sysadmin/sprpcb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Actualizar README.md

Browse Source
This commit is contained in:
sysadmin
2026-05-14 12:10:03 -04:00
parent 8b9bfa6deb
commit 75999aed6c
1 changed files with 44 additions and 149 deletions
Download Patch File Download Diff File Expand all files Collapse all files

189
README.md
View File

@@ -1,107 +1,49 @@
# arches-via-docker # SPRPCB desde Arches Project y OpenContext
SPRPCB es un desarrollo de [ArchesProject](https://www.archesproject.org/) empleando el modelo de implementación de [OpenContext](https://github.com/opencontext/arches-via-docker) SPRPCB es un desarrollo de [ArchesProject](https://www.archesproject.org/) y para este proyecto, se emplea el modelo de implementación de [OpenContext](https://github.com/opencontext/arches-via-docker)
# Implementación en servidor web público Arches versión 7.6.x # Implementación en servidor web público Arches versión 7.6.x
El propósito principal de este repositorio es desplegar el sistema SPRPCB en el servidor del Plan Moxos. Por el momento solo está disponible la versión de producción del sistema SPRPCB migrado de la implementación de la nube de ENTEL. ### 1. Prerrequisitos
* Tener un nombre de dominio.
* Servidor con una dirección IP pública.
* Apuntar el dominio al servidor con un registro tipo A
* Docker y Docker Compose están instalados.
* Clonar el repositorio:
En un tiempo breve se habilitará una actualización para implementar una versión de desarrollo en la última versión de ArchesProject
```bash ```bash
git checkout origin/pmoxos-local git clone -b prod-7_6_x https://gitea.patrimonio.org.bo/sysadmin/sprpcb.git avd-prod
```
### 2. Preparar la configuración para la instalación inicial
```shell
# crear volúmenes de docker para el manejo de certificados SSL/TLS
docker volume create --name=logs_nginx
docker volume create --name=nginx_ssl
docker volume create --name=certbot_certs
docker volume create --name=arches_certbot
# Configuración de docker
cd ./avd-prod
cp edit_dot_env .env
# Personalizar el archivo .env
vi .env
``` ```
# Nginx y Let’s Encrypt con Docker Compose # Nginx y Let’s Encrypt con Docker Compose
Este enfoque obtiene y renueva automáticamente los certificados TLS [Let's Encrypt](https://letsencrypt.org/) y configura HTTPS en Nginx para su dominio utilizando docker compose. Este enfoque obtiene y renueva automáticamente los certificados TLS [Let's Encrypt](https://letsencrypt.org/) y configura el acceso HTTPS en Nginx para su dominio.
La idea es simple. Hay 3 contenedores que trabajan así: Hay 3 contenedores que trabajan para ello utilizando docker compose:
* Nginx, generates self-signed "dummy" certificates to pass ACME challenge for obtaining Let's Encrypt certificates * Nginx, genera certificados autofirmados "dummy" para obtener los certificados de Let's Encrypt
* Certbot - for obtaining and renewing certificates, waits for Nginx to become ready and obtains certificates * Certbot - obtiene y renueva los certificados, espera hasta que Nginx esté listo para obtener los certificados
* Cron - for triggering certificates renewal once a day, triggers Certbot to try to renew certificates and Nginx to reload configuration on a daily basis * Cron - cada día renueva los certificados, si verifica que están vencidos, arranca Cerbot para renovarlos, luego reinicia Nginx
* The Nginx container uses updates symbolic links that point to either "dummy" certificates or Let's Encrypt certificates.
# Personalización 1: Agregar webapp adicional Para personalizar el manejo de certificados debe cambiar estos parámetros en el archivo `.env`:
Utilizando la función proxy_pass de la aplicación de nginx, se agrega servidores adicionales para complementar el proyecto con aplicaciones web (dominios) adicionales. Por el momento el procedimiento implica personalizar los archivos complementarios del docker compose y ejecutar un comando, luego de que el sistema está funcionando. Secuencia del procedimiento:
* Crear el archivo de configuración `[docker_compose_dir]/nginx/webapp1.conf`
```shell
server {
listen 443 ssl;
server_name webapp1.dominio.com;
ssl_certificate /etc/letsencrypt/live/webapp1.dominio.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/webapp1.dominio.com/privkey.pem;
location / {
proxy_pass http://[IP_Local]:[Puerto]/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
```
* Copiar el archivo recién creado `[docker_compose_dir]/nginx/webapp1.conf` al contenedor nginx y reiniciar el servicio
```shell
...
docker compose cp nginx/webapp1.conf <nginx_container_id>:/etc/nginx/conf.d/webapp1.conf
docker compose exec --no-TTY nginx nginx -s reload
...
```
* Procedimiento para agregar el certificado SSL/TLS correspondiente a la aplicación adicional: `webapp1.dominio.com`
* Modificar el archivo `[docker_compose_dir]/certbot/nvo_dominio.sh` indicando el nuevo dominio
```bash
DominioExtra="webapp1.dominio.com" # especificar dominio nuevo
EmailExtra="sysadmin@dominio.com" # y el correo correspondiente
```
* Copiar el script personalizado al contenedor de certbot y ejecutar el comando de docker para adquirir el nuevo certificado
```bash
docker compose cp certbot/nvo_dominio.sh <container_id>:/tmp/nvo_dominio.sh
docker compose exec chmod +x /tmp/nvo_dominio.sh
docker compose run --rm --no-TTY --entrypoint /tmp/nvo_dominio.sh
```
# The directories and files
The following lists some information about the contents of this repo and how they fit together:
* `docker-compose.yml`
* `.env` - specifies `COMPOSE_PROJECT_NAME` to make container names independent from the base directory name. specifies project configuration, e.g. domain names, emails, database connection details, etc. This file contains sensitive information.
