From 79935da2702d1ee403451cc22d18bbc82d5766ee Mon Sep 17 00:00:00 2001
From: "oleg.vodyanov91@gmail.com" <o.vodianov@hh.ru>
Date: Sun, 13 Apr 2025 00:48:00 +0400
Subject: [PATCH] add ssl

---
 Dockerfile.app                            |  1 +
 nginx/etc/nginx/sites-available/default   | 14 ++++++++++++--
 nginx/etc/nginx/snippets/self-signed.conf |  2 ++
 nginx/etc/nginx/snippets/ssl-params.conf  | 21 +++++++++++++++++++++
 running.sh                                |  5 ++++-
 5 files changed, 40 insertions(+), 3 deletions(-)
 create mode 100644 nginx/etc/nginx/snippets/self-signed.conf
 create mode 100644 nginx/etc/nginx/snippets/ssl-params.conf

diff --git a/Dockerfile.app b/Dockerfile.app
index a538cb5..77830e9 100644
--- a/Dockerfile.app
+++ b/Dockerfile.app
@@ -16,6 +16,7 @@ RUN pip install --no-cache-dir -r requirements.txt && \
 COPY instalinks/ /app/
 COPY static /app/static
 COPY nginx/etc/nginx/sites-available /etc/nginx/sites-available
+COPY nginx/etc/nginx/snippets /etc/nginx/snippets
 COPY running.sh /app/
 COPY manage.py /app/
 
diff --git a/nginx/etc/nginx/sites-available/default b/nginx/etc/nginx/sites-available/default
index c43ce34..2b64d96 100644
--- a/nginx/etc/nginx/sites-available/default
+++ b/nginx/etc/nginx/sites-available/default
@@ -1,6 +1,16 @@
 server {
-    listen 8080;
-    server_name myinstalinks.ru;
+    listen 8080 default_server;
+    listen [::]:8080 default_server;
+    server_name myinstalink.ru;
+    return 302 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
+    include snippets/self-signed.conf;
+    include snippets/ssl-params.conf;
+
     access_log  /var/log/nginx/instalinks-acces.log;
     error_log /var/log/nginx/instalinks-error.log;
 
diff --git a/nginx/etc/nginx/snippets/self-signed.conf b/nginx/etc/nginx/snippets/self-signed.conf
new file mode 100644
index 0000000..39332d7
--- /dev/null
+++ b/nginx/etc/nginx/snippets/self-signed.conf
@@ -0,0 +1,2 @@
+ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
+ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
\ No newline at end of file
diff --git a/nginx/etc/nginx/snippets/ssl-params.conf b/nginx/etc/nginx/snippets/ssl-params.conf
new file mode 100644
index 0000000..42e50b2
--- /dev/null
+++ b/nginx/etc/nginx/snippets/ssl-params.conf
@@ -0,0 +1,21 @@
+# from https://cipherli.st/
+# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+ssl_ecdh_curve secp384r1;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver 8.8.8.8 8.8.4.4 valid=300s;
+resolver_timeout 5s;
+# Disable preloading HSTS for now.  You can use the commented out header line that includes
+# the "preload" directive if you understand the implications.
+#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+
+ssl_dhparam /etc/ssl/certs/dhparam.pem;
\ No newline at end of file
diff --git a/running.sh b/running.sh
index 8c2d6ad..a923484 100755
--- a/running.sh
+++ b/running.sh
@@ -1,3 +1,6 @@
 #!/usr/bin/env bash
 
-python manage.py collectstatic && service nginx start && gunicorn wsgi:application
\ No newline at end of file
+python manage.py collectstatic && \
+    service nginx start && \
+    python manage.py migrate && \
+    gunicorn wsgi:application
\ No newline at end of file