|
| 1 | +# How to use NGINX as a reverse-proxy with LetsEncrypt |
| 2 | + |
| 3 | +## Requirements |
| 4 | + |
| 5 | +1. Start a Coder deployment and be sure to set the following [configuration values](https://coder.com/docs/v2/latest/admin/configure): |
| 6 | + |
| 7 | + ```console |
| 8 | + CODER_HTTP_ADDRESS=127.0.0.1:3000 |
| 9 | + CODER_ACCESS_URL=https://coder.example.com |
| 10 | + CODER_WILDCARD_ACCESS_URL=*coder.example.com |
| 11 | + ``` |
| 12 | + |
| 13 | + Throughout the guide, be sure to replace `coder.example.com` with the domain you intend to use with Coder. |
| 14 | + |
| 15 | +2. Configure your DNS provider to point your coder.example.com and \*.coder.example.com to your server's public IP address. |
| 16 | + |
| 17 | + > For example, to use `coder.example.com` as your subdomain, configure `coder.example.com` and `*.coder.example.com` to point to your server's public ip. This can be done by adding A records in your DNS provider's dashboard. |
| 18 | +
|
| 19 | +3. Install NGINX (assuming you're on Debian/Ubuntu): |
| 20 | + |
| 21 | + ```console |
| 22 | + sudo apt install nginx |
| 23 | + ``` |
| 24 | + |
| 25 | +4. Stop NGINX service: |
| 26 | + |
| 27 | + ```console |
| 28 | + sudo systemctl stop nginx |
| 29 | + ``` |
| 30 | + |
| 31 | +## Adding Coder deployment subdomain |
| 32 | + |
| 33 | +> This example assumes Coder is running locally on `127.0.0.1:3000` and that you're using `coder.example.com` as your subdomain. |
| 34 | +
|
| 35 | +1. Create NGINX configuration for this app: |
| 36 | + |
| 37 | + ```console |
| 38 | + sudo touch /etc/nginx/sites-available/coder.example.com |
| 39 | + ``` |
| 40 | + |
| 41 | +2. Activate this file: |
| 42 | + |
| 43 | + ```console |
| 44 | + sudo ln -s /etc/nginx/sites-available/coder.example.com /etc/nginx/sites-enabled/coder.example.com |
| 45 | + ``` |
| 46 | + |
| 47 | +## Install and configure LetsEncrypt Certbot |
| 48 | + |
| 49 | +1. Install LetsEncrypt Certbot: Refer to the [CertBot documentation](https://certbot.eff.org/instructions?ws=apache&os=ubuntufocal&tab=wildcard). Be sure to pick the wildcard tab and select your DNS provider for instructions to install the necessary DNS plugin. |
| 50 | + |
| 51 | +## Create DNS provider credentials |
| 52 | + |
| 53 | +> This example assumes you're using CloudFlare as your DNS provider. For other providers, refer to the [CertBot documentation](https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins). |
| 54 | +
|
| 55 | +1. Create an API token for the DNS provider you're using: e.g. [CloudFlare](https://dash.cloudflare.com/profile/api-tokens) with the following permissions: |
| 56 | + |
| 57 | + - Zone - DNS - Edit |
| 58 | + |
| 59 | +2. Create a file in `.secrets/certbot/cloudflare.ini` with the following content: |
| 60 | + |
| 61 | + ```ini |
| 62 | + dns_cloudflare_api_token = YOUR_API_TOKEN |
| 63 | + ``` |
| 64 | + |
| 65 | + ```console |
| 66 | + mkdir -p ~/.secrets/certbot |
| 67 | + touch ~/.secrets/certbot/cloudflare.ini |
| 68 | + nano ~/.secrets/certbot/cloudflare.ini |
| 69 | + ``` |
| 70 | + |
| 71 | +3. Set the correct permissions: |
| 72 | + |
| 73 | + ```console |
| 74 | + sudo chmod 600 ~/.secrets/certbot/cloudflare.ini |
| 75 | + ``` |
| 76 | + |
| 77 | +## Create the certificate |
| 78 | + |
| 79 | +1. Create the wildcard certificate: |
| 80 | + |
| 81 | + ```console |
| 82 | + sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini -d coder.example.com -d *.coder.example.com |
| 83 | + ``` |
| 84 | + |
| 85 | +## Configure nginx |
| 86 | + |
| 87 | +1. Edit the file with: |
| 88 | + |
| 89 | + ```console |
| 90 | + sudo nano /etc/nginx/sites-available/coder.example.com |
| 91 | + ``` |
| 92 | + |
| 93 | +2. Add the following content: |
| 94 | + |
| 95 | + ```nginx |
| 96 | + server { |
| 97 | + server_name coder.example.com *.coder.example.com; |
| 98 | +
|
| 99 | + # HTTP configuration |
| 100 | + listen 80; |
| 101 | + listen [::]:80; |
| 102 | +
|
| 103 | + # HTTP to HTTPS |
| 104 | + if ($scheme != "https") { |
| 105 | + return 301 https://$host$request_uri; |
| 106 | + } |
| 107 | +
|
| 108 | + # HTTPS configuration |
| 109 | + listen [::]:443 ssl ipv6only=on; |
| 110 | + listen 443 ssl; |
| 111 | + ssl_certificate /etc/letsencrypt/live/coder.example.com/fullchain.pem; |
| 112 | + ssl_certificate_key /etc/letsencrypt/live/coder.example.com/privkey.pem; |
| 113 | +
|
| 114 | + location / { |
| 115 | + proxy_pass http://127.0.0.1:3000; # Change this to your coder deployment port default is 3000 |
| 116 | + proxy_http_version 1.1; |
| 117 | + proxy_set_header Upgrade $http_upgrade; |
| 118 | + proxy_set_header Connection upgrade; |
| 119 | + proxy_set_header Host $host; |
| 120 | + proxy_set_header X-Real-IP $remote_addr; |
| 121 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 122 | + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; |
| 123 | + add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; |
| 124 | + } |
| 125 | + } |
| 126 | + ``` |
| 127 | + |
| 128 | + > Don't forget to change: `coder.example.com` by your (sub)domain |
| 129 | +
|
| 130 | +3. Test the configuration: |
| 131 | + |
| 132 | + ```console |
| 133 | + sudo nginx -t |
| 134 | + ``` |
| 135 | + |
| 136 | +## Refresh certificates automatically |
| 137 | + |
| 138 | +1. Create a new file in `/etc/cron.weekly`: |
| 139 | + |
| 140 | + ```console |
| 141 | + sudo touch /etc/cron.weekly/certbot |
| 142 | + ``` |
| 143 | + |
| 144 | +2. Make it executable: |
| 145 | + |
| 146 | + ```console |
| 147 | + sudo chmod +x /etc/cron.weekly/certbot |
| 148 | + ``` |
| 149 | + |
| 150 | +3. And add this code: |
| 151 | + |
| 152 | + ```sh |
| 153 | + #!/bin/sh |
| 154 | + sudo certbot renew -q |
| 155 | + ``` |
| 156 | + |
| 157 | +## Restart NGINX |
| 158 | + |
| 159 | +```console |
| 160 | +sudo systemctl restart nginx |
| 161 | +``` |
| 162 | + |
| 163 | +And that's it, you should now be able to access Coder at your sub(domain) e.g. `https://coder.example.com`. |
0 commit comments