NGINX Proxy Automation

After generating your Cloudflare API Token, follow these steps to activate DNS-01 validation:

1. Open your .env file.
2. Add your token to the CLOUDFLARE_DNS_TOKEN environment variable.
3. Open your docker-compose.yml file and uncomment the Cloudflare-related environment variable lines.
4. Restart your service by running docker compose up -d from your root folder.

The fresh-start.sh script performs the initial configuration process via an interactive walkthrough.

Interactive Mode

Navigate to the bin directory and run the script:

cd proxy/bin
./fresh-start.sh

Non-interactive Mode (Quick Start)

If you want to skip the interactive prompts, use the following flags:

• --yes: Automatically answer yes to prompts.
• -e <email>: Provide your email for Let's Encrypt.
• --skip-docker-image-check: Skip the Docker image verification step.

To see all available options, run ./fresh-start.sh --help.

To secure a virtual host with basic authentication, create an htpasswd file at ${NGINX_FILES_PATH}/htpasswd/${VIRTUAL_HOST}.

Replace ${NGINX_FILES_PATH} with your actual NGINX files path, [username] with your desired username, and ${VIRTUAL_HOST} with your domain name.

sudo sh -c "echo -n '[username]:' >> ${NGINX_FILES_PATH}/htpasswd/${VIRTUAL_HOST}"
sudo sh -c "openssl passwd -apr1 >> ${NGINX_FILES_PATH}/htpasswd/${VIRTUAL_HOST}"

To allow the NGINX proxy to validate your domain using the DNS-01 challenge, you must create a restricted Cloudflare API Token.

1. In your Cloudflare profile, navigate to the API Token option.
2. Create a token using the 'Edit zone DNS' template.
3. Crucial Security Step: Restrict the token's access to only the specific domains you intend to use and, if possible, specify your source IP address.
4. Copy the generated token.

To ensure the proxy has the necessary directories and correct permissions for persistent files, run the following commands. This assumes your data catalog is located in the default ./data directory.

mkdir -p data/certs
mkdir data/htpasswd
mkdir data/conf.d
mkdir data/vhost.d
mkdir data/html
chgrp -R 101 data
chmod -R g+rwx data

Synology NAS installs a default web server on port 80, which blocks certificate generation. To resolve this, configure your .env file to use alternative internal ports for HTTP and HTTPS.

Important: You must configure your internet router to forward external traffic from the official ports to these new internal ports. For example, if you set DOCKER_HTTP=81, your router must forward external port 80 to internal port 81.

DOCKER_HTTP=81
DOCKER_HTTPS=444

You can verify your setup using the provided test scripts or by running a dummy container.

Using test scripts

Run test.sh with your domain (ensure DNS is already pointing to your server):

./test.sh your.domain.com

To test Let's Encrypt specifically:

./ssl_test.sh your.domain.com

Manual test container

docker run -dit -e VIRTUAL_HOST=your.domain.com --network=proxy --name test-web httpd:alpine

To clean up the test:

./stop.sh
# OR
docker stop test-web && docker rm test-web

To run the NGINX Proxy Automation script, your environment must meet the following requirements:

Operating System

• Linux

Required Software

Ensure the following tools are installed on your system:

• Bash
• Docker
• Docker Compose
• Git
• Curl
• Dpkg
• Md5sum

To set up the automation environment, clone the repository using the --recurse-submodules flag to ensure external dependencies like basescript are included.

Prerequisites

• A Linux server.
• Docker and Docker-compose installed.
• Ports 80 and 443 available (ensure no other web services like Apache or NGINX are running on these ports).
• A public IP address accessible to the server.

git clone --recurse-submodules https://github.com/evertramos/nginx-proxy-automation.git proxy