This repository has been archived by the owner on Jul 1, 2022. It is now read-only.
HTTPS Sender #602
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| FROM nginx:alpine | ||
|
|
||
| # Overwrite default configuration | ||
| ADD build/proxy.conf /etc/nginx/conf.d/default.conf | ||
| # Install generated certificates; run `gen.sh` first | ||
| ADD build/proxy.crt /etc/nginx/proxy.crt | ||
| ADD build/proxy.key /etc/nginx/proxy.key | ||
|
|
||
| EXPOSE 8080 14443 | ||
|
|
||
| # Poll healthcheck port until it returns 2xx or 3xx. | ||
| CMD ["sh", "-c", "while ! { wget --spider -S http://jaeger-collector:14269; }; do echo waiting for healthcheck; sleep 1; done; nginx -g 'daemon off;'"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
|
There was a problem hiding this comment. What's the expiration date for this one? There was a problem hiding this comment. Noted in gen.sh |
||
| MIIBbTCCARSgAwIBAgIJAJXCC2VdhrxqMAoGCCqGSM49BAMCMBIxEDAOBgNVBAMM | ||
| B1RFU1QgQ0EwHhcNMTkwMzA3MTQzODIwWhcNMjkwMzA3MTQzODIwWjASMRAwDgYD | ||
| VQQDDAdURVNUIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAhYnw9zYU0G3 | ||
| VZ48nNlT5jAs096pX0zeHM/yxiJe+DS5Yj0EJXM/0A1Of2zqxbyJpaEIFcqTmTTy | ||
| TXCE7I6B6aNTMFEwHQYDVR0OBBYEFLXSxii6ZFvw427zs7ct/B+eHv2QMB8GA1Ud | ||
| IwQYMBaAFLXSxii6ZFvw427zs7ct/B+eHv2QMA8GA1UdEwEB/wQFMAMBAf8wCgYI | ||
| KoZIzj0EAwIDRwAwRAIgBrX7CX8zNoRLAZ48jGcqI8RuNlpkj0S+UShIQjwez3AC | ||
| IGuqhnGb9JZSiZmIQaYdSE6T/sQaX7iDnwEgKGMI8OB7 | ||
| -----END CERTIFICATE----- | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| -----BEGIN EC PARAMETERS----- | ||
| BggqhkjOPQMBBw== | ||
| -----END EC PARAMETERS----- | ||
| -----BEGIN EC PRIVATE KEY----- | ||
| MHcCAQEEIAA24MB8sxrLG1an0nG1DCH6J32iqrtborxFOjdqWNCmoAoGCCqGSM49 | ||
| AwEHoUQDQgAEAhYnw9zYU0G3VZ48nNlT5jAs096pX0zeHM/yxiJe+DS5Yj0EJXM/ | ||
| 0A1Of2zqxbyJpaEIFcqTmTTyTXCE7I6B6Q== | ||
| -----END EC PRIVATE KEY----- | ||
|
There was a problem hiding this comment. are these being generated by There was a problem hiding this comment. No, this is root certificate which is used to generate proxy's certificate by The Public key pin is coded here: There was a problem hiding this comment. Could you please document somewhere how you generated these files? |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -e | ||
|
|
||
| if [[ $# -ne 2 ]]; then | ||
| echo usage: $0 '<proxy-name> <forward-target>' | ||
| exit 1 | ||
| fi | ||
|
|
||
| SERVER=$1 | ||
| FORWARD=$2 | ||
| TARGET=build/proxy | ||
|
|
||
| # generate secrets | ||
| cd $(dirname $0) | ||
| mkdir -p ./build | ||
| openssl ecparam -genkey -name prime256v1 -out ${TARGET}.key | ||
| openssl req -new -sha256 -key ${TARGET}.key -out ${TARGET}.csr -subj \ | ||
| "/CN=${SERVER}/" | ||
| openssl x509 -req -sha256 -days 1 -CA authority.crt -CAkey authority.key -CAcreateserial -in ${TARGET}.csr -out ${TARGET}.crt | ||
| chmod 644 ${TARGET}.key | ||
|
|
||
| cat authority.crt >> ${TARGET}.crt | ||
|
|
||
| # generate nginx settings | ||
| SERVER=${SERVER} FORWARD=${FORWARD} envsubst < "proxy.template.conf" > ${TARGET}.conf |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| server { | ||
| listen 8080; | ||
| server_name ${SERVER}; | ||
| location / { | ||
| root /usr/share/nginx/html/; | ||
| index index.html; | ||
|
There was a problem hiding this comment. The indentation here seems a bit off |
||
| } | ||
| } | ||
|
|
||
| server { | ||
| listen 14443 ssl; | ||
jpkrohling marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| server_name ${SERVER}; | ||
|
|
||
| ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | ||
|
There was a problem hiding this comment. I know this is only for testing, but could we have a production-grade configuration here? Like, a secure set of ciphers and options like For reference, this is what I used to have on a few servers of mine, which was "current" a couple of years ago: server {
listen [::]:443 ssl http2;
listen 443 ssl http2;
server_name acme.example.com;
ssl_certificate /etc/pki/tls/certs/acme.example.com.bundle.cert;
ssl_certificate_key /etc/pki/tls/private/acme.example.com.key;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # probably needs an update to include TLSv1.3?
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
add_header Strict-Transport-Security max-age=31536000;
root /usr/share/nginx/html/acme.example.com;
}
|
||
| ssl_certificate /etc/nginx/proxy.crt; | ||
| ssl_certificate_key /etc/nginx/proxy.key; | ||
| location / { | ||
| proxy_pass http://${FORWARD}; | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not thrilled with the name. Is it typical to pass certs via env vars? We've recently added many TLS options to Jaeger backend, and the certs are always passed via files.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I had three reasons to pass this via environment variable over file.