Skip to content

Commit d457bb1

Browse files
ludomikulaludomikula
committed
fix: allow usage of SSL certificate
1 parent befb09c commit d457bb1

File tree

7 files changed

+111
-4
lines changed

7 files changed

+111
-4
lines changed

‎deploy/docker/Dockerfile

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,14 @@ COPY deploy/docker/frontend/01-update-nginx-conf.sh /docker-entrypoint.d/01-upda
149149
RUN chmod +x /docker-entrypoint.d/00-change-nginx-user.sh && \
150150
chmod +x /docker-entrypoint.d/01-update-nginx-conf.sh
151151

152-
COPY deploy/docker/frontend/nginx.conf /etc/nginx/nginx.conf
152+
COPY deploy/docker/frontend/nginx-http.conf /etc/nginx/nginx-http.conf
153+
COPY deploy/docker/frontend/nginx-https.conf /etc/nginx/nginx-https.conf
154+
COPY deploy/docker/frontend/ssl-certificate.conf /etc/nginx/ssl-certificate.conf
155+
COPY deploy/docker/frontend/ssl-params.conf /etc/nginx/ssl-params.conf
156+
157+
153158
EXPOSE 3000
159+
EXPOSE 3443
154160

155161
#############################################################################
156162

@@ -189,6 +195,7 @@ COPY --chown=lowcoder:lowcoder deploy/docker/all-in-one/etc /lowcoder/etc
189195
COPY --chown=lowcoder:lowcoder deploy/docker/all-in-one/entrypoint.sh /lowcoder/entrypoint.sh
190196

191197
EXPOSE 3000
198+
EXPOSE 3443
192199

193200
ENTRYPOINT [ "/bin/sh" , "/lowcoder/entrypoint.sh" ]
194201
CMD ["/usr/bin/supervisord", "-n" , "-c" , "/lowcoder/etc/supervisord.conf"]

‎deploy/docker/all-in-one/entrypoint.sh

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,20 @@ fi;
1919

2020
LOGS="/lowcoder-stacks/logs"
2121
DATA="/lowcoder-stacks/data"
22+
CERT="/lowcoder-stacks/ssl"
2223
# Create folder for holding application logs and data
2324
mkdir -p ${LOGS}/redis \
2425
${LOGS}/mongodb \
2526
${LOGS}/api-service \
2627
${LOGS}/node-service \
2728
${LOGS}/frontend \
2829
${DATA}/redis \
29-
${DATA}/mongodb
30+
${DATA}/mongodb \
31+
${CERT}
3032

3133
# Update owner of logs and data
3234
chown -R ${USER_ID}:${GROUP_ID} /lowcoder-stacks/ /lowcoder/etc
3335

34-
3536
# Enable services
3637
SUPERVISOR_AVAILABLE="/lowcoder/etc/supervisord/conf-available"
3738
SUPERVISOR_ENABLED="/lowcoder/etc/supervisord/conf-enabled"
@@ -62,9 +63,22 @@ if [ "${NODE_SERVICE_ENABLED:=true}" = "true" ]; then
6263
ln ${SUPERVISOR_AVAILABLE}/11-node-service.conf ${SUPERVISOR_ENABLED}/11-node-service.conf
6364
fi;
6465

65-
# Enable forntend if configured to run
66+
# Enable frontend if configured to run
6667
if [ "${FRONTEND_ENABLED:=true}" = "true" ]; then
6768
ln ${SUPERVISOR_AVAILABLE}/20-frontend.conf ${SUPERVISOR_ENABLED}/20-frontend.conf
69+
70+
unlink /etc/nginx/nginx.conf 2>/dev/null
71+
if [ -e "${CERT}/fullchain.pem" ] && [ -e "${CERT}/privkey.pem" ]; then
72+
echo "Certificates found, starting with HTTPS."
73+
ln -s /etc/nginx/nginx-https.conf /etc/nginx/nginx.conf
74+
if [ ! -e "${CERT}/dhparam.pem" ]; then
75+
echo "Diffle-Helmann parameters file not found, generating in now... (this can take some time)"
76+
openssl dhparam -out "${CERT}/dhparam.pem" 4096
77+
fi;
78+
else
79+
echo "Certificates not found, starting with HTTP."
80+
ln -s /etc/nginx/nginx-http.conf /etc/nginx/nginx.conf
81+
fi;
6882
fi;
6983

