I contacted the Amazon Support Center, and I chose to show you the answer.
Hello K...,
With Dockerrun.aws.json, Elastic Beanstalk hook scripts will only read
the first port from the JSON file.
This is because in /opt/elasticbeanstalk/hooks/appdeploy/pre/04run.sh:
if [ echo $EB_CONFIG_DOCKER_PORT | wc -w -gt 1 ]; then
EB_CONFIG_DOCKER_PORT=echo $EB_CONFIG_DOCKER_PORT | awk '{print $1}'
warn "Only one EXPOSE directive is allowed, using the first one:
$EB_CONFIG_DOCKER_PORT" fi
The hook scripts will have to specify a random port for the reverse
proxy to forward to, which then forwards to your Docker container's
port. Currently only one port mapping can be setup.
With regards to the nginx configuration, the quickest way to achieve a
port 443 listening to your environment is to create a separate server
section in /etc/nginx/conf.d/ e.g. custom-ssl.conf, which handles the
HTTPS handshake with the client. This means that you will have to
place your SSL certificates onto the instance so that nginx can
perform the SSL handshake. I will get back to you later with a sample
HTTPS configuration in nginx.
Otherwise, if your environment is a load balanced one, you can simply
setup an HTTPS listener on the ELB, and let the ELB handle the SSL
termination.
Meanwhile, if you have other questions, please do not hesitate to ask!
Best regards,
Sydney Support Centre
*
Hello again K...,
As I have mentioned in my previous correspondence, please find
attached a sample .ebextensions config file which will setup an https
server on nginx, on a single instance Docker environment. You did not
let me know which environment you were enquiring about, so the
attached .ebextensions will only work on single instance environments.
This .ebextensions config file performs the following:
Adds the https server config file for nginx as /etc/nginx/sites-enabled/https.conf, which reverse proxies the
incoming https session to the Docker container as http.
Adds an SSL key/cert combined file into /etc/pki/tls/certs/my_ssl.crt, required by the HTTPS server above.
Adds an extra ingress rule to the Beanstalk environment's EC2 security group to allow incoming TCP:443 connections to the instance
Please feel free to modify the .ebextensions config file to suit your
use case, and place this inside the .ebextensions/ directory at the
root level of your application to be deployed in Elastic Beanstalk. If
the directory is not there, then please create it.
For more information on .ebextensions config files, please see:
- http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers.html
If you are on a load balanced environment, then you will need to
upload your SSL certificate to IAM via the AWS CLI, and configure your
Beanstalk environment's ELB to enable its HTTPS listener. The
instructions will be different to the ones above:
- http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html
Please let me know how you go with the .ebextensions config file, and
let me know if you require further assistance!
Best regards,
Sydney Support Centre
And he gave me an example in attachment. 01-nginx-ssl.config
files:
"/etc/nginx/sites-enabled/https.conf":
mode: "000644"
owner: root
group: root
content: |
server {
listen 443 ssl;
ssl_certificate_key /etc/pki/tls/certs/my_ssl.crt;
ssl_certificate /etc/pki/tls/certs/my_ssl.crt;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://docker;
proxy_http_version 1.1;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
"/etc/pki/tls/certs/my_ssl.crt":
mode: "000400"
owner: root
group: root
content: |
<Your key/cert pair goes here>
Resources:
AllowSSL:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: {Ref : AWSEBSecurityGroup}
IpProtocol: tcp
ToPort: 443
FromPort: 443
CidrIp: 0.0.0.0/0
