-
Notifications
You must be signed in to change notification settings - Fork 15
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
11 changed files
with
205 additions
and
69 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| <!-- | ||
| SPDX-FileCopyrightText: 2022 - 2024 Orthanc Team SRL <[email protected]> | ||
| SPDX-License-Identifier: CC0-1.0 | ||
| --> | ||
|
|
||
| # Orthanc-nginx-cerbot | ||
|
|
||
| Same as [orthancteam/orthanc-nginx](https://hub.docker.com/r/orthancteam/orthanc-nginx) with certbot included to handle tls thanks to let'encrypt. | ||
|
|
||
| On top of [orthancteam/orthanc-nginx](https://hub.docker.com/r/orthancteam/orthanc-nginx) env var, these have to be defined: | ||
|
|
||
|
|
||
| | Environment variables | Default value | Description | | ||
| |----------------------------|:-------------------------------------------|:----------------------------------------------------------------------------------------------------------------| | ||
| | DOMAIN_NAME | - | FQNA redirecting to the public IP of the server running Nginx. | | ||
| | CERTBOT_EMAIL | - | Email adress provided to lets'encrypt, could be used to send warnings about certificates about to expire. | | ||
|
|
||
| NB: `ENABLE_HTTPS` env var decribed in [orthancteam/orthanc-nginx](https://hub.docker.com/r/orthancteam/orthanc-nginx) is not applicable in this version of the orthanc-nginx. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| # SPDX-FileCopyrightText: 2022 - 2024 Orthanc Team SRL <[email protected]> | ||
| # | ||
| # SPDX-License-Identifier: CC0-1.0 | ||
|
|
||
| FROM jonasal/nginx-certbot | ||
|
|
||
| RUN mkdir /etc/nginx/enabled-reverse-proxies | ||
| RUN mkdir /scripts-ot | ||
| ADD nginx/nginx-common.conf /etc/nginx/includes/ | ||
|
|
||
| ADD nginx/reverse-proxy.* /etc/nginx/disabled-reverse-proxies/ | ||
|
|
||
| ADD nginx/orthanc-nginx-certbot.conf /etc/nginx/user_conf.d/ | ||
|
|
||
| COPY nginx/docker-entrypoint-certbot.sh /scripts-ot/ | ||
| COPY nginx/copy-conf-files.sh /scripts-ot/ | ||
|
|
||
| RUN ls -al /etc/nginx/disabled-reverse-proxies/ | ||
|
|
||
| ENTRYPOINT ["./scripts-ot/docker-entrypoint-certbot.sh"] | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| #!/bin/bash | ||
|
|
||
| # SPDX-FileCopyrightText: 2022 - 2024 Orthanc Team SRL <[email protected]> | ||
| # | ||
| # SPDX-License-Identifier: CC0-1.0 | ||
|
|
||
| ## configuration files management | ||
|
|
||
| # first (and only) arg should be a boolean: | ||
| # 'true' --> https | ||
| # 'false'--> http | ||
|
|
||
| set -o errexit | ||
|
|
||
| # get https | ||
| if [ "$1" == true ]; then | ||
| https=true | ||
| else | ||
| https=false | ||
| fi | ||
|
|
||
| enableOrthanc="${ENABLE_ORTHANC:-false}" | ||
| enableOrthancForApi="${ENABLE_ORTHANC_FOR_API:-false}" | ||
| enableOrthancForShares="${ENABLE_ORTHANC_FOR_SHARES:-false}" | ||
| enableKeycloak="${ENABLE_KEYCLOAK:-false}" | ||
| enableOrthancTokenService="${ENABLE_ORTHANC_TOKEN_SERVICE:-false}" | ||
| enableOhif="${ENABLE_OHIF:-false}" | ||
| enableMedDream="${ENABLE_MEDDREAM:-false}" | ||
|
|
||
| ls -al /etc/nginx/disabled-reverse-proxies/ | ||
|
|
||
| if [[ $enableOrthanc == "true" ]]; then | ||
| echo "ENABLE_ORTHANC is true -> enable /orthanc/ reverse proxy" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.orthanc.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi | ||
|
|
||
| if [[ $enableOrthancForApi == "true" ]]; then | ||
| echo "ENABLE_ORTHANC_FOR_API is true -> enable /orthanc-api/ reverse proxy" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.orthanc-api.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi | ||
|
|
||
| if [[ $enableOrthancForShares == "true" ]]; then | ||
