Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use openssl #2

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

use openssl #2

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
747c625
use openssl
KoalaRong Sep 10, 2021
b6fc4fb
Update openssl3.0.0
KoalaRong Sep 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 6 additions & 24 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,21 +1,3 @@
FROM golang:alpine as boringssl_builder

RUN set -x \
# use tuna mirrors
&& sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories \
&& go env -w GO111MODULE=on \
&& go env -w GOPROXY=https://goproxy.cn,direct \
#use goproxy
&& apk add --no-cache --virtual .build-deps \
gcc libc-dev perl-dev git cmake make g++ libunwind-dev linux-headers musl-dev musl-utils \
&& mkdir -p /usr/local/src \
&& git clone https://github.com/google/boringssl.git /usr/local/src/boringssl \
&& cd /usr/local/src/boringssl \
&& mkdir build && cd build && cmake .. \
&& make -j$(getconf _NPROCESSORS_ONLN) && cd ../ \
&& mkdir -p .openssl/lib && cd .openssl && ln -s ../include . && cd ../ \
&& cp build/crypto/libcrypto.a build/ssl/libssl.a .openssl/lib

FROM alpine:latest as nginx_builder

ENV NGINX_VERSION 1.21.2
Expand All @@ -24,8 +6,6 @@ ENV NGINX_VERSION 1.21.2
WORKDIR /usr/local/src
COPY ./patch ./patch

COPY --from=boringssl_builder /usr/local/src/boringssl ./boringssl

RUN set -x \
# use tuna mirrors
&& sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories \
Expand Down Expand Up @@ -59,14 +39,16 @@ RUN set -x \
&& wget https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz \
&& tar -zxC /usr/local/src -f nginx-$NGINX_VERSION.tar.gz \
&& rm nginx-$NGINX_VERSION.tar.gz \
&& wget https://www.openssl.org/source/openssl-3.0.0.tar.gz \
&& tar -xzC /usr/local/src -f openssl-3.0.0.tar.gz \
&& rm -f openssl-3.0.0.tar.gz \
# ngx_brotli
&& git clone https://github.com/google/ngx_brotli.git /usr/local/src/ngx_brotli \
&& cd /usr/local/src/ngx_brotli \
&& git submodule update --init \
# make nginx
&& cd /usr/local/src/nginx-$NGINX_VERSION \
&& patch -p1 < /usr/local/src/patch/nginx.patch \
&& patch -p1 < /usr/local/src/patch/Enable_BoringSSL_OCSP.patch \
&& ./configure \
--prefix=/etc/nginx \
--sbin-path=/usr/sbin/nginx \
Expand Down Expand Up @@ -116,12 +98,12 @@ RUN set -x \
--with-stream_realip_module \
--with-stream_geoip_module=dynamic \
--with-pcre-jit \
--with-openssl=/usr/local/src/boringssl/ \
--with-openssl-opt='zlib enable-weak-ssl-ciphers enable-ec_nistp_64_gcc_128 -march=native -Wl,-flto' \
--with-openssl=/usr/local/src/openssl-3.0.0/ \
--with-openssl-opt='zlib -march=native -Wl,-flto' \
--with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC -lrt ' \
--with-cc-opt='-m64 -O3 -g -DTCP_FASTOPEN=23 -ffast-math -march=native -flto -fstack-protector-strong -fomit-frame-pointer -fPIC -Wformat -Wdate-time -D_FORTIFY_SOURCE=2 ' \
--add-module=/usr/local/src/ngx_brotli \
&& touch /usr/local/src/boringssl/.openssl/include/openssl/ssl.h \
#&& touch /usr/local/src/boringssl/.openssl/include/openssl/ssl.h \
&& make -j$(getconf _NPROCESSORS_ONLN) \
&& make install \
&& rm -rf /etc/nginx/html/ \
Expand Down