Skip to content

Commit 96974b1

Browse files
geerlingguygeerlingguy
committed
Issue #83: Add Nginx HTTPS Proxy example and test.
1 parent 603b08d commit 96974b1

File tree

12 files changed

+211
-3
lines changed

12 files changed

+211
-3
lines changed

‎.travis.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ env:
3232
- playbook: https-self-signed.yml
3333
distro: ubuntu1604
3434

35+
- playbook: https-nginx-proxy.yml
36+
distro: debian10
37+
3538
- playbook: includes.yml
3639
distro: ubuntu1604
3740

‎https-nginx-proxy/README.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# HTTPS Nginx Proxy demo VM
2+
3+
This project spins up a VM and demonstrates Nginx proxying HTTPS traffic to an HTTP-only backend application.
4+
5+
## Quick Start Guide
6+
7+
### 1 - Install dependencies (VirtualBox, Vagrant, Ansible)
8+
9+
1. Download and install [VirtualBox](https://www.virtualbox.org/wiki/Downloads).
10+
2. Download and install [Vagrant](http://www.vagrantup.com/downloads.html).
11+
3. [Mac/Linux only] Install [Ansible](http://docs.ansible.com/intro_installation.html).
12+
13+
Note for Windows users: *This guide assumes you're on a Mac or Linux host. Windows hosts are unsupported at this time.*
14+
15+
### 2 - Build the Virtual Machine
16+
17+
1. Download this project and put it wherever you want.
18+
2. Open Terminal, cd to this 'provisioning' directory.
19+
3. Run `ansible-galaxy install -r requirements.yml` to install required Ansible roles.
20+
4. cd up one level to this directory (with the README and Vagrantfile).
21+
4. Type in `vagrant up`, and let Vagrant do its magic.
22+
23+
Note: *If there are any errors during the course of running `vagrant up`, and it drops you back to your command prompt, just run `vagrant provision` to continue building the VM from where you left off. If there are still errors after doing this a few times, post an issue to this project's issue queue on GitHub with the error.*
24+
25+
### 3 - Configure your host machine to access the VM.
26+
27+
1. [Edit your hosts file](http://www.rackspace.com/knowledge_center/article/how-do-i-modify-my-hosts-file), adding the line `192.168.46.84 https-proxy.test` so you can connect to the VM.
28+
2. Open your browser and access [http://https.test](http://https.test), and you should be redirected to the `https://` version of the URL.
29+
30+
## Notes
31+
32+
- To shut down the virtual machine, enter `vagrant halt` in the Terminal in the same folder that has the `Vagrantfile`. To destroy it completely (if you want to save a little disk space, or want to rebuild it from scratch with `vagrant up` again), type in `vagrant destroy`.
33+
34+
## About the Author
35+
36+
This project was created by [Jeff Geerling](https://www.jeffgeerling.com/) as an example for [Ansible for DevOps](https://www.ansiblefordevops.com/).

‎https-nginx-proxy/Vagrantfile

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# -*- mode: ruby -*-
2+
# vi: set ft=ruby :
3+
4+
VAGRANTFILE_API_VERSION = "2"
5+
6+
Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
7+
config.vm.box = "geerlingguy/debian10"
8+
config.vm.hostname = "https-proxy.test"
9+
config.vm.network :private_network, ip: "192.168.46.84"
10+
config.ssh.insert_key = false
11+
12+
config.vm.provider :virtualbox do |v|
13+
v.memory = 512
14+
end
15+
16+
# Ansible provisioning.
17+
config.vm.provision "ansible" do |ansible|
18+
ansible.playbook = "provisioning/main.yml"
19+
ansible.become = true
20+
ansible.extra_vars = {
21+
ansible_python_interpreter: "/usr/bin/python3",
22+
}
23+
end
24+
end

‎https-nginx-proxy/provisioning/ansible.cfg

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[defaults]
2+
host_key_checking = False
3+
roles_path = ./roles
4+
nocows = 1
5+
6+
[ssh_connection]
7+
control_path = %(directory)s/%%h-%%p-%%r
8+
pipelining = True

‎https-nginx-proxy/provisioning/files/index.html

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<title>HTTPS Nginx Proxy Test</title>
5+
<style>* { font-family: Helvetica, Arial, sans-serif }</style>
6+
</head>
7+
<body>
8+
<h1>HTTPS Nginx Proxy Test</h1>
9+
<p>If you can see this message, it worked!</p>
10+
</body>
11+
</html>

