Skip to content

feat(infra): zero-config TLS for Nginx via Docker Compose profile#2579

Merged
crivetimihai merged 2 commits intomainfrom
2571-zero-config-tls-nginx
Jan 30, 2026
Merged

feat(infra): zero-config TLS for Nginx via Docker Compose profile#2579
crivetimihai merged 2 commits intomainfrom
2571-zero-config-tls-nginx

Conversation

@crivetimihai
Copy link
Copy Markdown
Member

@crivetimihai crivetimihai commented Jan 30, 2026

Summary

Implements zero-configuration TLS for the Docker Compose stack via a new --profile tls profile. This enables HTTPS with a single command, auto-generating self-signed certificates on first run.

  • One command TLS: make compose-tls starts the stack with HTTPS on port 8443
  • Auto-generates certs: Self-signed certificates created automatically if ./certs/ is empty
  • Custom certificates: Place your own cert.pem/key.pem in ./certs/ before starting
  • Optional HTTPS redirect: make compose-tls-https forces all HTTP traffic to HTTPS
  • Composable: Works alongside other profiles (--profile tls --profile monitoring)

Changes

New Files

File Description
infra/nginx/nginx-tls.conf TLS-enabled nginx configuration with HTTP:80 and HTTPS:443
infra/nginx/docker-entrypoint.sh Entrypoint script handling NGINX_FORCE_HTTPS env var

Modified Files

File Changes
docker-compose.yml Added cert_init and nginx_tls services with tls profile
Makefile Added compose-tls, compose-tls-https, compose-tls-down, compose-tls-logs, compose-tls-ps targets
infra/nginx/Dockerfile Added entrypoint script, improved healthcheck for TLS
docs/docs/deployment/tls-configuration.md Added Quick Start section for zero-config TLS
docs/docs/deployment/compose.md Added TLS section with commands table
docs/docs/deployment/.pages Added tls-configuration.md to navigation
README.md Added TLS option to Docker Compose quick start

Usage

# Start with TLS (HTTP + HTTPS both available)
make compose-tls

# Start with forced HTTPS redirect
make compose-tls-https

# Use custom certificates
mkdir -p certs
cp /path/to/cert.pem certs/cert.pem
cp /path/to/key.pem certs/key.pem
make compose-tls

# Test endpoints
curl http://localhost:8080/health      # HTTP
curl -sk https://localhost:8443/health  # HTTPS

Test plan

  • make compose-tls starts stack with both HTTP:8080 and HTTPS:8443 working
  • make compose-tls-https redirects HTTP requests to HTTPS (301)
  • Auto-generated certificates work (TLS 1.2/1.3)
  • Custom certificates are detected and used when present in ./certs/
  • cert_init container correctly skips generation when certs exist
  • Combined profiles work (--profile tls --profile monitoring)
  • Documentation is complete and accurate

Closes #2571

@crivetimihai
feat(infra): add zero-config TLS for nginx via Docker Compose profile
7a2a984 
Add a new `--profile tls` Docker Compose profile that enables HTTPS
with zero configuration. Certificates are auto-generated on first run
or users can provide their own CA-signed certificates.

Features:
- One command TLS: `make compose-tls` starts with HTTPS on port 8443
- Auto-generates self-signed certs if ./certs/ is empty
- Custom certs: place cert.pem/key.pem in ./certs/ before starting
- Optional HTTP->HTTPS redirect via `make compose-tls-https`
- Environment variable NGINX_FORCE_HTTPS=true for redirect mode
- Works alongside other profiles (monitoring, benchmark)

New files:
- infra/nginx/nginx-tls.conf: TLS-enabled nginx configuration
- infra/nginx/docker-entrypoint.sh: Handles NGINX_FORCE_HTTPS env var

New Makefile targets:
- compose-tls: Start with HTTP:8080 + HTTPS:8443
- compose-tls-https: Force HTTPS redirect (HTTP->HTTPS)
- compose-tls-down: Stop TLS stack
- compose-tls-logs: Tail TLS service logs
- compose-tls-ps: Show TLS stack status

Docker Compose additions:
- cert_init service: Auto-generates certs using alpine/openssl
- nginx_tls service: TLS-enabled nginx reverse proxy

Documentation:
- Updated tls-configuration.md with Quick Start section
- Updated compose.md with TLS section
- Added to deployment navigation
- Updated README.md quick start

Closes #2571

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai
fix(nginx): use smart port detection for HTTPS redirect
d88f753 
Fix hard-coded :8443 port in HTTPS redirect that broke internal
container-to-container calls.

Problem:
- External access via port 8080 correctly redirected to :8443
- Internal container calls (no port) also redirected to :8443
- But nginx_tls only listens on 443 internally, so internal redirects failed

Solution:
Add a map directive that detects request origin based on Host header:
- Requests with :8080 in Host → redirect to :8443 (external)
- Requests without port → redirect without port, defaults to 443 (internal)

Tested:
- External: curl http://localhost:8080/health → https://localhost:8443/health ✓
- Internal: curl http://nginx_tls/health → https://nginx_tls/health (443) ✓

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai crivetimihai self-assigned this Jan 30, 2026
@crivetimihai crivetimihai merged commit 38e4010 into main Jan 30, 2026
41 checks passed
@crivetimihai crivetimihai deleted the 2571-zero-config-tls-nginx branch January 30, 2026 06:34
@madhav165 madhav165 mentioned this pull request Jan 30, 2026
Closed
4 tasks
@crivetimihai crivetimihai added this to the Release 1.0.0-RC1 milestone Jan 31, 2026
hughhennelly pushed a commit to hughhennelly/mcp-context-forge that referenced this pull request Feb 8, 2026
@crivetimihai @hughhennelly
feat(infra): zero-config TLS for Nginx via Docker Compose profile (IB…
01a3577 
…M#2579)

* feat(infra): add zero-config TLS for nginx via Docker Compose profile

Add a new `--profile tls` Docker Compose profile that enables HTTPS
with zero configuration. Certificates are auto-generated on first run
or users can provide their own CA-signed certificates.

