From e33f5c94a52bbab585f4c1f9f207148f05afea81 Mon Sep 17 00:00:00 2001 From: Stafford Brunk Date: Wed, 2 Apr 2014 14:29:36 -0600 Subject: [PATCH 1/7] Use listen 443 ssl instead of ssl on in vhost conf file --- plugins/nginx-vhosts/post-deploy | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy index 824eb6915..d897ac8a5 100755 --- a/plugins/nginx-vhosts/post-deploy +++ b/plugins/nginx-vhosts/post-deploy @@ -31,11 +31,10 @@ server { } server { - listen [::]:443; - listen 443; + listen [::]:443 ssl; + listen 443 ssl; server_name $hostname; - ssl on; ssl_certificate $SSL_INUSE/server.crt; ssl_certificate_key $SSL_INUSE/server.key; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA; From bd5b2b210c4c9a8c52d37e9c85106cfddc767984 Mon Sep 17 00:00:00 2001 From: Stafford Brunk Date: Wed, 2 Apr 2014 19:18:23 -0600 Subject: [PATCH 2/7] Factor common SSL settings out to the http block --- plugins/nginx-vhosts/install | 13 ++++++++++++- plugins/nginx-vhosts/post-deploy | 14 ++++++++------ 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index a62d4505a..3d4f91d05 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -14,8 +14,19 @@ if ! grep -q dokku-nginx-reload "/etc/sudoers"; then rm /tmp/sudoers.new fi -echo "include $DOKKU_ROOT/*/nginx.conf;" > /etc/nginx/conf.d/dokku.conf +cat< /etc/nginx/conf.d/dokku.conf +include $DOKKU_ROOT/*/nginx.conf; +ssl_session_cache shared:SSL:20m; +ssl_session_timeout 10m; + +ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA; +ssl_protocols TLSv1.2 TLSv1.1 TLSv1; +ssl_prefer_server_ciphers on; + +#ssl_certificate $DOKKU_ROOT/ssl/server.crt; +#ssl_certificate_key $DOKKU_ROOT/ssl/server.key; +EOF sed -i 's/# server_names_hash_bucket_size/server_names_hash_bucket_size/' /etc/nginx/nginx.conf if [[ ! -f "$DOKKU_ROOT/VHOST" ]]; then diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy index d897ac8a5..3b895883b 100755 --- a/plugins/nginx-vhosts/post-deploy +++ b/plugins/nginx-vhosts/post-deploy @@ -15,8 +15,14 @@ if [[ -f "$DOKKU_ROOT/VHOST" ]]; then if [[ -f "$SSL/server.crt" ]] && [[ -f "$SSL/server.key" ]]; then SSL_INUSE="$SSL" + SSL_DIRECTIVES=$(cat < Date: Thu, 3 Apr 2014 07:15:21 -0600 Subject: [PATCH 3/7] Allow symlinks for SSL cert detection in nginx-vhosts post-deploy --- plugins/nginx-vhosts/post-deploy | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy index 3b895883b..d9bf16432 100755 --- a/plugins/nginx-vhosts/post-deploy +++ b/plugins/nginx-vhosts/post-deploy @@ -13,14 +13,14 @@ if [[ -f "$DOKKU_ROOT/VHOST" ]]; then hostname="${APP/\//-}.$VHOST" fi - if [[ -f "$SSL/server.crt" ]] && [[ -f "$SSL/server.key" ]]; then + if [[ -e "$SSL/server.crt" ]] && [[ -e "$SSL/server.key" ]]; then SSL_INUSE="$SSL" SSL_DIRECTIVES=$(cat < Date: Thu, 3 Apr 2014 07:20:18 -0600 Subject: [PATCH 4/7] Implement nginx spdy support --- plugins/nginx-vhosts/post-deploy | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy index d9bf16432..b2eed1376 100755 --- a/plugins/nginx-vhosts/post-deploy +++ b/plugins/nginx-vhosts/post-deploy @@ -37,11 +37,13 @@ server { } server { - listen [::]:443 ssl; - listen 443 ssl; + listen [::]:443 ssl spdy; + listen 443 ssl spdy; server_name $hostname; $SSL_DIRECTIVES + keepalive_timeout 70; + add_header Alternate-Protocol 443:npn-spdy/2; location / { proxy_pass http://$APP; From 1d165413622093f5c516284f1935e9ccd037e5b1 Mon Sep 17 00:00:00 2001 From: Stafford Brunk Date: Thu, 3 Apr 2014 10:44:28 -0600 Subject: [PATCH 5/7] Update the TLS documentation for how to enable and for SPDY support --- README.md | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 0940a8a4e..31f26ce95 100644 --- a/README.md +++ b/README.md @@ -104,16 +104,29 @@ config:set KEY1=VALUE1 [KEY2=VALUE2 ...] - set one or more config vars config:unset KEY1 [KEY2 ...] - unset one or more config vars ``` -## TLS support +## TLS/SPDY support -Dokku provides easy TLS support from the box. This can be done app-by-app or for all subdomains at once. +Dokku provides easy TLS/SPDY support out of the box. This can be done app-by-app or for all subdomains at once. Note that whenever TLS support is enabled SPDY is also enabled. -* To enable TLS connection to to one of your applications, copy the `.crt` and `.key` files into the applications `/home/dokku/:app/ssl` folder (notice, file names should be `server.crt` and `server.key`, respectively). +### Per App -* To enable TLS connections for all your applications at once you will need a wildcard TLS certificate. To enable TLS across the server copy the `.crt` and `.key` files into the `/home/dokku/ssl` folder (notice, file names should be `server.crt` and `server.key`, respectively). **Note**: A global/wildcard TLS will not be applied unless the application's VHOST matches the certificate's name. (i.e. if you have a cert for *.example.com TLS won't be applied for something.example.org or example.net) +To enable TLS connection to to one of your applications, copy or symlink the `.crt`/`.pem` and `.key` files into the application's `/home/dokku/:app/ssl` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. Redeployment of the application will be needed to apply TLS configuration. Once it is redeployed, the application will be accessible by `https://` (redirection from `http://` is applied as well). +### All Subdomains + +To enable TLS connections for all your applications at once you will need a wildcard TLS certificate. + +To enable TLS across all apps, copy or symlink the `.crt`/`.pem` and `.key` files into the `/home/dokku/ssl` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. Then, enable the certificates by editing `/etc/nginx/conf.d/dokku.conf` and uncommenting these two lines (remove the #): + + ssl_certificate /home/dokku/ssl/server.crt; + ssl_certificate_key /home/dokku/ssl/server.key; + +The nginx configuration will need to be reloaded in order for the updated TLS configuration to be applied. This can be done either via the init system or by re-deploying the application. Once TLS is enabled, the application will be accessible by `https://` (redirection from `http://` is applied as well). + +**Note**: TLS will not be enabled unless the application's VHOST matches the certificate's name. (i.e. if you have a cert for *.example.com TLS won't be enabled for something.example.org or example.net) + ## Upgrading Dokku is in active development. You can update the deployment step and the build step separately. From e2135a2c5f599184ce1f40beb21fccb9a0f8b8de Mon Sep 17 00:00:00 2001 From: Stafford Brunk Date: Tue, 8 Apr 2014 06:48:50 -0600 Subject: [PATCH 6/7] Change cert folder name from ssl to tls --- README.md | 8 ++++---- plugins/nginx-vhosts/install | 4 ++-- plugins/nginx-vhosts/post-deploy | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 31f26ce95..81c941d61 100644 --- a/README.md +++ b/README.md @@ -110,7 +110,7 @@ Dokku provides easy TLS/SPDY support out of the box. This can be done app-by-app ### Per App -To enable TLS connection to to one of your applications, copy or symlink the `.crt`/`.pem` and `.key` files into the application's `/home/dokku/:app/ssl` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. +To enable TLS connection to to one of your applications, copy or symlink the `.crt`/`.pem` and `.key` files into the application's `/home/dokku/:app/tls` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. Redeployment of the application will be needed to apply TLS configuration. Once it is redeployed, the application will be accessible by `https://` (redirection from `http://` is applied as well). @@ -118,10 +118,10 @@ Redeployment of the application will be needed to apply TLS configuration. Once To enable TLS connections for all your applications at once you will need a wildcard TLS certificate. -To enable TLS across all apps, copy or symlink the `.crt`/`.pem` and `.key` files into the `/home/dokku/ssl` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. Then, enable the certificates by editing `/etc/nginx/conf.d/dokku.conf` and uncommenting these two lines (remove the #): +To enable TLS across all apps, copy or symlink the `.crt`/`.pem` and `.key` files into the `/home/dokku/tls` folder (create this folder if it doesn't exist) as `server.crt` and `server.key` respectively. Then, enable the certificates by editing `/etc/nginx/conf.d/dokku.conf` and uncommenting these two lines (remove the #): - ssl_certificate /home/dokku/ssl/server.crt; - ssl_certificate_key /home/dokku/ssl/server.key; + ssl_certificate /home/dokku/tls/server.crt; + ssl_certificate_key /home/dokku/tls/server.key; The nginx configuration will need to be reloaded in order for the updated TLS configuration to be applied. This can be done either via the init system or by re-deploying the application. Once TLS is enabled, the application will be accessible by `https://` (redirection from `http://` is applied as well). diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index 3d4f91d05..d21bdeac5 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -24,8 +24,8 @@ ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:A ssl_protocols TLSv1.2 TLSv1.1 TLSv1; ssl_prefer_server_ciphers on; -#ssl_certificate $DOKKU_ROOT/ssl/server.crt; -#ssl_certificate_key $DOKKU_ROOT/ssl/server.key; +#ssl_certificate $DOKKU_ROOT/tls/server.crt; +#ssl_certificate_key $DOKKU_ROOT/tls/server.key; EOF sed -i 's/# server_names_hash_bucket_size/server_names_hash_bucket_size/' /etc/nginx/nginx.conf diff --git a/plugins/nginx-vhosts/post-deploy b/plugins/nginx-vhosts/post-deploy index b2eed1376..be7fd2007 100755 --- a/plugins/nginx-vhosts/post-deploy +++ b/plugins/nginx-vhosts/post-deploy @@ -1,8 +1,8 @@ #!/usr/bin/env bash set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x APP="$1"; PORT="$2" -WILDCARD_SSL="$DOKKU_ROOT/ssl" -SSL="$DOKKU_ROOT/$APP/ssl" +WILDCARD_SSL="$DOKKU_ROOT/tls" +SSL="$DOKKU_ROOT/$APP/tls" if [[ -f "$DOKKU_ROOT/VHOST" ]]; then VHOST=$(< "$DOKKU_ROOT/VHOST") From 1d7422efb9991647059ba472126afacda343740f Mon Sep 17 00:00:00 2001 From: Stafford Brunk Date: Tue, 8 Apr 2014 06:53:30 -0600 Subject: [PATCH 7/7] Add note about HSTS header to README --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 81c941d61..fede724ba 100644 --- a/README.md +++ b/README.md @@ -127,6 +127,12 @@ The nginx configuration will need to be reloaded in order for the updated TLS co **Note**: TLS will not be enabled unless the application's VHOST matches the certificate's name. (i.e. if you have a cert for *.example.com TLS won't be enabled for something.example.org or example.net) +### HSTS Header + +The [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is an HTTP header that can inform browsers that all requests to a given site should be made via HTTPS. dokku does not, by default, enable this header. It is thus left up to you, the user, to enable it for your site. + +Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails. + ## Upgrading Dokku is in active development. You can update the deployment step and the build step separately.