forked from mirrors/gotosocial
[documentation] NGINX docs updates (#471)
* start adjusting nginx documentation * update NGINX docs * add link to the websocket docs
This commit is contained in:
tobi
GitHub
parent
03bcd8a711
commit
4bace80fab
1 changed files with 79 additions and 83 deletions
|
|
@ -1,8 +1,9 @@
|
|||
# Reverse proxy with nginx
|
||||
# Reverse proxy with NGINX
|
||||
|
||||
## Requirements
|
||||
|
||||
For this you will need certbot, the certbot nginx plugin and of course nginx.
|
||||
For this you will need [Certbot](https://certbot.eff.org/), the Certbot NGINX plugin and of course [NGINX](https://www.nginx.com/) itself.
|
||||
|
||||
These are popular packages so your distro will probably have them.
|
||||
|
||||
### Ubuntu
|
||||
|
|
@ -25,64 +26,72 @@ sudo zypper install nginx python3-certbot python3-certbot-nginx
|
|||
|
||||
## Configure GoToSocial
|
||||
|
||||
In your GoToSocial config turn off letsencrypt.
|
||||
First open the file in your text editor.
|
||||
If GoToSocial is already running, stop it.
|
||||
|
||||
```bash
|
||||
sudoedit /gotosocial/config.yaml
|
||||
sudo systemctl stop gotosocial
|
||||
```
|
||||
|
||||
Then set `letsencrypt-enabled: false`.
|
||||
Or if you don't have a systemd service just stop it manually.
|
||||
|
||||
If GoToSocial is already running, restart it.
|
||||
In your GoToSocial config turn off letsencrypt by setting `letsencrypt-enabled` to `false`.
|
||||
|
||||
If you we running GoToSocial on port 443, change the `port` value back to the default `8080`.
|
||||
|
||||
## Set up NGINX
|
||||
|
||||
First we will set up NGINX to serve GoToSocial as unsecured http and then use Certbot to automatically upgrade it to serve https.
|
||||
|
||||
Please do not try to use it until that's done or you'll risk transmitting passwords over clear text, or breaking federation.
|
||||
|
||||
First we'll write a configuration for NGINX and put it in `/etc/nginx/sites-available`.
|
||||
|
||||
```bash
|
||||
sudo systemctl restart gotosocial.service
|
||||
```
|
||||
|
||||
Or if you don't have a systemd service just restart it manually.
|
||||
|
||||
## Set up nginx
|
||||
|
||||
First we will set up nginx to serve GoToSocial as unsecured http and then later use certbot to automatically upgrade to https.
|
||||
Please do not try to use it until that's done or you'll be transmitting passwords over clear text.
|
||||
|
||||
First we'll write a configuration for nginx and put it in `/etc/nginx/sites-available`.
|
||||
|
||||
```bash
|
||||
sudo mkdir /etc/nginx/sites-available/
|
||||
sudo mkdir -p /etc/nginx/sites-available
|
||||
sudoedit /etc/nginx/sites-available/yourgotosocial.url.conf
|
||||
```
|
||||
|
||||
The file you're about to create should look a bit like this:
|
||||
In the above commands, replace `yourgotosocial.url` with your actual GoToSocial host value. So if your `host` is set to `example.org`, then the file should be called `/etc/nginx/sites-available/example.org.conf`
|
||||
|
||||
The file you're about to create should look like this:
|
||||
|
||||
```nginx.conf
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name example.com;
|
||||
server_name example.org;
|
||||
location / {
|
||||
proxy_pass http://localhost:8080;
|
||||
proxy_pass http://localhost:8080/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Note***: You can remove the line `listen [::]:80;` if your server is not ipv6 capable.
|
||||
|
||||
**Note***: `proxy_set_header Host $host;` is essential: It guarantees that the proxy and the gotosocial speak of the same Server name. If not, gotosocial will build the wrong authentication headers, and all attempts at federation will be rejected with 401.
|
||||
|
||||
Change `proxy_pass` to the ip and port that you're actually serving GoToSocial on and change `server_name` to your own domain name.
|
||||
If your domain name is `gotosocial.example.com` then `server_name gotosocial.example.com;` would be the correct value.
|
||||
|
||||
If your domain name is `example.org` then `server_name example.org;` would be the correct value.
