This setup enables automatic creation and renewal of free SSL certificates using Let's Encrypt with Certbot in a Dockerized Nginx environment.
Issue new HTTPS certificates via Certbot using --webroot challenge
Auto-renew certificates before they expire (via cron)
| # -- The notification template is used to generate the notification content | |
| ## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/ | |
| templates: | |
| template.app-deployed: | | |
| message: | | |
| 🚀 **{{.app.metadata.name}} : Deployment Successful** | |
| Application: **{{.app.metadata.name}}** | |
| Repository: **{{.app.spec.source.repoURL}}** | |
| Revision: **{{.app.status.sync.revision}}** | |
| Status: **Healthy** |
| #!/bin/bash | |
| # Define Docker image tag | |
| TAG=${DOCKER_REGISTRY}/${REPO_NAME}:${APP_VER:latest} | |
| echo $TAG | |
| # Enable Docker BuildKit | |
| export DOCKER_BUILDKIT=1 | |
| # Pull Docker image cache |
| #!/bin/bash | |
| # Check if $ENV_FILE variable is set | |
| if [ -z .env ]; then | |
| echo "Error: ENV_FILE variable is not set. Please specify the path to the .env file." | |
| exit 1 | |
| fi | |
| # Check if the .env file exists | |
| if [ ! -f .env ]; then | |
| echo "Error: The specified .env file .env does not exist." |
| --- | |
| 🔐 infisical-get-secret: | |
| image: taufiq14s/infisical-cli | |
| rules: | |
| - if: $CI_COMMIT_BRANCH == "main" | |
| variables: | |
| INFISICAL_ENVIRONMENT: prod | |
| - if: $CI_COMMIT_BRANCH == "staging" | |
| variables: | |
| INFISICAL_ENVIRONMENT: staging |
| # Stage 1: Build the application | |
| FROM maven:3.9-eclipse-temurin-17-alpine AS build | |
| WORKDIR /build | |
| COPY . . | |
| RUN mvn package | |
| #Stage 2: Create the final lightweight image | |
| FROM eclipse-temurin:17-jre-alpine | |
| WORKDIR /app | |
| COPY --from=build /build/target/hello-world.jar . |
The permissions for ~/.ssh/ folder should be 700. Permissions for authorized_keys file and myKey.pem are to be 600.
1.Generate a public key first (usually from AWS EC2 key)
ssh-keygen -y -f AnalyticsSharedKeyPair.pem > AnalyticsSharedKeyPair.pub
2.Add a new public key to authorized_keys:
| prometheus.exporter.self "integrations_alloy" { } | |
| discovery.relabel "integrations_alloy" { | |
| targets = prometheus.exporter.self.integrations_alloy.targets | |
| rule { | |
| target_label = "instance" | |
| replacement = constants.hostname | |
| } |
| server { | |
| listen 80; | |
| server_name <YOUR_DOMAIN_NAME>; | |
| #Basic Auth | |
| auth_basic "loki auth"; | |
| auth_basic_user_file /etc/nginx/.htpasswd_loki; | |
| location / { | |
| proxy_read_timeout 1800s; |
| server { | |
| listen 80; | |
| server_name <YOUR_DOMAIN_NAME>; | |
| auth_basic "prometheus auth"; | |
| auth_basic_user_file /etc/nginx/.htpasswd_prometheus; | |
| location / { | |
| proxy_read_timeout 1800s; | |
| proxy_connect_timeout 1600s; |