instruction: Create a Dockerfile for Nginx with production best practices
output: ```dockerfile
  from the first step.Remove the service and the secret.
  
  > docker service rm my-iis
  > docker secret rm homepage
  > docker image remove secret-test
  Intermediate example: Use secrets with a Nginx serviceThis example is divided into two parts.
  The first part is all about generating
  the site certificate and does not directly involve Docker secrets at all, but
  it sets up the second part, where you store
  and use the site certificate and Nginx configuration as secrets.Generate the site certificateGenerate a root CA and TLS certificate and key for your site. For production
  sites, you may want to use a service such as Letâs Encrypt to generate the
  TLS certificate and key, but this example uses command-line tools. This step
  is a little complicated, but is only a set-up step so that you have
  something to store as a Docker secret. If you want to skip these sub-steps,
  you can use Let's Encrypt to
  generate the site key and certificate, name the files site.key and
  site.crt, and skip to
  Configure the Nginx container.Generate a root key.
  
  $ openssl genrsa -out "root-ca.key" 4096
  Generate a CSR using the root key.
  
  $ openssl req \
   -new -key "root-ca.key" \
   -out "root-ca.csr" -sha256 \
   -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=Swarm Secret Example CA'
  Configure the root CA. Edit a new file called root-ca.cnf and paste
  the following contents into it. This constrains the root CA to signing leaf
  certificates and not intermediate CAs.
  
  [root_ca]
  basicConstraints = critical,CA:TRUE,pathlen:1
  keyUsage = critical, nonRepudiation, cRLSign, keyCertSign
  subjectKeyIdentifier=hashSign the certificate.
  
  $ openssl x509 -req -days 3650 -in "root-ca.csr" \
   -signkey "root-ca.key" -sha256 -out "root-ca.crt" \
   -extfile "root-ca.cnf" -extensions \
   root_ca
  Generate the site key.
  
  $ openssl genrsa -out "site.key" 4096
  Generate the site certificate and sign it with the site key.
  
  $ openssl req -new -key "site.key" -out "site.csr" -sha256 \
   -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=localhost'
  Configure the site certificate. Edit a new file called site.cnf and
  paste the following contents into it. This constrains the site
  certificate so that it can only be used to authenticate a server and
  can't be used to sign certificates.
  
  [server]
  authorityKeyIdentifier=keyid,issuer
  basicConstraints = critical,CA:FALSE
  extendedKeyUsage=serverAuth
  keyUsage = critical, digitalSignature, keyEncipherment
  subjectAltName = DNS:localhost, IP:127.0.0.1
  subjectKeyIdentifier=hashSign the site certificate.
  
  $ openssl x509 -req -days 750 -in "site.csr" -sha256 \
   -CA "root-ca.crt" -CAkey "root-ca.key" -CAcreateserial \
   -out "site.crt" -extfile "site.cnf" -extensions server
  The site.csr and site.cnf files are not needed by the Nginx service, but
  you need them if you want to generate a new site certificate. Protect
  the root-ca.key file.Configure the Nginx containerProduce a very basic Nginx configuration that serves static files over HTTPS.
  The TLS certificate and key are stored as Docker secrets so that they
  can be rotated easily.In the current directory, create a new file called site.conf with the
  following contents:
  
  server {
   listen 443 ssl;
   server_name localhost;
   ssl_certificate /run/secrets/site.crt;
   ssl_certificate_key /run/secrets/site.key;
  
   location / {
   root /usr/share/nginx/html;
   index index.html index.htm;
   }
  }Create three secrets, representing the key, the certificate, and the
  site.conf. You can store any file as a secret as long as it is smaller
  than 500 KB. This allows you to decouple the key, certificate, and
  configuration
  ```