|
||||
|
||||
If you're running GoToSocial on another machine with the local ip of 192.168.178.69 and on port 8080 then `proxy_pass http://192.168.178.69:8080;` would be the correct value.
|
||||
|
||||
**Note**: You can remove the line `listen [::]:80;` if your server is not ipv6 capable.
|
||||
|
||||
**Note**: `proxy_set_header Host $host;` is essential. It guarantees that the proxy and GoToSocial use the same server name. If not, GoToSocial will build the wrong authentication headers, and all attempts at federation will be rejected with 401.
|
||||
|
||||
**Note**: The `Connection` and `Upgrade` headers are used for WebSocket connections. See the [WebSocket docs](./websocket.md).
|
||||
|
||||
Next we'll need to link the file we just created to the folder that nginx reads configurations for active sites from.
|
||||
|
||||
```bash
|
||||
sudo mkdir /etc/nginx/sites-enabled
|
||||
sudo mkdir -p /etc/nginx/sites-enabled
|
||||
sudo ln -s /etc/nginx/sites-available/yourgotosocial.url.conf /etc/nginx/sites-enabled/
|
||||
```
|
||||
|
||||
Again, replace `yourgotosocial.url` with your actual GoToSocial host value.
|
||||
|
||||
Now check for configuration errors.
|
||||
|
||||
```bash
|
||||
|
|
@ -111,72 +120,59 @@ sudo certbot --nginx
|
|||
```
|
||||
|
||||
After you do, it should have automatically edited your configuration file to enable https.
|
||||
Reload it one last time and after that you should be good to go!
|
||||
|
||||
Reload NGINX one last time:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart nginx
|
||||
```
|
||||
|
||||
### Results
|
||||
Now start GoToSocial again:
|
||||
|
||||
The resulting NGINX config should look something like this:
|
||||
```bash
|
||||
sudo systemctl start gotosocial
|
||||
```
|
||||
|
||||
## Results
|
||||
|
||||
You should now be able to open the splash page for your instance in your web browser, and will see that it runs under https!
|
||||
|
||||
If you open the NGINX config again, you'll see that Certbot added some extra lines to it.
|
||||
|
||||
**Note**: This may look a bit different depending on the options you chose while setting up Certbot, and the NGINX version you're using.
|
||||
|
||||
```nginx.conf
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name gts.example.com;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
default_type "text/plain";
|
||||
root /var/www/certbot;
|
||||
server_name example.org;
|
||||
location / {
|
||||
proxy_pass http://localhost:8080/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
|
||||
listen [::]:443 ssl ipv6only=on; # managed by Certbot
|
||||
listen 443 ssl; # managed by Certbot
|
||||
ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; # managed by Certbot
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name gts.example.com;
|
||||
if ($host = example.org) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
#############################################################################
|
||||
# Certificates #
|
||||
# you need a certificate to run in production. see https://letsencrypt.org/ #
|
||||
#############################################################################
|
||||
ssl_certificate /etc/letsencrypt/live/gts.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/gts.example.com/privkey.pem;
|
||||
|
||||
location ^~ '/.well-known/acme-challenge' {
|
||||
default_type "text/plain";
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
###########################################
|
||||
# Security hardening (as of Nov 15, 2020) #
|
||||
# based on Mozilla Guideline v5.6 #
|
||||
###########################################
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305";
|
||||
ssl_session_timeout 1d; # defaults to 5m
|
||||
ssl_session_cache shared:SSL:10m; # estimated to 40k sessions
|
||||
ssl_session_tickets off;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
# HSTS (https://hstspreload.org), requires to be copied in 'location' sections that have add_header directives
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Scheme $scheme;
|
||||
}
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name example.org;
|
||||
return 404; # managed by Certbot
|
||||
}
|
||||
```
|
||||
|
||||
## Extra Hardening
|
||||
|
||||
If you want to harden up your NGINX deployment with advanced configuration options, there are many guides online for doing so ([for example](https://beaglesecurity.com/blog/article/nginx-server-security.html)). Try to find one that's up to date. Mozilla also publishes best-practice ssl configuration [here](https://ssl-config.mozilla.org/).
|
||||
|
|
|
|||
Loading…
Reference in a new issue