search

yongjhih / docker-parse-server

Provide docker images and docker stack for parse-server npm versions and latest commit
https://hub.docker.com/r/yongjhih/parse-server/
Apache License 2.0
475 stars 166 forks source link

Tighten up the security #25

Open jacek-berlin opened 8 years ago

jacek-berlin commented 8 years ago

All the ports are open to the outside world. If you want to run this on Internet facing server make sure to take care of it.

Easiest way is to tell docker to bind ports only to localhost so instead of 27017:27017 use 127.0.0.1:27017:27017

and make sure your host has a firewall in place.

egorvas commented 8 years ago

Also I will be glad to see opportunity to use https instead of http

yongjhih commented 8 years ago

See Also: https://github.com/yongjhih/docker-parse-server#usage-of-https-certificated-domain-with-letsencrypt

cleever commented 8 years ago

Great work @yongjhih

egorvas commented 8 years ago

Seems that https way dosen't work correctly, so this is example of my compose script:

USER1=yotatravel USER1_PASSWORD=yotatravel PARSE_DASHBOARD_VIRTUAL_HOST=parse.yotatravel.tk PARSE_DASHBOARD_LETSENCRYPT_HOST=parse.yotatravel.tk PARSE_DASHBOARD_LETSENCRYPT_EMAIL=egorvas@gmail.com PARSE_SERVER_VIRTUAL_HOST=api.yotatravel.tk PARSE_SERVER_LETSENCRYPT_HOST=api.yotatravel.tk PARSE_SERVER_LETSENCRYPT_EMAIL=egorvas@gmail.com SERVER_URL=https://api.yotatravel.tk/parse APP_ID=yotatravel MASTER_KEY=yotatravel docker-compose -f docker-compose-le.yml up

With this configuration dns working good and parse.yotatravel.tk and api.yotatravel.tk domains are working. But yongjhih/parse-dashboard, yongjhih/parse-cloud-code, dockerparseserver_mongo-data_1 containers crashed. Also during letsencrypt-nginx-proxy-companion process this messages was shown:

2016-05-06 13:29:16,405:ERROR:simp_le:1271: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Is there a warning log entry about unsuccessful self-verification? Are all your domains accessible from the internet? Failing authorizations: https://acme-v01.api.letsencrypt.org/acme/authz/5MI7LyxpOMxYRM-EYqRZlNIdODWDg8-RikF1P8q_AAg

2016-05-06 13:29:20,668:ERROR:acme.challenges:256: Unable to reach http://parse.yotatravel.tk/.well-known/acme-challenge/eOQEOSIS60tBWYifOxvF4eLpmQlMKZPpySv8oL9OVms: HTTPConnectionPool(host='parse.yotatravel.tk', port=80): Max retries exceeded with url: /.well-known/acme-challenge/eOQEOSIS60tBWYifOxvF4eLpmQlMKZPpySv8oL9OVms (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection object at 0x7fc65aa13050>: Failed to establish a new connection: [Errno -2] Name does not resolve',))

I can provide full stacktrace if you want

yongjhih commented 8 years ago

I can not reproduce it. Do you have public ip on machine?

https://youtu.be/9ia2a9hfLkU

cleever commented 8 years ago

@egorvas Same error here.

Additional informational:

WARNING:simp_le:1303: api.**\ was not successfully self-verified. CA is likely to fail as well! letsencrypt-nginx-proxy-companion | Challenge validation has failed, see error log.

egorvas commented 8 years ago

@cleever yeap, thank you you right, already found and fixed

cleever commented 8 years ago

@egorvas Could you post your solution for the community?

egorvas commented 8 years ago

@cleever It hard to explain my solution, I just remove all my parse containers from the docker and I tried again with same configuration