Docker very secured Nginx with secure SSL

maintained by SepPenner

FAQ - All you need to know about the marvambass Containers

What is it

This Dockerfile gives you a ready to use secured production nginx server with phpBB running on it, with perfectly configured SSL. You should get a A+ Rating at the Qualys SSL Test.

Environment variables and defaults

• DH_SIZE
• default: 2048 (which takes a long time to create), for demo or unsecure applications you can use smaller values like 512

Running marvambass/nginx-ssl-secure Container

This Dockerfile is not really made for direct usage. It should be used as base-image for your nginx project. But you can run it anyways.

You should overwrite the /etc/nginx/external/ with a folder, containing your nginx *.conf files, certs and a dh.pem.
If you forget the dh.pem file, it will be created at the first start - but this can/will take a long time!

docker run -d \
-p 443:443 \
-e 'DH_SIZE=2048' \
-v /opt/Docker/nginx-phpBB/www-data:/usr/share/nginx/html/ \
--restart always \
--name nginxphpbb \
nginxphpbb

Build the image locally

sudo docker build . -f Dockerfile -t nginxphpbb

Based on

This Dockerfile bases on the /_/nginx/ Official Image and MarvAmBass/docker-nginx-ssl-secure.

Cheat Sheet

Creating the dh2048.pem with openssl

To create a Diffie-Hellman cert, you can use the following command

openssl dhparam -out dh2048.pem 2048

Creating a high secure SSL CSR with openssl

This cert might be incompatible with Windows 2000, XP and older IE Versions

openssl req -nodes -new -newkey rsa:2048 -out csr.pem -sha256

Creating a self-signed ssl cert

Please note, that the Common Name (CN) is important and should be the FQDN to the secured server:

openssl req -x509 -newkey rsa:4086 \
-keyout key.pem -out cert.pem \
-days 3650 -nodes -sha256