diff --git a/Makefile b/Makefile index 8bf3766abd..27aa0419f2 100644 --- a/Makefile +++ b/Makefile @@ -406,7 +406,7 @@ uwsgi: collectstatic @if [ "$(VENV_BASE)" ]; then \ . $(VENV_BASE)/tower/bin/activate; \ fi; \ - uwsgi -b 32768 --socket :8050 --module=awx.wsgi:application --home=/venv/tower --chdir=/tower_devel/ --vacuum --processes=5 --harakiri=60 --master --no-orphans --py-autoreload 1 --max-requests=1000 --stats /tmp/stats.socket --master-fifo=/tmp/awxfifo --lazy-apps + uwsgi -b 32768 --socket :8050 --module=awx.wsgi:application --home=/venv/tower --chdir=/tower_devel/ --vacuum --processes=5 --harakiri=120 --master --no-orphans --py-autoreload 1 --max-requests=1000 --stats /tmp/stats.socket --master-fifo=/tmp/awxfifo --lazy-apps daphne: @if [ "$(VENV_BASE)" ]; then \ diff --git a/config/awx-nginx.conf b/config/awx-nginx.conf index 3df3155ec8..15e58678ba 100644 --- a/config/awx-nginx.conf +++ b/config/awx-nginx.conf @@ -23,14 +23,8 @@ http { } sendfile on; - #tcp_nopush on; - - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - - keepalive_timeout 65; - - #gzip on; + tcp_nopush on; + tcp_nodelay on; upstream uwsgi { server 127.0.0.1:8050; @@ -42,16 +36,30 @@ http { server { listen 80 default_server; + listen [::]:80 default_server; + return 301 https://$host$request_uri; + } + + server { listen 443 default_server ssl; # If you have a domain name, this is where to add it server_name _; - keepalive_timeout 70; + keepalive_timeout 65; ssl_certificate /etc/tower/tower.cert; ssl_certificate_key /etc/tower/tower.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_ciphers HIGH:!aNULL:!MD5; + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; + + # intermediate configuration + ssl_protocols TLSv1.2; + ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; + ssl_prefer_server_ciphers on; + + # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) + add_header Strict-Transport-Security max-age=15768000; location /favicon.ico { alias /var/lib/awx/public/static/favicon.ico; } location /static { alias /var/lib/awx/public/static; } @@ -79,8 +87,11 @@ http { } location / { - include /etc/nginx/uwsgi_params; + # Redirect if there is no forward-slash + rewrite ^(.*[^/])$ $1/ permanent; + uwsgi_read_timeout 120s; uwsgi_pass uwsgi; + include /etc/nginx/uwsgi_params; } } } diff --git a/tools/docker-compose/nginx.conf b/tools/docker-compose/nginx.conf index 4f1f4e986e..9c9b7510e1 100644 --- a/tools/docker-compose/nginx.conf +++ b/tools/docker-compose/nginx.conf @@ -25,12 +25,6 @@ http { sendfile on; #tcp_nopush on; - - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - - keepalive_timeout 65; - #gzip on; include /etc/nginx/conf.d/*.conf; diff --git a/tools/docker-compose/nginx.vh.default.conf b/tools/docker-compose/nginx.vh.default.conf index 2325057378..5cabf89bbb 100644 --- a/tools/docker-compose/nginx.vh.default.conf +++ b/tools/docker-compose/nginx.vh.default.conf @@ -7,17 +7,32 @@ upstream daphne { } server { - listen 8013 default_server; - listen 8043 default_server ssl; + listen 8013 default_server; + listen [::]:8013 default_server; + return 301 https://$host:8043$request_uri; +} - # If you have a domain name, this is where to add it +server { + listen 8043 default_server ssl; + + # If you have a domain name, this is where to add it server_name _; - keepalive_timeout 70; + keepalive_timeout 65; - ssl_certificate /etc/nginx/nginx.crt; - ssl_certificate_key /etc/nginx/nginx.key; - ssl_protocols TLSv1 TLSv1.1 TLSv1.2; - ssl_ciphers HIGH:!aNULL:!MD5; + ssl_certificate /etc/nginx/nginx.crt; + ssl_certificate_key /etc/nginx/nginx.key; + + ssl_session_timeout 1d; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + + # intermediate configuration. tweak to your needs. + ssl_protocols TLSv1.2; + ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; + ssl_prefer_server_ciphers on; + + # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) + add_header Strict-Transport-Security max-age=15768000; location /static/ { root /tower_devel; @@ -26,30 +41,33 @@ server { sendfile off; } - location /websocket { - # Pass request to the upstream alias - proxy_pass http://daphne; - # Require http version 1.1 to allow for upgrade requests - proxy_http_version 1.1; - # We want proxy_buffering off for proxying to websockets. - proxy_buffering off; - # http://en.wikipedia.org/wiki/X-Forwarded-For - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - # enable this if you use HTTPS: - proxy_set_header X-Forwarded-Proto https; - # pass the Host: header from the client for the sake of redirects - proxy_set_header Host $http_host; - # We've set the Host header, so we don't need Nginx to muddle - # about with redirects - proxy_redirect off; - # Depending on the request value, set the Upgrade and - # connection headers - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - } + location /websocket { + # Pass request to the upstream alias + proxy_pass http://daphne; + # Require http version 1.1 to allow for upgrade requests + proxy_http_version 1.1; + # We want proxy_buffering off for proxying to websockets. + proxy_buffering off; + # http://en.wikipedia.org/wiki/X-Forwarded-For + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + # enable this if you use HTTPS: + proxy_set_header X-Forwarded-Proto https; + # pass the Host: header from the client for the sake of redirects + proxy_set_header Host $http_host; + # We've set the Host header, so we don't need Nginx to muddle + # about with redirects + proxy_redirect off; + # Depending on the request value, set the Upgrade and + # connection headers + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + } - location / { - include /etc/nginx/uwsgi_params; - uwsgi_pass uwsgi; - } + location / { + # Add trailing / if missing + rewrite ^(.*[^/])$ $1/ permanent; + uwsgi_read_timeout 120s; + uwsgi_pass uwsgi; + include /etc/nginx/uwsgi_params; + } }