support docker (+compose)

commit messages by http://whatthecommit.com

.gitignore

@@ -1 +1 @@
-/ssl
+/tls

Justfile

@@ -9,11 +9,8 @@ sh:
 logs:
 	podman logs --follow {{ NAME }}
 
-genssl DOMAIN='website.com':
+@setup-tls:
-	mkdir -p ssl
+	make setup-tls
-	openssl req -x509 -new -keyout ssl/key.pem -out ssl/cert.pem -noenc -days 3 \
-		-addext 'subjectAltName=DNS:sub.a.{{DOMAIN}},DNS:a.{{ DOMAIN }},DNS:b.{{DOMAIN}}' \
-		-subj '/CN={{ DOMAIN }}'
 
 container:
 	podman run \
@@ -22,5 +19,5 @@ container:
 		--publish 8443:443 \
 		--volume ./conf.d:/etc/nginx/conf.d:ro,z \
 		--volume ./www:/srv/www:ro,z \
-		--volume ./ssl:/etc/nginx/ssl:ro,z \
+		--volume ./tls:/etc/nginx/tls:ro,z \
 		nginx:alpine

Makefile

@@ -0,0 +1,16 @@
+.PHONY: setup-tls
+
+DOMAIN ::= website.com
+
+setup-tls: tls/cert.pem
+
+tls/cert.pem: tls/key.pem
+	openssl req -x509 -new -key $< -out $@ -noenc -days 365 \
+		-addext 'subjectAltName=DNS:sub.a.$(DOMAIN),DNS:a.$(DOMAIN),DNS:b.$(DOMAIN)' \
+		-subj '/CN=$(DOMAIN)'
+
+tls/key.pem: tls/
+	openssl genpkey -out $@ -algorithm RSA -pkeyopt bits:4096
+
+tls/:
+	mkdir $@

README.md

@@ -1,25 +1,66 @@
+# what is this?
+
 to play with cookies
 
 this serves a nginx server on port 8443
 
+# how to use?
+
+## set up dns
+
 > [!CAUTION]
-> you want to change your `/etc/hosts` (on \*nix)
+> you want to change your `/etc/hosts` (on \*nix; requires root)
 
 ```
 # /etc/hosts
 127.0.0.1 website.com a.website.com b.website.com sub.a.website.com
 ```
 
-next, install `just` for your system. take a look at <https://just.systems> if unsure how
+the nginx config has these domains hardcoded. change them too if you want
 
-get `podman` too while you're at it. you don't have `openssl`? what insane operating system are you on? get openssl too.
+## set up tls
+
+run `make setup-tls`
+
+you don't have `make`? well install it.
+
+you don't have `openssl`? what insane operating system are you on? get openssl too.
+
+
+## change the cookie attributes
+
+to add attributes, modify the file `cookieattr`
+```
+# cookieattr
+set $cookie_attr 'Secure; Domain=a.host.com; HttpOnly;';
+```
+note that the `;` at the end is the line terminator for nginx config and is necessary
+
+## start the server
+
+### with compose
+
+```console
+$ docker compose up -d
+$ docker compose exec cookies nginx -s reload
+$ # or create a make/just target to do that
+```
+
+### with podman
 
 ```console
-$ just genssl
 $ just container
-$ # now you mess around with conf.d/server.conf
+$ # now you mess around with cookieattr
 $ # you look at https://a.website.com https://b.website.com https://sub.a.website.com
 $ # you can tell you need to tell your browser you want a taste of danger
 $ just reload
-$ # ^ do that when you make changes to server.conf
+$ # ^ do that when you make changes to config
+```
+
+# what if sth doesn't work?
+
+might be the `:z` label in the `volumes` in `docker-compose.yml`. remove it.
+e.g.
+```
+- ./tls:/etc/nginx/tls:ro
 ```

conf.d/cookieattr.part

@@ -0,0 +1 @@
+set $cookie_attr 'Secure;';

conf.d/server.conf

@@ -5,10 +5,12 @@ map $host $flavour {
 }
 server {
 	listen 443 ssl;
-	ssl_certificate /etc/nginx/ssl/cert.pem;
+	ssl_certificate /etc/nginx/tls/cert.pem;
-	ssl_certificate_key /etc/nginx/ssl/key.pem;
+	ssl_certificate_key /etc/nginx/tls/key.pem;
 	server_name a.website.com b.website.com sub.a.website.com;
 
+	include 'conf.d/cookieattr.part';
+
 	root /srv/www;
 
 	try_files $uri $uri.html /index.html =200;
@@ -20,7 +22,7 @@ server {
 	}
 	location /set {
 		try_files $uri $uri.html /index.html =200;
-		add_header set-cookie 'flavour=$flavour; max-age=3600;';
+		add_header set-cookie 'flavour=$flavour; $cookie_attr';
 	}
 	location /clear {
 		try_files $uri $uri.html /index.html =200;

cookieattr

@@ -0,0 +1 @@
+conf.d/cookieattr.part

docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+  cookies:
+    image: nginx:alpine
+    volumes:
+      - ./conf.d/:/etc/nginx/conf.d:ro,z
+      - ./tls:/etc/nginx/tls:ro,z
+      - ./www:/srv/www:ro,z
+    publish:
+      - 8443:443
+