* `arches/`
* `Dockerfile`
* `arches_data` - A directory on your host machine that gets attached to the Arches container. This makes it convenient to pass data (like packages or exports) in and out of your Arches container.
* `conf.d/` - A directory of Supervisord configurations for the celery worker and celery beat processes. This gets copied into the Arches container.
* `celery.py` - Editable file if you want to modify your Arches project use of celery
* `arches_proj-supervisor.conf` - Supervisord configurations for the celery worker and celery beat processes
* `entrypoint.sh` - entrypoint script. This has some handy utility functions for some routine administration of the Arches container.
* `settings_local.py` - Editable python file to define project specific settings for your Arches instance. Many of the environment variables that you assign in your `.env` file
* `settings_local.py` - Editable python file configuring URLs in your Arches instance
* `certbot/`
* `Dockerfile`
* `certbot.sh` - entrypoint script
* `cron/`
* `Dockerfile`
* `renew_certs.sh` - script executed on a daily basis to try to renew certificates
* `html/` - directory mounted as `root` for Nginx
* `index.html`
* `nginx/`
* `Dockerfile`
* `nginx.sh` - entrypoint script. This script will update where symbolic links will resolve (either to the dummy self-assigned certificates or to the Let's Encrypt obtained certificates)
* `hsts.conf` - HTTP Strict Transport Security (HSTS) policy
* `options-ssl-nginx.conf` - SSL related configurations
* `default.conf` - Nginx configuration for your domain. Contains a configuration to get A+ rating at [SSL Server Test](https://www.ssllabs.com/ssltest/). This configuration also asks Nginx to gzip compress certain text-based static files (especially CSS and Javascript) which should help with performance. This config uses symbolic links to specify the path to SSL certificates.
* `default.conf` - Nginx server configuration. It loads the Perl language module to simplify passing environment variables to your Nginx domain configuration.
* `webpack/`
* `Dockerfile`
* `webpack_entrypoint.sh` - The `webpack` container is a minimalist container that invokes a docker command on the `arches` container. This command prepares static assets for the Arches frontend by running webpack and collectstatic.
To adapt the example to your domain names you need to change only `.env`:
```properties ```properties
DOMAINS=teach-with-arches.org DOMAINS=patrimonio.org.bo
CERTBOT_EMAILS=info@teach-with-arches.org info@teach2.with.arches.org CERTBOT_EMAILS=admin@patrimonio.org.bo info@patrimonio.org.bo
CERTBOT_TEST_CERT=0 CERTBOT_TEST_CERT=0
CERTBOT_RSA_KEY_SIZE=4096 CERTBOT_RSA_KEY_SIZE=4096
``` ```
@@ -179,76 +121,29 @@ docker volume create --name=certbot_certs
docker volume create --name=arches_certbot docker volume create --name=arches_certbot
``` ```
## Step 3 - Use Valid Let's Encrypt Certificates ## Usar certificados Let's Encrypt válidos
Configure to use production Let's Encrypt server in `.env`: Para producción, configure el archvo .env :
```properties ```properties
CERTBOT_TEST_CERT=0 CERTBOT_TEST_CERT=0
``` ```
## Step 4 - Build images and start containers ## Construir imágenes y arrancar contenedores
```bash ```bash
docker compose up --build docker compose up --build
``` ```
## Config Changes? - Replace volumes etc to implement changes Detener (Stop) los contenedores:
Stop the containers:
```bash ```bash
docker compose down docker compose down
``` ```
## Cómo crear comandos de administración de Arches
Re-create the volume for Let's Encrypt certificates: Además de configurar HTTPS y Nginx, este repositorio implementa una instancia de Arches.
Al inicio, se configura una instancia de Arches "vacía". Se deberá cargar con datos propios mediante la instalación de un paquete o algún otro método.
Una vez implementada Arches, puedes usar los comandos de administración habituales de Arches desde el servidor. Por ejemplo:
```bash ```bash
docker volume rm certbot_certs docker exec -it arches python manage.py makemigrations
docker volume rm arches_certbot docker exec -it arches python manage.py migrate
docker volume create --name=certbot_certs
docker volume create --name=arches_certbot
``` ```
Start the containers:
```bash
docker compose up
```
## How to Make Arches (administrative) Management Commands
Besides setting up HTTPS and Nginx, this repo deploys an instance of Arches. Currently this will setup an "empty" Arches instance. You'll need to load it with your own data by loading a package or some other approach. Once you deploy Arches, you can use normal Arches management commands as so:
```bash
docker exec -it arches python3 manage.py [Arches management commands and arguments here]
```
## NOTE
You may run into weirdness permissions issues restarting the docker container. I solved it with:
```
sudo chmod 666 /var/run/docker.sock
```
# BACKGROUND AND CREDIT
This repo will hopefully streamline deployment of Arches for use on the Web. Eventually, we hope to use this as the basis for deploying instances of Arches for use in archaeological teaching and learning applications.
None of this code is very original. This repo started by forking:
https://github.com/evgeniy-khist/letsencrypt-docker-compose
Some elements of this repo are also derived from:
https://github.com/opencontext/oc-docker
and
https://github.com/archesproject/arches-for-science-prj
and
https://github.com/archesproject/arches-dependency-containers
and finally
https://github.com/archesproject/arches-her