https integration via reverse proxy

[fsdgadfase]

Dear all,

I really like Traggo and would like to contribute. I thought of adding https to the service in the reverse proxy examples. Please consider the nginx config bellow.

Additionally, I would consider writing a page on fail2ban and a start/stop script. Would you appreciate it if I wrote those?

upstream traggo {
 # Set the port to the one you are using in traggo
 server localhost:3030;
}

server {
 listen 443 ssl;
 server_name localhost;

 ssl_certificate /your/cert.pem;
 ssl_certificate_key /your/privkey.pem;
 ssl on;
 error_page 497 https://$host:3032$request_uri;
 ssl_session_cache builtin:1000 shared:SSL:10m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
 ssl_prefer_server_ciphers on;

 location / {
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_read_timeout 90;
 proxy_pass http://traggo;
 }
}

[jmattheis]

Hey, thanks for your issue.

I think I'm against adding TLS documentation to traggo because TLS config isn't easy. I don't want to maintain it because it can change, and I rather move this responsibility to the user.
In your example, the deprecated versions TLSv1 & TLSv1.1 are enabled. Have a look at https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 for a mostly secure config.

I'd be okay with a page for fail2ban. What would include a start/stop script? Do you mean a systemd service?