# 하나의 설치에서 SSL로 도메인 3개에 컨테이너 3개 실행

**URL:** <https://meta.discourse.org/t/running-3-container-for-3-domain-in-one-installation-with-ssl/137283>\
**Category:** Self-hosting\
**Created:** [12월 29, 2019, 6:04오전 UTC](https://meta.discourse.org/t/running-3-container-for-3-domain-in-one-installation-with-ssl/137283 "2019-12-29T06:04:00Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![wanghaisheng](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/wanghaisheng/32/163707_2.png) [@wanghaisheng](https://meta.discourse.org/u/wanghaisheng)\
**Post date:** [12월 29, 2019, 6:04오전 UTC](https://meta.discourse.org/t/running-3-container-for-3-domain-in-one-installation-with-ssl/137283/1 "2019-12-29T06:04:01Z")

</div>

수일 동안 Let’s Encrypt를 조정한 끝에, 복수의 포럼을 실행하는 데 관심이 있는 분들을 위해 정리했습니다.

# 1. 목적

아래와 같은 도메인이 있고 3개의 포럼을 운영하려는 상황을 가정합니다.

```plaintext
bbs.antivte.com
cp.antivte.com
ytb.antivte.com

```

# 2. Discourse 컨테이너

## 2.1 준비

서로 다른 포럼을 위해 3개의 app.yml 파일이 필요합니다. 이름은 bbs.yml, cp.yml, ytb.yml 등 원하는 대로 지정할 수 있습니다.  
내용은 다음과 같아야 합니다.  
**참고: 외부 nginx와 백엔드 Discourse 컨테이너를 연결하기 위해 포트 80/443 리스닝 대신 유닉스 소켓을 사용하며, 백엔드 컨테이너의 SSL 설정도 제거합니다.**  
**참고: 여기서는 포럼마다 하나의 컨테이너만 사용하며, 포럼별로 데이터 컨테이너와 웹 컨테이너를 분리하지 않습니다.**

```plaintext
## this is the all-in-one, standalone Discourse Docker container template
##
## After making changes to this file, you MUST rebuild
## /var/discourse/launcher rebuild app
##
## BE *VERY* CAREFUL WHEN EDITING!
## YAML FILES ARE SUPER SUPER SENSITIVE TO MISTAKES IN WHITESPACE OR ALIGNMENT!
## visit http://www.yamllint.com/ to validate this file as needed

templates:
  - "templates/postgres.template.yml"
  - "templates/redis.template.yml"
  - "templates/web.template.yml"
  - "templates/web.ratelimited.template.yml"
## Uncomment these two lines if you wish to add Lets Encrypt (https)
# - "templates/web.ssl.template.yml"
# - "templates/web.letsencrypt.ssl.template.yml"
  - "templates/web.socketed.template.yml" # <-- Added
## which TCP/IP ports should this container expose?
## If you want Discourse to share a port with another webserver like Apache or nginx,
## see https://meta.discourse.org/t/17247 for details
**#expose:**
 **# - "8080:80" # http**
 **# - "8443:443" # https**

params:
  db_default_text_search_config: "pg_catalog.english"

  ## Set db_shared_buffers to a max of 25% of the total memory.
  ## will be set automatically by bootstrap based on detected RAM, or you can override
  db_shared_buffers: "256MB"

  ## can improve sorting performance, but adds memory usage per-connection
  #db_work_mem: "40MB"

  ## Which Git revision should this container use? (default: tests-passed)
  #version: tests-passed

env:
  LANG: en_US.UTF-8
  # DISCOURSE_DEFAULT_LOCALE: en

  ## How many concurrent web requests are supported? Depends on memory and CPU cores.
  ## will be set automatically by bootstrap based on detected CPUs, or you can override
  UNICORN_WORKERS: 4

  ## TODO: The domain name this Discourse instance will respond to
  ## Required. Discourse will not work with a bare IP number.
  DISCOURSE_HOSTNAME: bbs.antivte.com

  ## Uncomment if you want the container to be started with the same
  ## hostname (-h option) as specified above (default "$hostname-$config")
  #DOCKER_USE_HOSTNAME: true

  ## TODO: List of comma delimited emails that will be made admin and developer
  ## on initial signup example 'user1@example.com,user2@example.com'
  DISCOURSE_DEVELOPER_EMAILS: 'techempower@163.com'

  ## TODO: The SMTP mail server used to validate new accounts and send notifications
  # SMTP ADDRESS, username, and password are required
  # WARNING the char '#' in SMTP password can cause problems!
  DISCOURSE_SMTP_ADDRESS: smtp.mailgun.org
  DISCOURSE_SMTP_PORT: 587
  DISCOURSE_SMTP_USER_NAME: postmaster@mail.antivte.com
  DISCOURSE_SMTP_PASSWORD: "67c9458eb7a6ff11b4db70f097b1b5c3-f7910792-0e7dbcc9"
  #DISCOURSE_SMTP_ENABLE_START_TLS: true # (optional, default true)

  ## If you added the Lets Encrypt template, uncomment below to get a free SSL certificate
  LETSENCRYPT_ACCOUNT_EMAIL: techempower@163.com

  ## The http or https CDN address for this Discourse instance (configured to pull)
  ## see https://meta.discourse.org/t/14857 for details
  #DISCOURSE_CDN_URL: https://discourse-cdn.example.com

## The Docker container is stateless; all data is stored in /shared
volumes:
  - volume:
      **host: /var/discourse/shared/bbs**
      guest: /shared
  - volume:
      **host: /var/discourse/shared/bbs/log/var-log**
      guest: /var/log

## Plugins go here
## see https://meta.discourse.org/t/19157 for details
hooks:
  after_code:
    - exec:
        cd: $home/plugins
        cmd:
          - git clone https://github.com/discourse/docker_manager.git
          - git clone https://github.com/procourse/procourse-installer

## Any custom commands to run after building
run:
  - exec: echo "Beginning of custom commands"
  ## If you want to set the 'From' email address for your first registration, uncomment and change:
  ## After getting the first signup email, re-comment the line. It only needs to run once.
  #- exec: rails r "SiteSetting.notification_email='info@unconfigured.discourse.org'"
  - exec: echo "End of custom commands"

