Allow setting https-only on a ​per-application basis

[rimusz]

Controller should allow setting https-only on a ​per-application basis.
That would allow secure controller itself and run Apps with HTTPS/HTTP support

[helgi]

Can you elaborate on that? Attaching a certificate and then doing enforceHTTPS on the router then it gets HTTPS only, otherwise you have per application TLS

[krancour]

@helgi the issue really is that there's no way via the controller to enable enforcement of HTTPS only (i.e. a redirect from HTTP to HTTPS) on an app by app basis. Currently, all we can accommodate is that the router can enforce this globally.

I had an offline discussion with @rimusz and what he really wants to do is force HTTPS for the controller only, but not for any other apps. (Remember that the router regards the controller as "just another app.") On the router end, it would be very easy to start making the determination re: enforcement of HTTPS on an app-by-app basis if the controller can start annotating apps' service resources with such information. (This would require a complementary CLI change as well.)

With all of that in place, it would be possible to secure the controller only as @rimusz is looking to do-- although in that particular case, it would be achieved by directly modifying the controller's service resource and not through the CLI. Even so, the crux of the issue here is that enforcing HTTPS is currently possible for all apps or none and @rimusz would like to see that change.

[bacongobbler]

How do we want the client to look? I'm having a hard time thinking of a good client endpoint. deis apps:ssl enable, maybe? Any ideas?

[helgi]

I think that's fine, tho do we envision to ever add more ssl related options?

[bacongobbler]

that's the problem. I do believe we would want to add more ssl-related options, but certs currently exist as deis certs so deis ssl as a top level feature would just look confusing, IMO.

[slack]

No strong preference! Another option would be ssl:require enable, which would leave the ssl:* namespace for things like cipher lists, and... I don't know what else!

[bacongobbler]

Indeed. Users would probably want to supply app-specific cipher suites, whitelisted protocols, session timeouts, buffer sizes etc. which are all technically possible thanks to deis/router#237. It's just a matter of plugging that into the nginx config.

[slack]

I think certs being its own thing is okay, as the lifecycle of certificates are decoupled from the app...

[bacongobbler]

So for a more formal proposal with deis tls as a first class citizen:

deis tls:enforce true
deis tls:protocols "TLSv1 TLSv1.1 TLSv1.2"
deis tls:ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:..."

The more I think about it, the more I'd like this to be part of the Config/Release model rather than the AppSettings model. That way users can roll back changes as required and see what if SSL was enforced this release etc.

For the initial release this sprint, I'm going to try tackling only deis tls:enforce which will pave the way for other features and to reduce the amount of code required to review.