Verifying the Nginx Service and Cleaning Up

NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS nginx.1.9ls3yo9ugcls nginx:latest moby Running Running 3 minutes ago ``` 5. Verify that the service is operational: you can reach the Nginx server, and that the correct TLS certificate is being used. ```console $ curl --cacert root-ca.crt https://localhost:3000 <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } </style> </head> <body> <h1>Welcome to nginx!</h1> <p>If you see this page, the nginx web server is successfully installed and working. Further configuration is required.</p> <p>For online documentation and support. refer to <a href="https://nginx.org">nginx.org</a>.<br/> Commercial support is available at <a href="https://www.nginx.com">nginx.com</a>.</p> <p><em>Thank you for using nginx.</em></p> </body> </html> ``` ```console $ openssl s_client -connect localhost:3000 -CAfile root-ca.crt CONNECTED(00000003) depth=1 /C=US/ST=CA/L=San Francisco/O=Docker/CN=Swarm Secret Example CA verify return:1 depth=0 /C=US/ST=CA/L=San Francisco/O=Docker/CN=localhost verify return:1 --- Certificate chain 0 s:/C=US/ST=CA/L=San Francisco/O=Docker/CN=localhost i:/C=US/ST=CA/L=San Francisco/O=Docker/CN=Swarm Secret Example CA --- Server certificate -----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- subject=/C=US/ST=CA/L=San Francisco/O=Docker/CN=localhost issuer=/C=US/ST=CA/L=San Francisco/O=Docker/CN=Swarm Secret Example CA --- No client certificate CA names sent --- SSL handshake has read 1663 bytes and written 712 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: A1A8BF35549C5715648A12FD7B7E3D861539316B03440187D9DA6C2E48822853 Session-ID-ctx: Master-Key: F39D1B12274BA16D3A906F390A61438221E381952E9E1E05D3DD784F0135FB81353DA38C6D5C021CB926E844DFC49FC4 Key-Arg : None Start Time: 1481685096 Timeout : 300 (sec) Verify return code: 0 (ok) ``` 6. To clean up after running this example, remove the `nginx` service and the stored secrets. ```console $ docker service rm nginx $ docker secret rm site.crt site.key site.conf ``` ### Advanced example: Use secrets with a WordPress service In this example, you create a single-node MySQL service with a custom root password, add the credentials as secrets, and create a single-node WordPress service which uses these credentials to connect to MySQL. The [next example](#example-rotate-a-secret) builds on this one and shows you how to rotate the MySQL password and update the services so that the WordPress service can still connect to MySQL. This example illustrates some techniques to use Docker secrets to avoid saving sensitive credentials within your image or passing them directly on the command line. > [!NOTE] > > This example uses a single-Engine swarm for simplicity, and uses a > single-node MySQL service because a single MySQL server instance cannot be > scaled by simply using a replicated service, and setting up a MySQL cluster is > beyond the scope of this example. > > Also, changing a MySQL root passphrase isn’t as simple as changing > a file on disk. You must use a query or a `mysqladmin` command to change the > password in MySQL. 1. Generate a random alphanumeric password for MySQL and store it as a Docker secret with the name `mysql_password` using the `docker secret create` command. To make the password shorter or longer, adjust the last argument of

This section describes how to verify that the Nginx service is operational by checking if the Nginx server is reachable and the correct TLS certificate is being used, with example commands using `curl` and `openssl`. It also provides instructions on cleaning up by removing the created Nginx service and the stored secrets using `docker service rm` and `docker secret rm` commands. The document then transitions to a more complex example involving a WordPress service connected to a single-node MySQL service, demonstrating how to use Docker secrets to securely manage database credentials and avoid embedding them in images or passing them directly as command-line arguments.