AWS Elastic Beanstalk, Dockerrun.aws.json and multiple ports on docker run [duplicate]

I contacted the Amazon Support Center, and I chose to show you the answer.

Hello K...,

With Dockerrun.aws.json, Elastic Beanstalk hook scripts will only read the first port from the JSON file.

This is because in /opt/elasticbeanstalk/hooks/appdeploy/pre/04run.sh:

if [ echo $EB_CONFIG_DOCKER_PORT | wc -w -gt 1 ]; then EB_CONFIG_DOCKER_PORT=echo $EB_CONFIG_DOCKER_PORT | awk '{print $1}' warn "Only one EXPOSE directive is allowed, using the first one: $EB_CONFIG_DOCKER_PORT" fi

The hook scripts will have to specify a random port for the reverse proxy to forward to, which then forwards to your Docker container's port. Currently only one port mapping can be setup.

With regards to the nginx configuration, the quickest way to achieve a port 443 listening to your environment is to create a separate server section in /etc/nginx/conf.d/ e.g. custom-ssl.conf, which handles the HTTPS handshake with the client. This means that you will have to place your SSL certificates onto the instance so that nginx can perform the SSL handshake. I will get back to you later with a sample HTTPS configuration in nginx.

Otherwise, if your environment is a load balanced one, you can simply setup an HTTPS listener on the ELB, and let the ELB handle the SSL termination.

Meanwhile, if you have other questions, please do not hesitate to ask!

Best regards,

Sydney Support Centre

*

Hello again K...,

As I have mentioned in my previous correspondence, please find attached a sample .ebextensions config file which will setup an https server on nginx, on a single instance Docker environment. You did not let me know which environment you were enquiring about, so the attached .ebextensions will only work on single instance environments.

This .ebextensions config file performs the following:

• Adds the https server config file for nginx as /etc/nginx/sites-enabled/https.conf, which reverse proxies the incoming https session to the Docker container as http.

• Adds an SSL key/cert combined file into /etc/pki/tls/certs/my_ssl.crt, required by the HTTPS server above.

• Adds an extra ingress rule to the Beanstalk environment's EC2 security group to allow incoming TCP:443 connections to the instance

Please feel free to modify the .ebextensions config file to suit your use case, and place this inside the .ebextensions/ directory at the root level of your application to be deployed in Elastic Beanstalk. If the directory is not there, then please create it.

For more information on .ebextensions config files, please see:

• http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers.html

If you are on a load balanced environment, then you will need to upload your SSL certificate to IAM via the AWS CLI, and configure your Beanstalk environment's ELB to enable its HTTPS listener. The instructions will be different to the ones above:

• http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html

Please let me know how you go with the .ebextensions config file, and let me know if you require further assistance!

Best regards,

Sydney Support Centre

And he gave me an example in attachment. 01-nginx-ssl.config

files:  "/etc/nginx/sites-enabled/https.conf":    mode: "000644"    owner: root    group: root    content: |      server {        listen  443 ssl;        ssl_certificate_key /etc/pki/tls/certs/my_ssl.crt;        ssl_certificate /etc/pki/tls/certs/my_ssl.crt;        ssl_protocols       SSLv3 TLSv1 TLSv1.1 TLSv1.2;        ssl_ciphers         HIGH:!aNULL:!MD5;        location / {          proxy_pass          http://docker;          proxy_http_version  1.1;          proxy_set_header    Connection          $connection_upgrade;          proxy_set_header    Upgrade             $http_upgrade;          proxy_set_header    Host                $host;          proxy_set_header    X-Real-IP           $remote_addr;          proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;        }      }   "/etc/pki/tls/certs/my_ssl.crt":    mode: "000400"    owner: root    group: root    content: |      <Your key/cert pair goes here>Resources:  AllowSSL:     Type: AWS::EC2::SecurityGroupIngress    Properties:      GroupId: {Ref : AWSEBSecurityGroup}      IpProtocol: tcp      ToPort: 443      FromPort: 443      CidrIp: 0.0.0.0/0