Skip to content
This repository was archived by the owner on Oct 10, 2025. It is now read-only.

Commit 35755fc

Browse files
josecelanojosecelano
committed
fix: [#21] resolve SSL certificate key usage compatibility for browsers
- Fix ssl-generate-test-certs.sh to generate certificates with correct key usage * Added 'critical, digitalSignature, keyEncipherment' to resolve ERR_SSL_KEY_USAGE_INCOMPATIBLE * Added basicConstraints = CA:FALSE for proper certificate constraints * Certificates now work with modern browsers while maintaining security - Fix nginx-https-selfsigned.conf.tpl upstream reference error * Changed 'proxy_pass http://grafana:3000;' to 'proxy_pass http://grafana;' * Fixed HTTP Grafana server configuration to use defined upstream * Resolves nginx startup errors and container restart loops - Enhanced deploy-app.sh endpoint testing * Added dual HTTP/HTTPS endpoint validation * Improved error handling and certificate warnings * Better integration with two-phase SSL approach The SSL automation now generates browser-compatible certificates and the nginx configuration works correctly with both HTTP and HTTPS servers running in parallel for Let's Encrypt support and testing.
1 parent d538027 commit 35755fc

File tree

3 files changed

+191
-25
lines changed

3 files changed

+191
-25
lines changed

‎application/share/bin/ssl-generate-test-certs.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,9 +154,10 @@ OU=Testing
154154
CN=${subdomain}
155155
156156
[v3_req]
157-
keyUsage = keyEncipherment, dataEncipherment
157+
keyUsage = critical, digitalSignature, keyEncipherment
158158
extendedKeyUsage = serverAuth
159159
subjectAltName = @alt_names
160+
basicConstraints = CA:FALSE
160161
161162
[alt_names]
162163
DNS.1 = ${subdomain}

‎infrastructure/config/templates/nginx-https-selfsigned.conf.tpl‎

Lines changed: 128 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -125,38 +125,156 @@ server {
125125
}
126126
}
127127

128-
# HTTP to HTTPS redirect for tracker subdomain
128+
# HTTP server configuration (parallel to HTTPS for Let's Encrypt and testing)
129+
#
130+
# These HTTP servers run alongside HTTPS servers to provide:
131+
# 1. Let's Encrypt ACME challenge support on port 80
132+
# 2. HTTP endpoint testing for integration tests
133+
# 3. Certificate renewal automation support
134+
# 4. Fallback access during certificate issues
135+
136+
# HTTP server for tracker subdomain
129137
server {
130138
listen 80;
131139
listen [::]:80;
140+
141+
root /var/www/html;
142+
index index.html index.htm index.nginx-debian.html;
143+
132144
server_name tracker.${DOMAIN_NAME};
133145

134-
# Allow Let's Encrypt ACME challenge (for future Let's Encrypt upgrade)
146+
# Tracker API endpoints (HTTP access)
147+
location /api/ {
148+
proxy_pass http://tracker:1212/api/;
149+
proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
150+
proxy_set_header Host ${DOLLAR}host;
151+
proxy_set_header X-Real-IP ${DOLLAR}remote_addr;
152+
proxy_set_header X-Forwarded-Proto ${DOLLAR}scheme;
153+
}
154+
155+
# Tracker HTTP endpoints
156+
location / {
157+
proxy_pass http://tracker:7070;
158+
proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
159+
proxy_set_header Host ${DOLLAR}host;
160+
proxy_set_header X-Real-IP ${DOLLAR}remote_addr;
161+
proxy_set_header X-Forwarded-Proto ${DOLLAR}scheme;
162+
}
163+
164+
# Let's Encrypt ACME challenge
135165
location ~ /.well-known/acme-challenge {
136166
allow all;
137167
root /var/lib/torrust/certbot/webroot;
138168
}
139169

140-
# Redirect all other HTTP traffic to HTTPS
141-
location / {
142-
return 301 https://${DOLLAR}server_name${DOLLAR}request_uri;
170+
# Health check endpoint
171+
location /health {
172+
access_log off;
173+
return 200 "healthy\n";
174+
add_header Content-Type text/plain;
143175
}
144176
}
145177

