[#30] Nginx 인증서 심볼릭 링크 문제 해결 (#38)

Author: 1117mg

.github/workflows/deploy.yml

@@ -124,7 +124,7 @@ jobs:
         host: ${{ secrets.SERVER_HOST }}
         username: root
         password: ${{ secrets.SERVER_PASSWORD }}
-        source: "docker-compose.yml,nginx/nginx.conf,nginx/proxy.conf"
+        source: "docker-compose.yml,nginx/nginx.conf.template,nginx/proxy.conf"
         target: "~/retoday"
         overwrite: true
 
@@ -133,15 +133,19 @@ jobs:
       env:
         DOCKER_USER: ${{ secrets.DOCKERHUB_USERNAME }}
         SHA: ${{ needs.build-and-push.outputs.sha }}
+        DOMAIN: dev.re-today.com
       with:
         host: ${{ secrets.SERVER_HOST }}
         username: root
         password: ${{ secrets.SERVER_PASSWORD }}
-        envs: DOCKER_USER,SHA
+        envs: DOCKER_USER,SHA,DOMAIN
         script: |
           set -e
           cd ~/retoday
 
+          export DOMAIN="${DOMAIN}"
+          envsubst '${DOMAIN}' < nginx/nginx.conf.template > nginx/nginx.conf
+
           docker pull ${DOCKER_USER}/retoday-api:${SHA}
           docker tag ${DOCKER_USER}/retoday-api:${SHA} retoday-api:latest
           COMPOSE_PROFILES=dev docker compose up -d --force-recreate api
@@ -212,7 +216,7 @@ jobs:
         host: ${{ secrets.SERVER_HOST }}
         username: root
         password: ${{ secrets.SERVER_PASSWORD }}
-        source: "docker-compose.yml,nginx/nginx.conf,nginx/proxy.conf"
+        source: "docker-compose.yml,nginx/nginx.conf.template,nginx/proxy.conf"
         target: "~/retoday"
         overwrite: true
 
@@ -221,15 +225,19 @@ jobs:
       env:
         DOCKER_USER: ${{ secrets.DOCKERHUB_USERNAME }}
         SHA: ${{ needs.build-and-push.outputs.sha }}
+        DOMAIN: api.re-today.com
       with:
         host: ${{ secrets.SERVER_HOST }}
         username: root
         password: ${{ secrets.SERVER_PASSWORD }}
-        envs: DOCKER_USER,SHA
+        envs: DOCKER_USER,SHA,DOMAIN
         script: |
           set -e
           cd ~/retoday
 
+          export DOMAIN="${DOMAIN}"
+          envsubst '${DOMAIN}' < nginx/nginx.conf.template > nginx/nginx.conf
+
           # 활성 컨테이너 확인
           if grep -q "api-blue" nginx/upstream.conf; then
             CURRENT="blue"; TARGET="green"

docker-compose.yml

@@ -75,7 +75,7 @@ services:
     - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
     - ./nginx/proxy.conf:/etc/nginx/proxy.conf:ro
     - ./nginx/upstream.conf:/etc/nginx/upstream.conf
-    - ${NGINX_CERT_DIR}:/etc/nginx/certs:ro
+    - /etc/letsencrypt:/etc/letsencrypt:ro
     - /var/www/certbot:/var/www/certbot:ro
     restart: unless-stopped
     healthcheck:

nginx/nginx.conf nginx/nginx.conf.templatenginx/nginx.conf renamed to nginx/nginx.conf.template

@@ -35,7 +35,7 @@ http {
 
     server {
         listen      80;
-        server_name api.re-today.com dev.re-today.com;
+        server_name ${DOMAIN};
         limit_conn  conn 100;
 
         location = /actuator/health {
@@ -56,11 +56,12 @@ http {
     }
 
     server {
-        listen      443 ssl http2;
-        server_name api.re-today.com dev.re-today.com;
+        listen      443 ssl;
+        server_name ${DOMAIN};
+        http2 on;
 
-        ssl_certificate           /etc/nginx/certs/fullchain.pem;
-        ssl_certificate_key       /etc/nginx/certs/privkey.pem;
+        ssl_certificate           /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+        ssl_certificate_key       /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
         ssl_protocols             TLSv1.2 TLSv1.3;
         ssl_ciphers               'ECDHE+AESGCM:ECDHE+CHACHA20:!aNULL:!MD5:!RC4:!3DES';
         ssl_prefer_server_ciphers on;