Security improvements to docker deployment

.env

@@ -1,8 +1,8 @@
-MONGO_DB=assessments3
+MONGO_DB=assessments
 MONGO_HOST=mongodb
 MONGO_PORT=27017
 
-FLASK_DEBUG=True
+FLASK_DEBUG=False
 FLASK_MFA=False
 
 HOST=0.0.0.0

.gitignore

@@ -135,4 +135,8 @@ files/
 supervisord.pid
 sampledata/sigma/*
 external/*
-INITIAL_ADMIN_PASSWORD.TXT
+INITIAL_ADMIN_PASSWORD.TXT
+
+# Certs for SSL
+*.crt
+*.key

compose.yml

@@ -1,26 +1,49 @@
-version: '3.8'
-
 services:
   mongodb:
     image: mongo:7.0-rc
     container_name: mongodb
     ports:
-      - 27017
+      - 127.0.0.1:27017:27017
     volumes:
       - mongodb_data:/data/db
+    networks:
+      - app-network
+
   purpleops:
     build: .
     container_name: purpleops
-    command: gunicorn --bind 0.0.0.0:5000 purpleops:app
+    command: gunicorn --bind 0.0.0.0:5000 --forwarded-allow-ips="*" purpleops:app
     ports:
-      - "5000:5000"
+      - 127.0.0.1:5000:5000
     env_file:
       - ./.env
     depends_on:
       - mongodb
     volumes:
       - purpleops_data:/usr/src/app/
       - ./custom:/usr/src/app/custom
+    networks:
+      - app-network
+
+  nginx:
+    build:
+      context: ./nginx
+      dockerfile: Dockerfile
+    container_name: nginx
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - ./nginx/certs:/etc/nginx/ssl
+    depends_on:
+      - purpleops
+    networks:
+      - app-network
+
 volumes:
   mongodb_data:
   purpleops_data:
+
+networks:
+  app-network:
+    driver: bridge

nginx/Dockerfile

@@ -0,0 +1,23 @@
+FROM nginx:alpine
+
+# Install OpenSSL
+RUN apk add --no-cache openssl
+
+# Set working directory
+WORKDIR /etc/nginx
+
+# Copy a script to handle certificate generation or use
+COPY generate_or_use_cert.sh /usr/src/app/
+RUN chmod +x /usr/src/app/generate_or_use_cert.sh
+
+# Copy nginx configuration
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# Expose port 443
+EXPOSE 443
+
+# Set the entrypoint
+ENTRYPOINT ["/usr/src/app/generate_or_use_cert.sh"]
+
+# Start Nginx
+CMD ["nginx", "-g", "daemon off;"]

nginx/generate_or_use_cert.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+if [ ! -f "/etc/nginx/ssl/nginx.crt" ] || [ ! -f "/etc/nginx/ssl/nginx.key" ]; then
+    echo "Generating self-signed certificates"
+    mkdir -p /etc/nginx/ssl
+    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt \
+        -subj "/C=US/ST=State/L=City/O=Organization/CN=purpleops"
+else
+    echo "Nginx SSL certificates already exist"
+fi
+
+# Execute the CMD
+exec "$@"

nginx/nginx.conf

@@ -0,0 +1,22 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    server {
+        # uncomment to listen on port 80
+        # listen 80;
+        listen 443 ssl;
+        server_name localhost;
+
+        ssl_certificate /etc/nginx/ssl/nginx.crt;
+        ssl_certificate_key /etc/nginx/ssl/nginx.key;
+
+        location / {
+            proxy_pass http://purpleops:5000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}