146-
# HTTP to HTTPS redirect for grafana subdomain
178+
# HTTP server for grafana subdomain
147179
server {
148180
listen 80;
149181
listen [::]:80;
182+
183+
root /var/www/html;
184+
index index.html index.htm index.nginx-debian.html;
185+
150186
server_name grafana.${DOMAIN_NAME};
151187

152-
# Allow Let's Encrypt ACME challenge (for future Let's Encrypt upgrade)
188+
# Grafana web interface (HTTP access)
189+
location / {
190+
proxy_pass http://grafana;
191+
proxy_set_header Host ${DOLLAR}host;
192+
proxy_set_header X-Real-IP ${DOLLAR}remote_addr;
193+
proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
194+
proxy_set_header X-Forwarded-Proto ${DOLLAR}scheme;
195+
196+
# WebSocket support for Grafana live features
197+
proxy_http_version 1.1;
198+
proxy_set_header Upgrade ${DOLLAR}http_upgrade;
199+
proxy_set_header Connection ${DOLLAR}connection_upgrade;
200+
proxy_read_timeout 86400;
201+
proxy_buffering off;
202+
}
203+
204+
# Let's Encrypt ACME challenge
153205
location ~ /.well-known/acme-challenge {
154206
allow all;
155207
root /var/lib/torrust/certbot/webroot;
156208
}
157209

158-
# Redirect all other HTTP traffic to HTTPS
159-
location / {
160-
return 301 https://${DOLLAR}server_name${DOLLAR}request_uri;
210+
# Health check endpoint
211+
location /health {
212+
access_log off;
213+
return 200 "healthy\n";
214+
add_header Content-Type text/plain;
161215
}
162216
}
217+
218+
# HTTP to HTTPS redirect configuration (COMMENTED OUT)
219+
#
220+
# IMPORTANT: HTTP to HTTPS redirects are intentionally commented out because:
221+
#
222+
# 1. Let's Encrypt Certificate Generation:
223+
# - Let's Encrypt requires port 80 to be available for ACME HTTP-01 challenge
224+
# - Domain validation fails if all HTTP traffic is redirected to HTTPS
225+
# - Certificate generation scripts need HTTP access for domain verification
226+
#
227+
# 2. Certificate Renewal:
228+
# - Automatic certificate renewal also requires port 80 for challenge validation
229+
# - Redirects would break the renewal process, causing certificate expiration
230+
#
231+
# 3. Testing and Development:
232+
# - Integration tests expect HTTP endpoints to work for validation
233+
# - Mixed HTTP/HTTPS access needed for comprehensive endpoint testing
234+
# - Self-signed certificate environments don't require strict HTTPS enforcement
235+
#
236+
# 4. Manual Enablement:
237+
# - System administrators can manually enable these redirects after:
238+
# a) Successful Let's Encrypt certificate installation
239+
# b) Implementing alternative domain validation methods (DNS-01 challenge)
240+
# c) Ensuring certificate renewal automation works with redirects
241+
#
242+
# To enable HTTP to HTTPS redirects (advanced users only):
243+
# 1. Uncomment the server blocks below
244+
# 2. Ensure Let's Encrypt renewal uses DNS-01 challenge or webroot exception
245+
# 3. Test certificate renewal before enabling in production
246+
# 4. Consider leaving .well-known/acme-challenge accessible via HTTP
247+
248+
# server {
249+
# listen 80;
250+
# listen [::]:80;
251+
# server_name tracker.${DOMAIN_NAME};
252+
#
253+
# # Allow Let's Encrypt ACME challenge (required even with redirects)
254+
# location ~ /.well-known/acme-challenge {
255+
# allow all;
256+
# root /var/lib/torrust/certbot/webroot;
257+
# }
258+
#
259+
# # Redirect all other HTTP traffic to HTTPS
260+
# location / {
261+
# return 301 https://${DOLLAR}server_name${DOLLAR}request_uri;
262+
# }
263+
# }
264+
265+
# server {
266+
# listen 80;
267+
# listen [::]:80;
268+
# server_name grafana.${DOMAIN_NAME};
269+
#
270+
# # Allow Let's Encrypt ACME challenge (required even with redirects)
271+
# location ~ /.well-known/acme-challenge {
272+
# allow all;
273+
# root /var/lib/torrust/certbot/webroot;
274+
# }
275+
#
276+
# # Redirect all other HTTP traffic to HTTPS
277+
# location / {
278+
# return 301 https://${DOLLAR}server_name${DOLLAR}request_uri;
279+
# }
280+
# }

