github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: Enable HSTS by default

Browse Source 
This enables the HSTS header by default when an SSL certificate is in use. HSTS options can also be managed via the nginx:set command, which also exposes the ability to disable HSTS for your application.
This commit is contained in:
Jose Diaz-Gonzalez
2020-02-01 21:16:39 -05:00
parent d42fb02136
commit 73e7ff7b18
8 changed files with 151 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
plugins/nginx-vhosts/functions
View File

@@ -317,6 +317,7 @@ nginx_build_config() {
done
local PROXY_UPSTREAM_PORTS="$(echo "$PROXY_UPSTREAM_PORTS" | xargs)"
local SSL_INUSE=
local NONSSL_VHOSTS=$(get_app_domains "$APP")
local NOSSL_SERVER_NAME=$(echo "$NONSSL_VHOSTS" | xargs)
if is_ssl_enabled "$APP"; then
@@ -412,6 +413,8 @@ nginx_build_config() {
dokku_log_info1 "Creating $SCHEME nginx.conf"
mv "$NGINX_CONF" "$DOKKU_ROOT/$APP/nginx.conf"
fn-nginx-vhosts-manage-hsts "$APP" "$SSL_INUSE"
plugn trigger nginx-pre-reload "$APP" "$DOKKU_APP_LISTEN_PORT" "$DOKKU_APP_LISTEN_IP"
dokku_log_verbose "Reloading nginx"

3
plugins/nginx-vhosts/install
View File

@@ -2,9 +2,12 @@
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
source "$PLUGIN_AVAILABLE_PATH/config/functions"
source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
fn-plugin-property-setup "nginx"
NGINX_BIN="$(fn-nginx-vhosts-nginx-location)"
NGINX_ROOT="/etc/nginx"
NGINX_LOG_ROOT="/var/log/nginx"

36
plugins/nginx-vhosts/internal-functions
View File

@@ -37,6 +37,10 @@ cmd-nginx-report-single() {
local flag_map=(
"--nginx-bind-address-ipv4: $(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv4" "")"
"--nginx-bind-address-ipv6: $(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv6" "::")"
"--nginx-hsts: $(fn-plugin-property-get-default "nginx" "$APP" "hsts" "true")"
"--nginx-hsts-include-subdomains: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-include-subdomains" "true")"
"--nginx-hsts-max-age: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-max-age" "15724800")"
"--nginx-hsts-preload: $(fn-plugin-property-get-default "nginx" "$APP" "hsts-preload" "false")"
)
if [[ -z "$INFO_FLAG" ]]; then
@@ -65,6 +69,38 @@ cmd-nginx-report-single() {
fi
}
fn-nginx-vhosts-manage-hsts() {
declare APP="$1" SSL_ENABLED="$2"
local HSTS="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts" "true")"
local HSTS_INCLUDE_SUBDOMAINS="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts-include-subdomains" "true")"
local HSTS_MAX_AGE="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts-max-age" "15724800")"
local HSTS_PRELOAD="$(fn-plugin-property-get-default "nginx" "$APP" "nginx-hsts-preload" "false")"
local NGINX_HSTS_CONF="$DOKKU_ROOT/$APP/nginx.conf.d/hsts.conf"
local HSTS_TEMPLATE="$PLUGIN_AVAILABLE_PATH/nginx-vhosts/templates/hsts.conf.sigil"
if [[ "$HSTS" == "false" ]] || [[ "$SSL_ENABLED" != "true" ]]; then
rm -rf "NGINX_HSTS_CONF"
return
fi
dokku_log_verbose_quiet "Enabling HSTS"
local HSTS_HEADERS=""
if [[ -n "$HSTS_MAX_AGE" ]]; then
HSTS_HEADERS="max-age=$HSTS_MAX_AGE"
fi
if [[ "$HSTS_INCLUDE_SUBDOMAINS" == "true" ]]; then
HSTS_HEADERS+="; includeSubdomains"
fi
if [[ "$HSTS_PRELOAD" == "true" ]]; then
HSTS_HEADERS+="; preload"
fi
mkdir -p "$DOKKU_ROOT/$APP/nginx.conf.d"
sigil -f "$HSTS_TEMPLATE" HSTS_HEADERS="$HSTS_HEADERS" | cat -s >"$NGINX_HSTS_CONF"
}
fn-nginx-vhosts-uses-openresty() {
declare desc="returns whether openresty is in use or not"

4
plugins/nginx-vhosts/subcommands/set
View File

@@ -9,12 +9,12 @@ nginx-set-cmd() {
local cmd="nginx:set" argv=("$@")
[[ ${argv[0]} == "$cmd" ]] && shift 1
declare APP="$1" KEY="$2" VALUE="$3"
local VALID_KEYS=("bind-address-ipv4" "bind-address-ipv6")
local VALID_KEYS=("bind-address-ipv4" "bind-address-ipv6" "hsts" "hsts-include-subdomains" "hsts-preload" "hsts-max-age")
[[ -z "$APP" ]] && dokku_log_fail "Please specify an app to run the command on"
[[ -z "$KEY" ]] && dokku_log_fail "No key specified"
if ! fn-in-array "$KEY" "${VALID_KEYS[@]}"; then
dokku_log_fail "Invalid key specified, valid keys include: bind-address-ipv4, bind-address-ipv6"
dokku_log_fail "Invalid key specified, valid keys include: bind-address-ipv4, bind-address-ipv6, hsts, hsts-include-subdomains, hsts-preload, hsts-max-age"
fi
if [[ -n "$VALUE" ]]; then

1
plugins/nginx-vhosts/templates/hsts.conf.sigil Normal file
View File

@@ -0,0 +1 @@
add_header Strict-Transport-Security "{{ $.HSTS_HEADERS }}" always;