[AWS] 같은 브랜치에 있는 프론트엔드, 백엔드 자동배포하기 (3) Nginx 설치 및 설정

1. Nginx 설치

sudo apt update
sudo apt install nginx

 

2. SSL 인증서

1) certbot 설치

sudo add-apt-repository ppa:certbot/certbot
sudo apt install python-certbot-nginx

2) SSL 인증서 가져오기

nginx 플러그인을 사용한다.

sudo certbot --nginx -d 도메인주소

차례대로 이메일, 서비스 약관 동의절차를 수행한다.

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): 이메일입력

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
<https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf>. You must
agree in order to register with the ACME server at
<https://acme-v02.api.letsencrypt.org/directory>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

위 절차가 끝나면 https를 어떻게 설정할지 묻는데, 2를 선택해서 모든 http 연결을 https로 리다이렉팅 시키도록 한다.

Obtaining a new certificate
Performing the following challenges:
http-01 challenge for example.com
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/example.com

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

 

3. default 설정

certbot이 기본 nginx설정을 알아서 수정해준다. #managed by Certbot 부분은 전부 자동으로 붙여준 코드다. 전체적인 구조는 80요청으로 오는 http를 443 포트를 이용해 https로 리다이렉팅시키도록 되어있다.

location / 은 '도메인/'로 오는 모든 요청을 http://localhost:8081/로 넘긴다는 의미다. 나는 프론트엔드를 8081포트로 실행시켰기 때문에 8081을 붙였다.

location /api는 '도메인/api'로 오는 모든 요청을 http://localhost:3000/api으로 넘긴다는 의미다. 백엔드 서버를 3000포트로 실행시키는 중이었다. 스프링부트 context path를 api로 맞췄기 때문에 주소를 따로 rewrite시키진 않았다.

server {
    server_name 도메인; # managed by Certbot
    location / {
            charset utf-8;
            proxy_redirect off;
            proxy_set_header X-Real-Ip $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;

            client_max_body_size 10M;

            proxy_pass http://localhost:8081/;
    }

    location /api {
            error_page 405 =200 $uri;
            proxy_redirect off;
            charset utf-8;
            proxy_set_header X-Real-Ip $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-NginX-Proxy true;
            client_max_body_size 10M;
            proxy_pass http://localhost:3000/api;
    }


    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/도메인/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/도메인/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = 도메인) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80 default_server ;
        listen [::]:80 default_server ;
        server_name 도메인;
        return 404; # managed by Certbot


}