ASP.NET Core Web & nginxをConoHa VPS & Docker composeで公開する

$ adduser ユーザ名
$ gpasswd -a ユーザ名 sudo

$ logout

$ sudo apt update
$ sudo atp install vim
$ sudo update-alternatives --set editor /usr/bin/vim.basic

$ sudo apt update
$ sudo atp install snapd -y
$ sudo snap install nvim --classic

$ sudo vim /etc/ssh/sshd_config

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

Port 40022// [!code ++]

#AddressFamily any
#ListenAddress 0.0.0.0

# 省略 #

#PermitRootLogin prohibit-password
PermitRootLogin no// [!code ++]

# 省略 #

#PubkeyAuthentication yes
PubkeyAuthentication yes// [!code ++]

# 省略 #

#PermitEmptyPasswords no
PermitEmptyPasswords no// [!code ++]

$ sudo systemctl restart ssh.socket
$ sudo systemctl restart ssh

$ ufw --version
ufw 0.36.2
Copyright 2008-2023 Canonical Ltd.

$ sudo apt update
$ sudo apt install ufw

$ sudo ufw enable
Firewall is active and enabled on system startup

$ sudo ufw allow 40022/tcp
Rule added
Rule added (v6)

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: reject (incoming), allow (outgoing), disabled (routed)
New profiles: skip

sudo ufw reload

$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] OpenSSH                    ALLOW IN    Anywhere
[ 2] 40022/tcp                  ALLOW IN    Anywhere
[ 3] OpenSSH (v6)               ALLOW IN    Anywhere (v6)
[ 4] 40022/tcp (v6)             ALLOW IN    Anywhere (v6)
$ sudo ufw delete 1
Deleting:
 allow OpenSSH

sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 40022/tcp                  ALLOW IN    Anywhere
[ 2] OpenSSH (v6)               ALLOW IN    Anywhere (v6)
[ 3] 40022/tcp (v6)             ALLOW IN    Anywhere (v6)

sudo ufw delete 2
Deleting:
 allow OpenSSH

sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 10022/tcp                  ALLOW IN    Anywhere
[ 2] 10022/tcp (v6)             ALLOW IN    Anywhere (v6)

sudo reboot

cd ~
mkdir .ssh
chmod 700 .ssh

cd ~/.ssh
ssh-keygen -f id_rsa_conoha
ssh-copy-id -p 40022 -i ~/.ssh/id_rsa_conoha.pub remote-user@remote-url

Host conoha
    HostName リモートのアドレス
    IdentityFile ~/.ssh/id_rsa_conoha
    User リモートのユーザ名
	Port ポート番号

cd ~/.ssh
chmod 600 authorized_keys

$ sudo vim /etc/ssh/sshd_config

PasswordAuthentication yes   # 変更前

PasswordAuthentication no    # 変更後

$ ls /etc/ssh/sshd_config.d
50-cloud-init.conf
$ sudo vim /etc/ssh/sshd_config.d/50-cloud-init.conf
PasswordAuthentication no

sudo systemctl restart sshd

$ sudo sshd -T | grep passwordauthentication
passwordauthentication no

$ sudo certbot certonly --standalone -d makuta-kobo-app.top -d www.makuta-kobo-app.top
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for makuta-kobo-app.top and www.makuta-kobo-app.top

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/makuta-kobo-app.top/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/makuta-kobo-app.top/privkey.pem
This certificate expires on 2025-02-14.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# https://hub.docker.com/_/microsoft-dotnet
FROM mcr.microsoft.com/dotnet/sdk:8.0-jammy AS build
WORKDIR /source

# copy csproj files and restore as distinct layers
COPY ["OneThird.WebAPI/*.csproj", "OneThird.WebAPI/"]
COPY ["OneThirdCL.Domain/*.csproj", "OneThirdCL.Domain/"]
COPY ["OneThirdCL.Infrastructure/*.csproj", "OneThirdCL.Infrastructure/"]
RUN dotnet restore "OneThird.WebAPI/OneThird.WebAPI.csproj"

# copy and build app and libraries
COPY ["OneThird.WebAPI/", "OneThird.WebAPI/"]
COPY ["OneThirdCL.Domain/", "OneThirdCL.Domain/"]
COPY ["OneThirdCL.Infrastructure/", "OneThirdCL.Infrastructure/"]
WORKDIR "/source/OneThird.WebAPI"
RUN dotnet publish -o /app

# final stage/image
FROM mcr.microsoft.com/dotnet/nightly/aspnet:8.0-jammy-chiseled-composite
WORKDIR /app
COPY --from=build /app/ .
ENV ASPNETCORE_URLS http://*:5000
ENTRYPOINT ["./OneThird.WebAPI"]

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
});

$ docker build -t onethird-api:latest .

$ docker login -u ユーザ名 -p パスワード

$ docker tag onethird-api sa39bo/repos:latest
$ docker push sa39bo/repos

$ mkdir -p ~/work/myproject/nginx

FROM nginx:latest

COPY ./nginx.conf /etc/nginx/nginx.conf

COPY ./site.conf.template /etc/nginx/templates/site.conf.template

CMD [ "nginx", "-g", "daemon off;" ]

worker_processes 1;

events { worker_connections 1024; }

http {
    sendfile on;

    include /etc/nginx/conf.d/site.conf;
}

upstream web-app {
    server ${BACKEND_HOST};
}

server {
    listen 80;
    server_name $hostname;
    location / {
        proxy_pass         http://web-app;
        proxy_redirect     off;
        proxy_http_version 1.1;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection keep-alive;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   X-Forwarded-Host $server_name;
    }
}

services:
  app:
      image: [docker hubユーザ名]/[docker hub リポジトリ名]:latest
    environment:
      - 環境変数があれば=ここに記載する
      - linuxの場合jsonの階層は=アンダーバー2つ__で書く
    ports:
      - "5000:5000"
    networks:
      - webnet

  nginx:
    build:
      context: ./nginx
    environment:
      BACKEND_HOST: "app:5000"
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt:ro
    ports:
      - "80:80"
      - "443:443"
    networks:
      - webnet

$ docker compose up -d