```

## 2.2 설정

아래와 같은 설정 셸 스크립트를 준비합니다.

```plaintext
#!/usr/bin/env bash
./launcher bootstrap bbs
./launcher bootstrap test
./launcher bootstrap cp
./launcher bootstrap ytb
./launcher start bbs
./launcher start test
./launcher start cp
./launcher start ytb

```

이 스크립트를 이전에 사용했거나 각 컨테이너를 이미 한 번 실행한 적이 있다면, app.yml의 내용을 수정했다면 컨테이너에 적용하려면 다음 명령을 사용해야 합니다.

```plaintext
./launcher rebuild bbs

```

## 2.3 확인

3개의 컨테이너가 성공적으로 실행되고 있는지 확인하고 유닉스 소켓이 정상인지 점검합니다.

```plaintext
root@docker-s-1vcpu-2gb-sgp1-01:~# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9702f94ea9b4 local_discourse/bbs "/sbin/boot" 9 hours ago Up 9 hours bbs
dc13c303c38e local_discourse/cp "/sbin/boot" 9 hours ago Up 9 hours cp
dafa592ee16f local_discourse/ytb "/sbin/boot" 9 hours ago Up 9 hours ytb
root@docker-s-1vcpu-2gb-sgp1-01:~# curl --unix-socket /var/discourse/shared/bbs/nginx.http.sock http:/images/json
<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="utf-8">
  <title>血栓之家</title>

```

# 3. 외부 nginx

서버에 nginx/openresty를 설치하고 원하는 디렉토리에 nginx.conf 파일을 생성합니다. 디렉토리는 nginx 실행 명령에만 영향을 미치며, nginx.conf 내용은 다음과 같습니다.  
여기서는 Cloudflare 인증서와 키를 호스트 디렉토리에 다음과 같이 배치했습니다.

