Provide a Docker Compose example using a reverse proxy

[virtualtam]

Depends on #1153

Goals:

• document how Shaarli images are used in a multi-container environment
• ease deployments with Compose and other container orchestration solutions
• help diagnosing issues related to HTTP proxy setup

Suggested environment example:

• shaarli/shaarli:latest image with a volume for user data
• Nginx reverse proxy:
  • jwilder/nginx-proxy reverse proxy with Docker service discovery
  • JrCs/nginx-proxy-companion for Let's Encrypt SSL support

[nbud]

As a first draft, here's a working example using jwilder/nginx-proxy and JrCs/nginx-proxy-companion.

The shaarli container must be launched with VIRTUAL_HOST, LETENCRYPT_HOST and LETSENCRYPT_EMAIL, for example :

docker run -d \
    -e VIRTUAL_HOST=my.domain.com \
    -e LETSENCRYPT_HOST=my.domain.com \
    -e [email protected] \
    -v /srv/shaarli/data:/var/www/shaarli/data --restart=always \
    --name my_shaarli \
    shaarli/shaarli

The default proxy configuration of jwilder/nginx-proxy does not work out of the box with Shaarli. The proxy configuration is changed by mounting in the proxy container the file /etc/nginx/proxy.conf (see doc). As an example, here is a working /etc/nginx/proxy.conf, obtained by adding to the default configuration the X-Forwered-Host line:

# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
proxy_set_header X-Forwarded-Host $host;

# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";

I hope there's no side-effect for other proxified container, because this is a proxy-wide configuration. I haven't managed to change the proxy configuration for the shaarli container only.
As raised in #879, jwilder/nginx-proxy could work out of the box with Shaarli at the cost of a simple change of Shaarli's server_url() function.

[virtualtam]

Thanks!

The Nginx setup for Shaarli images was designed to be self-sufficient, so a bit of rework is needed to ease serving Shaarli containers behind a reverse proxy.

I'm considering providing separate images depending on the end-user's setup:

• self-sufficient images
• proxy-friendly images (though this might be limited to latestand mastertags not to add too much overhead)

You should be able to define container/service-specific configuration under /etc/nginx/vhost.d/<shaarli-domain>, but I'm not sure to which extent it applies to proxy settings (I've used it to add headers and limit payloads/body sizes).

I'd rather avoid adding too much logic to manage HTTP headers, and instead focus on providing sane and well-documented server configuration examples :)

Nginx's support for the HTTP Proxy protocol is also something worth leveraging.