Features:
- One command TLS: `make compose-tls` starts with HTTPS on port 8443
- Auto-generates self-signed certs if ./certs/ is empty
- Custom certs: place cert.pem/key.pem in ./certs/ before starting
- Optional HTTP->HTTPS redirect via `make compose-tls-https`
- Environment variable NGINX_FORCE_HTTPS=true for redirect mode
- Works alongside other profiles (monitoring, benchmark)

New files:
- infra/nginx/nginx-tls.conf: TLS-enabled nginx configuration
- infra/nginx/docker-entrypoint.sh: Handles NGINX_FORCE_HTTPS env var

New Makefile targets:
- compose-tls: Start with HTTP:8080 + HTTPS:8443
- compose-tls-https: Force HTTPS redirect (HTTP->HTTPS)
- compose-tls-down: Stop TLS stack
- compose-tls-logs: Tail TLS service logs
- compose-tls-ps: Show TLS stack status

Docker Compose additions:
- cert_init service: Auto-generates certs using alpine/openssl
- nginx_tls service: TLS-enabled nginx reverse proxy

Documentation:
- Updated tls-configuration.md with Quick Start section
- Updated compose.md with TLS section
- Added to deployment navigation
- Updated README.md quick start

Closes IBM#2571

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix(nginx): use smart port detection for HTTPS redirect

Fix hard-coded :8443 port in HTTPS redirect that broke internal
container-to-container calls.

Problem:
- External access via port 8080 correctly redirected to :8443
- Internal container calls (no port) also redirected to :8443
- But nginx_tls only listens on 443 internally, so internal redirects failed

Solution:
Add a map directive that detects request origin based on Host header:
- Requests with :8080 in Host → redirect to :8443 (external)
- Requests without port → redirect without port, defaults to 443 (internal)

Tested:
- External: curl http://localhost:8080/health → https://localhost:8443/health ✓
- Internal: curl http://nginx_tls/health → https://nginx_tls/health (443) ✓

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Signed-off-by: hughhennnelly <hughhennelly06@gmail.com>
kcostell06 pushed a commit to kcostell06/mcp-context-forge that referenced this pull request Feb 24, 2026
@crivetimihai
feat(infra): zero-config TLS for Nginx via Docker Compose profile (IB…
e66d884 
…M#2579)

* feat(infra): add zero-config TLS for nginx via Docker Compose profile

Add a new `--profile tls` Docker Compose profile that enables HTTPS
with zero configuration. Certificates are auto-generated on first run
or users can provide their own CA-signed certificates.

Features:
- One command TLS: `make compose-tls` starts with HTTPS on port 8443
- Auto-generates self-signed certs if ./certs/ is empty
- Custom certs: place cert.pem/key.pem in ./certs/ before starting
- Optional HTTP->HTTPS redirect via `make compose-tls-https`
- Environment variable NGINX_FORCE_HTTPS=true for redirect mode
- Works alongside other profiles (monitoring, benchmark)

New files:
- infra/nginx/nginx-tls.conf: TLS-enabled nginx configuration
- infra/nginx/docker-entrypoint.sh: Handles NGINX_FORCE_HTTPS env var

New Makefile targets:
- compose-tls: Start with HTTP:8080 + HTTPS:8443
- compose-tls-https: Force HTTPS redirect (HTTP->HTTPS)
- compose-tls-down: Stop TLS stack
- compose-tls-logs: Tail TLS service logs
- compose-tls-ps: Show TLS stack status

Docker Compose additions:
- cert_init service: Auto-generates certs using alpine/openssl
- nginx_tls service: TLS-enabled nginx reverse proxy

Documentation:
- Updated tls-configuration.md with Quick Start section
- Updated compose.md with TLS section
- Added to deployment navigation
- Updated README.md quick start

Closes IBM#2571

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix(nginx): use smart port detection for HTTPS redirect

Fix hard-coded :8443 port in HTTPS redirect that broke internal
container-to-container calls.

Problem:
- External access via port 8080 correctly redirected to :8443
- Internal container calls (no port) also redirected to :8443
- But nginx_tls only listens on 443 internally, so internal redirects failed

Solution:
Add a map directive that detects request origin based on Host header:
- Requests with :8080 in Host → redirect to :8443 (external)
- Requests without port → redirect without port, defaults to 443 (internal)

Tested:
- External: curl http://localhost:8080/health → https://localhost:8443/health ✓
- Internal: curl http://nginx_tls/health → https://nginx_tls/health (443) ✓

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@crivetimihai crivetimihai

Labels

None yet

Projects

None yet

Milestone

Release 1.0.0-RC1

Development

Successfully merging this pull request may close these issues.

[FEATURE][INFRA]: Zero-config TLS for Nginx via Docker Compose profile

1 participant

@crivetimihai