تنظیمات ssl روی Nginx

برای اینکه سرویس از https استفاده کند باید چند کار انجام دهیم.

1.فایل های certificate را در سرور بسازیم

2.درخواستهای http را به https ارجاع دهیم

3.تنظیمات https را در nginx تنظیم کنیم

4.در برنامه هرجا لازم است تغییراتی انجام میدهیم مثلا اگر تا الان از وب سوکت ws استفاده میشده باید الان از wss استفاده شود.

حواسمون باشه فایل های cert و key کلیدها باید با رشته های زیر تعریف شوند:

-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----


-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

برای این تنظیمات در داکری که یه سری سرویس دارد از تنظیمات زیر استفاده میکنیم:

nginx.conf

events {
  worker_connections 1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;
  sendfile        on;
  keepalive_timeout  65;
  client_header_timeout 600s;
  client_body_timeout 600s;
  send_timeout 600s;

  client_max_body_size 50M;

  proxy_buffers 4 256k;
  proxy_buffer_size 256k;
  proxy_busy_buffers_size 256k;

  client_header_buffer_size 512k;
  large_client_header_buffers 4 256k;

  proxy_connect_timeout 600s;
  proxy_read_timeout 600s;
  proxy_send_timeout 600s;

  #HTTP server Block
  server {
    listen 80;
    server_name hivadar.ir;

    # Redirect HTTP to HTTPS
    location / {
      return 301 https://$host$request_uri;
    }
  }

  #HTTPS Server
  server {
    listen 443 ssl;
    server_name hivadar.ir;

    # SSL Configuration
    ssl_certificate /etc/nginx/server.crt;
    ssl_certificate_key /etc/nginx/server.key;

    # Strong SSL protocols and ciphers
#    ssl_protocols TLSv1.2 TLSv1.3;
#    ssl_prefer_server_ciphers on;
#    ssl_ciphers HIGH:!aNULL:!MD5;

    # HSTS (optional): Forces HTTPS for future requests
#    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;


    location / {
      proxy_pass http://uwsgi-container:8000;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /ws/ {
      proxy_pass http://daphne-container:8001;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /static/ {
      alias /static/;
    }
  }
}

events {

worker_connections 1024;

}

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

sendfile on;

keepalive_timeout 65;

client_header_timeout 600s;

client_body_timeout 600s;

send_timeout 600s;

client_max_body_size 50M;

proxy_buffers 4 256k;

proxy_buffer_size 256k;

proxy_busy_buffers_size 256k;

client_header_buffer_size 512k;

large_client_header_buffers 4 256k;

proxy_connect_timeout 600s;

proxy_read_timeout 600s;

proxy_send_timeout 600s;

#HTTP server Block

server {

listen 80;

server_name hivadar.ir;

# Redirect HTTP to HTTPS

location / {

return 301 https://$host$request_uri;

}

#HTTPS Server

server {

listen 443 ssl;

server_name hivadar.ir;

# SSL Configuration

ssl_certificate /etc/nginx/server.crt;

ssl_certificate_key /etc/nginx/server.key;

# Strong SSL protocols and ciphers

# ssl_protocols TLSv1.2 TLSv1.3;

# ssl_prefer_server_ciphers on;

# ssl_ciphers HIGH:!aNULL:!MD5;

# HSTS (optional): Forces HTTPS for future requests

# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

location / {

proxy_pass http://uwsgi-container:8000;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

location /ws/ {

proxy_pass http://daphne-container:8001;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection "upgrade";

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

location /static/ {

alias /static/;

}

فایل compose داکر

version: '3.8'

services:
    uwsgi-container:
        image: nasimproject-nasim:latest
        #build:
        #    context: .
        #    dockerfile: ...
        hostname: nasim
        container_name: nasim
        volumes:
            - ./app:/opt/app
            - ./data:/opt/data
        expose:
            - "8000"
        environment:
            - DJANGO_SETTINGS_MODULE=core.settings
        command: >
            uwsgi --http 0.0.0.0:8000 --module core.wsgi:application --master --processes 4 --threads 4 --buffer-size 163840 --http-timeout 300 --harakiri 300
    daphne:
            #image: project-daphne:latest
        build:
            context: .
            dockerfile: ...
        hostname: daphne
        container_name: daphne
        volumes:
            - ./app:/opt/app
            - ./data:/opt/data
        expose:
            - "8001"
        environment:
            - DJANGO_SETTINGS_MODULE=core.settings
    nginx:
        image: project-nginx:latest
        #build:
        #    context: .
        #    dockerfile: ...
        hostname: nginx
        container_name: nginx
        ports:
            - "80:80"
            - "443:443"
        depends_on:
            - uwsgi-container
            - daphne
        volumes:
            - ./app/static:/static
            - ./nginx/nginx.conf:/etc/nginx/nginx.conf
            - ./nginx/certs/server.crt:/etc/nginx/server.crt
            - ./nginx/certs/server.key:/etc/nginx/server.key
    rabbit:
        hostname: rabbit
        container_name: rabbit
        image: rabbitmq:3-management
        environment:
            - RABBITMQ_DEFAULT_USER=...
            - RABBITMQ_DEFAULT_PASS=...
        ports:
            - "5672:5672"
            - "15672:15672"
    celery:
        build:
            context: .
            dockerfile: DockerfileCelery
        hostname: celery
        container_name: celery
        volumes:
            - ./app:/opt/app
    beat:
        build:
            context: .
            dockerfile: DockerfileBeat
        hostname: beat
        container_name: beat
        volumes:
            - ./app:/opt/app

version: '3.8'

services:

uwsgi-container:

image: nasimproject-nasim:latest

#build:

# context: .

# dockerfile: ...

hostname: nasim

container_name: nasim

volumes:

- ./app:/opt/app

- ./data:/opt/data

expose:

- "8000"

environment:

- DJANGO_SETTINGS_MODULE=core.settings

command: >

uwsgi --http 0.0.0.0:8000 --module core.wsgi:application --master --processes 4 --threads 4 --buffer-size 163840 --http-timeout 300 --harakiri 300

daphne:

#image: project-daphne:latest

build:

context: .

dockerfile: ...

hostname: daphne

container_name: daphne

volumes:

- ./app:/opt/app

- ./data:/opt/data

expose:

- "8001"

environment:

- DJANGO_SETTINGS_MODULE=core.settings

nginx:

image: project-nginx:latest

#build:

# context: .

# dockerfile: ...

hostname: nginx

container_name: nginx

ports:

- "80:80"

- "443:443"

depends_on:

- uwsgi-container

- daphne

volumes:

- ./app/static:/static

- ./nginx/nginx.conf:/etc/nginx/nginx.conf

- ./nginx/certs/server.crt:/etc/nginx/server.crt

- ./nginx/certs/server.key:/etc/nginx/server.key

rabbit:

hostname: rabbit

container_name: rabbit

image: rabbitmq:3-management

environment:

- RABBITMQ_DEFAULT_USER=...

- RABBITMQ_DEFAULT_PASS=...

ports:

- "5672:5672"

- "15672:15672"

celery:

build:

context: .

dockerfile: DockerfileCelery

hostname: celery

container_name: celery

volumes:

- ./app:/opt/app

beat:

build:

context: .

dockerfile: DockerfileBeat

hostname: beat

container_name: beat

volumes:

- ./app:/opt/app

دیدگاهتان را بنویسید لغو پاسخ