Dustin C. Hatch
670c1f7561
We're going to use *nginx* as the reverse proxy in front of Home Assistant, as well as the web consoles for Zigbee2MQTT and ZWaveJS2MQTT. It will provide TLS termination for all of these applications. Since *nginx* will not start without a certificate and private key file for HTTPS, the *gen-nginx-cert.service* systemd unit generates a self-signed certificate if one does not already exist. This ensures that *nginx* can start by default, but still allows the administrator to replace the certificate with a trusted one later. The *nginx* container image has symlinks at `/var/log/nginx/error.log` and `/var/log/nginx/access.log`, pointing to `/dev/stderr` and `/dev/stdout`, respectively. The intent here is to send all log messages to the container runtime. Unfortunately, when the the container is managed by Podman from a systemd unit, the standard output and standard error streams are connected to the systemd journal via a UNIX socket. As a result, the `/dev/stdout` and `/dev/stderr` pseudo-files cannot be "opened" like normal files or pipes. Thus, to forward nginx's logs to the systemd journal correctly, we have to do a bit of trickery. For the error log at least, setting `error_log stderr` works well; nginx simply writes messages to the existing file descriptor. Unfortunately, the access log has no such mechanism. For that, we use nginx's syslog capabilities. The `/dev/log` socket is bind-mounted into the container, and nginx is configured to connect to it.
27 lines
560 B
Plaintext
27 lines
560 B
Plaintext
# vim: set ft=systemd :
|
|
[Unit]
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
Requires=gen-nginx-cert.service
|
|
|
|
[Container]
|
|
Image=docker.io/library/nginx
|
|
Network=host
|
|
Volume=/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
|
Volume=/etc/nginx/conf.d:/etc/nginx/conf.d:ro
|
|
Volume=/etc/nginx/ssl:/etc/nginx/ssl:ro
|
|
Volume=/dev/log:/dev/log
|
|
User=82
|
|
Group=82
|
|
AddCapability=CAP_NET_BIND_SERVICE
|
|
ReadOnly=true
|
|
VolatileTmp=yes
|
|
|
|
[Service]
|
|
ProtectSystem=full
|
|
UMask=0077
|
|
ExecReload=/usr/bin/podman exec systemd-%N nginx -s reload
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|