View source for Dotnet Core on Nginx

[[Category:Linux]]
[[Category:Dotnet]]
[[Category:DigitalOcean]]
[[Category:Docker]]
[[Category:Nginx]]

[https://blog.tonysneed.com/2019/10/13/enable-ssl-with-asp-net-core-using-nginx-and-docker/ https://blog.tonysneed.com]
== Configure a reverse proxy server ==
A reverse proxy is a common setup for serving dynamic web apps. A reverse proxy terminates the HTTP request and forwards it to the ASP.NET Core app.

Because requests are forwarded by reverse proxy, use the '''Forwarded Headers Middleware''' from the '''Microsoft.AspNetCore.HttpOverrides''' package. The middleware updates the Request.Scheme, using the X-Forwarded-Proto header, so that redirect URIs and other security policies work correctly.

Forwarded Headers Middleware should run before other middleware.

'''Startup.cs'''
<pre>
// using Microsoft.AspNetCore.HttpOverrides;

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
});

app.UseAuthentication();
</pre>
Look [https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-3.1 https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-3.1] for more details

== Dockerize Nginx Server ==
Next add an Nginx folder to the solution folder, and place a file there named '''Nginx.Dockerfile'''.
<pre>
FROM nginx:latest

COPY nginx.conf /etc/nginx/nginx.conf
</pre>

create a '''nginx.conf''' file that will be copied to the container.
<pre>
worker_processes 1;

events { worker_connections 1024; }

http {

    sendfile on;

    upstream web-api {
        server api:5000;
    }

    server {
        listen 80;
        server_name $hostname;
        location / {
            proxy_pass         http://web-api;
            proxy_redirect     off;
            proxy_http_version 1.1;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection keep-alive;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   X-Forwarded-Host $server_name;
        }
    }
}
</pre>

Notice that '''proxy_pass''' specifies a host name of '''web-api''', which matches the upstream directive with a server value of api:'''5000''', which will be defined later as a service in a docker-compose file.

If you run both the Nginx and Web API containers at the name time, the reverse proxy will return a '''502 Bad Gateway''', because it will not see the Web API server. Both containers need to be placed in the same network. This can be accomplished using Docker networking directives, or you can simply use docker-compose, which is what we’ll do here. Add a docker-compose.yml file to the solution folder.

<pre>
version: "3.7"

services:

  reverseproxy:
    build:
      context: ./Nginx
      dockerfile: Nginx.Dockerfile
    ports:
      - "80:80"
    restart: always

  api:
    depends_on:
      - reverseproxy
    build:
      context: ./
      dockerfile: Dockerfile
    expose:
      - "5000"
    restart: always
</pre>

to build it 
 docker-compose -p quikorder build
To run both containers in a default bridge network
 docker-compose up -d
View the running containers with
 docker ps
To stop the containers 
 docker-compose down

== Enable SSL Termination ==
One of the benefits of using Nginx as a reverse proxy is that you can configure it to use SSL for secure communication with clients, with requests forwarded to the web app over plain HTTP. The first step in this process is to create a public / private key pair for localhost. We can accomplish this task using [https://www.openssl.org/ OpenSSL], which can be installed on both macOS and Windows. Start by adding a '''localhost.conf''' file to the '''Nginx folder'''.
<pre>
[req]
default_bits       = 2048
default_keyfile    = localhost.key
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_ca

[req_distinguished_name]
countryName                 = Country Name (2 letter code)
countryName_default         = UK
stateOrProvinceName         = State or Province Name (full name)
stateOrProvinceName_default = Manchester
localityName                = Locality Name (eg, city)
localityName_default        = Manchester
organizationName            = Organization Name (eg, company)
organizationName_default    = Logicmade
organizationalUnitName      = organizationalunit
organizationalUnitName_default = Development
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_default          = localhost
commonName_max              = 64

[req_ext]
subjectAltName = @alt_names

[v3_ca]
subjectAltName = @alt_names

[alt_names]
DNS.1   = localhost
DNS.2   = 127.0.0.1
</pre>
Run the following command to create localhost.crt and localhost.key files, inserting your own strong password.
<pre>
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt -config localhost.conf -passin pass:YourStrongPassword
</pre>
In order to trust the localhost certificate on your local machine, you’ll want to run the following command to create a '''localhost.pfx''' file, providing the same strong password when prompted.
<pre>
sudo openssl pkcs12 -export -out localhost.pfx -inkey localhost.key -in localhost.crt
</pre>

To trust the localhost certificate on macOS, open Keychain Access, select System in the Keychains pane, and drag localhost.pfx from the Finder into the certificate list pane. Then double-click the localhost certificate and under the trust section select Always Trust.
[[File:trust-keychain-access.png]]
Now that you have created a public / private key pair, you need to update '''Nginx.Dockerfile''' to copy these files to the container.

<pre>
FROM nginx:latest

COPY nginx.conf /etc/nginx/nginx.conf
COPY localhost.crt /etc/ssl/certs/localhost.crt
COPY localhost.key /etc/ssl/private/localhost.key
</pre>

Next, update '''nginx.conf''' to load the certificate key pair. Configure a server to listen on port 443 over ssl and forward requests to the upstream web-api server. Also configure a server to listen on port 80 and redirect requests to port 443.

<pre>
worker_processes 1;

events { worker_connections 1024; }

http {

    sendfile on;

    upstream web-api {
        server api:5000;
    }

    server {
        listen 80;
        server_name localhost;

        location / {
            return 301 https://$host$request_uri;
        }
    }

    server {
        listen 443 ssl;
        server_name localhost;

        ssl_certificate /etc/ssl/certs/localhost.crt;
        ssl_certificate_key /etc/ssl/private/localhost.key;

        location / {
            proxy_pass         http://web-api;
            proxy_redirect     off;
            proxy_http_version 1.1;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header   Upgrade $http_upgrade;
            proxy_set_header   Connection keep-alive;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   X-Forwarded-Host $server_name;
        }
    }
}
</pre>

Lastly, edit the '''docker-compose.yml''' file to expose both ports 80 and 443.
<pre>
ports:
  - "80:80"
  - "443:443"
</pre>

Run docker-compose build, followed by docker-compose up -d. This time when you browse to http://localhost/, you’ll be redirected to https://localhost/.