## 3.1 nginx.conf

```plaintext
    ssl_certificate /var/discourse/shared/ssl/antivte.com.cert.pem;
    ssl_certificate_key /var/discourse/shared/ssl/antivte.com.key.pem;

```

_향후 외부 nginx에서 Let’s Encrypt 자동 인증서와 키를 사용하는 방법을 알려드리겠습니다._

```plaintext
events {
  worker_connections 1024;
}

http {
  # The "auto_ssl" shared dict should be defined with enough storage space to
  # hold your certificate data. 1MB of storage holds certificates for
  # approximately 100 separate domains.
  lua_shared_dict auto_ssl 1m;
  # The "auto_ssl_settings" shared dict is used to temporarily store various settings
  # like the secret used by the hook server on port 8999. Do not change or
  # omit it.
  lua_shared_dict auto_ssl_settings 64k;

  # A DNS resolver must be defined for OCSP stapling to function.
  #
  # This example uses Google's DNS server. You may want to use your system's
  # default DNS servers, which can be found in /etc/resolv.conf. If your network
  # is not IPv6 compatible, you may wish to disable IPv6 results by using the
  # "ipv6=off" flag (like "resolver 8.8.8.8 ipv6=off").
  resolver 8.8.8.8;
server {
    listen 80; listen [::]:80;
    server_name bbs.antivte.com; # <-- change this

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2; listen [::]:443 ssl http2;
    server_name bbs.antivte.com; # <-- change this

    ssl_certificate /var/discourse/shared/ssl/antivte.com.cert.pem;
    ssl_certificate_key /var/discourse/shared/ssl/antivte.com.key.pem;
# ssl_dhparam /var/discourse/shared/standalone/ssl/dhparams.pem;
    ssl_session_tickets off;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;

    http2_idle_timeout 5m; # up from 3m default

    location / {
        proxy_pass http://unix:/var/discourse/shared/bbs/nginx.http.sock;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

server {
    listen 80; listen [::]:80;
    server_name cp.antivte.com; # <-- change this

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2; listen [::]:443 ssl http2;
    server_name cp.antivte.com; # <-- change this

    ssl_certificate /var/discourse/shared/ssl/antivte.com.cert.pem;
    ssl_certificate_key /var/discourse/shared/ssl/antivte.com.key.pem;
# ssl_dhparam /var/discourse/shared/standalone/ssl/dhparams.pem;
    ssl_session_tickets off;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;

    http2_idle_timeout 5m; # up from 3m default

    location / {
        proxy_pass http://unix:/var/discourse/shared/cp/nginx.http.sock;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

server {
    listen 80; listen [::]:80;
    server_name ytb.antivte.com; # <-- change this

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2; listen [::]:443 ssl http2;
    server_name ytb.antivte.com; # <-- change this

    ssl_certificate /var/discourse/shared/ssl/antivte.com.cert.pem;
    ssl_certificate_key /var/discourse/shared/ssl/antivte.com.key.pem;
# ssl_dhparam /var/discourse/shared/standalone/ssl/dhparams.pem;
    ssl_session_tickets off;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;

    http2_idle_timeout 5m; # up from 3m default

    location / {
        proxy_pass http://unix:/var/discourse/shared/ytb/nginx.http.sock;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

}

```

## 3.2 nginx 시작

nginx.conf 파일을 배치한 디렉토리로 이동하여 다음 명령을 실행합니다.

```plaintext
 nginx -p `pwd`/ -c nginx.conf

```

# 4. 이제 원하는 결과를 얻을 수 있습니다.

축하합니다!

---

_[View the full topic](https://meta.discourse.org/t/running-3-container-for-3-domain-in-one-installation-with-ssl/137283)._