Add support for upstream SSL

.env.template

@@ -0,0 +1,12 @@
+# Use fully qualified domain names. Set to DOMAIN=local if SSL_TYPE=selfsign.
+DOMAIN=your.domain.com
+
+# Used for Let's Encrypt expiration emails and Enketo technical support emails
+SYSADMIN_EMAIL=administrator@email.com
+
+# Options: letsencrypt, customssl, upstream, selfsign
+SSL_TYPE=letsencrypt
+
+# Do not change if using SSL_TYPE=letsencrypt
+HTTP_PORT=80
+HTTPS_PORT=443

docker-compose.yml

@@ -18,7 +18,6 @@ services:
     environment:
       - MAILNAME=${DOMAIN}
     restart: always
-
   service:
     container_name: service
     build:
@@ -47,21 +46,19 @@ services:
       - service
       - enketo
     environment:
-      - SSL_TYPE=${SSL_TYPE}
+      - SSL_TYPE=${SSL_TYPE:-letsencrypt}
       - DOMAIN=${DOMAIN}
       - CERTBOT_EMAIL=${SYSADMIN_EMAIL}
     ports:
-      - "80:80"
-      - "443:443"
+      - "${HTTP_PORT:-80}:80"
+      - "${HTTPS_PORT:-443}:443"
     healthcheck:
-      test: [ "CMD-SHELL", "nc -z localhost 443 || exit 1" ]
+      test: [ "CMD-SHELL", "nc -z localhost 80 || exit 1" ]
     restart: always
-
   pyxform:
     container_name: pyxform
     image: 'getodk/pyxform-http:v1.3.4'
     restart: always
-
   secrets:
     container_name: secrets
     volumes:
@@ -105,10 +102,8 @@ services:
       - redis-server
       - /usr/local/etc/redis/redis.conf
     restart: always
-
 volumes:
   transfer:
   enketo_redis_main:
   enketo_redis_cache:
   secrets:
-

files/nginx/odk-setup.sh

@@ -1,5 +1,5 @@
 DHPATH=/etc/dh/nginx.pem
-if [ ! -e "$DHPATH" ]
+if [ ! -e "$DHPATH" ] && [ "$SSL_TYPE" != "upstream" ]
 then
   echo "diffie hellman private key does not exist; creating.."
   openssl dhparam -out "$DHPATH" 2048
@@ -25,6 +25,13 @@ if [ "$SSL_TYPE" = "letsencrypt" ]
 then
   echo "starting nginx with certbot.."
   /bin/bash /scripts/entrypoint.sh
+elif [ "$SSL_TYPE" = "upstream" ]
+then
+  perl -i -ne 's/listen 443.*/listen 80;/; print if ! /ssl_/' /etc/nginx/conf.d/odk.conf
+  perl -i -pe 's/X-Forwarded-Proto \$scheme/X-Forwarded-Proto https/;' /etc/nginx/conf.d/odk.conf
+  rm -f /etc/nginx/conf.d/certbot.conf
+  echo "starting nginx without local SSL to allow for upstream SSL.."
+  nginx -g "daemon off;"
 else
   echo "starting nginx without certbot.."
   nginx -g "daemon off;"