how to add TLS to hypnotoad web server ?

[e-ferrari]

Hi guys,
i hope this is the right place for my question. If not, please advice me.
First: i'm not a developer, i'm a system administrator. I don't know much about perl and a little bit of CPAN. I installed already some perl modules with it.
We have a perl application which uses hypnotoad to offer web pages.
Because the page requires a login i like to encrypt it with TLS.
I read that "Another huge advantage is that it supports TLS and WebSockets out of the box" (https://github.com/mojolicious/mojo/blob/main/lib/Mojolicious/Guides/Cookbook.pod", so it should be possible.
I start a script with systemd. This starts the following lines:

/usr/local/bin/hypnotoad /home/crispor/crispr_allele_designer/crispr_designer/script/crispr_designer
/home/crispor/crispr_allele_designer/crispr_designer/script/crispr_designer > \  /home/crispor/crispr_allele_designer/crispr_designer/log/crispr-designer.log 2>&1 &

Our developer has created a conf file:

{
  logs             => '/home/crispor/logs/hypnotoad.log',
  loglevel         => 'verbose',
  debug            => '1',
  secrets          => ['xxxxx'],
  pg               => 'postgresql://xxx:xxx@127.0.0.1:5432/crisprdesigner',
  hypnotoad        => {
  listen           => ['https://*:8443'],
# listen           => ['https://*:8443?cert=/home/crispor/certs/crispr-designer_helmholtz-muenchen_de_chain.crt&key=/home/crispor/certs/private.key__'],
  workers          => '5',
  logs             => '/home/crispor/logs/hypnotoad.log',
  path             => '/home/crispor/logs/hypnotoad.log',
  level         => 'verbose',
  cert => '/home/crispor/certs/crispr-designer_helmholtz-muenchen_de_chain.crt__',
  key  => '/home/crispor/certs/private.key',
  }
}

#
#  input_size_limit:  max length of user input string (textarea)
#  loglevel        :  server log (available log levels are: debug, info, warn, error and fatal in that order)
#  debug           :  for debugging set to 1 (default 0)
#  worker_jobs     :  max number of jobs of a worker in the job queue default: 12 (should be larger than lock_limit)
#  retry_delay     :  time delay (sec) for a job retry (during named lock) default: 60 sec (should be below lock_time), see Analyze.pm
#  lock_limit      :  max number of active jobs in the job queue (other jobs are delayed) default: 3 (1 for testing), see Analyze.pm
#  lock_time       :  duration for a named lock default: 300 sec (could be increased), see Analyze.pm
#  secrets
#  hypnotoad
#

#  retry_delay      => '60',
#  lock_limit       => '1',
#  lock_time        => '300',
#  worker_jobs      => '8',

# Short scheme, username, password, host and database
#          postgresql://sri:s3cret@localhost:port/databasename
# PSQL database: crisprdesigner
# user: xxx
# PWD : xxx

# Mojolicious v9.22

What is strange if i change the port the webserver listens to, and restart the application it listens immediately on the new port.
But when i change anything by cert or key, it seems that it does not care about these entries.
I entered already a wrong path in cert, but nothing complained.
As you see i played around with listen (i found that on the net), but that didn't help.

Thanks for ayn advice.

Bernd

[kraih]

All you need is to install IO::Socket::SSL and Mojolicious supports TLS. But we recommend using a reverse proxy for TLS termination.

[e-ferrari]

Hi,
it is installed:
root@crispor-server:/home/crispor/scripts# cpan -l|grep -i ssl

...
IO::Socket::SSL 2.067

Bernd

[guest20]

You have two "listen" entries in your config, but the one that points at keys is commented out with a #...

Is the problem that the server starts, but with a self signed cert, or does it just serve plain http?

I'm not a big systemd enjoyer, but I found that some log/errors get lost I don't run hypnotoad with --foreground, though this might just be a superstition from older versions of mojo.

Edit: you likely want all your logging to go to STDERR, so systemd puts them all into journald instead of doing redirecting, and you want to run hypnotoad without backgrounding so any other misc output ends up there too

[e-ferrari]

I changed it:

{
  logs             => '/home/crispor/logs/hypnotoad.log',
  loglevel         => 'verbose',
  debug            => '1',
  secrets          => ['xxxxx'],
  pg               => 'postgresql://xxxxx:cccccc@127.0.0.1:5432/crisprdesigner',
  hypnotoad        => {
#  listen           => ['https://*:8443'],
  listen           => ['https://*:8443?cert=/home/crispor/certs/crispr-designer_helmholtz-muenchen_de_chain.cer&key=/home/crispor/certs/private.key'],
  workers          => '5',
  logs             => '/home/crispor/logs/hypnotoad.log',
  path             => '/home/crispor/logs/hypnotoad.log',
  level            => 'verbose',
#  tls              => {
#    cert             => '/home/crispor/certs/crispr-designer_helmholtz-munich_de_chain.cer',
#    key              => '/home/crispor/certs/private.key',
#  };
 }
}

The problem is that it still uses a self-signed certificate (i assume a default).
The server starts.
It does not care about my certificate.

Bernd

[kraih]

Is the cert file really a. .cer, or is that a typo? Maybe give the cert a shorter name for testing to avoid possible typos.