enabling https for the server

[lisachev]

I've spent some time to configure https for the server, so decided to put down a post. For many it might be obvious, but for some this might be helpful.

Athens https server setup

Overview

This setup is done on a Ubuntu server in Azure cloud. I've chosen to run Athens server as a set of docker container services that will provide http connectivity to the web client as well as http-based connectivity for the Athens application. Installation details from the Athens team can be found here https://athensresearch.github.io/docs/developer_guide/self-hosted#docker

To upgrade it to https you will need

1. a domain you control to be able to issue a certificate for a server
2. a server (Amazon, Digital Ocean, Azure, any other)
3. Ability to install nginx on that server
4. Ability to install certbot/setup certificates and https your own way
5. Configure nginx forward https requests to local websocket

Steps

nginx in docker container?

We will be using nginx outside of containers. This will allow to control the webserver aside from the Athens server. First of all, lets make sure that docker-compose up --detach will not start nginx. This will allow us to use all the commands provided in the setup procedures by the Athens team (https://athensresearch.github.io/docs/developer_guide/self-hosted#docker) during further updates/upgrades without any modifications to the downloaded docker-compose.yml. To achieve this you need to create an override file docker-compose.override.yml with the following content:

version: "3.8"
services:
	nginx:
		image: nginx:latest
		restart: always
		profiles: ["nginx"]
		ports:
			- 80:80
			- 443:443

The key here is the profiles line as it forces docker-compose up command to ignore the nginx service unless the specific profile is called. This way the original nginx section of docker-compose.yml is overriden by a profiled section, that is excluded from a 'normal' start.

Ubuntu nginx installation

sudo apt update
sudo apt install nginx

You have now nginx installed on your server but not ready to serve web pages. you have to start the nginx. You can do this by using this command:

sudo systemctl start nginx

This will start a default nginx configuration. Good time to make a test connection and see if web pages are served.

certbot installation and configuration

To serve https traffic you will need to install a SSL certificate. The easiest way to do it is by using Let's Encrypt certificate authority that provides free SSL certificates.
First, install the Let's encrypt client, called certbot

sudo apt update
sudo apt install certbot
sudo apt install python3-certbot-nginx

Then start a wizard that will lead you through the setup

sudo certbot --nginx

nginx configuration

nginx configuration is based on the config file that Athens team provides in the https://github.com/athensresearch/athens/blob/main/nginx.conf
I've made nginx forward all insecure http connections to https and moved the actual Athens serving setup under https. With this setup the http connection will proxy websocket to localhost:3010. Substitute athens.webserver.com with your server name and make sure that the certificate paths are correct.

events {}
http {
	map $http_upgrade $connection_upgrade {
		default upgrade;
		'' close;
		}
	upstream websocket {
		server localhost:3010; # Change the port based on config.edn
		}
	server {
		listen 80;
		server_name _;
		return 301 https://$host$request_uri;
		}
	server {
		listen 443 ssl;
		server_name athens.webserver.com;
		# SSL code
		ssl_certificate /etc/nginx/ssl/live/athens.webserver.com/fullchain.pem;
		ssl_certificate_key /etc/nginx/ssl/live/athens.webserver.com/privkey.pem;
		location / {
			proxy_pass http://websocket;
			proxy_http_version 1.1;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
			proxy_set_header Host $host;
			proxy_connect_timeout 7d;
			proxy_send_timeout 7d;
			proxy_read_timeout 7d;
			}
		}
	}

Connecting to the server

With this setup you can connect to the server either via web client, pointing it to https://athens.webserver.com, or via the Athens client via Add database dialog, by selecting Join remote tab, giving this database any name you like and putting https://athens.webserver.com in the Remote address field.

[brandonkal]

Thank you for this. The documentation appeared to suggest https was not possible: https://athensresearch.github.io/docs/developer_guide/self-hosted#cannot-connect-to-athens-via-https

So now I can go ahead and set this up.