‎infrastructure/scripts/deploy-app.sh‎

Lines changed: 61 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -874,40 +874,81 @@ validate_deployment() {
874874
vm_exec "${vm_ip}" "
875875
echo '=== Testing Application Endpoints ==='
876876
877-
# Test global health check endpoint (through nginx proxy)
877+
# Test HTTP health check endpoint (through nginx proxy)
878+
echo 'Testing HTTP health check endpoint...'
878879
if curl -f -s http://localhost/health_check >/dev/null 2>&1; then
879-
echo '✅ Global health check endpoint: OK'
880+
echo '✅ HTTP health check endpoint: OK'
880881
else
881-
echo '❌ Global health check endpoint: FAILED'
882+
echo '❌ HTTP health check endpoint: FAILED'
882883
exit 1
883884
fi
884885
885-
# Test API stats endpoint (through nginx proxy, requires auth)
886+
# Test HTTPS health check endpoint (through nginx proxy, with self-signed certificates)
887+
echo 'Testing HTTPS health check endpoint...'
888+
if curl -f -s -k https://localhost/health_check >/dev/null 2>&1; then
889+
echo '✅ HTTPS health check endpoint: OK (self-signed certificate)'
890+
else
891+
echo '❌ HTTPS health check endpoint: FAILED'
892+
# Don't exit on HTTPS failure in case certificates aren't ready yet
893+
echo '⚠️ HTTPS may not be fully configured yet, continuing with HTTP tests'
894+
fi
895+
896+
# Test HTTP API stats endpoint (through nginx proxy, requires auth)
897+
echo 'Testing HTTP API stats endpoint...'
886898
# Save response to temp file and get HTTP status code
887899
api_http_code=\$(curl -s -o /tmp/api_response.json -w '%{http_code}' \"http://localhost/api/v1/stats?token=MyAccessToken\" 2>&1 || echo \"000\")
888900
api_response_body=\$(cat /tmp/api_response.json 2>/dev/null || echo \"No response\")
889901
890902
# Check if HTTP status is 200 (success)
891903
if [ \"\$api_http_code\" -eq 200 ] 2>/dev/null; then
892-
echo '✅ API stats endpoint: OK'
904+
echo '✅ HTTP API stats endpoint: OK'
893905
else
894-
echo '❌ API stats endpoint: FAILED'
906+
echo '❌ HTTP API stats endpoint: FAILED'
895907
echo \" HTTP Code: \$api_http_code\"
896908
echo \" Response: \$api_response_body\"
897909
rm -f /tmp/api_response.json
898910
exit 1
899911
fi
900912
rm -f /tmp/api_response.json
901913
914+
# Test HTTPS API stats endpoint (through nginx proxy, with self-signed certificates)
915+
echo 'Testing HTTPS API stats endpoint...'
916+
# Save response to temp file and get HTTP status code
917+
api_https_code=\$(curl -s -k -o /tmp/api_response_https.json -w '%{http_code}' \"https://localhost/api/v1/stats?token=MyAccessToken\" 2>&1 || echo \"000\")
918+
api_https_response=\$(cat /tmp/api_response_https.json 2>/dev/null || echo \"No response\")
919+
920+
# Check if HTTPS status is 200 (success)
921+
if [ \"\$api_https_code\" -eq 200 ] 2>/dev/null; then
922+
echo '✅ HTTPS API stats endpoint: OK (self-signed certificate)'
923+
else
924+
echo '⚠️ HTTPS API stats endpoint: FAILED'
925+
echo \" HTTPS Code: \$api_https_code\"
926+
echo \" Response: \$api_https_response\"
927+
# Don't exit on HTTPS failure in case certificates aren't ready yet
928+
echo '⚠️ HTTPS may not be fully configured yet, continuing with HTTP validation'
929+
fi
930+
rm -f /tmp/api_response_https.json
931+
902932
# Test HTTP tracker endpoint (through nginx proxy - expects 404 for root)
933+
echo 'Testing HTTP tracker endpoint...'
903934
if curl -s -w '%{http_code}' http://localhost/ -o /dev/null | grep -q '404'; then
904935
echo '✅ HTTP tracker endpoint: OK (nginx proxy responding, tracker ready for BitTorrent clients)'
905936
else
906937
echo '❌ HTTP tracker endpoint: FAILED'
907938
exit 1
908939
fi
909940
910-
echo '✅ All endpoints are responding'
941+
# Test HTTPS tracker endpoint (through nginx proxy - expects 404 for root)
942+
echo 'Testing HTTPS tracker endpoint...'
943+
if curl -s -k -w '%{http_code}' https://localhost/ -o /dev/null | grep -q '404'; then
944+
echo '✅ HTTPS tracker endpoint: OK (nginx proxy with SSL responding, tracker ready for secure BitTorrent clients)'
945+
else
946+
echo '⚠️ HTTPS tracker endpoint: FAILED'
947+
# Don't exit on HTTPS failure in case certificates aren't ready yet
948+
echo '⚠️ HTTPS may not be fully configured yet, HTTP tracker is working'
949+
fi
950+
951+
echo '✅ All critical endpoints are responding (HTTP validated, HTTPS optional)'
911952
" "Testing application endpoints"
912953

