The additional step is to add a [security group and rule to allow incoming connections](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html).
For any of above, don't forget to add exposed AWS public IP address or hostname to `docker-compose.override.yml`:
For any of above, don't forget to set the `CVAT_HOST` environemnt variable to the exposed
AWS public IP address or hostname:
```
version: "2.3"
services:
cvat_proxy:
environment:
CVAT_HOST: your-instance.amazonaws.com
export CVAT_HOST=your-instance.amazonaws.com
```
In case of problems with using hostname, you can also use the public IPV4 instead of hostname.
@ -37,5 +34,4 @@ the public IPV4 and hostname changes with every stop and reboot.
To address this efficiently, avoid using spot instances that cannot be stopped,
since copying the EBS to an AMI and restarting it throws problems.
On the other hand, when a regular instance is stopped and restarted,
the new hostname/IPV4 can be used in the `CVAT_HOST` variable in the `docker-compose.override.yml`
and the build can happen instantly with CVAT tasks being available through the new IPV4.
the new hostname/IPV4 can be used to set the `CVAT_HOST` environment variable.
Update a CVAT site proxy template `$HOME/cvat/cvat_proxy/conf.d/cvat.conf.template` on docker(system) host.
Site config updates from this template each time `cvat_proxy` container start.
Add a location to server with `server_name ${CVAT_HOST};` ahead others:
To enable this, first set the the `CVAT_HOST` (the domain of your website) and `ACME_EMAIL`
(contact email for Let's Encrypt) environment variables:
```
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
root /var/tmp/letsencrypt-webroot;
}
export CVAT_HOST=<YOUR_DOMAIN>
export ACME_EMAIL=<YOUR_EMAIL>
```
Make the changes where necessary, e.g. base.py or somewhere else.
Build the containers with new configurations updated in `docker-compose.override.yml`
E.g. including `analytics` module:
Then, use the `docker-compose.https.yml` file to override the base `docker-compose.yml` file:
```
docker-compose -f docker-compose.yml -f components/analytics/docker-compose.analytics.yml -f docker-compose.override.yml up -d --build
docker-compose -f docker-compose.yml -f docker-compose.https.yml up -d
```
Your server should be available (and unsecured) at `http://CVAT.example.com`
Something went wrong ? The most common cause is a containers and images cache which were built earlier.
This will enable serving `http://CVAT.example.com/.well-known/acme-challenge/`
route from `/var/tmp/letsencrypt-webroot` directory on the container's filesystem
which is bind mounted from docker host `$HOME/cvat/letsencrypt-webroot`.
That volume needed for issue and renewing certificates only.
Another volume `/etc/ssl/private` should be used within web server according to [acme.sh](https://github.com/acmesh-official/acme.sh#3-install-the-cert-to-apachenginx-etc) documentation
At this point your deployment is up and running, ready for run acme-challenge for issue a new certificate
##### 2. Issue a certificate and run HTTPS versions with `acme.sh` helper
###### Create certificate files using an ACME challenge on docker host
**Prepare certificates**
Point you shell in cvat repository directory, usually `cd $HOME/cvat` on docker host.
Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible.
They recommend utilize their staging environment instead of the production API during testing.
Tadej Svetina
5 years ago
committed by
GitHub