@ -327,29 +327,37 @@ If this is not the case, please complete the steps in the installation manual fi
We will go through the following sequence of steps to get CVAT over HTTPS:
We will go through the following sequence of steps to get CVAT over HTTPS:
- Move Docker Compose CVAT access port to 80/tcp.
- Setup containers on default 80/tcp port. Checkin and then down the containers.
- Configure Nginx to pass one of the [ACME challenges](https://letsencrypt.org/docs/challenge-types/).
- Configure Nginx to pass one of the [ACME challenges](https://letsencrypt.org/docs/challenge-types/) - webroot.
- Create the certificate files using [acme.sh](https://github.com/acmesh-official/acme.sh).
- Create the certificate files using [acme.sh](https://github.com/acmesh-official/acme.sh).
- Reconfigure Nginx to serve over HTTPS and map CVAT to Docker Compose port 443.
- Reconfigure Nginx to serve over HTTPS and map CVAT to Docker Compose port 443.
#### Step-by-step instructions
#### Step-by-step instructions
##### 1. Move the CVAT access port
##### 1. Make the proxy listen on standard port 80 and prepare nginx for the ACME challenge via webroot method
> The configuration assumes that on the docker host there will be only one instance of the CVAT site listens for incoming connections on 80 and 443 port. Also redirecting everything that does not concern renewal of certificates to the site via secure HTTPS protocol.
Let's assume the server will be at `my-cvat-server.org`.
Let's assume the server will be at `my-cvat-server.org`.
Point you shell in cvat repository directory, usually `cd $HOME/cvat`:
Add the following into your `docker-compose.override.yml`, replacing `my-cvat-server.org` with your own IP address. This file lives in the same directory as `docker-compose.yml`.
Create enough directories for letsencrypt webroot operation and acme folder passthrougth.
and restart containers with a new configuration updated in `docker-compose.override.yml`
```bash
```bash
# on the server
# on the docker host
docker-compose down
# add docker-compose.override.yml as per instructions below
# this will create ~/.acme.sh directory
curl https://get.acme.sh | sh
docker-compose up -d
# create a subdirs for acme-challenge webroot manually
You should now see an unsecured version of CVAT at `http://my-cvat-server.org`.
This will enable serving `http://my-cvat-server.org/.well-known/acme-challenge/`
route from `/var/tmp/letsencrypt-webroot` directory on the container's filesystem which is bind mounted from docker host `$HOME/cvat/letsencrypt-webroot`. That volume needed for issue and renewing certificates only.
Update a CVAT site proxy template `$HOME/cvat/cvat_proxy/conf.d/cvat.conf.template` on docker(system) host. Site config updates from this template each time `cvat_proxy` container start.
##### 2. Configure Nginx for the ACME challenge
Add a location to server with `server_name ${CVAT_HOST};` ahead others:
There are multiple approaches. First one is to use helper on docker host.
proxy_pass http://cvat:8080;
proxy_pass_header X-CSRFToken;
proxy_set_header Host $http_host;
proxy_pass_header Set-Cookie;
}
location / {
In a our approach
# workaround for match location by arguments
* it is easier to setup automatic certificate updates and (than it can be done in the container).
error_page 418 = @annotation_ui;
* leave certificates in safe place on docker host (protect from `docker-compose down` cleanup)
* no unnecessary certificate files copying between container and host.
if ( $query_string ~ "^id=\d+.*" ) { return 418; }
###### Create certificate files using an ACME challenge on docker host
proxy_pass http://cvat_ui;
**Prepare certificates.**
proxy_pass_header X-CSRFToken;
proxy_set_header Host $http_host;
proxy_pass_header Set-Cookie;
}
# old annotation ui, will be removed in the future.
Point you shell in cvat repository directory, usually `cd $HOME/cvat` on docker host.
location @annotation_ui {
proxy_pass http://cvat:8080;
proxy_pass_header X-CSRFToken;
proxy_set_header Host $http_host;
proxy_pass_header Set-Cookie;
}
}
```
Now create the `/letsencrypt` directory and mount it into `cvat_proxy` container.
> Certificate issue and updates should be on docker host in this approach.
Edit your `docker-compose.override.yml` to look like the following:
```yaml
Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible. They recommend utilize their staging environment instead of the production API during testing. So first try to get a test certificate.
Vladimir Skubriev
6 years ago