postgresql secure upstream about nginx-le HOT 5 CLOSED

nginx-le doesn't do any magic. All it does is LE certificate update and replacement of SSL_CERT, SSL_CERT and SSL_CHAIN_CERT with those cert paths. And the file you mapped to /etc/nginx/service.conf will be copied to /etc/nginx.d/conf/ and this about it.

You can see what it made by yourself inside the container, i.e. docker exec -it nginx cat /etc/nginx/conf.d/service.conf. As long as your source service.conf valid the result should be valid as well, so whatever works with nginx will be working fine with nginx-le because nginx-le is the nginx.

from nginx-le.

Thanks for your reply.
With a bit of hacking I managed to make it work (but I finally realized that I could not do SSL termination for that TCP stream as it requires NGINX Plus (see https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-tcp/).

from nginx-le.

Can you please post what you did at least briefly? Otherwise somebody will find this thread and will not be able to learn about how to do what you did.

from nginx-le.

Sure,

in the docker-compose.yml, I add a volume like so: - ./path_to/service_db.conf:/etc/nginx/stream.d/service_db.conf

and the content of service_db.conf (see the hardcoded value for ssl_certificate as nginx-le script does not take care of this)

upstream postgres {
    server localhost:5432;
}

server {
    listen     5433;
    proxy_pass postgres;
    proxy_ssl  on;

    ssl_certificate         /etc/nginx/ssl/le-crt.pem;
    ssl_certificate_key     /etc/nginx/ssl/le-key.pem;
    ssl_trusted_certificate /etc/nginx/ssl/le-chain-crt.pem;   

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/ssl/dhparams.pem;
    ssl_ecdh_curve secp384r1;
    ssl_session_timeout 10m;
}

Maybe one enhancement of neginx-le script could be to retrieve all files that look like stream_*.conf and replace certificate path the same way as service*.conf and move the files to stream.dfolder.

That is just a pity that open source nginx does not handle SSL termination for TCP upstream...

from nginx-le.

@vtoupet thanks for the idea, will be done in #48. I believe it was proposed some time ago in another issue but we didn't pick it up at that time.

from nginx-le.