Skip to content

Commit 84e9641

Browse files
authored
Merge pull request #1 from SamWanekeya/develop
Develop
2 parents 4f16e37 + 0b535f3 commit 84e9641

File tree

7 files changed

+629
-632
lines changed

7 files changed

+629
-632
lines changed

.env.example

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#Node environment
2+
REACT_APP_NODE_ENV="production"

README.md

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
### Running the project
44
1. Run `git clone https://github.com/SamWanekeya/dockerizing-react-js-with-nginx-and-self-signed-ssl-certificate.git .`
5+
2. Be sure to replace `samwanekeya.com` domain with your own domain
56
4. Run `sh frontend_deploy.sh` from the project root folder to build the images and run the containers
67
5. Run `sh frontend_destroy.sh` from the project root folder to destroy the running containers
78
6. Test it out at [https://localhost](https://localhost). No mounted folders. To apply changes, the image must be re-built.

docker/Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,12 @@ RUN yarn install --silent --non-interactive --frozen-lockfile --ignore-optional
1414
COPY . .
1515
RUN PUBLIC_URL=/ yarn run build
1616

17-
FROM nginx:1.17.9-alpine as app
17+
FROM nginx:1.18.0-alpine as app
1818

1919
# Add bash
2020
RUN apk add --no-cache bash
2121

22-
FROM debian:10.3-slim
22+
FROM debian:10.4-slim
2323

2424
RUN apt-get update \
2525
&& apt-get install -y nginx openssl \

docker/nginx.conf

+48-24
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,45 @@
22

33
# This value auto allows binding worker processes automatically to available CPU
44
worker_processes auto;
5-
#worker_cpu_affinity auto;
5+
# Allows binding worker processes automatically to available CPUs
6+
worker_cpu_affinity auto;
7+
# The number of simultaneous connections is limited by the number of file descriptors available on the system as each socket will open a file descriptor. If NGINX tries to open more sockets than the available file descriptors, it will lead to the Too many opened files message in the error.log.
8+
worker_rlimit_nofile 65535;
69

710
# logging
11+
error_log /var/log/nginx/error.log;
812
error_log /var/log/nginx/error.log warn;
13+
error_log /var/log/nginx/error.log notice;
14+
error_log /var/log/nginx/error.log info;
915

1016
pid /var/run/nginx.pid;
1117

1218

1319
events {
14-
multi_accept on;
20+
# The maximum number of connections that each worker process can handle simultaneously. The default is 512, but most systems have enough resources to support a larger number. The appropriate setting depends on the size of the server and the nature of the traffic, and can be discovered through testing.
1521
worker_connections 65535;
22+
# This directive allows a worker to accept many connections in the queue at a time. A queue in this context simply means a sequence of data objects waiting to be processed.
23+
multi_accept on;
24+
# With this directive worker processes will accept new connections by turn. Otherwise, all worker processes will be notified about new connections, and if volume of new connections is low, some of the worker processes may just waste system resources.
25+
accept_mutex on;
26+
# This directive determines how long a worker should wait before accepting a new connection. Once the accept_mutex is turned on, a mutex lock is assigned to a worker for a timeframe specified by the accept_mutex_delay . When the timeframe is up, the next worker in line is ready to accept new connections.
27+
accept_mutex_delay 200ms;
28+
# This directive specifies the method to process a connection from the client. We decided to set the value to epoll because we are working on a Ubuntu platform. The epoll method is the most effective processing method for Linux platforms.
29+
use epoll;
30+
# This specifies the number of events that NGINX will pass to the kernel.
31+
epoll_events 1024;
1632
}
1733

