PodmanでNginxリバースプロキシの起動

dnf install -y epel-release
dnf install -y certbot python3-certbot-nginx

# certbot certonly --standalone -d ydlprog.ddns.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): メールアドレス

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at

404 Page not found
Let's Encrypt is a free, automated, and open Certificate Authority brought to you by the nonprofit Internet Security Res...
letsencrypt.org You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: n
Account registered.
Requesting a certificate for ydlprog.ddns.net

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/ydlprog.ddns.net/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/ydlprog.ddns.net/privkey.pem
This certificate expires on 2023-04-30.
These files will be updated when the certificate renews.

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

podman network create --subnet 10.0.10.0/24 --gateway 10.0.10.1 network-revproxy

mkdir -p \
  /home/podman/revproxy-pod/nginx/conf.d \
  /home/podman/revproxy-pod/public
echo "Hello World!" > /home/podman/revproxy-pod/public/index.html
podman run -d --name tmp docker.io/library/nginx:latest
podman cp tmp:/etc/nginx/nginx.conf /home/podman/revproxy-pod/nginx/nginx.conf
podman cp tmp:/etc/nginx/conf.d/default.conf /home/podman/revproxy-pod/nginx/conf.d/default.conf
podman rm -f tmp

podman pod create --name revproxy-pod -p 80:80 -p 443:443 --network=network-revproxy
podman create --pod revproxy-pod --name revproxy-nginx \
  -v /home/podman/revproxy-pod/nginx/nginx.conf:/etc/nginx/nginx.conf:ro \
  -v /home/podman/revproxy-pod/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro \
  -v /home/podman/revproxy-pod/public:/usr/share/nginx/html \
  -v /etc/letsencrypt/live/ydlprog.ddns.net/fullchain.pem:/etc/nginx/server.crt:ro \
  -v /etc/letsencrypt/live/ydlprog.ddns.net/privkey.pem:/etc/nginx/server.key:ro \
  docker.io/library/nginx:latest

# http
server {
    listen			80;
    listen			[::]:80;
    server_name		_;

    # httpアクセスは全てhttpsへリダイレクト
    location / {
        return 301 https://$host$request_uri;
    }
}

# https
server {
    ssl						on;
    listen					443;
    listen					[::]:443;
    ssl_certificate			/etc/nginx/server.crt;
    ssl_certificate_key		/etc/nginx/server.key;
    server_name				_;

    # エラーページ
    error_page 500 502 503 504  /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    # Let's Encrypt(未チェック)
    location ^~ /.well-known/acme-challenge/ {
        root /usr/share/nginx/html/letsencrypt;
    }
    location = /.well-known/acme-challenge/ {
        return 404;
    }

    # リバースプロキシ設定
    proxy_redirect							off;
    proxy_set_header Host					$host;
    proxy_set_header X-Real-IP				$remote_addr;
    proxy_set_header X-Forwarded-Host		$host;
    proxy_set_header X-Forwarded-Server 	$host;
    proxy_set_header X-Forwarded-Proto		$scheme;
    proxy_set_header X-Forwarded-For		$proxy_add_x_forwarded_for;

    # 以前のdokuwikiページへリバースプロキシ
    location /ydlprog {
        proxy_pass http://10.0.30.1:30080/ydlprog;
    }

    # GitLabへリバースプロキシ
    location /gitlab {
        client_max_body_size 1000M;
        proxy_pass http://10.0.40.1:22080/gitlab;
    }

    # WordPressへリバースプロキシ
    location / {
        proxy_pass http://10.0.20.1:21080/;
    }
}

podman pod start revproxy-pod

# cd /usr/lib/systemd/system
# podman generate systemd --name revproxy-pod --files --restart-policy=always
/usr/lib/systemd/system/pod-revproxy-pod.service
/usr/lib/systemd/system/container-revproxy-nginx.service

systemctl daemon-reload
systemctl enable pod-revproxy-pod.service
systemctl enable container-revproxy-nginx.service

#! /bin/bash

PodName='revproxy'

# 起動済みのポッド削除
echo ポッド削除
podman pod stop ${PodName}-pod
podman pod rm ${PodName}-pod

# ポッド作成
echo ポッド作成
podman pod create --name ${PodName}-pod -p 80:80 -p 443:443 --network=network-${PodName}
podman create --pod ${PodName}-pod --name ${PodName}-nginx \
  -v /home/podman/${PodName}-pod/nginx/nginx.conf:/etc/nginx/nginx.conf:ro \
  -v /home/podman/${PodName}-pod/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro \
  -v /home/podman/${PodName}-pod/public:/usr/share/nginx/html \
  -v /etc/letsencrypt/live/ydlprog.ddns.net/fullchain.pem:/etc/nginx/server.crt:ro \
  -v /etc/letsencrypt/live/ydlprog.ddns.net/privkey.pem:/etc/nginx/server.key:ro \
  docker.io/library/nginx:latest

# ポッド起動
echo ポッド起動
podman pod start ${PodName}-pod

echo Finish!