From 27cb863308aa1a9126d61ff0bc805bf5a8ec089f Mon Sep 17 00:00:00 2001 From: Adam Nadrowski Date: Sun, 22 Sep 2024 16:06:53 -0400 Subject: [PATCH 1/4] ignoring certs --- .gitignore | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index a313e6e..d751cf3 100644 --- a/.gitignore +++ b/.gitignore @@ -135,4 +135,8 @@ files/ supervisord.pid sampledata/sigma/* external/* -INITIAL_ADMIN_PASSWORD.TXT \ No newline at end of file +INITIAL_ADMIN_PASSWORD.TXT + +# Certs for SSL +*.crt +*.key From d633f1a33f093aebff1324ae3510e07fe988e782 Mon Sep 17 00:00:00 2001 From: Adam Nadrowski Date: Sun, 22 Sep 2024 16:07:35 -0400 Subject: [PATCH 2/4] Modifying docker compose configuration to use self signed certs --- compose.yml | 33 ++++++++++++++++++++++++++++----- nginx/Dockerfile | 31 +++++++++++++++++++++++++++++++ nginx/generate_or_use_cert.sh | 14 ++++++++++++++ nginx/nginx.conf | 24 ++++++++++++++++++++++++ 4 files changed, 97 insertions(+), 5 deletions(-) create mode 100644 nginx/Dockerfile create mode 100644 nginx/generate_or_use_cert.sh create mode 100644 nginx/nginx.conf diff --git a/compose.yml b/compose.yml index e11eb8e..c6afae2 100644 --- a/compose.yml +++ b/compose.yml @@ -1,19 +1,20 @@ -version: '3.8' - services: mongodb: image: mongo:7.0-rc container_name: mongodb ports: - - 27017 + - 127.0.0.1:27017:27017 volumes: - mongodb_data:/data/db + networks: + - app-network + purpleops: build: . container_name: purpleops - command: gunicorn --bind 0.0.0.0:5000 purpleops:app + command: gunicorn --bind 0.0.0.0:5000 --forwarded-allow-ips="*" purpleops:app ports: - - "5000:5000" + - '127.0.0.1:5000:5000' env_file: - ./.env depends_on: @@ -21,6 +22,28 @@ services: volumes: - purpleops_data:/usr/src/app/ - ./custom:/usr/src/app/custom + networks: + - app-network + + nginx: + build: + context: ./nginx + dockerfile: Dockerfile + container_name: nginx + ports: + - '80:80' + - '443:443' + volumes: + - ./nginx/custom_certs:/etc/nginx/ssl + depends_on: + - purpleops + networks: + - app-network + volumes: mongodb_data: purpleops_data: + +networks: + app-network: + driver: bridge diff --git a/nginx/Dockerfile b/nginx/Dockerfile new file mode 100644 index 0000000..c96a021 --- /dev/null +++ b/nginx/Dockerfile @@ -0,0 +1,31 @@ +FROM nginx:alpine + +# Install OpenSSL +RUN apk add --no-cache openssl + +# Set working directory +WORKDIR /etc/nginx + +# Create ssl directory +# RUN mkdir -p /etc/nginx/ssl + +# Generate self-signed certificate +# RUN openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ +# -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt \ +# -subj "/C=US/ST=State/L=City/O=Organization/CN=localhost" + +# Copy a script to handle certificate generation or use +COPY generate_or_use_cert.sh /usr/src/app/ +RUN chmod +x /usr/src/app/generate_or_use_cert.sh + +# Copy nginx configuration +COPY nginx.conf /etc/nginx/nginx.conf + +# Expose port 443 +EXPOSE 443 + +# Set the entrypoint +ENTRYPOINT ["/usr/src/app/generate_or_use_cert.sh"] + +# Start Nginx +CMD ["nginx", "-g", "daemon off;"] \ No newline at end of file diff --git a/nginx/generate_or_use_cert.sh b/nginx/generate_or_use_cert.sh new file mode 100644 index 0000000..46e201e --- /dev/null +++ b/nginx/generate_or_use_cert.sh @@ -0,0 +1,14 @@ +#!