WIP - Add automatic self signed SSL by default to setup

setup/docker-compose.yml

@@ -44,7 +44,11 @@ services:
   nginx:
     image: redash/nginx:latest
     ports:
+      - "443:443"
       - "80:80"
+    volumes:
+      - ./ssl/nginx.conf:/etc/nginx/conf.d/default.conf
+      - ./ssl:/etc/nginx/ssl
     depends_on:
       - server
     links:

setup/ssl/.gitignore

@@ -0,0 +1,3 @@
+**.crt
+**.key
+**.pem

setup/ssl/README.md

@@ -0,0 +1,3 @@
+- Run the generate self signed certificate bash script
+- docker-compose up --build (you may need to remove old docker images)
+

setup/ssl/generate_self_signed.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.key -out server.crt
+openssl dhparam -out dhparam.pem 2048

setup/ssl/nginx.conf

@@ -0,0 +1,46 @@
+upstream redash {
+  server redash:5000;
+}
+
+server {
+  listen   80 default;
+
+  gzip on;
+  gzip_types *;
+  gzip_proxied any;
+
+  location /ping {
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+
+    proxy_pass       http://redash;
+  }
+
+  location / { 
+	  return 301 https://$host$request_uri;
+  }
+}
+
+server{
+	listen 443 ssl http2 default_server;
+	listen [::]:443 ssl http2 default_server;
+	include ssl/self-signed.conf;
+	include ssl/ssl-params.conf;
+	access_log /var/log/nginx/redash.access.log;
+
+	gzip on;
+	gzip_types *;
+	gzip_proxied any;
+
+  location /{
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+
+    proxy_pass       http://redash;
+  }
+}
+

setup/ssl/self-signed.conf

@@ -0,0 +1,2 @@
+ssl_certificate /etc/nginx/ssl/server.crt;
+ssl_certificate_key /etc/nginx/ssl/server.key;

setup/ssl/ssl-params.conf

@@ -0,0 +1,21 @@
+# from https://cipherli.st/
+# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+ssl_ecdh_curve secp384r1;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver 8.8.8.8 8.8.4.4 valid=300s;
+resolver_timeout 5s;
+# Disable preloading HSTS for now.  You can use the commented out header line that includes
+# the "preload" directive if you understand the implications.
+#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+
+ssl_dhparam /etc/nginx/ssl/dhparam.pem;