{"id":1326,"date":"2018-12-17T22:26:10","date_gmt":"2018-12-17T21:26:10","guid":{"rendered":"https:\/\/markus-blog.de\/?p=1326"},"modified":"2018-12-17T10:11:46","modified_gmt":"2018-12-17T09:11:46","slug":"how-to-securely-deploy-minio-s3-object-storage-with-docker-behind-apache2-on-ubuntu","status":"publish","type":"post","link":"https:\/\/markus-blog.de\/index.php\/2018\/12\/17\/how-to-securely-deploy-minio-s3-object-storage-with-docker-behind-apache2-on-ubuntu\/","title":{"rendered":"How to securely deploy minio S3 Object Storage with docker behind Apache2 on Ubuntu"},"content":{"rendered":"

Today, we want to deploy our own S3 Object Storage with minio<\/a> behind an Apache2 https proxy via Docker. This howto works with both Ubuntu 16.04 and 18.04.<\/p>\n

Requirements: <\/strong> <\/span>
\n– one Ubuntu VPS
\n– LAMP stack installed
\n– Apache2 Reverse Proxy Modules activated
\n– Docker installed
\n– certbot installed
\n– DNS-A record for Apache2-vHost<\/p>\n

If requirements are missing please use this:<\/p>\n

LAMP stack: <\/strong><\/p>\n

 sudo apt-get install lamp-server^<\/pre>\n
 Apache2 reverse proxy module: <\/strong><\/p>\n
sudo a2enmod proxy\r\nsudo a2enmod proxy_http\r\nsudo a2enmod proxy_ajp\r\nsudo a2enmod rewrite\r\nsudo a2enmod deflate\r\nsudo a2enmod headers\r\nsudo a2enmod proxy_balancer\r\nsudo a2enmod proxy_connect\r\nsudo a2enmod proxy_html<\/pre>\n
 Docker: <\/strong>
\nVersion from official Ubuntu Repository:<\/p>\n
sudo apt-get install docker.io\r\nsudo systemctl start docker\r\nsudo systemctl enable docker<\/pre>\n
or directly from Docker:<\/p>\n
sudo curl -sSL https:\/\/get.docker.com\/ | CHANNEL=stable sh\r\nsudo systemctl enable docker.service\r\nsudo systemctl start docker.service<\/pre>\n
 Certbot: <\/strong><\/p>\n
sudo apt-get update\r\nsudo apt-get install software-properties-common\r\nsudo add-apt-repository ppa:certbot\/certbot\r\nsudo apt-get update\r\nsudo apt-get install python-certbot-apache<\/pre>\n
when finished, we can continue with Step 1.<\/p>\n
  Step 1: Create Apache2 vHost <\/strong> <\/span><\/p>\n
As a first step we create the Apache-vHost as reverse proxy:<\/p>\n
sudo nano \/etc\/apache2\/sites-available\/005-minio.conf<\/pre>\n
add the following content:<\/p>\n
<VirtualHost *:80>\r\n\r\nServerName s3.your-domain.tld\r\n\r\n<\/VirtualHost><\/pre>\n
save file, activate site and restart Apache2:<\/p>\n
sudo a2ensite 005-minio.conf\r\nsudo systemctl restart apache2<\/pre>\n
we can now generate a certificate via certbot:<\/p>\n
sudo certbot --apache<\/pre>\n
select the corresponding vHost and select „2“ for „redirect“ at the end.<\/p>\n
Then we edit the created configuration again:<\/p>\n
sudo nano \/etc\/apache2\/sites-available\/005-minio-le-ssl.conf<\/pre>\n
and add the following content between the VirtualHost block:<\/p>\n
# Proxy to minio\r\nProxyPreserveHost On\r\nProxyPass \/ http:\/\/0.0.0.0:32768\/\r\nProxyPassReverse \/ http:\/\/0.0.0.0:32768\/\r\nRequestHeader set X-Forwarded-Proto \"https\"\r\nProxyVia Block\r\n\r\n<Proxy *>\r\nRequire all granted\r\n<\/Proxy>\r\n\r\n# SSL Configuration - uses strong cipher list - these might need to be downgraded if you need to support older browsers\/devices\r\nSSLEngine on\r\nSSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\r\nSSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1\r\nSSLHonorCipherOrder On\r\n\r\n# HSTS (optional)\r\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubdomains;\"\r\n# Prevent MIME based attacks\r\nHeader set X-Content-Type-Options \"nosniff\"\r\n\r\nErrorLog \/var\/log\/apache2\/s3.your-domain.tld-error.log\r\nCustomLog \/var\/log\/apache2\/s3.your-domain.tld-access.log combined<\/pre>\n
restart Apache2 again:<\/p>\n
sudo systemctl restart apache2<\/pre>\n
After the restart we are finished and can move on to the next step.
\n  Step 2: Deploy minio <\/strong> <\/span><\/p>\n
To make our data persistent, we first create two folders in our file system, which we will mount to the minio container later:<\/p>\n
sudo mkdir \/s3data\r\nsudo mkdir \/miniocfg<\/pre>\n
Then we can start to deploy the container:<\/p>\n
sudo docker run -d -p 32768:9000 --name minio --restart=always -e \"MINIO_ACCESS_KEY=$YOUR_KEY\" -e \"MINIO_SECRET_KEY=$YOUR_SECRET\" -v \/s3data:\/data -v \/miniocfg:\/root\/.minio minio\/minio server \/data<\/pre>\n
Define the variables as followed:<\/p>\n
$YOUR_KEY = Access key of minimum 3 characters in length.
\n$MINIO_SECRET_KEY = Secret key of minimum 8 characters in length.<\/p>\n
  Step 3: Create Bucket <\/strong> <\/span><\/p>\n
In this step we create our first bucket, to do this we call our domain in a browser of our choice and log in with the credentials:<\/p>\n
\"\"<\/p><\/blockquote>\n
After logging in, we can (+) create buckets in the lower right and use them in appropriate applications, e.g. in Plesk as a backup target or as External Storage for Nextcloud (read this HINT<\/a> before).<\/p>\n
\"\"<\/p><\/blockquote>\n
Finished… have fun trying it out \ud83d\ude09<\/p>\n
Feedback and sharing as always desired …<\/p>\n