HTTPS support for the web API

[tsibley]

We'll need the web API to be available over HTTPS (with a browser-trusted cert) so that our HTTPS-only site seattleflu.org can make successful cross-origin requests for viz.

I ran into this last night while prototyping viz for https://seattleflu.org/current on a dev server that wasn't localhost. While the model web API allows cross-origin requests, the browser denies cross-origin requests of any kind from an HTTPS origin to an HTTP origin by preventing the CORS preflight request.¹

There is no rush on this, as our viz isn't ready to deploy to production yet and this issue doesn't block (most) dev. That said, getting that viz into production is a priority for the next couple weeks and HTTPS support for the model web API is a blocker to that.

¹ See the second "possible cause" on this doc page.

[famulare]

@devclinton @tsibley We can do this. Also, we'd like to set up seattleflu.org domain name for the API service instead of just a naked IP address. I'm not sure if that would prove to be related.

[tsibley]

Thanks! A verifiable certificate will require a domain name, so might as well make it a seattleflu.org one. I have control over DNS and can add a subdomain for you if you give me details. (We could also have the existing seattleflu.org web server proxy requests to your backend if you'd rather requests be on seattleflu.org under some path.)

[devclinton]

What details do you need @tsibley ? I should be able to provide those to you.

[tsibley]

@devclinton Wasn't sure if you wanted an A record or a delegation of a subzone to your own DNS servers. Happy to just do an A for now, in which case just need:

1. Subdomain or subpath you want
2. Confirmation that IP address is 40.112.165.255 (unless you wanted a CNAME/ALIAS record for some internal hostname?)

[devclinton]

Sorry I needed to confirm the IP. The IP you have is correct. I think the domain is up for discussion. I would think we could do incidencemapper.seattleflu.com . I am not very opinionated there. I think that name would most likely me the most descriptive and clearly tie this project to domain.

[tsibley]

incidence-mapper.seattleflu.org now resolves to that IP.

[devclinton]

Do you have a site-wide cert or a subdomain cert you can send me so I can update my nginx configuration? I can try to go the free route, but usually you need the ownership of root domain for that so I am thinking I will need to be provided one

[tsibley]

We use the excellent Let's Encrypt for seattleflu.org and backoffice.seattleflu.org. Heroku handles the interaction with Let's Encrypt for the former, and we have an automated Let's Encrypt client, Certbot, configured for the latter. I don't have a wildcard cert on hand, although might be able to obtain one.

Let's Encrypt doesn't require ownership, only the co-operation of the owner, which you have from me. :-) So you should be able to setup Certbot for incidence-mapper.seattleflu.org which automates against your nginx infrastructure. This would be my preferred approach rather than maintaining a wildcard cert since that will require us to coordinate renewals (which are frequent).

[devclinton]

Awesome! I already have a Let's encrypt docker solution ready to go for this that should need minimal configuration for our existing deployment. I should finish that by EOD today. I will update ticket once done and close ticket.

[devclinton]

SSL should be enabled. I am waiting on port to be open by IT team. Sorry for delay