feat: Add HTTPS support with mkcert and automatic SSL configuration

Add comprehensive HTTPS support with two deployment options: - mkcert for local development with trusted certificates - Automatic SSL with Let's Encrypt for production HTTPS Implementation: - Add docker-compose.https-mkcert.yml for local HTTPS development - Add docker-compose.https-auto.yml for automatic SSL certificates - Create Dockerfile.mkcert for certificate generation - Add setup scripts (setup-https-mkcert.sh/bat) - Add startup scripts (start-https.sh/bat) - Add certificate generation script (generate-mkcert-certs.sh) CSRF and IP Access Fixes: - Fix CSRF token validation for IP-based access - Add CSRF troubleshooting documentation - Update configuration to handle various access patterns Documentation: - Add HTTPS_MKCERT_GUIDE.md with setup instructions - Add README_HTTPS.md with general HTTPS documentation - Add README_HTTPS_AUTO.md for automatic SSL setup - Add AUTOMATIC_HTTPS_SUMMARY.md - Add CSRF_IP_ACCESS_FIX.md and CSRF_IP_FIX_SUMMARY.md - Add docs/CSRF_IP_ACCESS_GUIDE.md - Update main README.md with HTTPS information Configuration: - Update .gitignore for SSL certificates and nginx configs - Update env.example with new HTTPS-related variables - Update docker-compose.yml with SSL configuration options This enables secure HTTPS access in both development and production environments while maintaining compatibility with existing deployments.
2026-05-07 04:50:32 -05:00 · 2025-10-13 18:32:45 +02:00
parent e61c628526
commit 94e8e49439
25 changed files with 3527 additions and 25 deletions
@@ -0,0 +1,67 @@
+server {
+    listen 80;
+    listen [::]:80;
+    # Redirect all HTTP to HTTPS on the same host
+    return 308 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    # Catch-all; optionally set a specific server_name
+    server_name _;
+
+    ssl_certificate     /etc/nginx/ssl/cert.pem;
+    ssl_certificate_key /etc/nginx/ssl/key.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    # Security headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Proxy to application
+    location / {
+        proxy_pass http://app:8080;
+        # Preserve original host including port (e.g., localhost:8443)
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Preserve cookies
+        proxy_pass_request_headers on;
+        proxy_cookie_path / /;
+    }
+
+    # Socket.IO (WebSocket) endpoint
+    location /socket.io/ {
+        proxy_pass http://app:8080/socket.io/;
+        # WebSocket upgrade headers
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Preserve original host and client details
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Timeouts and buffering suitable for long-lived WS
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+        proxy_buffering off;
+    }
+}
+
+