| echo "ENABLE_ORTHANC_FOR_SHARES is true -> enable /shares/ reverse proxy" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.shares.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi | ||
|
|
||
| if [[ $enableKeycloak == "true" ]]; then | ||
| if [[ $https == "true" ]]; then | ||
| echo "ENABLE_KEYCLOAK is true and ENABLE_HTTPS is true -> enable /keycloak/ reverse proxy in https version" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.keycloak-https.conf /etc/nginx/enabled-reverse-proxies/ | ||
| else | ||
| echo "ENABLE_KEYCLOAK is true and ENABLE_HTTPS is false -> enable /keycloak/ reverse proxy in http version" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.keycloak-http.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi | ||
| fi | ||
|
|
||
| if [[ $enableOrthancTokenService == "true" ]]; then | ||
| echo "ENABLE_ORTHANC_TOKEN_SERVICE is true -> enable /token-service/ reverse proxy" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.token-service.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi | ||
|
|
||
| if [[ $enableMedDream == "true" ]]; then | ||
| echo "ENABLE_MEDDREAM is true -> enable /meddream/ reverse proxy" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.meddream.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi | ||
|
|
||
| if [[ $enableOhif == "true" ]]; then | ||
| echo "ENABLE_OHIF is true -> enable /ohif/ reverse proxy" | ||
| cp -f /etc/nginx/disabled-reverse-proxies/reverse-proxy.ohif.conf /etc/nginx/enabled-reverse-proxies/ | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| #!/bin/bash | ||
|
|
||
| # SPDX-FileCopyrightText: 2022 - 2024 Orthanc Team SRL <[email protected]> | ||
| # | ||
| # SPDX-License-Identifier: CC0-1.0 | ||
|
|
||
| # set -o xtrace | ||
| set -o errexit | ||
|
|
||
| # configuration files management (true for https) | ||
|
|
||
| ./scripts-ot/copy-conf-files.sh true | ||
|
|
||
| # domain name management | ||
|
|
||
| if [ -z "${DOMAIN_NAME}" ]; then | ||
| echo "Error: DOMAIN_NAME is not set or is empty." | ||
| exit 1 | ||
| fi | ||
| domainName="${DOMAIN_NAME}" | ||
|
|
||
| sed -i "s/domain-name-placeholder/${domainName}/g" /etc/nginx/user_conf.d/orthanc-nginx-certbot.conf | ||
|
|
||
| # run ngix-certbot original entrypoint | ||
| ./scripts/start_nginx_certbot.sh |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| # SPDX-FileCopyrightText: 2022 - 2024 Orthanc Team SRL <[email protected]> | ||
| # | ||
| # SPDX-License-Identifier: CC0-1.0 | ||
|
|
||
| # To avoid 504 error | ||
| proxy_read_timeout 240s; | ||
|
|
||
| # To avoid "too big header... / 502 Bad Gateway" error (inspired from https://www.getpagespeed.com/server-setup/nginx/tuning-proxy_buffer_size-in-nginx) | ||
| proxy_buffer_size 32k; | ||
| proxy_buffers 64 8k; | ||
| proxy_busy_buffers_size 48k; | ||
|
|
||
| # To avoid "414 Request-URI Too Large" whant opening 15(!) studies in OHIF | ||
| large_client_header_buffers 8 16k; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| # SPDX-FileCopyrightText: 2022 - 2024 Orthanc Team SRL <[email protected]> | ||
| # | ||
| # SPDX-License-Identifier: CC0-1.0 | ||
|
|
||
| server { | ||
|
|
||
| listen 443 ssl; | ||
|
|
||
| server_name domain-name-placeholder; | ||
|
|
||
| # Load the certificate files. | ||
| ssl_certificate /etc/letsencrypt/live/domain-name-placeholder/fullchain.pem; | ||
| ssl_certificate_key /etc/letsencrypt/live/domain-name-placeholder/privkey.pem; | ||
| ssl_trusted_certificate /etc/letsencrypt/live/domain-name-placeholder/chain.pem; | ||
|
|
||
| # include buffers/timeout parameters | ||
| include /etc/nginx/includes/nginx-common.conf; | ||
|
|
||
| # include all reverse proxies that have been enabled through env var (check docker-entrypoint.sh) | ||
| include /etc/nginx/enabled-reverse-proxies/*.conf; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters