Let's encrypt SSL like onthe demo instance

[mittkkoo]

I'm using the package installation on ubuntu 20.04 and want to setup SSL with let's encrypt.

https://demo.inventree.org/ uses Let's encrypt for SSL. I bet many people will be interested in having SSL. Since the configuration may be cumbersome, is it possible to share the server configuration of the demo instance so people can have a starting point? Or maybe there is already a tutorial for that?

[matmair]

The package install uses nginx as a web proxy/server, every tutorial for that server should work.
The demo is not using the package install method.

[mittkkoo]

Here is how I did it on Ubuntu 20.04 with inventree installed from package. Maybe someone will find the instructions usefull. I'm curious if this will be update safe...

Make sure the ufw (if used as firewall on the server) has the profile Nginx Full enabled. Run ufw status. The output should look like this:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT       Anywhere                  
Nginx Full                 ALLOW       Anywhere                  
22/tcp (v6)                LIMIT       Anywhere (v6)             
Nginx Full (v6)            ALLOW       Anywhere (v6)  

Install certbot with nginx plugin

apt update
apt install python3-certbot-nginx

Stop nginx

systemctl stop nginx

Backup the nginx server configuration to sites-available. (The conf's there are not used unless a symlink is created for them in sites-enabled.)

cp /etc/nginx/sites-enabled/inventree.conf /etc/nginx/sites-available/inventree_old.conf

Modify /etc/nginx/sites-enabled/inventree.conf by adding these lines after the line listen 80; and replacing some.example.com with the DNS entry which has an A DNS record pointing to the server's IP. (For Digitalocean: always point to a reserved IP.) Use for example nano inventree.conf.

    listen [::]:80;
    server_name some.example.com;

Move the conf to sites-available and rename it to inventree_80.conf in order to denote this is the conf for http. Create a symlink in sites-enabled.

mv /etc/nginx/sites-enabled/inventree.conf /etc/nginx/sites-available/inventree_80.conf
sudo ln -s /etc/nginx/sites-available/inventree_80.conf /etc/nginx/sites-enabled/

Let certbot issue certificates

certbot --nginx -d some.example.com

When asked, choose not to redirect (1), because redirection will be handeled in the server conf later.
See where the certificates are stored with certbot certificates and copy both paths for later.

    Certificate Path: /etc/letsencrypt/live/some.example.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/some.example.com/privkey.pem

Run nano /etc/nginx/nginx.conf and uncomment the line

       server_names_hash_bucket_size 64;

Run

wget -q https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem -P /etc/nginx/ssl

Run (depending on the server resources this will take really long time!)

openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096

Check if the nginx configurations are OK

sudo nginx -t

Start nginx

systemctl start nginx

Create a new server conf in sites-available with nano /etc/nginx/sites-available/inventree_ssl.conf. Thereby replace all four occurancies of some.example.com and check if the paths ssl_certificate and ssl_certificate_key match the paths certbot reported above.

server {
	listen 80;
	listen [::]:80;

	server_name some.example.com;

	# security - prevent information disclosure about server version
	server_tokens off;

	access_log /var/log/nginx/inventree.access.log;
	error_log /var/log/nginx/inventree.error.log;

	location /.well-known/ {
    root /var/www/html;
	}

	return 301 https://$server_name$request_uri;

}

server {

	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name some.example.com;

	# security - prevent information disclosure about server version
	server_tokens off;
	
	ssl_certificate /etc/letsencrypt/live/some.example.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/some.example.com/privkey.pem;

	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384';


	ssl_dhparam /etc/nginx/ssl/dhparam.pem;

	ssl_prefer_server_ciphers on;
	
	
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 180m;

	ssl_stapling on;
	ssl_stapling_verify on;

	ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;

	resolver 8.8.8.8 8.8.4.4;

	add_header Strict-Transport-Security "max-age=31536000" always;
  
    real_ip_header proxy_protocol;

    location / {

        proxy_set_header      Host              $http_host;
        proxy_set_header      X-Forwarded-By    $server_addr:$server_port;
        proxy_set_header      X-Forwarded-For   $remote_addr;
        proxy_set_header      X-Forwarded-Proto $scheme;
        proxy_set_header      X-Real-IP         $remote_addr;
        proxy_set_header      CLIENT_IP         $remote_addr;

        proxy_pass_request_headers on;

        proxy_redirect off;

        client_max_body_size 100M;

        proxy_buffering off;
        proxy_request_buffering off;

        # Do not touch this unless you have a specific reason - this and the docker-compose need to match
        proxy_pass http://localhost:6000;
    }

    # Redirect any requests for static files
    location /static/ {
        alias /opt/inventree/data/static/;
        autoindex on;

        # Caching settings
        expires 30d;
        add_header Pragma public;
        add_header Cache-Control "public";
    }

    # Redirect any requests for media files
    location /media/ {
        alias /opt/inventree/data/media/;

        # Media files require user authentication
        auth_request /auth;

        # Content header to force download
        add_header Content-disposition "attachment";
    }

    # Use the 'user' API endpoint for auth
    location /auth {
        internal;

        proxy_pass http://localhost:6000/auth/;

        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }

}

Create a symlink for the new conf in sites-enabled and remove the other conf symlink.

sudo ln -s /etc/nginx/sites-available/inventree_ssl.conf /etc/nginx/sites-enabled/
rm /etc/nginx/sites-enabled/inventree_80.conf

Start nginx

systemctl start nginx

Check if certbot will be able to renew the certificates in future

sudo certbot renew --dry-run

Check the score of the new configuration with https://www.ssllabs.com/ssltest/analyze.html?d=some.example.com. It should be A+.

[matmair]

Good intentions but this will stop working on package installs the second we ship a new nginx config.

[SchrodingersGat]

@mittkkoo the process for the demo server (which also runs on docker) is very similar. It might be a good blog post - not "official" documentation but potentially useful.

[mittkkoo]

I'm here to report that this config survived an update from 0.12.8 to 0.13.0.

[gid204]

I'm here on 0.16.3 and these instructions worked for me, thank you!
Ubuntu 20.04, Inventree installed via script.