Fixing apache

Ian provided us with the following steps to fix apache (without this, we might have problems with multiple students connecting to the server simultaneously).

In the students machine:

$ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
$ sudo yum install nginx
# Add /etc/nginx/nginx.conf
# Add /etc/nginx/conf.d/jupyterhub.conf

Then, we need to include the two files below:

sudo echo """
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
    worker_connections 1024;
}
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    client_max_body_size 0;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;
#    server {
#        listen       80 default_server;
#        listen       [::]:80 default_server;
#        server_name  _;
#        root         /usr/share/nginx/html;
#
#        # Load configuration files for the default server block.
#        include /etc/nginx/default.d/*.conf;
#
#        location / {
#        }
#
#        error_page 404 /404.html;
#        location = /404.html {
#        }
#
#        error_page 500 502 503 504 /50x.html;
#        location = /50x.html {
#        }
#    }
# Settings for a TLS enabled server.
#
#    server {
#        listen       443 ssl http2 default_server;
#        listen       [::]:443 ssl http2 default_server;
#        server_name  _;
#        root         /usr/share/nginx/html;
#
#        ssl_certificate "/etc/pki/nginx/server.crt";
#        ssl_certificate_key "/etc/pki/nginx/private/server.key";
#        ssl_session_cache shared:SSL:1m;
#        ssl_session_timeout  10m;
#        ssl_ciphers HIGH:!aNULL:!MD5;
#        ssl_prefer_server_ciphers on;
#
#        # Load configuration files for the default server block.
#        include /etc/nginx/default.d/*.conf;
#
#        location / {
#        }
#
#        error_page 404 /404.html;
#        location = /404.html {
#        }
#
#        error_page 500 502 503 504 /50x.html;
#        location = /50x.html {
#        }
#    }
}
""" > /etc/nginx/nginx.conf

sudo echo """
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}
# HTTP server to redirect all 80 traffic to SSL/HTTPS
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name stat-201-student.stat.ubc.ca;
    return 301 https://$host$request_uri;
}
# HTTPS server to handle JupyterHub
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name stat-201-student.stat.ubc.ca;
    ssl_certificate /home/acme/certs/stat-201-student.stat.ubc.ca/fullchain.pem;
    ssl_certificate_key /home/acme/certs/stat-201-student.stat.ubc.ca/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:50m;
    ssl_session_tickets off;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_stapling on;
    ssl_stapling_verify on;
    # Static portion of site
    location  / {
      root /var/www/html/site;
    }
    location  /.well-known/acme-challenge/ {
      allow all;
      alias /home/acme/challenge/;
      try_files $uri $uri/ =404;
    }
    # Managing literal requests to the JupyterHub front end
    location /jupyter/ {
        proxy_pass http://127.0.0.1:8000/jupyter/;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # websocket headers
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}""" > /etc/nginx/conf.d/jupyterhub.conf;

Note, however, that the following lines need to be updated in the file /etc/nginx/conf.d/jupyterhub.conf

server_name stat-201-student.stat.ubc.ca;
ssl_certificate /home/acme/certs/stat-201-student.stat.ubc.ca/fullchain.pem;
ssl_certificate_key /home/acme/certs/stat-201-student.stat.ubc.ca/privkey.pem;

to

server_name <FQDN>;
ssl_certificate /home/acme/certs/<FQDN>/fullchain.pem;
ssl_certificate_key /home/acme/certs/<FQDN>/privkey.pem;

where <FQDN> is the fully qualified (i.e. including .stat.uc.ca) domain name. Be careful as the first line (server_name stat-201-student.stat.ubc.ca;) occurs twice.

Finally, run

$ sudo systemctl disable httpd
$ sudo systemctl enable nginx
$ sudo systemctl stop httpd
$ openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
$ sudo systemctl start nginx