1834
http {
35+
# To support larger number of server names that are defined
36+
server_names_hash_bucket_size 64;
37+
# Sets the bucket size for the server names hash tables. The default value depends on the size of the processor’s cache line.
38+
server_names_hash_max_size 512;
1939
# redirect all http traffic to https
2040
server {
2141
listen 80 default_server;
2242
listen [::]:80 default_server ipv6only=on;
23-
server_name _;
43+
server_name samwanekeya.com;
2444
root /usr/share/nginx/html;
2545
index index.html index.htm index.nginx-debian.html;
2646
return 301 https://$host$request_uri;
@@ -29,35 +49,42 @@ http {
2949
server {
3050
listen 443 ssl;
3151
listen [::]:443 ssl ipv6only=on;
32-
server_name _;
52+
server_name samwanekeya.com;
3353
# MIME
3454
include /etc/nginx/mime.types;
3555
default_type application/octet-stream;
36-
# Display nginx Version number in error or http header may result in hacker to search for known vulnerability.
37-
# Therefore, the version number should be removed for every http response.
56+
# Display nginx Version number in error or http header may result in hacker to search for known vulnerability. Therefore, the version number should be removed for every http response.
3857
server_tokens "off";
39-
charset utf-8;
40-
sendfile on;
41-
tcp_nopush on;
58+
#charset utf-8;
59+
# This directive, by default, is disabled to allow small packets to wait for a specified period before they are sent at once. To allow all data to be sent at once, this directive is enabled.
4260
tcp_nodelay on;
43-
#Defines a timeout for reading client request body. The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body. If a client does not transmit anything within this time, the 408 (Request Time-out) error is returned to the client.
61+
# Because we have enabled tcp_nodelay directive, small packets are sent at once. However, if you still want to make use of John Nagle’s buffering algorithm, we can also enable the tcp_nopush to add packets to each other and send them all at once.
62+
tcp_nopush on;
63+
# Defines a timeout for reading client request body. The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body. If a client does not transmit anything within this time, the 408 (Request Time-out) error is returned to the client.
4464
client_body_timeout 12;
45-
#Defines a timeout for reading client request header. If a client does not transmit the entire header within this time, the 408 (Request Time-out) error is returned to the client.
65+
# Defines a timeout for reading client request header. If a client does not transmit the entire header within this time, the 408 (Request Time-out) error is returned to the client.
4666
client_header_timeout 12;
47-
#The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ. The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. MSIE closes keep-alive connections by itself in about 60 seconds.
48-
keepalive_timeout 15;
49-
#Sets a timeout for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.
50-
send_timeout 10;
51-
#Size Limits & Buffer Overflows
52-
client_body_buffer_size 10K;
67+
# This directive sets the buffer size for the request body. If you plan to run the webserver on 64-bit systems, you need to set the value to 16k. If you want to run the webserver on the 32-bit system, set the value to 8k.
68+
client_body_buffer_size 16K;
69+
# Similar to the previous directive, only instead it handles the client header size. For all intents and purposes, 1K is usually a decent size for this directive not unless you're sending mayopic stuff via header i.e permissions.
5370
client_header_buffer_size 1k;
71+
# The maximum number and size of buffers for large client headers.
5472
large_client_header_buffers 2 1k;
55-
types_hash_max_size 2048;
56-
client_max_body_size 16M;
57-
73+
# The maximum allowed size for a client request. If the maximum size is exceeded, then Nginx will spit out a 413 error or Request Entity Too Large.
74+
client_max_body_size 64M;
75+
# Defines the maximum size of an entry in the MIME types hash tables.
76+
types_hash_max_size 4096;
77+
# The first parameter sets a timeout during which a keep-alive client connection will stay open on the server side. The zero value disables keep-alive client connections. The optional second parameter sets a value in the “Keep-Alive: timeout=time” response header field. Two parameters may differ. The “Keep-Alive: timeout=time” header field is recognized by Mozilla and Konqueror. The default is 75 seconds.
78+
keepalive_timeout 120s;
79+
# Configure a number of requests to keep alive for a specific period of time. You can set the number of requests to 20 or 30.
80+
keepalive_requests 120;
81+
# if you want to disable keepalive connection for a specific group of browsers, use this directive.
82+
#keepalive_disable;
83+
#Sets a timeout for transmitting a response to the client. The timeout is set only between two successive write operations, not for the transmission of the whole response. If the client does not receive anything within this time, the connection is closed.
84+
send_timeout 75s;
85+
# TLS certificate and key
5886
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
5987
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
60-
6188
# enable session resumption to improve https performance
6289
# http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
6390
ssl_session_cache shared:SSL:10m;
@@ -66,7 +93,6 @@ http {
6693
# generated using:# openssl dhparam -dsaparam -out /etc/ssl/dh4096.pem 4096
6794
ssl_ecdh_curve secp384r1;
6895
ssl_session_tickets off;
69-
7096
# enables server-side protection from BEAST attacks
7197
# http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
7298
ssl_prefer_server_ciphers on;
@@ -76,7 +102,6 @@ http {
76102
# http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
77103
# Disabled insecure ciphers suite. For example, MD5, DES, RC4, PSK
78104
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGTH";
79-
80105
# -!MEDIUM:exclude encryption cipher suites using 128 bit encryption.
81106
# -!LOW: exclude encryption cipher suites using 64 or 56 bit encryption algorithms
82107
# -!EXPORT: exclude export encryption algorithms including 40 and 56 bits algorithms.
@@ -85,7 +110,6 @@ http {
85110
# -!eNULL:exclude the "NULL" ciphers that is those offering no encryption.
86111
# Because these offer no encryption at all and are a security risk they are disabled unless explicitly included.
87112
# @STRENGTH:sort the current cipher list in order of encryption algorithm key length.
88-
89113
# enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
90114
# http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
91115
#Cloudflare resolver 1dot1dot1dot1.cloudflare-dns.com

docker/nginxconfig/general.conf

+54-4
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,47 @@
22
location = /public/favicon.ico {
33
log_not_found off;
44
access_log off;
5+
error_log off;
56
}
67

