|
| 1 | +# SSL/TLS Setup |
| 2 | +On this page the setup proces will be described howto setup SSL for Hashtopolis. Before you continue it is highly recommanded to read [Docker](docker.md). |
| 3 | + |
| 4 | +## Generate x509 Certificate |
| 5 | +First create a folder were we are going to store all of our hashtopolis persistent files. |
| 6 | + |
| 7 | +```bash |
| 8 | + |
| 9 | +mkdir hashtopolis/ |
| 10 | +cd hashtopolis/ |
| 11 | + |
| 12 | +``` |
| 13 | + |
| 14 | +Next generate a self signed certificate |
| 15 | + |
| 16 | +```bash |
| 17 | + |
| 18 | +openssl req -x509 -newkey rsa:2048 -keyout nginx.key -out nginx.crt -days 365 -nodes |
| 19 | + |
| 20 | +``` |
| 21 | + |
| 22 | +## Setting up docker-compose and env.example |
| 23 | + |
| 24 | +Please see the [Install](../install.md) page on how to download those settings file. |
| 25 | + |
| 26 | +1. Edit docker-compose.yaml |
| 27 | + |
| 28 | +Add the following new container to the `service:` section in the docker-compose.yaml. |
| 29 | + |
| 30 | +```json |
| 31 | + nginx: |
| 32 | + container_name: nginx |
| 33 | + image: nginx:latest |
| 34 | + restart: always |
| 35 | + volumes: |
| 36 | + - ./nginx.conf:/etc/nginx/nginx.conf:ro |
| 37 | + - ./nginx.crt:/etc/nginx/ssl/nginx.crt:ro |
| 38 | + - ./nginx.key:/etc/nginx/ssl/nginx.key:ro |
| 39 | + ports: |
| 40 | + - 443:443 |
| 41 | + - 80:80 |
| 42 | +``` |
| 43 | + |
| 44 | +2. Create a nginx.conf |
| 45 | + |
| 46 | +Make sure that the server_name reflects your real server name. If you have changed the container names inside your docker-compose file, make sure to reflect those changes inside the nginx.conf file below. |
| 47 | + |
| 48 | +``` |
| 49 | +events { |
| 50 | + worker_connections 1024; |
| 51 | +} |
| 52 | +
|
| 53 | +http { |
| 54 | + server { |
| 55 | + listen 80; |
| 56 | + server_name localhost; |
| 57 | + return 301 https://$host$request_uri; |
| 58 | + } |
| 59 | +
|
| 60 | +
|
| 61 | + server { |
| 62 | + listen 443 ssl; |
| 63 | + server_name localhost; |
| 64 | +
|
| 65 | + ssl_certificate /etc/nginx/ssl/nginx.crt; |
| 66 | + ssl_certificate_key /etc/nginx/ssl/nginx.key; |
| 67 | +
|
| 68 | + ssl_protocols TLSv1.2 TLSv1.3; |
| 69 | + ssl_prefer_server_ciphers on; |
| 70 | + ssl_ciphers HIGH:!aNULL:!MD5; |
| 71 | +
|
| 72 | + location / { |
| 73 | + proxy_pass http://hashtopolis-frontend; |
| 74 | + proxy_set_header Host $host; |
| 75 | + proxy_set_header X-Real-IP $remote_addr; |
| 76 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 77 | + proxy_set_header X-Forwarded-Proto $scheme; |
| 78 | + } |
| 79 | +
|
| 80 | + location /api/v2 { |
| 81 | + proxy_pass http://hashtopolis-backend:80/api/v2; |
| 82 | + proxy_set_header Host $host; |
| 83 | + proxy_set_header X-Real-IP $remote_addr; |
| 84 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 85 | + proxy_set_header X-Forwarded-Proto $scheme; |
| 86 | + } |
| 87 | + |
| 88 | + location /old { |
| 89 | + proxy_pass http://hashtopolis-backend/; |
| 90 | + proxy_set_header Host $host; |
| 91 | + proxy_set_header X-Real-IP $remote_addr; |
| 92 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 93 | + proxy_set_header X-Forwarded-Proto $scheme; |
| 94 | + } |
| 95 | + } |
| 96 | +} |
| 97 | +``` |
| 98 | + |
| 99 | +3. Edit the `HASHTOPOLIS_BACKEND_URL` in `.env` to `https://localhost/api/v2` to reflect the changes done above. |
| 100 | + |
| 101 | +4. Start the containers |
| 102 | +``` |
| 103 | +
|
| 104 | +docker compose up |
| 105 | +
|
| 106 | +``` |
| 107 | +5. Visit hashtopolis on http://localhost/ the old ui is available via http://localhost/old |
0 commit comments