Address.IP }}:{{ .Address.HostPort }}; {{/* If there is no swarm node or the port is not published on host, use container's IP:PORT */}} {{ else if .Network }} # {{ .Container.Name }} server {{ .Network.IP }}:{{ .Address.Port }}; {{ end }} {{ else if .Network }} # {{ .Container.Name }} {{ if .Network.IP }} server {{ .Network.IP }} down; {{ else }} server 127.0.0.1 down; {{ end }} {{ end }} {{ end }} {{ define "ssl_policy" }} {{ if eq .ssl_policy "Mozilla-Modern" }} ssl_protocols TLSv1.3; {{/* nginx currently lacks ability to choose ciphers in TLS 1.3 in configuration, see https://trac.nginx.org/nginx/ticket/1529 /*}} {{/* a possible workaround can be modify /etc/ssl/openssl.cnf to change it globally (see https://trac.nginx.org/nginx/ticket/1529#comment:12 ) /*}} {{/* explicitly set ngnix default value in order to allow single servers to override the global http value */}} ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers off; {{ else if eq .ssl_policy "Mozilla-Intermediate" }} ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers off; {{ else if eq .ssl_policy "Mozilla-Old" }} ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA'; ssl_prefer_server_ciphers on; {{ else if eq .ssl_policy "AWS-TLS-1-2-2017-01" }} ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES128-SHA256:AES256-GCM-SHA384:AES256-SHA256'; ssl_prefer_server_ciphers on; {{ else if eq .ssl_policy "AWS-TLS-1-1-2017-01" }} ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA'; ssl_prefer_server_ciphers on; {{ else if eq .ssl_policy "AWS-2016-08" }} ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA'; ssl_prefer_server_ciphers on; {{ else if eq .ssl_policy "AWS-2015-05" }} ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DES-CBC3-SHA'; ssl_prefer_server_ciphers on; {{ else if eq .ssl_policy "AWS-2015-03" }} ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA'; ssl_prefer_server_ciphers on; {{ else if eq .ssl_policy "AWS-2015-02" }} ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA'; ssl_prefer_server_ciphers on; {{ end }} {{ end }} # If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the # scheme used to connect to this server map $http_x_forwarded_proto $proxy_x_forwarded_proto { default $http_x_forwarded_proto; '' $scheme; } # If we receive X-Forwarded-Port, pass it through; otherwise, pass along the # server port the client connected to map $http_x_forwarded_port $proxy_x_forwarded_port { default $http_x_forwarded_port; '' $server_port; } # If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any # Connection header that may have been passed to this server map $http_upgrade $proxy_connection { default upgrade; '' close; } # Apply fix for very long server names server_names_hash_bucket_size 128; # Default dhparam {{ if (exists "/etc/nginx/dhparam/dhparam.pem") }} ssl_dhparam /etc/nginx/dhparam/dhparam.pem; {{ end }} # Set appropriate X-Forwarded-Ssl header map $scheme $proxy_x_forwarded_ssl { default off; https on; } gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; log_format vhost '$host $remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"'; access_log off; {{/* Get the SSL_POLICY defined by this container, falling back to "Mozilla-Intermediate" */}} {{ $ssl_policy := or ($.Env.SSL_POLICY) "Mozilla-Intermediate" }} {{ template "ssl_policy" (dict "ssl_policy" $ssl_policy) }} {{ if $.Env.RESOLVERS }} resolver {{ $.Env.RESOLVERS }}; {{ end }} {{ if (exists "/etc/nginx/proxy.conf") }} include /etc/nginx/proxy.conf; {{ else }} # HTTP 1.1 support proxy_http_version 1.1; proxy_buffering off; proxy_set_header Host $http_host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $proxy_connection; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl; proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; # Mitigate httpoxy attack (see README for details) proxy_set_header Proxy ""; {{ end }} {{ $enable_ipv6 := eq (or ($.Env.ENABLE_IPV6) "") "true" }} server { server_name _; # This is just an invalid value which will never trigger on a real hostname. listen 80; {{ if $enable_ipv6 }} listen [::]:80; {{ end }} access_log /var/log/nginx/access.log vhost; return 503; } {{ if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }} server { server_name _; # This is just an invalid value which will never trigger on a real hostname. listen 443 ssl http2; {{ if $enable_ipv6 }} listen [::]:443 ssl http2; {{ end }} access_log /var/log/nginx/access.log vhost; return 503; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_certificate /etc/nginx/certs/default.crt; ssl_certificate_key /etc/nginx/certs/default.key; } {{ end }} {{ range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }} {{ $host := trim $host }} {{ $is_regexp := hasPrefix "~" $host }} {{ $upstream_name := when $is_regexp (sha1 $host) $host }} # {{ $host }} upstream {{ $upstream_name }} { {{ range $container := $containers }} {{ $addrLen := len $container.Addresses }} {{ range $knownNetwork := $CurrentContainer.Networks }} {{ range $containerNetwork := $container.Networks }} {{ if (and (ne $containerNetwork.Name "ingress") (or (eq $knownNetwork.Name $containerNetwork.Name) (eq $knownNetwork.Name "host"))) }} ## Can be connected with "{{ $containerNetwork.Name }}" network {{/* If only 1 port exposed, use that */}} {{ if eq $addrLen 1 }} {{ $address := index $container.Addresses 0 }} {{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }} {{/* If more than one port exposed, use the one matching VIRTUAL_PORT env var, falling back to standard web port 80 */}} {{ else }} {{ $port := coalesce $container.Env.VIRTUAL_PORT "80" }} {{ $address := where $container.Addresses "Port" $port | first }} {{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }} {{ end }} {{ else }} # Cannot connect to network of this container server 127.0.0.1 down; {{ end }} {{ end }} {{ end }} {{ end }} } {{ $default_host := or ($.Env.DEFAULT_HOST) "" }} {{ $default_server := index (dict $host "" $default_host "default_server") $host }} {{/* Get the VIRTUAL_PROTO defined by containers w/ the same vhost, falling back to "http" */}} {{ $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }} {{/* Get the NETWORK_ACCESS defined by containers w/ the same vhost, falling back to "external" */}} {{ $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }} {{/* Get the HTTPS_METHOD defined by containers w/ the same vhost, falling back to "redirect" */}} {{ $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) "redirect" }} {{/* Get the SSL_POLICY defined by containers w/ the same vhost, falling back to empty string (use default) */}} {{ $ssl_policy := or (first (groupByKeys $containers "Env.SSL_POLICY")) "" }} {{/* Get the HSTS defined by containers w/ the same vhost, falling back to "max-age=31536000" */}} {{ $hsts := or (first (groupByKeys $containers "Env.HSTS")) "max-age=31536000" }} {{/* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}} {{ $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }} {{/* Get the first cert name defined by containers w/ the same vhost */}} {{ $certName := (first (groupByKeys $containers "Env.CERT_NAME")) }} {{/* Get the best matching cert by name for the vhost. */}} {{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}} {{/* vhostCert is actually a filename so remove any suffixes since they are added later */}} {{ $vhostCert := trimSuffix ".crt" $vhostCert }} {{ $vhostCert := trimSuffix ".key" $vhostCert }} {{/* Use the cert specified on the container or fallback to the best vhost match */}} {{ $cert := (coalesce $certName $vhostCert) }} {{ $is_https := (and (ne $https_method "nohttps") (ne $cert "") (exists (printf "/etc/nginx/certs/%s.crt" $cert)) (exists (printf "/etc/nginx/certs/%s.key" $cert))) }} {{ if $is_https }} {{ if eq $https_method "redirect" }} server { server_name {{ $host }}; listen 80 {{ $default_server }}; {{ if $enable_ipv6 }} listen [::]:80 {{ $default_server }}; {{ end }} access_log /var/log/nginx/access.log vhost; return 301 https://$host$request_uri; } {{ end }} server { server_name {{ $host }}; listen 443 ssl http2 {{ $default_server }}; {{ if $enable_ipv6 }} listen [::]:443 ssl http2 {{ $default_server }}; {{ end }} access_log /var/log/nginx/access.log vhost; # CUSTOM FOR NEXTCLOUD UPLOADS client_max_body_size 5G; # 0=unlimited - set max upload size client_body_buffer_size 0; {{ if eq $network_tag "internal" }} # Only allow traffic from internal clients include /etc/nginx/network_internal.conf; {{ end }} {{ template "ssl_policy" (dict "ssl_policy" $ssl_policy) }} ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }}; ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }}; {{ if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }} ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }}; {{ end }} {{ if (exists (printf "/etc/nginx/certs/%s.chain.pem" $cert)) }} ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.pem" $cert }}; {{ end }} {{ if (not (or (eq $https_method "noredirect") (eq $hsts "off"))) }} add_header Strict-Transport-Security "{{ trim $hsts }}" always; {{ end }} {{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }} include {{ printf "/etc/nginx/vhost.d/%s" $host }}; {{ else if (exists "/etc/nginx/vhost.d/default") }} include /etc/nginx/vhost.d/default; {{ end }} location / { {{ if eq $proto "uwsgi" }} include uwsgi_params; uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ else if eq $proto "fastcgi" }} root {{ trim $vhost_root }}; include fastcgi_params; fastcgi_pass {{ trim $upstream_name }}; {{ else }} proxy_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ end }} {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }} auth_basic "Restricted {{ $host }}"; auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }}; {{ end }} {{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }} include {{ printf "/etc/nginx/vhost.d/%s_location" $host}}; {{ else if (exists "/etc/nginx/vhost.d/default_location") }} include /etc/nginx/vhost.d/default_location; {{ end }} } } {{ end }} {{ if or (not $is_https) (eq $https_method "noredirect") }} server { server_name {{ $host }}; listen 80 {{ $default_server }}; {{ if $enable_ipv6 }} listen [::]:80 {{ $default_server }}; {{ end }} access_log /var/log/nginx/access.log vhost; {{ if eq $network_tag "internal" }} # Only allow traffic from internal clients include /etc/nginx/network_internal.conf; {{ end }} {{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }} include {{ printf "/etc/nginx/vhost.d/%s" $host }}; {{ else if (exists "/etc/nginx/vhost.d/default") }} include /etc/nginx/vhost.d/default; {{ end }} location / { {{ if eq $proto "uwsgi" }} include uwsgi_params; uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ else if eq $proto "fastcgi" }} root {{ trim $vhost_root }}; include fastcgi_params; fastcgi_pass {{ trim $upstream_name }}; {{ else }} proxy_pass {{ trim $proto }}://{{ trim $upstream_name }}; {{ end }} {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }} auth_basic "Restricted {{ $host }}"; auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }}; {{ end }} {{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }} include {{ printf "/etc/nginx/vhost.d/%s_location" $host}}; {{ else if (exists "/etc/nginx/vhost.d/default_location") }} include /etc/nginx/vhost.d/default_location; {{ end }} } } {{ if (and (not $is_https) (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }} server { server_name {{ $host }}; listen 443 ssl http2 {{ $default_server }}; {{ if $enable_ipv6 }} listen [::]:443 ssl http2 {{ $default_server }}; {{ end }} access_log /var/log/nginx/access.log vhost; return 500; ssl_certificate /etc/nginx/certs/default.crt; ssl_certificate_key /etc/nginx/certs/default.key; } {{ end }} {{ end }} {{ end }} ```

kerem commented