minibolt-guide / minibolt

A step-by-step guide to building a Bitcoin & Lightning node, and other stuff on a personal computer
https://minibolt.info
MIT License
74 stars 37 forks source link

nginx: automatic redirection of HTTP traffic to HTTPS #18

Closed 1ma closed 1 year ago

1ma commented 1 year ago

What

This PR proposes separating the reverse proxying of websites from pure TCP stream data (for now this is only electrs), so that these sites can be automatically redirected to HTTPS when the end user doesn't write the full URL in the browser.

Why

The current NGINX configuration is very simple and easy to maintain, but the stream directive cannot observe the traffic so it is unable to redirect HTTP requests to HTTPS.

Because of this, currently when the user types (for instance) 192.168.0.100:4000 in his browser, NGINX shows an error instead of redirecting automatically to https://192.168.0.100:4000.

By adding an http directive to nginx.conf that maps to /etc/nginx/sites-enabled we can use this directory to set up websites with HTTPS redirect. In the configuration file of each website, the error_page 497 ... directive makes the redirect when necessary: https://chrisguitarguy.com/2019/08/20/redirecting-http-requests-on-an-https-listener-in-nginx-status-code-497/

Scope

Fixes # (link issue)

Test & maintenance

:exclamation: I searched for nginx usages in all the project, but for now I only tested these changes in the BTC RCP Explorer.

1ma commented 1 year ago

By the way is there any reason why there is not a TLS reverse proxy for Fulcrum? Do you want me to add it to the PR?

twofaktor commented 1 year ago

Great addon! Thanks for your contribution, I will have a look in coming days. Fulcrum integrate SSL certificate creation and reading.

Check out this: https://twofaktor.github.io/minibolt/guide/bitcoin/electrum-server.html#configuration

## Fulcrum server general settings 
cert = /data/fulcrum/cert.pem 
key = /data/fulcrum/key.pem

So it don't need to use reverse proxy

Anyway, Fulcrum use an own Server Electrum protocol, not a web server http protocol

1ma commented 1 year ago

BTCEXP tested, RTL tested. Non-tested bits moved to #19

Ready to merge from my end.