Docker Compose で NGINX の起動前に自己署名証明書を生成する方法

version: "3"

services:
  # NGINX を動かす
  front:
    build: ./services/front
    ports:
      - "80:80"
      - "443:443"
    environment:
      NGINX_SERVER_NAME: example.local
    volumes:
      - front_certs:/etc/ssl/certs/nginx:ro,cached
    # NGINX の起動条件として「証明書生成処理が正常終了していること」を指定する
    depends_on:
      certs:
        condition: service_completed_successfully
  # 証明書を生成する
  certs:
    build: ./services/certs
    environment:
      DOMAIN: example.local
    volumes:
      - front_certs:/app:delegated

volumes:
  # 証明書のファイルはボリュームで共有する
  front_certs:

FROM alpine:latest

WORKDIR /app

RUN apk update && \
  apk add openssl

CMD openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
  -keyout domain.key \
  -out signed.crt \
  -subj "/CN=${DOMAIN}" \
  -addext "subjectAltName=DNS:${DOMAIN}" \
  -addext "extendedKeyUsage=serverAuth"

server {
    listen 80;
    server_name ${NGINX_SERVER_NAME};
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name ${NGINX_SERVER_NAME};

    charset utf8;

    # HSTS ヘッダー
    add_header Strict-Transport-Security "max-age=${NGINX_HSTS_MAX_AGE}" always;

    # `signed.crt` と `domain.key` は事前に生成し volumes で設置しておく必要があります
    ssl_certificate /etc/ssl/certs/nginx/signed.crt;
    ssl_certificate_key /etc/ssl/certs/nginx/domain.key;

    location / {
        proxy_pass ${NGINX_PROXY_PASS};
    }
}