nginx-https-config.sh

#!/bin/bash

# Django usually listens on port 8000 without SSL.
# Some of our projects however require SSL.
# Run this script to set up nginx SSL proxy for Django.


if [[ "$EUID" != 0 ]]; then
    echo "Need to be run as root."
    exit 1
fi

SITES_AVAILABLE="/etc/nginx/sites-available"
SITES_ENABLED="/etc/nginx/sites-enabled"
CONFIG_FILENAME="443-ssl-to-8000"

CERT_PUB="/etc/ssl/certs/ssl-cert-snakeoil.pem"
CERT_KEY="/etc/ssl/private/ssl-cert-snakeoil.key"

set -e  # die on error
set -u  # die if some var not set

if [[ ! -d "$SITES_AVAILABLE" ]] || [[ ! -d "$SITES_AVAILABLE" ]]; then
    echo "Is nginx installed?"
    exit 1
fi

if [[ ! -e "$CERT_PUB" ]] || [[ ! -e "$CERT_KEY" ]]; then
    echo "No snakeoil certs?"
    exit 1
fi

echo "Seting up site config..."

sudo cat > "$SITES_AVAILABLE/$CONFIG_FILENAME" << EOF

upstream localhost8000 {
  server localhost:8000;
}

server {
  listen     443;
  ssl  on;

  allow 127.0.0.1;
  allow 141.71.113.0/24;
  deny all;

  ssl_certificate                $CERT_PUB;
  ssl_certificate_key            $CERT_KEY;
  ssl_protocols                  TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers                 "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

  location / {
    proxy_pass        http://localhost8000;
    proxy_set_header  Host \$host;
    proxy_set_header  X-Forwarded-For \$remote_addr;
    proxy_set_header  X-Forwarded-Proto "https";
    proxy_set_header  REMOTE-USER \$remote_user;
  }
}

EOF

set +e  # stop dying on errors now

sudo ln -f -s "$SITES_AVAILABLE/$CONFIG_FILENAME" "$SITES_ENABLED/"

echo "Restarting nginx..."

sudo systemctl restart nginx

if [[ "`systemctl is-active nginx`" == "active" ]]; then
    echo "http://localhost:8000 with SSL is here: https://localhost"
else
    echo "Oops. Seems like nginx is dead now."
    echo
    systemctl status nginx | cat
    echo
fi

exit