Docker + Nginx + SSL

Introduction

This document describes the installation and operation of Euro-Office Document Server on a Linux server environment using Docker containers. The deployment is designed to operate behind an existing Nginx reverse proxy that provides HTTPS access and central SSL certificate management.

The recommended architecture ensures that the Euro-Office container is only accessible locally on the server. All external access is routed through Nginx. This approach reduces the attack surface and allows centralized management of SSL certificates, security headers, logging, and access control.

For secure communication between Euro-Office and integrated applications, JWT (JSON Web Token) authentication should be enabled. It is strongly recommended to use JWT in all production environments.

Target Architecture

Internet
    │
HTTPS (443)
    │
Nginx Reverse Proxy
    │
HTTP (127.0.0.1:8080)
    │
Euro-Office Docker Container

Prerequisites

Before starting the installation, ensure the following requirements are met.

Operating System

Ubuntu Server 24.04 LTS or newer
Root or sudo privileges

Infrastructure

Existing Nginx reverse proxy installation
Public DNS record for the Euro-Office service
Valid SSL certificate (Let's Encrypt, Wildcard Certificate, or Enterprise Certificate)
Internet access for downloading Docker images

Recommended Hardware Resources

Component	Recommendation

Component	Recommendation
CPU	4 vCPUs
Memory	8 GB RAM
Disk Space	20 GB available
Network	Gigabit connectivity

For environments with many concurrent users, additional CPU and memory resources should be allocated.

Docker Installation

If Docker is not yet installed, install it using the Ubuntu package repositories.

Update package information:

apt update

Install Docker:

apt install -y docker.io

Enable and start Docker:

systemctl enable docker
systemctl start docker

Verify the installation:

docker --version
docker ps

The commands should return the installed Docker version and an empty container list if no containers are currently running.

Downloading the Euro-Office Docker Image

The Euro-Office Document Server image is distributed through GitHub Container Registry (GHCR).

Download the latest image:

docker pull ghcr.io/euro-office/documentserver:latest

Depending on available bandwidth, the download may take several minutes because the image size exceeds several gigabytes.

Verify the downloaded image:

docker images

Example output:

REPOSITORY                               TAG       IMAGE ID
ghcr.io/euro-office/documentserver       latest    xxxxxxxxx

Generating a JWT Secret

JWT is used to authenticate communication between Euro-Office and connected applications.

Generate a new JWT secret:

openssl rand -hex 32

Example output:

a6d98b61cf9f2f0d7e4e98e0ef5db8e45e42e44c55a1b8f9c7a9f0c6d8f4a1e2

Store this secret securely. It will be required when integrating Euro-Office with external applications.

Starting the Euro-Office Container

The recommended deployment binds Euro-Office exclusively to localhost. This prevents direct access from external networks and ensures that all traffic is routed through Nginx.

Start the container:

docker run -d \
  --name euro-office \
  --restart unless-stopped \
  -p 80:80 \
  -e JWT_ENABLED=true \
  -e JWT_SECRET="PASTE_YOUR_TOKEN_HERE" \
  -e JWT_HEADER=Authorization \
  ghcr.io/euro-office/documentserver:latest

Parameter Explanation

Parameter	Description
--restart unless-stopped	Automatically restarts the container after server reboot
-p 80:80	Restricts access to localhost only
JWT_ENABLED	Enables JWT authentication
JWT_SECRET	Defines the JWT secret
EXAMPLE_ENABLED	Enables the example application for testing

Test the insallation in local browser:

Verifying the Installation

Check running containers:

docker ps

View container logs:

docker logs -f euro-office

Check the health endpoint:

curl http://127.0.0.1:8080/healthcheck

Expected response:

true

Verify the example application:

curl -I http://127.0.0.1:8080/example/

Nginx Reverse Proxy Configuration

Euro-Office should be published through an existing Nginx reverse proxy.

Example Hostname

office.example.com

Create a new Nginx configuration file:

vi /etc/nginx/sites-available/office.example.com

Example Configuration

server {
    listen 80;
    server_name office.example.com;

    return 301 https://office.example.com$request_uri;
}

server {
    listen 443 ssl;
    server_name office.example.com;

    ssl_certificate /etc/letsencrypt/live/euro-office/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/euro-office/privkey.pem;

    location / {
        proxy_pass http://10.0.1:80;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
    }
}

Enabling the Configuration

Enable the site:

ln -s /etc/nginx/sites-available/office.example.com \
      /etc/nginx/sites-enabled/office.example.com

Validate the configuration:

nginx -t

Reload Nginx:

systemctl reload nginx

DNS Configuration

Create a DNS record for the service:

office.example.com

Example DNS entry:

Type: A
Host: office
Value: <SERVER_IP>

Verify DNS resolution:

host office.example.com

Functional Testing

Verify HTTPS connectivity:

curl -I https://office.example.com

Check the health endpoint:

curl https://office.example.com/healthcheck

Open the service in a browser:

https://office.example.com/example/

Maintenance and Operations

Check Container Status

docker ps

Restart the Container

docker restart euro-office

Stop the Container

docker stop euro-office

View Logs

docker logs -f euro-office

Updating Euro-Office

Download the latest image:

docker pull ghcr.io/euro-office/documentserver:latest

Stop and remove the old container:

docker stop euro-office
docker rm euro-office

Start a new container using the same configuration and JWT secret.

It is recommended to test updates in a staging environment before deploying them to production.

Troubleshooting

Container Fails to Start

docker logs euro-office

Nginx Configuration Issues