You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/README.md
+2-22Lines changed: 2 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,28 +70,8 @@ docker compose -f dev-compose.yml down
70
70
71
71
### Docassemble
72
72
73
-
If you are running the docker container on the same machine as docassemble, you will likely need to add the following changes to your EfileProxyServer repo:
# Necessary b/c docassemble is external to the docker network
82
-
ports:
83
-
- target: 9009
84
-
- published: 80
85
-
+ published: 9000
86
-
- target: 9000
87
-
- published: 443
88
-
+ published: 9001
89
-
env_file: .env
90
-
depends_on:
91
-
- "db"
92
-
```
93
-
94
-
This allows both docassemble and the proxy server to run on the same machine (by default both use the default HTTP and HTTPS ports, 80 and 443).
73
+
If you are running the docker container on the same machine as docassemble, use the `-f dev-compose.yml` command
74
+
above to allow this server and docassemble to use different HTTP ports.
95
75
96
76
To communicate with the Efile Proxy Server from docassemble using the [EFSPIntegration package](https://github.com/SuffolkLITLab/docassemble-EFSPIntegration), you will need to add some config values in docassemble's config:
Copy file name to clipboardExpand all lines: docs/https.md
+3-73Lines changed: 3 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,76 +5,6 @@ can read the sensitive information passed to the proxy server in plaintext.
5
5
6
6
For a simple explainer, see [Julia Evan's Twitter comic about it](https://twitter.com/b0rk/status/809594614147645440/photo/1).
7
7
8
-
## Getting a Certificate
9
-
10
-
The first of two steps to using HTTPS is actually getting a signed TLS certificate from a certificate signer.
11
-
12
-
### Using Let's Encrypt and ACME
13
-
14
-
We've integrated [Let's Encrypt](https://letsencrypt.org/) support into our server with the [ACME protocol](https://letsencrypt.org/how-it-works/), using [acme4j](https://github.com/shred/acme4j).
15
-
16
-
We are still working to improve the steps, but current the process is:
17
-
18
-
1. In your `.env` file, set `USE_LETSENCRYPT=True`, and `CERT_PASSWORD` to a securely generated password, at least 16 characters.
19
-
Something like `openssl rand -base64 12` will generate 16 characters securely.
20
-
* You can also set a `MONITORING_EMAIL` which will be used for email renewal reminders from Lets Encrypt.
21
-
2. Start up the docker containers (see [setup.md](setup.md)).
22
-
3. Start a shell inside the running container: `docker exec -it efileproxyserver-efspjava-1 /bin/sh`
23
-
4. Change directories to the app: `cd /app`.
24
-
5. Run the ACME renewal process: `java -cp efspserver-with-deps.jar edu.suffolk.litlab.efsp.server.services.acme.AcmeRenewal renew`.
25
-
If the renewal process succeeded, `acme-domain-chain.crt` and `tls_server_cert.jks`
26
-
should both be present in `/tmp/tls_certs` inside the container and in `src/main/config` outside the container.
27
-
6. Exit the shell you started, and rebuild and restart the java docker container.
28
-
29
-
The newly started container should be able to serve HTTPS correctly!
30
-
31
-
### (Not preferred) From a Certificate Authority
32
-
33
-
This was the original way we did things, but Let's Encrypt is currently simpler and more secure than
34
-
sending around important certificates files. If Let's Encrypt doesn't work for your organization,
35
-
you can follow the below steps that we took when we set up HTTPS using a purchased signed certificate.
36
-
37
-
You can purchase TLS Certificates from providers directly, (for example, [from namecheap](https://www.namecheap.com/security/ssl-certificates/)). You should receive the following files:
38
-
* a bundle of certificate authorities who make up the chain of CAs who signed your certificate. In our case, this had a `*.ca-bundle` extension.
39
-
* The signed certificate for your website. In our case, this had a `*.crt` extension.
40
-
* The private key for your website, sometimes called the domain key. In our case, this had a `*.key` extension.
41
-
42
-
Once you have those three things, you need to turn convert them into the Java Key Store (JKS) format, which the server can read. You can follow the below steps in a shell with `openssl` and `keytool` installed:
43
-
44
-
```bash
45
-
# Add the full list of CA signers to the cert. Going to the root signer means it's more likely
46
-
# for the server to be trusted. Not always necessary, but was in our case.
* The ServerConfig.xml shouldn't use the `clientAuthentication` elem, as it expects our connecting clients to also have a TLS cert, which isn't how HTTPS traffic usually works.
* The external address (i.e `ServerFactoryBean.setAddress`) needs to be `https://`, not `http://`. We use `CERT_PASSWORD` to determine if someone is trying to run with TLS, and if no `CERT_PASSWORD` is present, we use `http://`.
72
-
73
-
74
-
The following CXF documentation pages have more information, but are kinda sparse:
We previously had [custom code to retrieve certs](https://github.com/SuffolkLITLab/EfileProxyServer/blob/b287ed3fe42e71458b8a594d0287d542b6f6035e/docs/https.md#getting-a-certificate), but now use our hosting provider, fly, to [generate certs for us](https://fly.io/docs/flyctl/certs/). We recommend something similar for folks looking to run
9
+
their own version of this server. If your hosting provider doesn't provide certs, you can
10
+
look into using [nginx and letsencrypt together](esc.sh/blog/lets-encrypt-and-nginx-definitive-guide/) as a reverse proxy for this server.
0 commit comments