From 287881b64c6f3ee72ae1499539dc4835c6800d1c Mon Sep 17 00:00:00 2001
From: Jeremy Quinton <jeremyquinton@gmail.com>
Date: Tue, 2 Oct 2018 12:15:20 +0200
Subject: [PATCH] add self signed cert to ngix

---
 Dockerfile-nginx   |  6 ++++++
 docker-compose.yml |  1 +
 nginx.conf         |  7 +++++++
 self-signed.conf   |  2 ++
 ssl-params.conf    | 21 +++++++++++++++++++++
 5 files changed, 37 insertions(+)
 create mode 100644 self-signed.conf
 create mode 100644 ssl-params.conf

diff --git a/Dockerfile-nginx b/Dockerfile-nginx
index 8fe57077..a9c6196b 100644
--- a/Dockerfile-nginx
+++ b/Dockerfile-nginx
@@ -1,2 +1,8 @@
 FROM nginx:latest
 COPY nginx.conf /etc/nginx/conf.d/default.conf
+RUN apt-get update && apt-get install openssl
+RUN openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt -subj "/C=GB/ST=London/L=London/O=NA/CN=localhost"
+RUN openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
+RUN mkdir /etc/nginx/snippets
+COPY self-signed.conf /etc/nginx/snippets/self-signed.conf
+COPY ssl-params.conf /etc/nginx/snippets/ssl-params.conf
diff --git a/docker-compose.yml b/docker-compose.yml
index 957b2f69..d9d31683 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,6 +9,7 @@ services:
       - ./.env
     ports:
     - "8080:80"
+    - "8081:443"
     networks:
       - attendizenet
     volumes:
diff --git a/nginx.conf b/nginx.conf
index c7c665b0..dc48bb3e 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -2,6 +2,13 @@ server {
     listen 80 default_server;
     server_name localhost;
 
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
+
+    include snippets/self-signed.conf;
+    include snippets/ssl-params.conf;
+
+
     root /usr/share/nginx/html/attendize/public;
     index index.php;
 
diff --git a/self-signed.conf b/self-signed.conf
new file mode 100644
index 00000000..39332d77
--- /dev/null
+++ b/self-signed.conf
@@ -0,0 +1,2 @@
+ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
+ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
\ No newline at end of file
diff --git a/ssl-params.conf b/ssl-params.conf
new file mode 100644
index 00000000..42e50b26
--- /dev/null
+++ b/ssl-params.conf
@@ -0,0 +1,21 @@
+# from https://cipherli.st/
+# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+ssl_ecdh_curve secp384r1;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver 8.8.8.8 8.8.4.4 valid=300s;
+resolver_timeout 5s;
+# Disable preloading HSTS for now.  You can use the commented out header line that includes
+# the "preload" directive if you understand the implications.
+#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+
+ssl_dhparam /etc/ssl/certs/dhparam.pem;
\ No newline at end of file