‎https-nginx-proxy/provisioning/main.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
- hosts: all
3+
4+
vars_files:
5+
- vars/main.yml
6+
7+
pre_tasks:
8+
- name: Ensure apt cache is updated.
9+
apt: update_cache=true cache_valid_time=600
10+
11+
- name: Install dependency for pyopenssl.
12+
apt: name=libssl-dev state=present
13+
14+
roles:
15+
- geerlingguy.firewall
16+
- geerlingguy.pip
17+
- geerlingguy.nginx
18+
19+
tasks:
20+
- import_tasks: tasks/self-signed-cert.yml
21+
22+
- name: Ensure docroot exists.
23+
file:
24+
path: "{{ nginx_docroot }}"
25+
state: directory
26+
27+
- name: Copy example index.html file in place.
28+
copy:
29+
src: files/index.html
30+
dest: "{{ nginx_docroot }}/index.html"
31+
mode: 0755
32+
33+
- name: Start simple python webserver on port 8080.
34+
shell: >
35+
python3 -m http.server 8080 --directory {{ nginx_docroot }} &
36+
changed_when: false
37+
async: 45
38+
poll: 0
39+
40+
- name: Copy Nginx server configuration in place.
41+
template:
42+
src: templates/https.test.conf.j2
43+
dest: /etc/nginx/sites-enabled/https.test.conf
44+
mode: 0644
45+
notify: restart nginx

‎https-nginx-proxy/provisioning/requirements.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
- src: geerlingguy.firewall
3+
- src: geerlingguy.pip
4+
- src: geerlingguy.nginx

‎https-nginx-proxy/provisioning/tasks/self-signed-cert.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
- name: Ensure directory exists for local self-signed TLS certs.
3+
file:
4+
path: "{{ certificate_dir }}/{{ server_hostname }}"
5+
state: directory
6+
7+
- name: Generate an OpenSSL private key.
8+
openssl_privatekey:
9+
path: "{{ certificate_dir }}/{{ server_hostname }}/privkey.pem"
10+
11+
- name: Generate an OpenSSL CSR.
12+
openssl_csr:
13+
path: "{{ certificate_dir }}/{{ server_hostname }}.csr"
14+
privatekey_path: "{{ certificate_dir }}/{{ server_hostname }}/privkey.pem"
15+
common_name: "{{ server_hostname }}"
16+
17+
- name: Generate a Self Signed OpenSSL certificate.
18+
openssl_certificate:
19+
path: "{{ certificate_dir }}/{{ server_hostname }}/fullchain.pem"
20+
privatekey_path: "{{ certificate_dir }}/{{ server_hostname }}/privkey.pem"
21+
csr_path: "{{ certificate_dir }}/{{ server_hostname }}.csr"
22+
provider: selfsigned

‎https-nginx-proxy/provisioning/templates/https.test.conf.j2

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# HTTPS Test server configuration.
2+
3+
# Redirect HTTP traffic to HTTPS.
4+
server {
5+
listen 80 default_server;
6+
server_name _;
7+
index index.html;
8+
return 301 https://$host$request_uri;
9+
}
10+
11+
# Proxy HTTPS traffic using the self-signed certificate created by Ansible.
12+
server {
13+
listen 443 ssl default_server;
14+
server_name {{ server_hostname }};
15+
16+
location / {
17+
include /etc/nginx/proxy_params;
18+
proxy_pass http://localhost:8080;
19+
proxy_read_timeout 90s;
20+
proxy_redirect http://localhost:8080 {{ server_hostname }};
21+
}
22+
23+
ssl_certificate {{ certificate_dir }}/{{ server_hostname }}/fullchain.pem;
24+
ssl_certificate_key {{ certificate_dir }}/{{ server_hostname }}/privkey.pem;
25+
}

‎https-nginx-proxy/provisioning/vars/main.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
# Firewall settings.
3+
firewall_allowed_tcp_ports:
4+
- "22"
5+
- "80"
6+
- "443"
7+
8+
# Python settings.
9+
pip_package: python3-pip
10+
pip_install_packages: ['pyopenssl']
11+
12+
# Nginx settings.
13+
nginx_vhosts: []
14+
nginx_remove_default_vhost: True
15+
nginx_ppa_use: True
16+
nginx_ppa_version: stable
17+
nginx_docroot: /var/www/html
18+
19+
# Self-signed certificate settings.
20+
certificate_dir: /etc/ssl/private
21+
server_hostname: https-proxy.test

0 commit comments

Comments
 (0)