Mise en place en https
CAS 1 : Serveur NGINX
Modification du fichier pod/custom/settings_local.py
...
| Bloc de code |
|---|
sudo systemctl restart uwsgi-pod nginx |
CAS 2 : serveur Apache
Mise en place d'un serveur front de type Apache: configuration des fichiers pod.conf et pod-ssl.conf
- configuration du fichier pod.conf
| Bloc de code |
|---|
<VirtualHost *:80> |
...
ServerAdmin pod@univ.fr |
...
ServerName pod.univ.fr |
...
DocumentRoot /var/www/html |
...
RewriteEngine On |
...
RewriteCond %{HTTPS} !on |
...
RewriteRule (.*) https://%{HTTP_HOST}/ |
...
ErrorLog ${APACHE_LOG_DIR}/pod_error.log |
...
CustomLog ${APACHE_LOG_DIR}/pod_access.log combined |
...
</VirtualHost> |
2. configuration du fichier pod-ssl.conf
| Bloc de code |
|---|
<VirtualHost *:443> |
...
ServerAdmin pod@univ.fr |
...
ServerName pod.univ.fr |
...
SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW |
...
SSLProxyCheckPeerCN Off SSLProxyCheckPeerName Off SSLProxyVerify none SSLCertificateFile /etc/apache2/ssl/pod_univ.fr.crt |
...
SSLCertificateKeyFile /etc/apache2/ssl/pod_univ.fr.key |
...
SSLCertificateChainFile /etc/apache2/ssl/DigiCertCA.crt |
...
DocumentRoot /var/www/html |
...
Header always set X-Frame-Options "sameorigin" |
...
RewriteEngine On |
...
ProxyPassReverse / http://ip_priv_pod_ |
...
apache/ ProxyPass / http://ip_priv_pod_ |
...
apache/ ProxyPreserveHost On <Proxy *> Order deny,allow Allow from all </Proxy> <Directory /> Options FollowSymLinks AllowOverride None </Directory> CustomLog /var/log/apache2/pod_access.log combined |
...
ErrorLog /var/log/apache2/pod_error.log |
...
ServerSignature Off |
...
</VirtualHost> |
→ relancer apache
sur le serveur front-pod-priv
ajouter les lignes suivantes dans pod/custom/settings_local.py
ajouter les lignes suivante :
| Bloc de code |
|---|
SESSION_COOKIE_SECURE = True |
...
CSRF_COOKIE_SECURE = True |
...
USE_X_FORWARDED_HOST = True |
...
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') |
puis
...
relancer
...
le
...
service
| Bloc de code |
|---|
sudo systemctl restart uwsgi-pod |