# ###################################################### #
# NGINX & Certbot                                        #
#                                                        #
# This is a solution for a reverse-proxy configuration   #
# and also letsencript certificate create and renew      #
#                                                        #
# NGINX - Will act as a reverse proxy and SSL            #
# Certbot - Will manage certificate's with Let's encript #
# ###################################################### #

Project Structure:
==================

docker-nginx/
├── docker-compose.yml
├── nginx/
│   ├── Dockerfile
│   └── default.conf
│   └── default.conf.FULL_HTTPS			 # The full NGINX configuration. With SSL support
│   └── default.conf.INITIAL_HTTP_ONLY	 # Minimal for Certbot firsttime certificate request. HTTP only.
├── certbot/
│   ├── conf/              # Mounted volume for certs (empty at first)
│   └── www/               # Mounted volume for webroot challenge (empty at first)


NOTE: The first certificate needs a special environment. Thats why we need 2 distinct NGINX conf


Build & Run:
============

For a full startup: 

#1 copy&rename the file: nginx/default.conf.INITIAL_HTTP_ONLY to nginx/default.conf
#2 > docker-compose up --build
#3 copy&rename the file: nginx/default.conf.FULL_HTTPS to nginx/default.conf
#4 > docker-compose restart nginx


Certificate management
======================

	1. Self-Signed
	
	   No need for Certbot. Comment docker-composer.yml configuration for certbot:
	   Generate or Copy the self-signed certificate files (*.crt & *.key) to \certs
	   Make sure docker-composer.yml maps the volume ./nginx/certs:/etc/nginx/certs
	   Make sure the nginx\default.conf uses the /etc/nginx/certs.
	   
	2. First Let's Encript certificate
	
	   This is a very special situation. NGINX must be up & running to respond to Let's Encript challenge (/.well-known/acme-challenge/)
	   BUT, if we have HTTPS configured, NGINX will fail (no certificate, obviously).
	   Comment all server's in nginx\default.conf, keep the only the server for HTTP and  /.well-known/acme-challenge/
	   Uncomment docker-composer.yml certbot: configuration, including entrypoint.
	   Then, startup docker :: docker-compose up --build. Wait for everything to finish. A new certificate was requested, copied and configured into NGINX.
	   Stop. Uncomment all servers's in nginx\default.conf. Comment the docker-composer.yml certbot.entrypoint configuration.
	
	3. Automate renoval of Let's Encript certificate
	
	   #1 renew the certificate
	      > docker-compose run certbot renew --webroot --webroot-path=/var/www/certbot
	   #2 reload NGINX
		  > docker-compose exec nginx nginx -s reload

