Nginx SSL

Nov 2, 2020 19:48 · 406 words · 2 minute read

Setup Nginx with SSL

Requirements

  • nginx
  • certbot
  • valid domain
  • Helloworld wsgi app deployed in /srv/helloworld
  • Assuming Helloworld was started using gunicorn server.

Nginx base config

# hello-nginx.conf

# Add this block to block all not existing config reqs
server {
    listen      80 default_server;
    listen      [::]:80 default_server;
    server_name "";
    return      444;
}
# End of block

upstream app_server {
  # fail_timeout=0 means we always retry an upstream even if it failed
  # to return a good HTTP response (in case the Unicorn master nukes a
  # single worker for timing out).

  server unix:/tmp/gunicorn.sock fail_timeout=0;
}

server {
    server_name hello.example.com www.hello.example.com;

    client_max_body_size 1M;

    if ($host != hello.example.com) {
        return 404;
    }

#    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
#        expires 365d;
#    }

    location /static/ {
        alias  /srv/helloworld/static/;
        access_log off;
        expires 1M;
        add_header Cache-Control "public";
    }

    location / {
        # an HTTP header important enough to have its own Wikipedia entry:
        #   http://en.wikipedia.org/wiki/X-Forwarded-For
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # enable this if and only if you use HTTPS, this helps Rack
        # set the proper protocol for doing redirects:
        # proxy_set_header X-Forwarded-Proto https;

        # pass the Host: header from the client right along so redirects
        # can be set properly within the Rack application
        proxy_set_header Host $http_host;

        # we don't want nginx trying to do something clever with
        # redirects, we set the Host: header above already.
        proxy_redirect off;

        # set "proxy_buffering off" *only* for Rainbows! when doing
        # Comet/long-poll stuff.  It's also safe to set if you're
        # using only serving fast clients with Unicorn + nginx.
        # Otherwise you _want_ nginx to buffer responses to slow
        # clients, really.
        # proxy_buffering off;

        # Try to serve static files from nginx, no point in making an
        # *application* server like Unicorn/Rainbows! serve static files.
        if (!-f $request_filename) {
            proxy_pass http://app_server;
            break;
        }
    }

    # Error pages
    error_page 500 502 503 504 /500.html;
    location = /500.html {
        root /srv/helloworld/static/;
    }
}

Nginx SSL Setup

# Install nginx & certbot
$ sudo apt install -y nginx certbot python3-certbot-nginx

# Disable default nginx page
$ sudo unlink /etc/nginx/sites-enabled/default

# Copy our hello world app's nginx config
$ sudo cp hello-nginx.conf /etc/nginx/sites-enabled/hello.example.com

# Check for any config errors
$ sudo nginx -t

# Restart nginx confi
$ sudo systemctl reload nginx

# Install & Verify deployed certificate
# enable http in firewall to verify the cert
# before this updated dns record to point to this server
$ sudo certbot --nginx -d hello.example.com --email mydemo@gmail.com