7-
# assets, media, allow safe files
8+
# Disable directory listing
9+
location / {
10+
autoindex off;
11+
}
12+
13+
# assets, media, and Static File Caching while allowing safe files
814
location ~* \.(?:css(\.map)?|js(\.map)?|ttf|ttc|otf|eot|woff2?|svgz?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv|pdf|docx?|dotx?|docm|dotm|xlsx?|xltx?|xlsm|xltm|pptx?|potx?|pptm|potm|ppsx?)$ {
915
add_header Access-Control-Allow-Origin "*";
1016
add_header Cache-Control "public";
11-
expires 30d;
12-
access_log off;
17+
expires 365d;
18+
# Nginx logs every request that hits the server to a log file. If you use analytics to monitor this, you may want to turn this functionality off. Simply edit the access_log directive:
19+
access_log on;
1320
}
1421

1522
# deny access to .htaccess files
1623
location ~ /\.ht {
1724
deny all;
25+
error_log off;
26+
log_not_found off;
1827
}
1928

2029
# Deny access to hidden files (beginning with a period)
2130
location ~ /\. {
2231
deny all;
32+
error_log off;
33+
log_not_found off;
34+
}
35+
36+
37+
location /video/ {
38+
# To utilize operating system resources, set the value of this directive to on. sendfile transfers data between file descriptors within the OS kernel space without sending it to the application buffers. This directive will be used to serve small files.
39+
sendfile on;
40+
# This directive enables multi-threading when set to on for write and read operation. Multi-threading is an execution model that allows multiple threads to execute separately from each other whilst sharing their hosting process resources.
41+
aio threads;
42+
# This directive improves cache effectiveness by allowing read and write to be sent directly to the application. directio is a filesystem feature of every modern operating system. This directive will be used to serve larger files like videos.
43+
directio 8m;
44+
# This directive assigns a block size value to the data transfer. It related to the directio directive.
45+
directio_alignment 1024;
2346
}
2447

2548
# define error pages
@@ -46,4 +69,31 @@ if ($request_method !~ ^(GET|PUT|POST)$ ) {
4669
if ($host !~ ^(samwanekeya.com|localhost)$ ) {
4770
return 444;
4871
}
49-
##
72+
73+
#Gzip can help reduce the amount of network transfer Nginx deals with. However, be careful increasing the gzip_comp_level too high as the server will begin wasting cpu cycles.
74+
#For those using Cloudflare as their CDN this is already taken care of - https://support.cloudflare.com/hc/en-us/articles/200168086-Does-Cloudflare-compress-resources-
75+
76+
#If you want to enable compression, set the value of this directive to on. By default, it is disabled.
77+
#gzip on;
78+
# You can make use of this directive to set the compression level. In order not to waste CPU resources, you need not set the compression level too high. Between 1 and 9, you can set the compression level to 2 or 3.
79+
#gzip_comp_level 2;
80+
# Set the minimum response length for compression via the content-length response header field. You can set it to more than 20 bytes.
81+
#gzip_min_length 1000;
82+
#gzip_proxied expired no-cache no-store private auth;
83+
# This directive allows you to choose the response type you want to compress. By default, the response type text/html is always compressed. You can add other response type such as text/plain application/x-javascript text/xml as shown in the code above.
84+
#gzip_types text/plain application/x-javascript text/xml text/css application/xml;
85+
# This directive allows you to choose the minimum HTTP version of a request for a compressed response. You can make use of the default value which is 1.1.
86+
#gzip_http_version 1.1;
87+
# When gzip directive is enabled, this directive add the header field Vary:Accept Encoding to the response.
88+
#gzip_vary on;
89+
# Some browsers such as Internet Explorer 6 do not have support for gzip compression. This directive make use of User-Agent request header field to disable compression for certain browsers.
90+
#gzip_disable "MSIE [4-6] \.";
91+
92+
# This directive is disabled by default. Enable it if you want implement caching in Nginx. This directive stores metadata of files and directories commonly requested by users.
93+
open_file_cache max=1000 inactive=30s;
94+
# This directive contains backup information inside the open_file_cache directive. You can use this directive to set a valid period usually in seconds after which the information related to files and directories is re-validated again.
95+
open_file_cache_valid 30s;
96+
# Nginx usually clear information inside the open_file_cache directive after a period of inactivity based on the open_file_cache_min_uses. You can use this directive to set a minimum number of access to identify which files and directories are actively accessed.
97+
open_file_cache_min_uses 4;
98+
# You can make use of this directive to allow Nginx to cache errors such as “permission denied” or “can’t access this file” when files are accessed. So anytime a resource is accessed by a user who does not have the right to do so, Nginx displays the same error report “permission denied”.
99+
open_file_cache_errors on;

docker/nginxconfig/security.conf

+3-1
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,6 @@ add_header Referrer-Policy "no-referrer-when-downgrade";
2828
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
2929
# add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'";
3030
#For Clouflare users comment this out as it's handle from the admin UI
31-
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
31+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
32+
# Prevent search engine indexing
33+
#add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";

0 commit comments

Comments
 (0)