Deploying a new service in UAT with Docker and Nginx

This guide provides a step-by-step approach to deploy a new service in the UAT environment using Docker, configure it in Nginx, and secure it with SSL. 

1. Create a Domain 

1. Choose a domain or subdomain for the new service, for example:

newservice.uat.example.com   

1. Add an A or CNAME record in your DNS provider pointing the domain to your UAT server’s public IP.

2. Configure Nginx 

1. Open the UAT Nginx configuration file:

sudo nano /home/ubuntu/project/hei-core-new/nginx.uat.conf   

1. Add a new server block for the service:

server { 
   listen 443 ssl http2; 
   server_name newservice.uat.example.com; 
 
   ssl_certificate     /etc/letsencrypt/live/newservice.uat.example.com/fullchain.pem; 
   ssl_certificate_key /etc/letsencrypt/live/newservice.uat.example.com/privkey.pem; 
   ssl_protocols       TLSv1 TLSv1.1 TLSv1.2; 
   ssl_ciphers         HIGH:!aNULL:!MD5; 
 
   location / { 
       proxy_pass         http://<container_name>; 
       proxy_set_header   X-Forwarded-Proto \(scheme; 
       proxy_set_header   Upgrade \)http_upgrade; 
       proxy_set_header   Connection keep-alive; 
       proxy_set_header   Host \(host; 
       proxy_cache_bypass \)http_upgrade; 
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for; 
       proxy_set_header   X-Forwarded-Proto https; 
       proxy_set_header   X-Forwarded-Ssl on; 
   } 
}   

Notes: 

1. Replace <container_name> with the Docker container name running your service. 

2. If the service exposes a specific internal port, append it in the proxy_pass URL, e.g., http://<container_name>:<container_port>. 

3. Save and close the file.

3. Generate SSL Certificate 

1. Install Certbot if it is not already installed:

sudo apt update 
sudo apt install certbot python3-certbot-nginx -y   

1. Generate the SSL certificate and configure Nginx automatically:

sudo certbot --nginx -d newservice.uat.example.com   

1. Follow the interactive prompts to complete HTTPS configuration.

Tip: Enable automatic renewal of SSL certificates: 

sudo crontab -e 
# Add the following line to renew certificates daily 
0 3 * certbot renew --quiet   

4. Update Docker Compose 

1. Stop current Docker services in UAT:

docker-compose -f docker-compose.yaml -f docker-compose.uat.yaml down   

1. Bring up the updated services:

docker-compose -f docker-compose.yaml -f docker-compose.uat.yaml up -d   

1. Verify that your new service container is running:

docker ps   

5. Verify Deployment 

1. Access the new service via the domain:

https://newservice.uat.example.com   

1. Check logs if any issues occur:

docker logs <container_name> 
sudo journalctl -u nginx -f   

Best Practices 

• Always back up nginx.uat.conf before making edits. 

• Use docker-compose down only when necessary; up -d can often apply changes without downtime. 

• Ensure firewall rules allow HTTP (80) and HTTPS (443) traffic. 

• Monitor logs after deployment to catch configuration issues early. 

• Schedule automatic SSL renewal using Certbot’s cron job.