thurloat/docker-compose-sentry

Docker Compose configuration for running a Sentry server.

docker-compose-sentry's Issues

Circular dependency on `docker-compose pull`

In a fresh repo and performing:

docker-compose pull

I get:

ERROR: Circular dependency between letsencrypt and nginx and sentry-web and sentry-cron

docker-compose version 1.9.0, build 2585387
Docker version 17.05.0-ce-rc3, build 90d35ab

Security issue

Hi,

This config appears to leave ports exposed on the host. This is a security issue. Will soon submit PR with fixes

Davide

Letsencrypt not creating keys

Hi,

I've been trying to use your package to set up a Sentry instance but when I run docker-compose up -d it finishes but docker ps shows Nginx left constantly restarting. Looking at the Nginx logs I see the following over and over (I've edited my domain to sentry.example.co.uk to avoid giving it out):

2019/10/22 13:45:36 [emerg] 1#1: cannot load certificate "/etc/letsencrypt/live/sentry.example.co.uk/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/sentry.example.co.uk/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/sentry.example.co.uk/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/sentry.example.co.uk/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)

Looking then at the Letsencrypt container I'm seeing the following in the logs.

Using the staging environment
[INFO] certificate file not found for domain sentry.example.co.uk. Starting webroot initial certificate request script...
Making a temporary self signed certificate to prevent chicken and egg problems
Generating a 4096 bit RSA private key
.............................................................................................................................................................................................................................................................................++
.++
writing new private key to '/etc/letsencrypt/live/sentry.example.co.uk/privkey.pem'
/etc/letsencrypt/live/sentry.example.co.uk/privkey.pem: No such file or directory
139782929086112:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/etc/letsencrypt/live/sentry.example.co.uk/privkey.pem','w')
139782929086112:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
Warning: This Docker image will soon be switching to Alpine Linux.
You can switch now using the certbot/certbot repo on Docker Hub.
/opt/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/primitives/constant_time.py:26: CryptographyDeprecationWarning: Support for your Python version is deprecated. The next version of cryptography will remove support. Please upgrade to a 2.7.x release that supports hmac.compare_digest as soon as possible.
  utils.DeprecatedIn23,
Saving debug log to /var/letsencrypt/log/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Skipped user interaction because Certbot doesn't appear to be running in a terminal. You should probably include --non-interactive or --force-interactive on the command line.
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for sentry.example.co.uk
Using the webroot path /tmp/letsencrypt for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. sentry.example.co.uk (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://sentry.example.co.uk/.well-known/acme-challenge/lq6qiuwyKh47lzCEjSGi5Km3IqUsuqUGXbWlxHJFvw4: Connection refused
IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: sentry.example.co.uk
   Type:   connection
   Detail: Fetching
   http://sentry.example.co.uk/.well-known/acme-challenge/lq6qiuwyKh47lzCEjSGi5Km3IqUsuqUGXbWlxHJFvw4:
   Connection refused

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
[INFO] Fixing permissions
Certificate request process finished for domain sentry.example.co.uk

I think the line /etc/letsencrypt/live/sentry.example.co.uk/privkey.pem: No such file or directory seems to be where things are going wrong. Looking in the ./data/letsencrypt directory I can see various directories have been created but not the live directory. I tried manually creating them all but Letsencrypt still can't write to them and in fact if I /bin/bash into the container and look in /etc I can see the other directories but not the one I created. Am I looking in the wrong place perhaps?

I don't suppose you can think of anything obvious I'm doing wrong or need to change?