Improve Nginx and Let's Encrypt documentation
- Truncate descriptions
Created by: KattMingMing
I went through the Nginx and Let's Encrypt documentation and ran into several issues. Below is documentation on the steps I followed to configure Nginx with a self signed cert and using cert bot.
Deploying on GCP and accessing your instance
- Install Sourcegraph with Docker on Google Cloud
- Navigate to Compute Engine and click VM instances
- SSH into VM
- Click the SSH button from the Compute Engine VM instances page
- Navigate to the Sourcegraph directory.
sudo su;
cd /root/.sourcegraph
Create admin account
Navigate to the External IP address of the VM. You may need to wait a few minutes for it to be accessible.
- Create an admin account
- Navigate to /site-admin
- Copy the management configuration password and save it somewhere safe
Update DNS Records
There can be a delay when updating DNS records, so I did this step earlier than expected.
- In a separate tab, navigate to your registrar
- Create custom resource record by following your registrar's instructions
- Create an A record
- Map the domain name to the External IP address of the VM
- 1m TTL so the cache is updated immediately, the default is typically 1hr.
- Create an A record
Setting up SSL / TLS
There are a few ways to configure SSL / TLS.
- Self signed certificate
- Existing certificate
- Using Let's Encrypt
Option A: Self signed certificate
Generate the certificate
Inside the VM run the following commands:
-
sudo su;
-
cd /root/.sourcegraph/config
-
If you don't already have a TLS certificate and key, you can generate them with the following command. Note: Replace sourcegraph.example.com with your domain.
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \
~/.sourcegraph/config/sourcegraph.example.com.key -out \
~/.sourcegraph/config/sourcegraph.example.com.crt
nginx.conf
Update Update the nginx.conf
that is in the same directory. Replace sourcegraph.example.com
with your domain.
The three lines in the nginx.conf
need to be updated with your domain:
server_name sourcegraph.example.com;
ssl_certificate YOUR_CERTIFICATE.crt;
ssl_certificate_key YOUR_KEY.key;
error_log stderr;
pid /var/run/nginx.pid;
events{
}
http {
server_tokens off;
# We can upload large extensions
client_max_body_size 150M;
# Don't timeout websockets quickly. Default is 60s. This is the timeout
# between reads/writes, not the full session timeout.
proxy_send_timeout 1h;
proxy_read_timeout 1h;
access_log off;
upstream backend {
server localhost:8080;
}
server {
listen 7080;
return 301 https://$host:7433$request_uri;
}
server {
listen 7443 ssl;
server_name sourcegraph.example.com;
ssl_certificate YOUR_CERTIFICATE.crt;
ssl_certificate_key YOUR_KEY.key;
# use low age for testing
add_header Strict-Transport-Security "max-age=10" always;
location / {
proxy_pass http://backend;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
Restart container
Since we do not have access to the command line of the NGINX container directly, we cannot use the nginx
command to control NGINX. Fortunately, Docker provides kill
command for sending signals to the container.
- Get the Sourcegraph container ID
docker ps | grep sourcegraph | awk '{print $1}'
docker rm -f <container ID>
docker run -d --publish 80:7080 --publish 443:7443 --publish 2633:2633 --restart unless-stopped --volume /root/.sourcegraph/config:/etc/sourcegraph --volume /root/.sourcegraph/data:/var/opt/sourcegraph sourcegraph/server:3.1.1
Your instance should now be accessible with a self signed certificate.
Option B: Let's Encrypt
Let’s Encrypt automatically provisions TLS certificates so that your server is accessible via HTTPS.
To do this, I followed the Using Let’s Encrypt with nginx on Ubuntu 16.04 instructions.
Let's Encrypt needs to access port 80 which is currently in use by Sourcegraph, so it was necessary to stop the container. Inside the VM run the following commands:
docker ps | grep sourcegraph | awk '{print $1}'
docker rm -f <container ID>
Next, I needed to install certbot.
sudo su;
- According to certbot documentation:
apt-get update
apt-get install software-properties-common
add-apt-repository universe
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install certbot python-certbot-nginx
- Create the certificate using
certonly
sudo certbot --nginx certonly
- Once created copy the certificates into the Sourcegraph directory
cp /etc/letsencrypt/live/$YOUR_DOMAIN/fullchain.pem /etc/letsencrypt/live/$YOUR_DOMAIN/privkey.pem /root/.sourcegraph/config
- Stop the nginx service that was started by certbot
service nginx stop
- Modify your
nginx.conf
Update nginx.conf with certbot
The three lines in the nginx.conf
need to be updated with your domain.
By default fullchain.pem and privkey.pem are names generated by certbot.
server_name sourcegraph.example.com;
ssl_certificate fullchain.pem;
ssl_certificate_key privkey.pem;
error_log stderr;
pid /var/run/nginx.pid;
events{
}
http {
server_tokens off;
# We can upload large extensions
client_max_body_size 150M;
# Don't timeout websockets quickly. Default is 60s. This is the timeout
# between reads/writes, not the full session timeout.
proxy_send_timeout 1h;
proxy_read_timeout 1h;
access_log off;
upstream backend {
server localhost:8080;
}
server {
listen 7080;
return 301 https://$host:7433$request_uri;
}
server {
listen 7443 ssl;
server_name sourcegraph.example.com;
ssl_certificate fullchain.pem;
ssl_certificate_key privkey.pem;
# use low age for testing
add_header Strict-Transport-Security "max-age=10" always;
location / {
proxy_pass http://backend;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
docker run -d --publish 80:7080 --publish 443:7443 --publish 2633:2633 --restart unless-stopped --volume /root/.sourcegraph/config:/etc/sourcegraph --volume /root/.sourcegraph/data:/var/opt/sourcegraph sourcegraph/server:3.1.1
Now your instance should be accessible via HTTPS with your signed certificate generated by certbot.

