{"id":624,"date":"2018-05-11T08:14:27","date_gmt":"2018-05-11T06:14:27","guid":{"rendered":"https:\/\/markus-blog.de\/?p=624"},"modified":"2018-08-30T17:28:08","modified_gmt":"2018-08-30T15:28:08","slug":"how-to-manage-docker-with-portainer-on-ubuntu-16-04-lts-with-apache2-as-reverse-proxy","status":"publish","type":"post","link":"https:\/\/markus-blog.de\/index.php\/2018\/05\/11\/how-to-manage-docker-with-portainer-on-ubuntu-16-04-lts-with-apache2-as-reverse-proxy\/","title":{"rendered":"How to manage Docker with portainer on Ubuntu 16.04 LTS with Apache2 as reverse proxy"},"content":{"rendered":"

Today I want to show how to manage your Docker containers with portainer <\/a>. We use the portainer docker image, Apache2 as a reverse proxy, and we will secure our installation with LetsEncrypt.<\/p>\n

Prerequisites: <\/strong> <\/span>
\n– an Ubuntu VPS
\n– LAMP stack installed
\n– Reverse Proxy Module enabled in Apache2
\n– Docker installed
\n– certbot installed
\n– DNS-A record for our Apache2-vHost<\/p>\n

If requirements are missing, of course we have to do this first.<\/p>\n

LAMP stack: <\/strong><\/p>\n

 sudo apt-get install lamp-server^<\/pre>\n
 Enable reverse proxy modules: <\/strong><\/p>\n
sudo a2enmod proxy proxy_http proxy_ajp rewrite deflate headers proxy_balancer proxy_connect proxy_html proxy_wstunnel authz_core authn_core setenvif ssl<\/pre>\n
 Docker: <\/strong>
\nVersion from the official package sources:<\/p>\n
sudo apt-get install docker.io\r\nsudo systemctl start docker\r\nsudo systemctl enable docker<\/pre>\n
or directly from Docker:<\/p>\n
sudo curl -sSL https:\/\/get.docker.com\/ | CHANNEL=stable sh\r\nsudo systemctl enable docker.service\r\nsudo systemctl start docker.service<\/pre>\n
 Certbot: <\/strong><\/p>\n
sudo apt-get update\r\nsudo apt-get install software-properties-common\r\nsudo add-apt-repository ppa:certbot\/certbot\r\nsudo apt-get update\r\nsudo apt-get install python-certbot-apache<\/pre>\n
Afterwards we can continue and put Portainer into operation.<\/p>\n
  Step 1: Run Portainer docker Image<\/strong> <\/span><\/p>\n
With the following command we start the container on our server:<\/p>\n
sudo docker run -d -p 9000:9000 --restart always -v \/var\/run\/docker.sock:\/var\/run\/docker.sock -v \/opt\/portainer:\/data portainer\/portainer<\/pre>\n
We check, if the container was started:<\/p>\n
sudo docker ps<\/pre>\n
Portainer now listens on port 9000.<\/p>\n
  Step 2: Create Apache2 vHost <\/strong> <\/span><\/p>\n
When the container is running, we create a vHost so we can use the reverse proxy functionality and call it in the browser without a port specification later:<\/p>\n
sudo nano \/etc\/apache2\/sites-available\/003-portainer.conf<\/pre>\n
we add the following content:<\/p>\n
<VirtualHost *:80>\r\n\r\nServerName portainer.your-domain.tld\r\n\r\n<\/VirtualHost><\/pre>\n
Save file, activate site and restart Apache2:<\/p>\n
sudo a2ensite 003-portainer.conf\r\nsudo systemctl restart apache2<\/pre>\n
Now Portainer would already be accessible via http: \/\/portainer.your-domain.tld. But we are working with password input, so we encrypt the connection with SSL.<\/p>\n
we use Certbot:<\/p>\n
sudo certbot --apache<\/pre>\n
Select the corresponding host and at the end select „2“ for „redirect“.<\/p>\n
Now we have to edit the generated conf:<\/p>\n
sudo nano \/etc\/apache2\/sites-available\/003-portainer-le-ssl.conf<\/pre>\n
and add the following block after ServerName<\/code>:<\/p>\n
# Proxy to Portainer\r\nProxyPreserveHost On\r\nProxyPass \/ http:\/\/127.0.0.1:9000\/\r\nProxyPassReverse \/ http:\/\/127.0.0.1:9000\/\r\nRequestHeader set X-Forwarded-Proto \"https\"\r\n\r\nProxyVia Block\r\n\r\n<Proxy *>\r\nRequire all granted\r\n<\/Proxy>\r\n\r\n# SSL Configuration - uses strong cipher list - these might need to be downgraded if you need to support older browsers\/devices\r\nSSLEngine on\r\nSSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\r\nSSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1\r\nSSLHonorCipherOrder On\r\n\r\n# HSTS (optional)\r\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubdomains;\"\r\n# Prevent MIME based attacks\r\nHeader set X-Content-Type-Options \"nosniff\"\r\n\r\nErrorLog \/var\/log\/apache2\/portainer-error.log\r\nCustomLog \/var\/log\/apache2\/portainer-access.log combined\r\n\r\n#Proxy to docker container console\r\n\r\n<Location \/api\/websocket\/>\r\nRewriteEngine on\r\nRewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]\r\nRewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]\r\nRewriteRule \/api\/websocket\/(.*) ws:\/\/127.0.0.1:9000\/api\/websocket\/$1 [P]\r\n<\/Location><\/pre>\n
Save File and Restart Apache2 again.<\/p>\n
sudo systemctl restart apache2<\/pre>\n
  Step 3: Configure Portainer <\/strong> <\/span><\/p>\n
via the browser of our choice we call https:\/\/portainer.your-domain.tld and must first assign a password for the admin:<\/p>\n
\"\"<\/p>\n
In the next dialog we set the setting to „Local“:<\/p>\n
\"\"<\/p>\n
click on the button „Connect“ and after a short time you will see the dashboard of portainer:<\/p>\n
\"\"<\/p>\n
If we select „Container“, we can see more information about the individual containers or restart, stop, etc.:<\/p>\n
\"\"<\/p>\n
Container details:<\/p>\n
\"\"<\/p>\n
Update:<\/strong><\/p>\n
If you want to call Portainer in a subfolder of an existing vHost (as example: https:\/\/hostname.your-domain.tld\/portainer\/) than you have to add the following block to this conf:<\/p>\n
<Location \/portainer\/>\r\nProxyPass http:\/\/127.0.0.1:9000\/\r\nProxyPassReverse http:\/\/127.0.0.1:9000\/\r\nRequestHeader set X-Forwarded-Proto \"https\"\r\n<\/Location>\r\n\r\n<Location \/portainer\/api\/websocket\/>\r\nProxyPass http:\/\/127.0.0.1:9000\/api\/websocket\/\r\nProxyPassReverse http:\/\/127.0.0.1:9000\/api\/websocket\/\r\nRewriteEngine on\r\nRewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]\r\nRewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]\r\nRewriteRule \/api\/websocket\/(.*) ws:\/\/127.0.0.1:9000\/api\/websocket\/$1 [P]\r\n<\/Location><\/pre>\n
Don not forget to enable reverse proxy modules.<\/p>\n
That’s it for today, have fun \ud83d\ude42<\/p>\n