Emily CLI Documentation

Adding Nginx configurations

It is often desirable to host a microservice behind a secured HTTPS connection. To facilitate this, a common strategy is to proxy the microservice behind a reverse proxy certified using SSL certificates.

The emily configuration add compose nginx command creates a Docker Compose configuration that adds the following to a project:

1. An Nginx reverse proxy service
2. A certifcate service that automatically creates/renews SSL certificates on deployment
   • Certificates are created with Let's Encrypt
3. Reverse proxying of HTTP(S) requests to the Emily service

Reverse proxy

The Nginx reverse proxy listens on the host ports 80 (HTTP) and 443 (HTTPS).

• All http:// requests wil be redirected (HTTP 301) to https:// to ensure that all connections reaching the microservice are secured.

• All https:// requests will be proxied as-is to the service.

For example, say our project contains the following endpoints:

1. http://my-project-m9vhkd:4242/api
2. http://my-project-m9vhkd:4242/api/predict

After running the command:

... those endpoints will be available over a secured connection as:

1. https://ai.company.com/api
2. https://ai.company.com/api/predict

Certificate creation and renewal

Emily will automatically create and renew SSL certificates each time your project is deployed to a server. The email address provided with --email will receive expiry notifications when the SSL certificate needs to be renewed.

Certificates are valid for 3 months.

Modifying the reverse proxy

By default, only the current project service will be proxied by the Nginx reverse proxy. However, it's completely possible to proxy multiple services running on the server.

The Nginx reverse proxy configuration is found as a template file under ./configurations/<configuration>/nginx/nginx.template.conf. To proxy another service, simply add a new location under the server listening on port 443 (HTTPS):

...

http {

  ...
  
  server {
    listen 443 default_server ssl http2;
    
    ...
  
    server_name ai.company.com;
  
    ## Add a new location specifying that all requests for https://ai.company.com/auth
    ## will be proxied to a Docker Compose service called "emily-auth-service-ks882" on port 4242.

    ## NOTE: Ensure that the Nginx service (docker-compose.nginx.yml) and the emily-auth-service-ks882
    ##       service are running on the same Docker network.
    location /auth {
      proxy_pass http://emily-auth-service-ks882:4242/;
      proxy_set_header Host              $host;
      proxy_set_header X-Forwarded-For   $remote_addr;
      proxy_set_header X-Forwarded-Proto https;
    }
    
    ## All requests that haven't matched any locations before this one will be redirected to
    ## the default Emily project service.
    location / {
      proxy_pass http://${COMPOSE_PROJECT_NAME}:${CONTAINER_PORT}/;
      ...
    }
  }
}

For additional configuration options, consult the Nginx documentation.