- [1. Make the proxy listen on standard port 80 and prepare nginx for the ACME challenge via webroot method](#1-make-the-proxy-listen-on-standard-port-80-and-prepare-nginx-for-the-acme-challenge-via-webroot-method)
- [2. Setting up HTTPS with `acme.sh` helper](#2-setting-up-https-with-acmesh-helper)
- [Create certificate files using an ACME challenge on docker host](#create-certificate-files-using-an-acme-challenge-on-docker-host)
# Quick installation guide
@ -311,47 +317,55 @@ contains a text (url for example) which is shown in the client-share browser.
### Serving over HTTPS
We will add [letsencrypt.org](https://letsencrypt.org/) issued certificate to secure
our server connection.
our server connection.
#### Prerequisites
We assume that
We assume that
- you have sudo access on your server machine,
- you have sudo access on your server machine,
- you have an IP address to use for remote access, and
- that the local CVAT installation works on your server.
If this is not the case, please complete the steps in the installation manual first.
#### Roadmap
We will go through the following sequence of steps to get CVAT over HTTPS:
- Move Docker Compose CVAT access port to 80/tcp.
- Configure Nginx to pass one of the [ACME challenges](https://letsencrypt.org/docs/challenge-types/).
- Setup containers on default 80/tcp port. Checkin and then down the containers.
- Configure Nginx to pass one of the [ACME challenges](https://letsencrypt.org/docs/challenge-types/) - webroot.
- Create the certificate files using [acme.sh](https://github.com/acmesh-official/acme.sh).
- Reconfigure Nginx to serve over HTTPS and map CVAT to Docker Compose port 443.
#### Step-by-step instructions
##### 1. Move the CVAT access port
##### 1. Make the proxy listen on standard port 80 and prepare nginx for the ACME challenge via webroot method
> The configuration assumes that on the docker host there will be only one instance of the CVAT site listens for incoming connections on 80 and 443 port. Also redirecting everything that does not concern renewal of certificates to the site via secure HTTPS protocol.
Let's assume the server will be at `my-cvat-server.org`.
Point you shell in cvat repository directory, usually `cd $HOME/cvat`:
Add the following into your `docker-compose.override.yml`, replacing `my-cvat-server.org` with your own IP address. This file lives in the same directory as `docker-compose.yml`.
Create enough directories for letsencrypt webroot operation and acme folder passthrougth.
Let's assume the server will be at `my-cvat-server.org`.
and restart containers with a new configuration updated in `docker-compose.override.yml`
```bash
# on the server
docker-compose down
# on the docker host
# add docker-compose.override.yml as per instructions below
# this will create ~/.acme.sh directory
curl https://get.acme.sh | sh
docker-compose up -d
# create a subdirs for acme-challenge webroot manually
You should now see an unsecured version of CVAT at `http://my-cvat-server.org`.
This will enable serving `http://my-cvat-server.org/.well-known/acme-challenge/`
route from `/var/tmp/letsencrypt-webroot` directory on the container's filesystem which is bind mounted from docker host `$HOME/cvat/letsencrypt-webroot`. That volume needed for issue and renewing certificates only.
##### 2. Configure Nginx for the ACME challenge
Update a CVAT site proxy template `$HOME/cvat/cvat_proxy/conf.d/cvat.conf.template` on docker(system) host. Site config updates from this template each time `cvat_proxy` container start.
There are multiple approaches. First one is to use helper on docker host.
location / {
# workaround for match location by arguments
error_page 418 = @annotation_ui;
In a our approach
* it is easier to setup automatic certificate updates and (than it can be done in the container).
* leave certificates in safe place on docker host (protect from `docker-compose down` cleanup)
* no unnecessary certificate files copying between container and host.
if ( $query_string ~ "^id=\d+.*" ) { return 418; }
###### Create certificate files using an ACME challenge on docker host
proxy_pass http://cvat_ui;
proxy_pass_header X-CSRFToken;
proxy_set_header Host $http_host;
proxy_pass_header Set-Cookie;
}
**Prepare certificates.**
# old annotation ui, will be removed in the future.
location @annotation_ui {
proxy_pass http://cvat:8080;
proxy_pass_header X-CSRFToken;
proxy_set_header Host $http_host;
proxy_pass_header Set-Cookie;
}
}
```
Point you shell in cvat repository directory, usually `cd $HOME/cvat` on docker host.
Now create the `/letsencrypt` directory and mount it into `cvat_proxy` container.
Edit your `docker-compose.override.yml` to look like the following:
> Certificate issue and updates should be on docker host in this approach.
```yaml
# docker-compose.override.yml
version: "2.3"
Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible. They recommend utilize their staging environment instead of the production API during testing. So first try to get a test certificate.
Nikita Manovich
6 years ago