/bin/sh + +if [ ! -f "/etc/nginx/ssl/nginx.crt" ] || [ ! -f "/etc/nginx/ssl/nginx.key" ]; then + echo "Generating self-signed certificates" + mkdir -p /etc/nginx/ssl + openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ + -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt \ + -subj "/C=US/ST=State/L=City/O=Organization/CN=purpleops" +else + echo "Nginx SSL certificates already exist" +fi + +# Execute the CMD +exec "$@" diff --git a/nginx/nginx.conf b/nginx/nginx.conf new file mode 100644 index 0000000..f114cfe --- /dev/null +++ b/nginx/nginx.conf @@ -0,0 +1,24 @@ +events { + worker_connections 1024; +} + +http { + server { + listen 80; + listen 443 ssl; + server_name localhost; + + ssl_certificate /etc/nginx/ssl/nginx.crt; + ssl_certificate_key /etc/nginx/ssl/nginx.key; + + location / { + proxy_pass http://purpleops:5000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + # proxy_set_header X-Forwarded-Host $server_name; + # proxy_set_header X-Forwarded-Port $server_port; + } + } +} \ No newline at end of file From b9ff3e79df75c2896e9d7eec5f472f88aa0523a7 Mon Sep 17 00:00:00 2001 From: Adam Nadrowski Date: Sun, 22 Sep 2024 18:21:16 -0400 Subject: [PATCH 3/4] Minor updates --- .env | 4 ++-- compose.yml | 6 +++--- nginx/Dockerfile | 8 -------- nginx/nginx.conf | 6 ++---- 4 files changed, 7 insertions(+), 17 deletions(-) diff --git a/.env b/.env index dbf4318..c863957 100644 --- a/.env +++ b/.env @@ -1,8 +1,8 @@ -MONGO_DB=assessments3 +MONGO_DB=assessments MONGO_HOST=mongodb MONGO_PORT=27017 -FLASK_DEBUG=True +FLASK_DEBUG=False FLASK_MFA=False HOST=0.0.0.0 diff --git a/compose.yml b/compose.yml index c6afae2..597db5e 100644 --- a/compose.yml +++ b/compose.yml @@ -14,7 +14,7 @@ services: container_name: purpleops command: gunicorn --bind 0.0.0.0:5000 --forwarded-allow-ips="*" purpleops:app ports: - - '127.0.0.1:5000:5000' + - 127.0.0.1:5000:5000 env_file: - ./.env depends_on: @@ -31,8 +31,8 @@ services: dockerfile: Dockerfile container_name: nginx ports: - - '80:80' - - '443:443' + - 80:80 + - 443:443 volumes: - ./nginx/custom_certs:/etc/nginx/ssl depends_on: diff --git a/nginx/Dockerfile b/nginx/Dockerfile index c96a021..831bdc5 100644 --- a/nginx/Dockerfile +++ b/nginx/Dockerfile @@ -6,14 +6,6 @@ RUN apk add --no-cache openssl # Set working directory WORKDIR /etc/nginx -# Create ssl directory -# RUN mkdir -p /etc/nginx/ssl - -# Generate self-signed certificate -# RUN openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -# -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt \ -# -subj "/C=US/ST=State/L=City/O=Organization/CN=localhost" - # Copy a script to handle certificate generation or use COPY generate_or_use_cert.sh /usr/src/app/ RUN chmod +x /usr/src/app/generate_or_use_cert.sh diff --git a/nginx/nginx.conf b/nginx/nginx.conf index f114cfe..4d06646 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -4,7 +4,8 @@ events { http { server { - listen 80; + # uncomment to listen on port 80 + # listen 80; listen 443 ssl; server_name localhost; @@ -15,10 +16,7 @@ http { proxy_pass http://purpleops:5000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; - # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; - # proxy_set_header X-Forwarded-Host $server_name; - # proxy_set_header X-Forwarded-Port $server_port; } } } \ No newline at end of file From 5317609d8355aad970d6179b923ddf066ef35e68 Mon Sep 17 00:00:00 2001 From: Adam Nadrowski Date: Sun, 22 Sep 2024 18:29:19 -0400 Subject: [PATCH 4/4] rename volume to a more accurate name --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 597db5e..a84fbc3 100644 --- a/compose.yml +++ b/compose.yml @@ -34,7 +34,7 @@ services: - 80:80 - 443:443 volumes: - - ./nginx/custom_certs:/etc/nginx/ssl + - ./nginx/certs:/etc/nginx/ssl depends_on: - purpleops networks: