Merge pull request #4 from olegvodyanov/add_ssl

add ssl

Dockerfile.app

@@ -16,6 +16,7 @@ RUN pip install --no-cache-dir -r requirements.txt && \
 COPY instalinks/ /app/
 COPY static /app/static
 COPY nginx/etc/nginx/sites-available /etc/nginx/sites-available
+COPY nginx/etc/nginx/snippets /etc/nginx/snippets
 COPY running.sh /app/
 COPY manage.py /app/
 

nginx/etc/nginx/sites-available/default

@@ -1,6 +1,16 @@
 server {
-    listen 8080;
+    listen 8080 default_server;
-    server_name myinstalinks.ru;
+    listen [::]:8080 default_server;
+    server_name myinstalink.ru;
+    return 302 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
+    include snippets/self-signed.conf;
+    include snippets/ssl-params.conf;
+
     access_log  /var/log/nginx/instalinks-acces.log;
     error_log /var/log/nginx/instalinks-error.log;
 

nginx/etc/nginx/snippets/self-signed.conf

@@ -0,0 +1,2 @@
+ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
+ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

nginx/etc/nginx/snippets/ssl-params.conf

@@ -0,0 +1,21 @@
+# from https://cipherli.st/
+# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+ssl_ecdh_curve secp384r1;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver 8.8.8.8 8.8.4.4 valid=300s;
+resolver_timeout 5s;
+# Disable preloading HSTS for now.  You can use the commented out header line that includes
+# the "preload" directive if you understand the implications.
+#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+
+ssl_dhparam /etc/ssl/certs/dhparam.pem;

running.sh

@@ -1,3 +1,6 @@
 #!/usr/bin/env bash
 
-python manage.py collectstatic && service nginx start && gunicorn wsgi:application
+python manage.py collectstatic && \
+    service nginx start && \
+    python manage.py migrate && \
+    gunicorn wsgi:application