913954
log_success "Deployment validation passed"
@@ -924,15 +965,21 @@ show_connection_info() {
924965
echo "SSH Access: ssh torrust@${vm_ip}"
925966
echo
926967
echo "=== APPLICATION ENDPOINTS ==="
927-
echo "Health Check: http://${vm_ip}/health_check" # DevSkim: ignore DS137138
928-
echo "API Stats: http://${vm_ip}/api/v1/stats?token=MyAccessToken" # DevSkim: ignore DS137138
929-
echo "HTTP Tracker: http://${vm_ip}/ (for BitTorrent clients)" # DevSkim: ignore DS137138
930-
echo "UDP Tracker: udp://${vm_ip}:6868, udp://${vm_ip}:6969"
931-
echo "Grafana: http://${vm_ip}:3100 (admin/admin)" # DevSkim: ignore DS137138
968+
echo "HTTP Health Check: http://${vm_ip}/health_check" # DevSkim: ignore DS137138
969+
echo "HTTP API Stats: http://${vm_ip}/api/v1/stats?token=MyAccessToken" # DevSkim: ignore DS137138
970+
echo "HTTP Tracker: http://${vm_ip}/ (for BitTorrent clients)" # DevSkim: ignore DS137138
971+
echo "UDP Tracker: udp://${vm_ip}:6868, udp://${vm_ip}:6969"
972+
echo "Grafana HTTP: http://${vm_ip}:3100 (admin/admin)" # DevSkim: ignore DS137138
932973
echo
933974
echo "=== HTTPS ENDPOINTS (with self-signed certificates) ==="
934-
echo "Tracker API: https://tracker.test.local (add to /etc/hosts)"
935-
echo "Grafana: https://grafana.test.local (add to /etc/hosts)"
975+
echo "HTTPS Health Check: https://${vm_ip}/health_check (expect certificate warning)" # DevSkim: ignore DS137138
976+
echo "HTTPS API Stats: https://${vm_ip}/api/v1/stats?token=MyAccessToken (expect certificate warning)" # DevSkim: ignore DS137138
977+
echo "HTTPS Tracker: https://${vm_ip}/ (expect certificate warning)" # DevSkim: ignore DS137138
978+
echo "Grafana HTTPS: https://${vm_ip}:3100 (expect certificate warning)" # DevSkim: ignore DS137138
979+
echo
980+
echo "=== DOMAIN-BASED HTTPS (add to /etc/hosts for testing) ==="
981+
echo "Tracker API: https://tracker.test.local (requires hosts entry)"
982+
echo "Grafana: https://grafana.test.local (requires hosts entry)"
936983
echo
937984
echo "=== SETUP FOR HTTPS TESTING ==="
938985
echo "Add these lines to your /etc/hosts file:"

0 commit comments

Comments
 (0)