7084
# Handle CMD command

‎deploy/docker/docker-compose.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ services:
99
container_name: lowcoder
1010
ports:
1111
- "3000:3000"
12+
- "3443:3443"
1213
environment:
1314
# enable services
1415
REDIS_ENABLED: "true"

‎deploy/docker/frontend/nginx.conf renamed to ‎deploy/docker/frontend/nginx-http.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,14 @@ http {
4646
location /api {
4747
proxy_set_header X-Forwarded-Proto $scheme;
4848
proxy_set_header X-Forwarded-Host $host;
49+
proxy_set_header X-Real-IP $remote_addr;
4950
proxy_pass __LOWCODER_API_SERVICE_URL__;
5051
}
5152

5253
location /node-service/plugin-icons {
5354
proxy_set_header X-Forwarded-Proto $scheme;
5455
proxy_set_header X-Forwarded-Host $host;
56+
proxy_set_header X-Real-IP $remote_addr;
5557
proxy_pass __LOWCODER_NODE_SERVICE_URL__;
5658
}
5759
}

‎deploy/docker/frontend/nginx-https.conf

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
user lowcoder;
2+
3+
worker_processes 1;
4+
5+
events {
6+
worker_connections 1024;
7+
}
8+
9+
http {
10+
11+
include /etc/nginx/mime.types;
12+
default_type application/octet-stream;
13+
14+
log_format main '"$time_local" client=$remote_addr '
15+
'method=$request_method request="$request" '
16+
'request_length=$request_length '
17+
'status=$status bytes_sent=$bytes_sent '
18+
'body_bytes_sent=$body_bytes_sent '
19+
'referer=$http_referer '
20+
'http_x_forwarded_for=$http_x_forwarded_for '
21+
'user_agent="$http_user_agent" '
22+
'upstream_addr=$upstream_addr '
23+
'upstream_status=$upstream_status '
24+
'request_time=$request_time '
25+
'upstream_response_time=$upstream_response_time '
26+
'upstream_connect_time=$upstream_connect_time '
27+
'upstream_header_time=$upstream_header_time';
28+
29+
keepalive_timeout 65;
30+
sendfile on;
31+
#tcp_nopush on;
32+
33+
server {
34+
listen 3443 ssl;
35+
root /lowcoder/client;
36+
37+
include /etc/nginx/ssl-certificate.conf;
38+
include /etc/nginx/ssl-params.conf;
39+
40+
location / {
41+
try_files $uri /index.html;
42+
43+
if ($request_filename ~* .*.(html|htm)$) {
44+
add_header Cache-Control no-cache;
45+
}
46+
}
47+
48+
location /api {
49+
proxy_set_header X-Forwarded-Proto $scheme;
50+
proxy_set_header X-Forwarded-Host $host;
51+
proxy_set_header X-Real-IP $remote_addr;
52+
proxy_pass __LOWCODER_API_SERVICE_URL__;
53+
}
54+
55+
location /node-service/plugin-icons {
56+
proxy_set_header X-Forwarded-Proto $scheme;
57+
proxy_set_header X-Forwarded-Host $host;
58+
proxy_set_header X-Real-IP $remote_addr;
59+
proxy_pass __LOWCODER_NODE_SERVICE_URL__;
60+
}
61+
}
62+
63+
}

‎deploy/docker/frontend/ssl-certificate.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ssl_certificate /lowcoder-stacks/ssl/fullchain.pem;
2+
ssl_certificate_key /lowcoder-stacks/ssl/privkey.pem;

‎deploy/docker/frontend/ssl-params.conf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
ssl_protocols TLSv1.3;
2+
ssl_prefer_server_ciphers on;
3+
ssl_dhparam /lowcoder-stacks/ssl/dhparam.pem;
4+
ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
5+
ssl_ecdh_curve secp384r1;
6+
ssl_session_timeout 10m;
7+
ssl_session_cache shared:SSL:10m;
8+
ssl_session_tickets off;
9+
ssl_stapling on;
10+
ssl_stapling_verify on;
11+
resolver 8.8.8.8 8.8.4.4 valid=300s;
12+
resolver_timeout 5s;
13+
# Disable strict transport security for now. You can uncomment the following
14+
# line if you understand the implications.
15+
#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
16+
add_header X-Frame-Options DENY;
17+
add_header X-Content-Type-Options nosniff;
18+
add_header X-XSS-Protection "1; mode=block";

0 commit comments

Comments
 (0)